pip-audit

What it does

Advisory sources

It can check vulnerabilities using PyPI or OSV services.checked 11 Oct 2026

Automatic fixes

The --fix option can automatically upgrade vulnerable dependencies.checked 11 Oct 2026

Input limitations

It does not process Pipfile or Pipfile.lock directly; the project suggests converting them to a supported requirements file.checked 11 Oct 2026

Installation

The project says pip-audit requires Python 3.10 or newer and can be installed with pip; it also lists conda-forge as an installation option.checked 11 Oct 2026

Integrations

The project provides an official GitHub Action and supports pre-commit.checked 11 Oct 2026

License

pip-audit is licensed under Apache 2.0.checked 11 Oct 2026

Output formats

Audit results can be emitted as columns, Markdown, JSON, CycloneDX JSON, or CycloneDX XML.checked 11 Oct 2026

Private indexes

Interactive authentication to third-party package indexes is unsupported; pip keyring authentication is supported with limitations.checked 11 Oct 2026

Purpose

Audits Python environments, requirements files, and dependency trees for known security vulnerabilities.checked 11 Oct 2026

SBOM output

It can emit CycloneDX SBOMs in XML or JSON.checked 11 Oct 2026

Security scope

It analyzes dependency trees, not source code, and does not claim to defend against malicious packages.checked 11 Oct 2026

Vulnerability limitations

The project cautions that vulnerability feeds may contain noisy reports and that vulnerabilities in shared libraries may not be detected.checked 11 Oct 2026