pip-audit

library2.10.1pypypi✓ verified 24d ago

pip-audit is a command-line tool for scanning Python environments (installed packages, requirements files, or lockfiles) for known vulnerabilities. It leverages various vulnerability databases like OSV and Ecosyste.ms to provide comprehensive security checks. Currently at version 2.10.0, it maintains an active development pace with frequent minor releases to introduce new features, fix bugs, and update dependencies.

auth-security devops

pip install pip-audit

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PIP-AUDIT

pip-audit

auth-securitypythonv2.10.1

Install

4.8s avg

Import

—

Disk

46MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.10.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 46.3MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 4.8s · import 0.000s · 47MB

46MB installed

● package 46MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

audit_environment

✓ from pip_audit import audit_environment

✗ from pip_audit import audit_environment

This quickstart demonstrates how to use `pip-audit` via its command-line interface, which is its primary mode of operation. It shows scanning the current Python environment and a requirements file, outputting results in JSON format for machine readability. The `subprocess` module is used to simulate a command-line invocation.

import subprocess # Scan the current Python environment print('Scanning current environment:') result_env = subprocess.run(['pip-audit', '--output-format', 'json'], capture_output=True, text=True, check=False) print(result_env.stdout) # Example: Scan a requirements file (create a dummy one) with open('requirements.txt', 'w') as f: f.write('requests==2.25.1\n') # Known vulnerable version print('\nScanning requirements.txt:') result_req = subprocess.run(['pip-audit', '-r', 'requirements.txt', '--output-format', 'json'], capture_output=True, text=True, check=False) print(result_req.stdout)

pip-audit --version

Debug

Known issues

breakingThe minimum required Python version has progressively increased. As of v2.10.0, Python >=3.10 is required. Earlier versions (v2.8.0 onwards required >=3.9, v2.6.2 onwards required >=3.8) supported older Python versions.

fix

Ensure your environment uses Python 3.10 or newer for v2.10.0+. Consult `pip-audit`'s changelog for specific version requirements if using an older `pip-audit` release.

affects: >=2.6.2

gotchaUsers resolving packages against private package indexes that require authentication might experience hangs. This was a recurring issue with `pip` subprocess invocation.

fix

Upgrade to `pip-audit` v2.7.2 or newer, which includes fixes for authentication-related hangs and improves `pip`'s keyring provider usage. Ensure `keyring` is properly configured if using authenticated indices.

affects: <2.6.2, <2.7.2

gotcha`pip-audit`'s default cache locations on macOS and Linux changed in v2.8.0 to align with platform-specific caching directory idioms (e.g., XDG).

fix

Be aware that cache files created by older `pip-audit` versions might not be recognized by newer versions in their new default locations. Manually clear or relocate old cache data if issues arise, or specify `--cache-dir` for explicit control.

affects: <2.8.0

gotchaOn Windows, some versions experienced crashes or issues related to temporary file handling and subprocess deadlocks.

fix

Upgrade to `pip-audit` v2.7.3 or newer to benefit from improved handling of temporary files and subprocesses on Windows, addressing crashes and deadlocks.

affects: <2.6.1, <2.7.3

Upgrade

Version history

2.10.1latest on PyPI · released Jun 10, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

41 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/pypa/pip-audit ↗

packagehttps://pypi.org/project/pip-audit/ ↗

homepagehttps://pypi.org/project/pip-audit/ ↗