使用 Homebrew, Nix 安装 pip-audit

项目链接

• 主页
• 软件包管理器页面

命令和别名

• pip-audit

项目历史

pip-audit was created as a dedicated Python dependency-auditing command and is now hosted by the Python Packaging Authority. It uses vulnerability data from the Python Packaging Advisory Database through PyPI and can also query OSV.

采用历史

pip-audit became part of the Python Packaging Authority's project ecosystem and is maintained in part by Trail of Bits with support from Google. It is available through PyPI, Homebrew, Nix, conda-forge, pre-commit, and an official GitHub Action.

使用方式

Users run pip-audit against the active Python environment, requirements files, or a local project. It returns status 0 when no known vulnerabilities are found and 1 when vulnerabilities are detected; CI use is supported through pre-commit and an official GitHub Action.

为什么软件包爱好者会关心

pip-audit gives Python users a packaging-aware vulnerability scanner that can resolve dependency trees, consume requirements files, emit CycloneDX SBOMs, and optionally fix vulnerable dependencies. Its security model explicitly distinguishes dependency auditing from static code analysis and malicious-package detection.

时间线

• 2021: Early public pip-audit releases established Python dependency vulnerability auditing.
• Later releases: Added OSV support, CycloneDX output, automatic fixes, environment-variable options, and improved authenticated-index handling.

Related projects

• pip
• PyPI
• Python Packaging Advisory Database
• OSV
• CycloneDX
• pypa/gh-action-pip-audit

来源

• https://github.com/pypa/pip-audit#readme
• https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md
• https://pypi.org/project/pip-audit/