pip-audit mit Homebrew, Nix installieren

Projektlinks

• Homepage
• Paketmanager-Seite

Befehle und Aliase

• pip-audit

Projektgeschichte

pip-audit was created as a dedicated Python dependency-auditing command and is now hosted by the Python Packaging Authority. It uses vulnerability data from the Python Packaging Advisory Database through PyPI and can also query OSV.

Adoptionsgeschichte

pip-audit became part of the Python Packaging Authority's project ecosystem and is maintained in part by Trail of Bits with support from Google. It is available through PyPI, Homebrew, Nix, conda-forge, pre-commit, and an official GitHub Action.

Wie es verwendet wird

Users run pip-audit against the active Python environment, requirements files, or a local project. It returns status 0 when no known vulnerabilities are found and 1 when vulnerabilities are detected; CI use is supported through pre-commit and an official GitHub Action.

Warum Paket-Nerds sich dafür interessieren

pip-audit gives Python users a packaging-aware vulnerability scanner that can resolve dependency trees, consume requirements files, emit CycloneDX SBOMs, and optionally fix vulnerable dependencies. Its security model explicitly distinguishes dependency auditing from static code analysis and malicious-package detection.

Zeitleiste

• 2021: Early public pip-audit releases established Python dependency vulnerability auditing.
• Later releases: Added OSV support, CycloneDX output, automatic fixes, environment-variable options, and improved authenticated-index handling.

Related projects

• pip
• PyPI
• Python Packaging Advisory Database
• OSV
• CycloneDX
• pypa/gh-action-pip-audit

Quellen

• https://github.com/pypa/pip-audit#readme
• https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md
• https://pypi.org/project/pip-audit/