-
Notifications
You must be signed in to change notification settings - Fork 2.9k
Open
Labels
trackingA "meta" issue that tracks completion of a bigger task via a list of smaller scoped issues.A "meta" issue that tracks completion of a bigger task via a list of smaller scoped issues.
Description
This is a roadmap/tracking issue for uv audit, including both MVP and post-MVP tracks.
For previous context, see #9189 and #18119.
MVP tasks
- Core CLI scaffolding (this PR)
- Audit core (probably a new
uv-auditcrate): Add auv-auditcrate #18124 - Bulk dependency audits with OSV: Switch to batched OSV queries for
uv audit#18394- Concurrency controls for bulk fetches should honor the user's CLI settings Plumb top-level concurrency into
uv audit#18407
- Concurrency controls for bulk fetches should honor the user's CLI settings Plumb top-level concurrency into
- Result presentation
- Workspace members should not be audited: Filter down to auditable packages #18322
- Groups, extras, etc. should be filtered correctly: Evaluate extras and groups when determining auditable packages #18511
-
uv auditshould exit with non-zero when there are findings: Exit with nonzero on audit findings #18512 - Unhide
uv audit: Unhideuv audit#18540 - Add
--service-formatand--service-urltouv audit#18571 - Integration tests: Integration tests for
uv audit#18673
Post-MVP tasks
- Support for
pylock.toml(ref Support passingpylock.tomlfiles intouv audit#18422) - Support for (locked, hashed)
requirements.txt - Support for machine-readable output formats (e.g. JSON)
-
--fixmode - "Adverse status" reporting per Support for PEP 792 #15254
- Support for other vulnerability DB sources (e.g. PyPI/PYSEC, ecosyste.ms, others?)
- Support ignoring vulnerabilities via CLI and config: uv audit:
--ignoreand--ignore-until-fixed#18737
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
trackingA "meta" issue that tracks completion of a bigger task via a list of smaller scoped issues.A "meta" issue that tracks completion of a bigger task via a list of smaller scoped issues.