pip-audit を Homebrew, Nix でインストール

プロジェクトリンク

• ホームページ
• パッケージマネージャページ

コマンドとエイリアス

• pip-audit

プロジェクトの歴史

pip-audit was created as a dedicated Python dependency-auditing command and is now hosted by the Python Packaging Authority. It uses vulnerability data from the Python Packaging Advisory Database through PyPI and can also query OSV.

採用の歴史

pip-audit became part of the Python Packaging Authority's project ecosystem and is maintained in part by Trail of Bits with support from Google. It is available through PyPI, Homebrew, Nix, conda-forge, pre-commit, and an official GitHub Action.

使われ方

Users run pip-audit against the active Python environment, requirements files, or a local project. It returns status 0 when no known vulnerabilities are found and 1 when vulnerabilities are detected; CI use is supported through pre-commit and an official GitHub Action.

パッケージ好きにとっての重要性

pip-audit gives Python users a packaging-aware vulnerability scanner that can resolve dependency trees, consume requirements files, emit CycloneDX SBOMs, and optionally fix vulnerable dependencies. Its security model explicitly distinguishes dependency auditing from static code analysis and malicious-package detection.

タイムライン

• 2021: Early public pip-audit releases established Python dependency vulnerability auditing.
• Later releases: Added OSV support, CycloneDX output, automatic fixes, environment-variable options, and improved authenticated-index handling.

Related projects

• pip
• PyPI
• Python Packaging Advisory Database
• OSV
• CycloneDX
• pypa/gh-action-pip-audit

ソース

• https://github.com/pypa/pip-audit#readme
• https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md
• https://pypi.org/project/pip-audit/