Astral founder Charlie Marsh launches uv audit to bring native dependency vulnerability scanning to the Python toolchain · Digg

Astral founder Charlie Marsh launches uv audit to bring native dependency vulnerability scanning to the Python toolchain · Digg

Posts from X

Most Activity

VIEWS3.4K

Charlie Marsh@charliermarsh

https://astral.sh/blog/uv-audit

Charlie Marsh@charliermarsh

We also now support on-the-fly malware checks via the Open Source Vulnerabilities (OSV) database.

Set UV_MALWARE_CHECK=1, and we'll cross-reference your resolved dependencies with known malware reports prior to installation.

1d3.4K263

BOOKMARKS8LIKES49RETWEETS3REPLIES2

Charlie Marsh@charliermarsh

We also now support on-the-fly malware checks via the Open Source Vulnerabilities (OSV) database.

Set UV_MALWARE_CHECK=1, and we'll cross-reference your resolved dependencies with known malware reports prior to installation.

Charlie Marsh@charliermarsh

Announcing uv audit: native support for vulnerability scanning across your project's dependencies

1d2.7K498

Charlie Marsh@charliermarsh

All credit here goes to our security king William Woodruff

https://github.com/woodruffw

Charlie Marsh@charliermarsh

https://astral.sh/blog/uv-audit

1d1.9K263

jon@JonofFive

@charliermarsh Feature request: `uv tool audit`, not just for project venvs

1d2347

Florian Brand@xeophon

@charliermarsh thank you mr uv

Charlie Marsh@charliermarsh

Announcing uv audit: native support for vulnerability scanning across your project's dependencies

1d563100

Charlie Marsh@charliermarsh

@JonofFive That’s a nice idea

1d2035

Leo@AgenticLeo

@charliermarsh ty so much

1d1161

Leo@AgenticLeo

@charliermarsh ty mentioned

1d111

Charlie Marsh@charliermarsh

@kaumnen We might make it the default! It’s a preview feature for now.

1d91

asiimov✨@asiimov

@charliermarsh Common uv W

1d1652

kaumnen@kaumnen

@charliermarsh should this be a default? unless for more than x dependencies, where it would take significantly more time

but it might be good default for both cases, with maybe local caching along with exclude-newer

1d10

june@jjunapur

@charliermarsh THANK YOU

1d1651

Michael Roberts@michealjroberts

@charliermarsh AMAZING

1d1101

Tim Kostolansky@thkostolansky

@charliermarsh but whos gonna audit the auditor

1d741

Jan Giacomelli@jangiacomelli

@charliermarsh nice!

1d681

Tyler@TPwidd

@charliermarsh Lets go

1d371

Tony Lofreso Jr.@tlofreso

@charliermarsh Omg ♥️

1d231

Morteza Hosseini@MoriHosseini1

@charliermarsh Yesss

1d181

Charlie Marsh@charliermarsh

@AgenticLeo ty mentioned

1d101

Chris Dare@chrisdare_

@charliermarsh Thanks Charlie! Been using this in my ci workflows for a while now. Pretty good!

Also wrote about it to help with discovery: https://blog.chrisdare.me/the-fastest-way-to-audit-your-python-dependencies-2e1661d91cc3

1d14