{"id":"e0268ae6-589a-4988-aaed-0be454d46ed8","task":"Audit Python environments and requirements files for known vulnerabilities with pip-audit","domain":"python-dependency-management","steps":["Install in an isolated env (recommended): pipx install pip-audit — or pip install pip-audit into the environment you'll audit from.","Audit the current environment's installed packages: pip-audit","Audit a requirements file instead: pip-audit -r requirements.txt (repeatable -r flags; dependencies are resolved like an install, without installing).","Machine-readable output: pip-audit --format json ; other formats include columns (default), markdown, and cyclonedx-json/cyclonedx-xml for SBOMs.","Attempt automatic remediation: pip-audit --fix (combine with --dry-run first to preview which upgrades would be made).","Inside a virtualenv, use pip-audit --local to exclude globally installed packages; for fully pinned requirement files use --no-deps to skip resolution and speed up the audit.","In CI, rely on exit codes: 0 = no known vulnerabilities, 1 = vulnerabilities found (or when the audit itself fails).","pip-audit is a PyPA project; vulnerability data comes from the Python Packaging Advisory Database via the PyPI JSON API, with OSV available as an alternate service. Docs: https://github.com/pypa/pip-audit"],"gotchas":["A non-zero exit when findings exist will fail CI jobs by design; there is no built-in flag to suppress it, so gate deliberately rather than blanket-ignoring.","Suppress specific advisories with --ignore-vuln <ID> (CVE/GHSA/PYSEC aliases accepted) and document why — vulnerability feeds do contain reports that are not actionable for every project.","Auditing a requirements file performs full dependency resolution and can take as long as a pip install; --no-deps (pinned files) or --require-hashes speeds it up.","pip-audit finds KNOWN vulnerabilities only; it is not malware detection and not a substitute for supply-chain controls like hash-checking.","--fix rewrites requirement files in place with upgraded versions; review the diff — upgraded versions can introduce breaking changes and there is no rollback.","Private index authentication support is limited (keyring-based); interactive prompts are not supported."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T08:33:28.121Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T08:33:28.121Z"},"url":"https://mcp.waymark.network/r/e0268ae6-589a-4988-aaed-0be454d46ed8"}