uv-secure is a command-line tool designed to scan your uv.lock file for dependencies with known vulnerabilities. It provides a quick way to ensure your project's Python dependencies, managed by `uv`, are secure. The library is actively maintained with frequent releases, often including dependency updates and minor feature enhancements.
pip install uv-secureNo compatibility data collected yet for this library.
To use `uv-secure`, you must first generate a `uv.lock` file for your project using `uv`. Once the lock file exists, simply run `uv-secure scan` in the same directory. Output will be printed to the console, detailing any found vulnerabilities. Additional flags allow filtering by severity or ignoring unfixed issues.
This is intended behavior. If you wish to ignore these, you can use the `.uv-secure-ignore` configuration file to explicitly silence reports for `uv-secure`'s internal dependencies if they are not relevant to your project's risk profile.
Ensure you have `uv` installed and have run `uv pip install -r requirements.txt` (or similar) followed by `uv pip freeze > uv.lock` to create the necessary lock file before running `uv-secure`.
Review `uv-secure --help` and the official documentation for version 0.16.0 and later to understand and leverage the new filtering and ignore capabilities effectively in your CI/CD pipelines or local development.
Generate `uv.lock` using `uv`: `uv pip install -r requirements.txt && uv pip freeze > uv.lock`. Ensure you run `uv-secure scan` from the same directory where `uv.lock` resides or provide the path with `--lock-file PATH_TO_LOCK_FILE`.
Install `uv-secure` via pip: `pip install uv-secure`. If it's already installed, ensure your shell's PATH includes the directory where Python installs scripts (e.g., `~/.local/bin` or a virtual environment's `bin` directory).
Consult `uv-secure --help` to see the list of valid options for your installed version. Check release notes if you recently updated the tool, as options might have changed.