Add a `uv-audit` crate by woodruffw · Pull Request #18124 · astral-sh/uv

woodruffw · 2026-02-20T23:11:14Z

Summary

Atop #18119. This should be merged into #18119's branch.

This adds a uv-audit crate, which provides some common types ~~and a trait (VulnerabilityService)~~ for interacting with vulnerability "services" (i.e. online APIs that provide vulnerability DB access).

Our MVP service is OSV; supporting PyPI's PYSEC responses through the same trait would be straightforward.

(This should also not increase our dependency footprint; I've only used crates that were already present in our top-level dependencies.)

Test Plan

I've added initial unit tests; I'm going to add more that use a mocked server to ensure we have good coverage of the pagination branches.

woodruffw · 2026-02-20T23:24:44Z

Note: marking as ready for review for functionality, but I'm going to add more tests before actually landing this on my feature branch 🙂

konstin

Mostly Rust and uv specific comments.

crates/uv-audit/src/service/mod.rs

crates/uv-audit/src/lib.rs

crates/uv-audit/src/types.rs

crates/uv-audit/src/service/mod.rs

crates/uv-audit/src/service/osv.rs

woodruffw · 2026-02-23T18:48:10Z

I'm not sure how to action these cargo shear errors:

shear/unused_dependency

  × unused dependency `reqwest`
    ╭─[crates/uv-audit/Cargo.toml:31:1]
 30 │ insta = { workspace = true }
 31 │ reqwest = { workspace = true }
    · ───┬───
    ·    ╰── not used in code
 32 │ serde_json = { workspace = true }
    ╰────
  help: remove this dependency

shear/unused_optional_dependency

  ⚠ unused optional dependency `clap`
    ╭─[crates/uv-install-wheel/Cargo.toml:33:1]
 32 │ 
 33 │ clap = { workspace = true, optional = true, features = ["derive"] }
    · ──┬─
    ·   ╰── not used in code
 34 │ configparser = { workspace = true }
    ╰────

Advice: 
  ☞ removing an optional dependency may be a breaking change

Advice: 
  ☞ used in feature `clap`
    ╭─[crates/uv-install-wheel/Cargo.toml:57:9]
 56 │ [features]
 57 │ clap = ["dep:clap", "uv-fs/clap"]
    ·         ─────┬────
    ·              ╰── enabled here
 58 │ schemars = ["dep:schemars", "uv-fs/schemars"]
    ╰────

shear/unused_optional_dependency

  ⚠ unused optional dependency `schemars`
    ╭─[crates/uv-install-wheel/Cargo.toml:44:1]
 43 │ rustc-hash = { workspace = true }
 44 │ schemars = { workspace = true, optional = true }
    · ────┬───
    ·     ╰── not used in code
 45 │ serde = { workspace = true, features = ["derive"] }
    ╰────

Advice: 
  ☞ removing an optional dependency may be a breaking change

Advice: 
  ☞ used in feature `schemars`
    ╭─[crates/uv-install-wheel/Cargo.toml:58:13]
 57 │ clap = ["dep:clap", "uv-fs/clap"]
 58 │ schemars = ["dep:schemars", "uv-fs/schemars"]
    ·             ───────┬──────
    ·                    ╰── enabled here
 59 │ 
    ╰────

shear/unused_workspace_dependency

  × unused workspace dependency `uv-audit`
    ╭─[Cargo.toml:19:1]
 18 │ [workspace.dependencies]
 19 │ uv-audit = { version = "0.1.0", path = "crates/uv-audit" }
    · ────┬───
    ·     ╰── not used by any workspace member
 20 │ uv-auth = { version = "0.0.24", path = "crates/uv-auth" }
    ╰────
  help: remove this dependency

shear/summary

  ✗ 2 errors
  ⚠ 2 warnings

Advice:
  ☞ run with `--fix` to fix 2 issues
  ☞ to suppress a dependency issue
   ╭─[Cargo.toml:2:12]
 1 │ [package.metadata.cargo-shear] # or [workspace.metadata.cargo-shear]
 2 │ ignored = ["crate-name"]
   ·            ──────┬─────
   ·                  ╰── add a crate name here
   ╰────
Error: Process completed with exit code 1.

The reqwest dev-dev is needed because cargo doesn't seem to select the right reqwest features without it (specifically, no TLS stack for Tower). And I'm not 100% sure why uv-install-wheel is popping up in this unrelated PR 🤔

konstin · 2026-02-23T19:04:26Z

The unrelated messages are only warnings, they don't actually error (#18165). For the reqwest feature, can you activate the rustls reqwest-middleware feature as a dev dependency? Otherwise you can use reqwest with no-default-features and the ssl features you need as a dev dependency and put it in the cargo shear ignores.

woodruffw · 2026-02-23T20:14:23Z

Okay, I think we're good to go now 🙂

Signed-off-by: William Woodruff <william@astral.sh>

Needed to prevent hyper from only supporting HTTP. Signed-off-by: William Woodruff <william@astral.sh>

Signed-off-by: William Woodruff <william@astral.sh>

crates/uv-audit/src/service/osv.rs

konstin · 2026-02-24T14:00:04Z

crates/uv-audit/src/service/osv.rs

+    }
+
+    #[test]
+    fn test_deserialize_rangetype() {


I don't think we need a separate test for this

Happy to remove if you feel strongly, but IMO these kinds of serde backstops are nice to have: in this case #[serde(other)] is load-bearing (since it converts unknown variants into Other), and it's nice to have an explicit test in case we ever refactor that.

konstin · 2026-02-24T14:04:06Z

clippy.toml

  "UV_SHOW_RESOLUTION",
  "UV_VENV_CLEAR",
  "UV_VENV_SEED",
-  ".." # Include the defaults


Is that change intentional?

Nope, this is editor churn. Can remove if you want.

Signed-off-by: William Woodruff <william@astral.sh>

Atop #18119. This should be merged into #18119's branch. This adds a `uv-audit` crate, which provides some common types ~~and a trait (`VulnerabilityService`)~~ for interacting with vulnerability "services" (i.e. online APIs that provide vulnerability DB access). Our MVP service is OSV; supporting PyPI's PYSEC responses through the same trait would be straightforward. (This should also not increase our dependency footprint; I've only used crates that were already present in our top-level dependencies.) I've added initial unit tests; I'm going to add more that use a mocked server to ensure we have good coverage of the pagination branches. --------- Signed-off-by: William Woodruff <william@astral.sh>

Atop #18119. This should be merged into #18119's branch. This adds a `uv-audit` crate, which provides some common types ~~and a trait (`VulnerabilityService`)~~ for interacting with vulnerability "services" (i.e. online APIs that provide vulnerability DB access). Our MVP service is OSV; supporting PyPI's PYSEC responses through the same trait would be straightforward. (This should also not increase our dependency footprint; I've only used crates that were already present in our top-level dependencies.) I've added initial unit tests; I'm going to add more that use a mocked server to ensure we have good coverage of the pagination branches. --------- Signed-off-by: William Woodruff <william@astral.sh> Fixup API usage Signed-off-by: William Woodruff <william@astral.sh>

## Summary This provides the scaffolding (CLI and initial `uv-audit` crate) for a `uv audit` subcommand. Closes #9189. Tracking: - [x] Core CLI scaffolding (this PR) - [x] #18185 - [x] Audit core (probably a new `uv-audit` crate): #18124 - [ ] Bulk dependency audits with OSV - [ ] Result presentation - [ ] #18193 Things that also need to be done with the MVP: - [ ] We should not audit workspace members by default (by definition, they don't exist on indices and therefore don't have meaningful results from vulnerability services). - [ ] I need to ensure groups/etc. are being filtered by correctly, right now we audit every single package in the lockfile unconditionally. ## Test Plan Unit and integration tests commensurate with the new functionality. --------- Signed-off-by: William Woodruff <william@astral.sh>

Atop #18119. This should be merged into #18119's branch. This adds a `uv-audit` crate, which provides some common types ~~and a trait (`VulnerabilityService`)~~ for interacting with vulnerability "services" (i.e. online APIs that provide vulnerability DB access). Our MVP service is OSV; supporting PyPI's PYSEC responses through the same trait would be straightforward. (This should also not increase our dependency footprint; I've only used crates that were already present in our top-level dependencies.) I've added initial unit tests; I'm going to add more that use a mocked server to ensure we have good coverage of the pagination branches. --------- Signed-off-by: William Woodruff <william@astral.sh>

woodruffw self-assigned this Feb 20, 2026

woodruffw added the internal A refactor or improvement that is not user-facing label Feb 20, 2026

woodruffw mentioned this pull request Feb 20, 2026

Scaffolding for uv audit #18119

Merged

10 tasks

woodruffw marked this pull request as ready for review February 20, 2026 23:12

konstin reviewed Feb 22, 2026

View reviewed changes

woodruffw requested a review from konstin February 23, 2026 18:22

woodruffw mentioned this pull request Feb 23, 2026

Clarify documentation of return format for /v1/querybatch API google/osv.dev#466

Open

woodruffw force-pushed the ww/uv-audit branch from b069412 to 96aaeb3 Compare February 23, 2026 20:53

woodruffw force-pushed the ww/uv-audit-crate branch from 87cedfc to 6dc0c69 Compare February 23, 2026 21:45

woodruffw force-pushed the ww/uv-audit branch from 96aaeb3 to 36af6d9 Compare February 23, 2026 22:35

woodruffw added 16 commits February 23, 2026 17:45

Initial CLI scaffolding for uv audit

95408e6

Signed-off-by: William Woodruff <william@astral.sh>

Initial uv-audit scaffolding

49ef411

Signed-off-by: William Woodruff <william@astral.sh>

Build out OSV service

a05362d

Signed-off-by: William Woodruff <william@astral.sh>

Use a proper sum type

ab3b512

Signed-off-by: William Woodruff <william@astral.sh>

Remove chum, add notes

f53097f

Signed-off-by: William Woodruff <william@astral.sh>

Add query_batch test, remove explicit impl

43310f7

Signed-off-by: William Woodruff <william@astral.sh>

Do some more encapsulation

568e17d

Signed-off-by: William Woodruff <william@astral.sh>

Remove unused dep

7cec5e7

Signed-off-by: William Woodruff <william@astral.sh>

Remove lifetimes

1fad626

Signed-off-by: William Woodruff <william@astral.sh>

Use a transparent error for reqwest_middleware::Error

9435c19

Signed-off-by: William Woodruff <william@astral.sh>

Remove explicit serde_json usage

96ec6fd

Signed-off-by: William Woodruff <william@astral.sh>

Use a proper enum for RangeType

08e3b87

Signed-off-by: William Woodruff <william@astral.sh>

Add a NOTE

8ee9c5b

Signed-off-by: William Woodruff <william@astral.sh>

Add a test-osv feature for online tests

1c9ec7c

Signed-off-by: William Woodruff <william@astral.sh>

Add SemVer to clippy doc-valid-idents

ad1fd00

Signed-off-by: William Woodruff <william@astral.sh>

Make reqwest a dev-dep

20a9e63

Needed to prevent hyper from only supporting HTTP. Signed-off-by: William Woodruff <william@astral.sh>

woodruffw added 7 commits February 23, 2026 17:45

Remove IndexMap

ca1d62d

Signed-off-by: William Woodruff <william@astral.sh>

Add a mocked pagination test

7c2ea84

Signed-off-by: William Woodruff <william@astral.sh>

Remove VulnerabilityService trait

54727d0

Signed-off-by: William Woodruff <william@astral.sh>

Remove my custom lints

3946ae5

Signed-off-by: William Woodruff <william@astral.sh>

Clippy

d5812bf

Signed-off-by: William Woodruff <william@astral.sh>

Fix cargo shear

c6c2701

Signed-off-by: William Woodruff <william@astral.sh>

Trailing newline

30553d3

Signed-off-by: William Woodruff <william@astral.sh>

woodruffw force-pushed the ww/uv-audit-crate branch from d83e170 to 30553d3 Compare February 23, 2026 22:45

konstin approved these changes Feb 24, 2026

View reviewed changes

woodruffw added 4 commits February 24, 2026 11:09

Fixup snapshots

cde713e

Signed-off-by: William Woodruff <william@astral.sh>

Feedback

ddcdfcd

Signed-off-by: William Woodruff <william@astral.sh>

Prefer if-let

81aaf1e

Signed-off-by: William Woodruff <william@astral.sh>

Clippy

60c2f9e

Signed-off-by: William Woodruff <william@astral.sh>

woodruffw merged commit f65e112 into ww/uv-audit Feb 24, 2026
101 checks passed

woodruffw deleted the ww/uv-audit-crate branch February 24, 2026 18:00

woodruffw mentioned this pull request Mar 16, 2026

Roadmap: uv audit #18506

Open

21 tasks

Conversation

woodruffw commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test Plan

Uh oh!

woodruffw commented Feb 20, 2026

Uh oh!

konstin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

konstin commented Feb 23, 2026

Uh oh!

woodruffw commented Feb 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

konstin Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

woodruffw Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

konstin Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

woodruffw Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

woodruffw commented Feb 20, 2026 •

edited

Loading

woodruffw commented Feb 23, 2026 •

edited

Loading