python-pip-audit

To scan Python dependencies for vulnerabilities, you can audit requirements files to surface CVEs and GHSA IDs. This process queries the PyPI JSON API and OSV database to identify insecure packages and provide fix versions.

pip-audit checks environments for CVEs and GHSAs by querying the PyPI JSON API and OSV for comprehensive vulnerability data. It inspects installed packages and requirements files to surface known security issues across ecosystems.

Yes, you can integrate dependency vulnerability scanning into CI to fail builds when new vulnerabilities are detected. The audit supports multi-format output, making it suitable for automated pipelines to block insecure deployments.

Yes, you need Python 3.10 or higher to run pip-audit for dependency auditing. The tool supports installation via pip, pipx, or conda, ensuring flexibility across different environment setups.

The best way to audit PyPI packages for security issues is using a tool that queries both PyPI and OSV databases. This approach surfaces CVEs, GHSA IDs, and fix versions by inspecting environments and requirements files.

When scanning Python environments for vulnerabilities, the tool queries the PyPI JSON API and OSV for comprehensive vulnerability data. These sources provide coverage across ecosystems to identify known CVEs and GHSA IDs.