pypa/pip-audit
View on GitHub ↗ ★ 1,389 Python
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
11 mentions on Hacker News by 4 people: 1 story, 10 comments · first 2021-10-08 · latest 2026-04-13
20082026
-
…point: pip-audit's CycloneDX emission was subtly incorrect for years, and nobody noticed[1].) [1]: https://github.com/pypa/pip-audit/pull/981
comment by woodruffw · 2025-12-24 · in Could lockfiles just be SBOMs? -
…The skeleton gets tweaked slightly each time, but it's served me well for 4+ years. [1]: https://github.com/pypa/pip-audit/blob/main/Makefile
comment by woodruffw · 2023-10-19 · in Show HN: One makefile to rule them all -
…credentials out of pushing assets). actually one more minor, support for poetry in pip-audit.. https://github.com/pypa/pip-audit/issues/84
comment by kapilvt · 2023-08-04 · in PSF Hires PyPI Safety and Security Engineer -
…for you as well.) Similarly, to build distributions, all you need is `build`: python -m build [1]: https://github.com/pypa/pip-audit
comment by woodruffw · 2023-01-15 · in How to improve Python packaging -
…(FD: my project). [1]: https://github.com/pypa/flit [2]: https://github.com/pypa/build [3]: https://github.com/pypa/pip-audit
comment by woodruffw · 2023-01-03 · in Underappreciated challenges with Python packaging -
…setup.cfg[2]. Everything goes through pyproject.toml. [1]: https://peps.python.org/pep-0518/ [2]: https://github.com/trailofbits/pip-audit/blob/main/pyproject...
comment by woodruffw · 2022-07-28 · in How to create a Python package in 2022 -
…and running audits against the official PyPI vulnerability feed. FD: My company, my work. [1]: https://github.com/trailofbits/pip-audit
comment by woodruffw · 2022-05-25 · in Python utility for tracking third party dependencies within a library -
…a tool pip-audit that audits Python environments and dependency trees for known vulnerabilities. https://github.com/trailofbits/pip-audit
comment by throwawayt215 · 2022-01-29 · in Black, the uncompromising Python code formatter, is stable -
…`make` rules, to boot. The CI in turn calls `make` as well, so there's no duplication. For example: https://github.com/trailofbits/pip-audit/blob/main/Makefile
comment by woodruffw · 2021-12-21 · in Pre-commit: framework for managing/maintaining multi-language pre-commit hooks -
It’s not ready for showtime yet, but this is being worked on[1]. [1]: https://github.com/trailofbits/pip-audit
comment by woodruffw · 2021-10-08 · in GitHub Advisory Database now powers NPM audit