tessl/pypi-pip-audit

A tool for scanning Python environments for known vulnerabilities

—

Pending

Overview

Eval results

Files

Core Auditing

Name: tessl/pypi-pip-audit
Author: tessl

The main auditing functionality that coordinates dependency collection and vulnerability scanning. This provides the primary entry point for programmatic usage of pip-audit.

Capabilities

Auditor Class

The central coordinator that orchestrates the audit process by combining a dependency source with a vulnerability service.

class Auditor:
    """
    The core class of the pip-audit API.
    
    For a given dependency source and vulnerability service, supply a mapping of dependencies to
    known vulnerabilities.
    """
    
    def __init__(
        self,
        service: VulnerabilityService,
        options: AuditOptions = AuditOptions(),
    ):
        """
        Create a new auditor.
        
        Parameters:
        - service: VulnerabilityService, the service to query for vulnerabilities
        - options: AuditOptions, configuration options for the audit
        """

    def audit(
        self, source: DependencySource
    ) -> Iterator[tuple[Dependency, list[VulnerabilityResult]]]:
        """
        Perform an audit of the given dependency source.
        
        Parameters:
        - source: DependencySource, the source of dependencies to audit
        
        Returns:
        Iterator yielding (dependency, vulnerabilities) tuples
        """

Audit Options

Configuration options that control the behavior of an Auditor instance.

@dataclass(frozen=True)
class AuditOptions:
    """
    Settings that control the behavior of an Auditor instance.
    """
    
    dry_run: bool = False
    """
    Whether to perform a dry run (no actual fixes applied).
    """

Usage Examples

Basic Audit

from pip_audit._audit import Auditor, AuditOptions
from pip_audit._dependency_source import PipSource
from pip_audit._service import PyPIService

# Create components
service = PyPIService()
source = PipSource()
auditor = Auditor(service=service)

# Perform audit
results = list(auditor.audit(source))
for dependency, vulnerabilities in results:
    if vulnerabilities:
        print(f"{dependency.name} v{dependency.version}: {len(vulnerabilities)} vulnerabilities")
        for vuln in vulnerabilities:
            print(f"  - {vuln.id}: {vuln.description}")

Audit with Options

from pip_audit._audit import Auditor, AuditOptions
from pip_audit._dependency_source import RequirementSource
from pip_audit._service import OsvService

# Create with options
options = AuditOptions(dry_run=True)
service = OsvService()
source = RequirementSource("requirements.txt")
auditor = Auditor(service=service, options=options)

# Perform dry run audit
for dependency, vulnerabilities in auditor.audit(source):
    if vulnerabilities:
        print(f"Would fix {dependency.name}: {len(vulnerabilities)} issues")

Install with Tessl CLI