pysentry-rs 0.3.4__tar.gz → 0.3.6__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pysentry-rs might be problematic. Click here for more details.
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/dependabot.yml +0 -6
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/ci.yml +2 -0
- pysentry_rs-0.3.6/.pre-commit-hooks.yaml +10 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/Cargo.lock +7 -7
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/Cargo.toml +3 -3
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/PKG-INFO +52 -7
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/README.md +51 -6
- pysentry_rs-0.3.6/benchmarks/results/0.3.4.md +141 -0
- pysentry_rs-0.3.6/benchmarks/results/0.3.5.md +141 -0
- pysentry_rs-0.3.6/benchmarks/results/latest.md +141 -0
- pysentry_rs-0.3.6/benchmarks/test_data/uv.lock +2972 -0
- pysentry_rs-0.3.6/fixtures/pipfile-tests/Pipfile +27 -0
- pysentry_rs-0.3.6/fixtures/pipfile-tests/Pipfile.lock +259 -0
- pysentry_rs-0.3.6/fixtures/pipfile-vulnerable-tests/Pipfile +20 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/audit.rs +48 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/storage.rs +2 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cli.rs +167 -71
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/scanner.rs +92 -39
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/lib.rs +5 -2
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/lock.rs +245 -6
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/mod.rs +65 -12
- pysentry_rs-0.3.6/src/parsers/pipfile.rs +598 -0
- pysentry_rs-0.3.6/src/parsers/pipfile_lock.rs +342 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/poetry_lock.rs +4 -4
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/pyproject.rs +13 -10
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/requirements.rs +3 -3
- pysentry_rs-0.3.4/.pre-commit-hooks.yaml +0 -10
- pysentry_rs-0.3.4/benchmarks/results/latest.md +0 -141
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/FUNDING.yml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/benchmark.yml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/release.yml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.gitignore +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.pre-commit-config.yaml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/LICENSE +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/.gitignore +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/.python-version +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/README.md +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/main.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/pyproject.toml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.2.3.md +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.1.md +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.2.md +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.3.md +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/benchmark_runner.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/performance_monitor.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/report_generator.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/tool_wrapper.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/test_data/large_requirements.txt +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/test_data/small_requirements.txt +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/uv.lock +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests/requirements-dev.txt +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests/requirements.txt +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests-vulnerable/requirements.txt +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/pyproject.toml +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/python/pysentry/__init__.py +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/mod.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/config.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/mod.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/mod.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/pip_tools.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/uv.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/error.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/main.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/mod.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/report.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/sarif.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/mod.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/osv.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/pypa.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/pypi.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/python.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/types.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/database.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/matcher.rs +0 -0
- {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/mod.rs +0 -0
|
@@ -11,16 +11,10 @@ updates:
|
|
|
11
11
|
patterns:
|
|
12
12
|
- "*"
|
|
13
13
|
|
|
14
|
-
# Python dependencies (pyproject.toml only)
|
|
15
14
|
- package-ecosystem: "pip"
|
|
16
15
|
directory: "/"
|
|
17
16
|
schedule:
|
|
18
17
|
interval: "weekly"
|
|
19
|
-
open-pull-requests-limit: 10
|
|
20
|
-
allow:
|
|
21
|
-
- dependency-type: "all"
|
|
22
|
-
ignore:
|
|
23
|
-
- dependency-name: "*"
|
|
24
18
|
groups:
|
|
25
19
|
python-dependencies:
|
|
26
20
|
patterns:
|
|
@@ -10,6 +10,7 @@ on:
|
|
|
10
10
|
- ".editorconfig"
|
|
11
11
|
- ".github/dependabot.yml"
|
|
12
12
|
- ".github/FUNDING.yml"
|
|
13
|
+
- ".pre-commit-hooks.yaml"
|
|
13
14
|
pull_request:
|
|
14
15
|
branches: [main]
|
|
15
16
|
paths-ignore:
|
|
@@ -19,6 +20,7 @@ on:
|
|
|
19
20
|
- ".editorconfig"
|
|
20
21
|
- ".github/dependabot.yml"
|
|
21
22
|
- ".github/FUNDING.yml"
|
|
23
|
+
- ".pre-commit-hooks.yaml"
|
|
22
24
|
|
|
23
25
|
env:
|
|
24
26
|
CARGO_TERM_COLOR: always
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
- id: pysentry
|
|
2
|
+
name: pysentry (DEPRECATED - moved to nyudenkov/pysentry-pre-commit)
|
|
3
|
+
description: "⚠️ DEPRECATED - See github.com/nyudenkov/pysentry-pre-commit"
|
|
4
|
+
entry: pysentry-rs
|
|
5
|
+
language: python
|
|
6
|
+
always_run: true
|
|
7
|
+
additional_dependencies:
|
|
8
|
+
["pysentry-rs==0.3.5", "uv==0.8.9", "pip-tools==7.5.0"]
|
|
9
|
+
minimum_pre_commit_version: "2.9.2"
|
|
10
|
+
types: [python]
|
|
@@ -108,9 +108,9 @@ dependencies = [
|
|
|
108
108
|
|
|
109
109
|
[[package]]
|
|
110
110
|
name = "async-trait"
|
|
111
|
-
version = "0.1.
|
|
111
|
+
version = "0.1.89"
|
|
112
112
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
113
|
-
checksum = "
|
|
113
|
+
checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
|
|
114
114
|
dependencies = [
|
|
115
115
|
"proc-macro2",
|
|
116
116
|
"quote",
|
|
@@ -1137,7 +1137,7 @@ dependencies = [
|
|
|
1137
1137
|
|
|
1138
1138
|
[[package]]
|
|
1139
1139
|
name = "pysentry"
|
|
1140
|
-
version = "0.3.
|
|
1140
|
+
version = "0.3.6"
|
|
1141
1141
|
dependencies = [
|
|
1142
1142
|
"anyhow",
|
|
1143
1143
|
"async-trait",
|
|
@@ -1699,18 +1699,18 @@ dependencies = [
|
|
|
1699
1699
|
|
|
1700
1700
|
[[package]]
|
|
1701
1701
|
name = "thiserror"
|
|
1702
|
-
version = "2.0.
|
|
1702
|
+
version = "2.0.15"
|
|
1703
1703
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
1704
|
-
checksum = "
|
|
1704
|
+
checksum = "80d76d3f064b981389ecb4b6b7f45a0bf9fdac1d5b9204c7bd6714fecc302850"
|
|
1705
1705
|
dependencies = [
|
|
1706
1706
|
"thiserror-impl",
|
|
1707
1707
|
]
|
|
1708
1708
|
|
|
1709
1709
|
[[package]]
|
|
1710
1710
|
name = "thiserror-impl"
|
|
1711
|
-
version = "2.0.
|
|
1711
|
+
version = "2.0.15"
|
|
1712
1712
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
1713
|
-
checksum = "
|
|
1713
|
+
checksum = "44d29feb33e986b6ea906bd9c3559a856983f92371b3eaa5e83782a351623de0"
|
|
1714
1714
|
dependencies = [
|
|
1715
1715
|
"proc-macro2",
|
|
1716
1716
|
"quote",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
[package]
|
|
2
2
|
name = "pysentry"
|
|
3
|
-
version = "0.3.
|
|
3
|
+
version = "0.3.6"
|
|
4
4
|
edition = "2021"
|
|
5
5
|
rust-version = "1.79"
|
|
6
6
|
description = "Security vulnerability auditing for Python packages"
|
|
@@ -23,7 +23,7 @@ python = ["pyo3"]
|
|
|
23
23
|
|
|
24
24
|
[dependencies]
|
|
25
25
|
anyhow = "1.0.99"
|
|
26
|
-
async-trait = "0.1.
|
|
26
|
+
async-trait = "0.1.89"
|
|
27
27
|
chrono = { version = "0.4.41", features = ["serde"] }
|
|
28
28
|
clap = { version = "4.5.45", features = ["derive"] }
|
|
29
29
|
dirs = "6.0.0"
|
|
@@ -40,7 +40,7 @@ serde_json = "1.0.142"
|
|
|
40
40
|
serde_yaml = "0.9.34"
|
|
41
41
|
sha2 = "0.10.9"
|
|
42
42
|
tempfile = "3.20.0"
|
|
43
|
-
thiserror = "2.0.
|
|
43
|
+
thiserror = "2.0.15"
|
|
44
44
|
tokio = { version = "1.47.1", features = ["fs", "io-util", "rt-multi-thread", "macros", "process"] }
|
|
45
45
|
toml = "0.9.5"
|
|
46
46
|
tracing = "0.1.41"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: pysentry-rs
|
|
3
|
-
Version: 0.3.
|
|
3
|
+
Version: 0.3.6
|
|
4
4
|
Classifier: Development Status :: 4 - Beta
|
|
5
5
|
Classifier: Intended Audience :: Developers
|
|
6
6
|
Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
|
|
@@ -27,18 +27,21 @@ Project-URL: Issues, https://github.com/nyudenkov/pysentry/issues
|
|
|
27
27
|
# 🐍 PySentry
|
|
28
28
|
|
|
29
29
|
[](https://google.github.io/osv.dev/)
|
|
30
|
+
[](https://pepy.tech/projects/pysentry-rs)
|
|
30
31
|
|
|
31
32
|
[Help to test and improve](https://github.com/nyudenkov/pysentry/issues/12) | [Latest PySentry - pip-audit benchmark](benchmarks/results/latest.md)
|
|
32
33
|
|
|
34
|
+
Please, send feedback to nikita@pysentry.com
|
|
35
|
+
|
|
33
36
|
A fast, reliable security vulnerability scanner for Python projects, written in Rust.
|
|
34
37
|
|
|
35
38
|
## Overview
|
|
36
39
|
|
|
37
|
-
PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `pyproject.toml`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
|
|
40
|
+
PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
|
|
38
41
|
|
|
39
42
|
## Key Features
|
|
40
43
|
|
|
41
|
-
- **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `pyproject.toml`, and `requirements.txt` files
|
|
44
|
+
- **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, and `requirements.txt` files
|
|
42
45
|
- **External Resolver Integration**: Leverages `uv` and `pip-tools` for accurate requirements.txt constraint solving
|
|
43
46
|
- **Multiple Data Sources**:
|
|
44
47
|
- PyPA Advisory Database (default)
|
|
@@ -191,7 +194,7 @@ uvx pysentry-rs /path/to/python/project
|
|
|
191
194
|
pysentry
|
|
192
195
|
pysentry /path/to/python/project
|
|
193
196
|
|
|
194
|
-
# Automatically detects project type (uv.lock, poetry.lock, pyproject.toml, requirements.txt)
|
|
197
|
+
# Automatically detects project type (uv.lock, poetry.lock, Pipfile.lock, pyproject.toml, Pipfile, requirements.txt)
|
|
195
198
|
pysentry /path/to/project
|
|
196
199
|
|
|
197
200
|
# Force specific resolver
|
|
@@ -297,7 +300,8 @@ Add PySentry to your `.pre-commit-config.yaml`:
|
|
|
297
300
|
|
|
298
301
|
```yaml
|
|
299
302
|
repos:
|
|
300
|
-
- repo: https://github.com/
|
|
303
|
+
- repo: https://github.com/pysentry/pysentry-pre-commit
|
|
304
|
+
rev: v0.3.5
|
|
301
305
|
hooks:
|
|
302
306
|
- id: pysentry # default pysentry settings
|
|
303
307
|
```
|
|
@@ -306,7 +310,8 @@ repos:
|
|
|
306
310
|
|
|
307
311
|
```yaml
|
|
308
312
|
repos:
|
|
309
|
-
- repo: https://github.com/
|
|
313
|
+
- repo: https://github.com/pysentry/pysentry-pre-commit
|
|
314
|
+
rev: v0.3.5
|
|
310
315
|
hooks:
|
|
311
316
|
- id: pysentry
|
|
312
317
|
args: ["--sources", "pypa,osv", "--fail-on", "high"]
|
|
@@ -494,6 +499,46 @@ Full support for Poetry lock files:
|
|
|
494
499
|
- Handles Poetry's dependency groups and optional dependencies
|
|
495
500
|
- Perfect for Poetry-managed projects with established lock files
|
|
496
501
|
|
|
502
|
+
### Pipfile.lock Files
|
|
503
|
+
|
|
504
|
+
Full support for Pipenv lock files with exact version resolution:
|
|
505
|
+
|
|
506
|
+
- **Exact Version Resolution**: Scans exact dependency versions locked by Pipenv
|
|
507
|
+
- **Lock-File Only Analysis**: Relies purely on the lock file structure, no Pipfile parsing needed
|
|
508
|
+
- **Complete Dependency Tree**: Analyzes all resolved dependencies including transitive ones
|
|
509
|
+
- **Dependency Classification**: Distinguishes between default dependencies and development groups
|
|
510
|
+
|
|
511
|
+
**Key Features:**
|
|
512
|
+
|
|
513
|
+
- No external tools required
|
|
514
|
+
- Fast parsing with exact version information
|
|
515
|
+
- Handles Pipenv's dependency groups (default and develop)
|
|
516
|
+
- Perfect for Pipenv-managed projects with established lock files
|
|
517
|
+
|
|
518
|
+
### Pipfile Files (External Resolution)
|
|
519
|
+
|
|
520
|
+
Support for Pipfile specification files using external dependency resolvers:
|
|
521
|
+
|
|
522
|
+
**Key Features:**
|
|
523
|
+
|
|
524
|
+
- **Dependencies Resolution**: Converts version constraints from Pipfile to exact versions using mature external tools
|
|
525
|
+
- **Multiple Resolver Support**:
|
|
526
|
+
- **uv**: Rust-based resolver, extremely fast and reliable (recommended)
|
|
527
|
+
- **pip-tools**: Python-based resolver using `pip-compile`, widely compatible
|
|
528
|
+
- **Auto-detection**: Automatically detects and uses the best available resolver in your environment
|
|
529
|
+
- **Dependency Groups**: Supports both default packages and dev-packages sections
|
|
530
|
+
- **Complex Constraint Handling**: Supports version ranges, Git dependencies, and environment markers
|
|
531
|
+
|
|
532
|
+
**Resolution Workflow:**
|
|
533
|
+
|
|
534
|
+
1. Detects `Pipfile` in your project (when `Pipfile.lock` is not present)
|
|
535
|
+
2. Auto-detects available resolver (`uv` or `pip-tools`) in current environment
|
|
536
|
+
3. Resolves version constraints to exact dependency versions
|
|
537
|
+
4. Scans resolved dependencies for vulnerabilities
|
|
538
|
+
5. Reports findings with dependency group classification
|
|
539
|
+
|
|
540
|
+
**Note**: When both `Pipfile` and `Pipfile.lock` are present, PySentry prioritizes the lock file for better accuracy. Consider using `pipenv lock` to generate a lock file for the most precise vulnerability scanning.
|
|
541
|
+
|
|
497
542
|
### requirements.txt Files (External Resolution)
|
|
498
543
|
|
|
499
544
|
Advanced support for `requirements.txt` files using external dependency resolvers:
|
|
@@ -732,7 +777,7 @@ pysentry /path/to/python/project
|
|
|
732
777
|
pysentry --requirements requirements-dev.txt --requirements requirements-test.txt
|
|
733
778
|
|
|
734
779
|
# Check if higher-priority files exist (they take precedence)
|
|
735
|
-
ls uv.lock poetry.lock pyproject.toml
|
|
780
|
+
ls uv.lock poetry.lock Pipfile.lock pyproject.toml Pipfile requirements.txt
|
|
736
781
|
```
|
|
737
782
|
|
|
738
783
|
**Performance Issues**
|
|
@@ -1,18 +1,21 @@
|
|
|
1
1
|
# 🐍 PySentry
|
|
2
2
|
|
|
3
3
|
[](https://google.github.io/osv.dev/)
|
|
4
|
+
[](https://pepy.tech/projects/pysentry-rs)
|
|
4
5
|
|
|
5
6
|
[Help to test and improve](https://github.com/nyudenkov/pysentry/issues/12) | [Latest PySentry - pip-audit benchmark](benchmarks/results/latest.md)
|
|
6
7
|
|
|
8
|
+
Please, send feedback to nikita@pysentry.com
|
|
9
|
+
|
|
7
10
|
A fast, reliable security vulnerability scanner for Python projects, written in Rust.
|
|
8
11
|
|
|
9
12
|
## Overview
|
|
10
13
|
|
|
11
|
-
PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `pyproject.toml`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
|
|
14
|
+
PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
|
|
12
15
|
|
|
13
16
|
## Key Features
|
|
14
17
|
|
|
15
|
-
- **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `pyproject.toml`, and `requirements.txt` files
|
|
18
|
+
- **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, and `requirements.txt` files
|
|
16
19
|
- **External Resolver Integration**: Leverages `uv` and `pip-tools` for accurate requirements.txt constraint solving
|
|
17
20
|
- **Multiple Data Sources**:
|
|
18
21
|
- PyPA Advisory Database (default)
|
|
@@ -165,7 +168,7 @@ uvx pysentry-rs /path/to/python/project
|
|
|
165
168
|
pysentry
|
|
166
169
|
pysentry /path/to/python/project
|
|
167
170
|
|
|
168
|
-
# Automatically detects project type (uv.lock, poetry.lock, pyproject.toml, requirements.txt)
|
|
171
|
+
# Automatically detects project type (uv.lock, poetry.lock, Pipfile.lock, pyproject.toml, Pipfile, requirements.txt)
|
|
169
172
|
pysentry /path/to/project
|
|
170
173
|
|
|
171
174
|
# Force specific resolver
|
|
@@ -271,7 +274,8 @@ Add PySentry to your `.pre-commit-config.yaml`:
|
|
|
271
274
|
|
|
272
275
|
```yaml
|
|
273
276
|
repos:
|
|
274
|
-
- repo: https://github.com/
|
|
277
|
+
- repo: https://github.com/pysentry/pysentry-pre-commit
|
|
278
|
+
rev: v0.3.5
|
|
275
279
|
hooks:
|
|
276
280
|
- id: pysentry # default pysentry settings
|
|
277
281
|
```
|
|
@@ -280,7 +284,8 @@ repos:
|
|
|
280
284
|
|
|
281
285
|
```yaml
|
|
282
286
|
repos:
|
|
283
|
-
- repo: https://github.com/
|
|
287
|
+
- repo: https://github.com/pysentry/pysentry-pre-commit
|
|
288
|
+
rev: v0.3.5
|
|
284
289
|
hooks:
|
|
285
290
|
- id: pysentry
|
|
286
291
|
args: ["--sources", "pypa,osv", "--fail-on", "high"]
|
|
@@ -468,6 +473,46 @@ Full support for Poetry lock files:
|
|
|
468
473
|
- Handles Poetry's dependency groups and optional dependencies
|
|
469
474
|
- Perfect for Poetry-managed projects with established lock files
|
|
470
475
|
|
|
476
|
+
### Pipfile.lock Files
|
|
477
|
+
|
|
478
|
+
Full support for Pipenv lock files with exact version resolution:
|
|
479
|
+
|
|
480
|
+
- **Exact Version Resolution**: Scans exact dependency versions locked by Pipenv
|
|
481
|
+
- **Lock-File Only Analysis**: Relies purely on the lock file structure, no Pipfile parsing needed
|
|
482
|
+
- **Complete Dependency Tree**: Analyzes all resolved dependencies including transitive ones
|
|
483
|
+
- **Dependency Classification**: Distinguishes between default dependencies and development groups
|
|
484
|
+
|
|
485
|
+
**Key Features:**
|
|
486
|
+
|
|
487
|
+
- No external tools required
|
|
488
|
+
- Fast parsing with exact version information
|
|
489
|
+
- Handles Pipenv's dependency groups (default and develop)
|
|
490
|
+
- Perfect for Pipenv-managed projects with established lock files
|
|
491
|
+
|
|
492
|
+
### Pipfile Files (External Resolution)
|
|
493
|
+
|
|
494
|
+
Support for Pipfile specification files using external dependency resolvers:
|
|
495
|
+
|
|
496
|
+
**Key Features:**
|
|
497
|
+
|
|
498
|
+
- **Dependencies Resolution**: Converts version constraints from Pipfile to exact versions using mature external tools
|
|
499
|
+
- **Multiple Resolver Support**:
|
|
500
|
+
- **uv**: Rust-based resolver, extremely fast and reliable (recommended)
|
|
501
|
+
- **pip-tools**: Python-based resolver using `pip-compile`, widely compatible
|
|
502
|
+
- **Auto-detection**: Automatically detects and uses the best available resolver in your environment
|
|
503
|
+
- **Dependency Groups**: Supports both default packages and dev-packages sections
|
|
504
|
+
- **Complex Constraint Handling**: Supports version ranges, Git dependencies, and environment markers
|
|
505
|
+
|
|
506
|
+
**Resolution Workflow:**
|
|
507
|
+
|
|
508
|
+
1. Detects `Pipfile` in your project (when `Pipfile.lock` is not present)
|
|
509
|
+
2. Auto-detects available resolver (`uv` or `pip-tools`) in current environment
|
|
510
|
+
3. Resolves version constraints to exact dependency versions
|
|
511
|
+
4. Scans resolved dependencies for vulnerabilities
|
|
512
|
+
5. Reports findings with dependency group classification
|
|
513
|
+
|
|
514
|
+
**Note**: When both `Pipfile` and `Pipfile.lock` are present, PySentry prioritizes the lock file for better accuracy. Consider using `pipenv lock` to generate a lock file for the most precise vulnerability scanning.
|
|
515
|
+
|
|
471
516
|
### requirements.txt Files (External Resolution)
|
|
472
517
|
|
|
473
518
|
Advanced support for `requirements.txt` files using external dependency resolvers:
|
|
@@ -706,7 +751,7 @@ pysentry /path/to/python/project
|
|
|
706
751
|
pysentry --requirements requirements-dev.txt --requirements requirements-test.txt
|
|
707
752
|
|
|
708
753
|
# Check if higher-priority files exist (they take precedence)
|
|
709
|
-
ls uv.lock poetry.lock pyproject.toml
|
|
754
|
+
ls uv.lock poetry.lock Pipfile.lock pyproject.toml Pipfile requirements.txt
|
|
710
755
|
```
|
|
711
756
|
|
|
712
757
|
**Performance Issues**
|
|
@@ -0,0 +1,141 @@
|
|
|
1
|
+
# PySentry - pip-audit Benchmark Report
|
|
2
|
+
|
|
3
|
+
**Generated:** 2025-08-14 15:42:52
|
|
4
|
+
**Duration:** 1m 55.57s
|
|
5
|
+
**Total Tests:** 20
|
|
6
|
+
|
|
7
|
+
## Executive Summary
|
|
8
|
+
|
|
9
|
+
**Overall Success Rate:** 100.0% (20/20 successful runs)
|
|
10
|
+
|
|
11
|
+
### Small_Requirements Dataset - Cold Cache
|
|
12
|
+
- **Fastest:** pysentry-pypi (0.306s) - 28.70x faster than slowest
|
|
13
|
+
- **Memory Efficient:** pysentry-osv (10.63 MB) - 10.15x less memory than highest
|
|
14
|
+
|
|
15
|
+
### Small_Requirements Dataset - Hot Cache
|
|
16
|
+
- **Fastest:** pysentry-pypi (0.224s) - 36.53x faster than slowest
|
|
17
|
+
- **Memory Efficient:** pysentry-osv (10.78 MB) - 9.89x less memory than highest
|
|
18
|
+
|
|
19
|
+
### Large_Requirements Dataset - Cold Cache
|
|
20
|
+
- **Fastest:** pysentry-pypi (0.996s) - 18.56x faster than slowest
|
|
21
|
+
- **Memory Efficient:** pysentry-osv (10.98 MB) - 9.40x less memory than highest
|
|
22
|
+
|
|
23
|
+
### Large_Requirements Dataset - Hot Cache
|
|
24
|
+
- **Fastest:** pysentry-pypi (0.657s) - 24.63x faster than slowest
|
|
25
|
+
- **Memory Efficient:** pysentry-osv (10.68 MB) - 10.06x less memory than highest
|
|
26
|
+
|
|
27
|
+
## Test Environment
|
|
28
|
+
|
|
29
|
+
- **Platform:** Linux-6.11.0-1018-azure-x86_64-with-glibc2.39
|
|
30
|
+
- **Python Version:** 3.11.13
|
|
31
|
+
- **CPU Cores:** 4
|
|
32
|
+
- **Total Memory:** 15.62 GB
|
|
33
|
+
- **Available Memory:** 14.62 GB
|
|
34
|
+
|
|
35
|
+
## Performance Comparison
|
|
36
|
+
|
|
37
|
+
### Small_Requirements Dataset - Cold Cache
|
|
38
|
+
|
|
39
|
+
#### Execution Time Comparison
|
|
40
|
+
|
|
41
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
42
|
+
|---------------------|---------------------|---------------------|
|
|
43
|
+
| 🥇 pysentry-pypi | 0.306s | 1.00x |
|
|
44
|
+
| 🥈 pysentry-osv | 0.992s | 3.24x |
|
|
45
|
+
| pysentry-pypa | 1.225s | 4.00x |
|
|
46
|
+
| pysentry-all-sources | 1.238s | 4.04x |
|
|
47
|
+
| pip-audit-default | 8.785s | 28.70x |
|
|
48
|
+
|
|
49
|
+
#### Memory Usage Comparison
|
|
50
|
+
|
|
51
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
52
|
+
|---------------------|---------------------|---------------------|
|
|
53
|
+
| 🥇 pysentry-osv | 10.63 MB | 1.00x |
|
|
54
|
+
| 🥈 pysentry-pypi | 12.06 MB | 1.13x |
|
|
55
|
+
| pip-audit-default | 45.50 MB | 4.28x |
|
|
56
|
+
| pysentry-pypa | 73.88 MB | 6.95x |
|
|
57
|
+
| pysentry-all-sources | 107.95 MB | 10.15x |
|
|
58
|
+
|
|
59
|
+
### Small_Requirements Dataset - Hot Cache
|
|
60
|
+
|
|
61
|
+
#### Execution Time Comparison
|
|
62
|
+
|
|
63
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
64
|
+
|---------------------|---------------------|---------------------|
|
|
65
|
+
| 🥇 pysentry-pypi | 0.224s | 1.00x |
|
|
66
|
+
| 🥈 pysentry-pypa | 1.027s | 4.59x |
|
|
67
|
+
| pysentry-all-sources | 1.136s | 5.08x |
|
|
68
|
+
| pysentry-osv | 1.142s | 5.11x |
|
|
69
|
+
| pip-audit-default | 8.165s | 36.53x |
|
|
70
|
+
|
|
71
|
+
#### Memory Usage Comparison
|
|
72
|
+
|
|
73
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
74
|
+
|---------------------|---------------------|---------------------|
|
|
75
|
+
| 🥇 pysentry-osv | 10.78 MB | 1.00x |
|
|
76
|
+
| 🥈 pysentry-pypi | 12.29 MB | 1.14x |
|
|
77
|
+
| pip-audit-default | 44.93 MB | 4.17x |
|
|
78
|
+
| pysentry-pypa | 74.12 MB | 6.88x |
|
|
79
|
+
| pysentry-all-sources | 106.62 MB | 9.89x |
|
|
80
|
+
|
|
81
|
+
### Large_Requirements Dataset - Cold Cache
|
|
82
|
+
|
|
83
|
+
#### Execution Time Comparison
|
|
84
|
+
|
|
85
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
86
|
+
|---------------------|---------------------|---------------------|
|
|
87
|
+
| 🥇 pysentry-pypi | 0.996s | 1.00x |
|
|
88
|
+
| 🥈 pysentry-pypa | 1.328s | 1.33x |
|
|
89
|
+
| pysentry-osv | 3.112s | 3.13x |
|
|
90
|
+
| pysentry-all-sources | 3.483s | 3.50x |
|
|
91
|
+
| pip-audit-default | 18.476s | 18.56x |
|
|
92
|
+
|
|
93
|
+
#### Memory Usage Comparison
|
|
94
|
+
|
|
95
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
96
|
+
|---------------------|---------------------|---------------------|
|
|
97
|
+
| 🥇 pysentry-osv | 10.98 MB | 1.00x |
|
|
98
|
+
| 🥈 pysentry-pypi | 13.16 MB | 1.20x |
|
|
99
|
+
| pip-audit-default | 47.48 MB | 4.32x |
|
|
100
|
+
| pysentry-pypa | 72.94 MB | 6.64x |
|
|
101
|
+
| pysentry-all-sources | 103.27 MB | 9.40x |
|
|
102
|
+
|
|
103
|
+
### Large_Requirements Dataset - Hot Cache
|
|
104
|
+
|
|
105
|
+
#### Execution Time Comparison
|
|
106
|
+
|
|
107
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
108
|
+
|---------------------|---------------------|---------------------|
|
|
109
|
+
| 🥇 pysentry-pypi | 0.657s | 1.00x |
|
|
110
|
+
| 🥈 pysentry-pypa | 1.518s | 2.31x |
|
|
111
|
+
| pysentry-all-sources | 3.055s | 4.65x |
|
|
112
|
+
| pysentry-osv | 3.429s | 5.22x |
|
|
113
|
+
| pip-audit-default | 16.172s | 24.63x |
|
|
114
|
+
|
|
115
|
+
#### Memory Usage Comparison
|
|
116
|
+
|
|
117
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
118
|
+
|---------------------|---------------------|---------------------|
|
|
119
|
+
| 🥇 pysentry-osv | 10.68 MB | 1.00x |
|
|
120
|
+
| 🥈 pysentry-pypi | 13.18 MB | 1.23x |
|
|
121
|
+
| pip-audit-default | 48.80 MB | 4.57x |
|
|
122
|
+
| pysentry-pypa | 72.41 MB | 6.78x |
|
|
123
|
+
| pysentry-all-sources | 107.36 MB | 10.06x |
|
|
124
|
+
|
|
125
|
+
## Detailed Analysis
|
|
126
|
+
|
|
127
|
+
### Pysentry Performance
|
|
128
|
+
|
|
129
|
+
- **Execution Time:** Avg: 1.554s, Min: 0.224s, Max: 3.483s
|
|
130
|
+
|
|
131
|
+
- **Memory Usage:** Avg: 50.77 MB, Min: 10.63 MB, Max: 107.95 MB
|
|
132
|
+
|
|
133
|
+
- **Success Rate:** 100.0% (16/16)
|
|
134
|
+
|
|
135
|
+
### Pip-Audit Performance
|
|
136
|
+
|
|
137
|
+
- **Execution Time:** Avg: 12.899s, Min: 8.165s, Max: 18.476s
|
|
138
|
+
|
|
139
|
+
- **Memory Usage:** Avg: 46.68 MB, Min: 44.93 MB, Max: 48.80 MB
|
|
140
|
+
|
|
141
|
+
- **Success Rate:** 100.0% (4/4)
|
|
@@ -0,0 +1,141 @@
|
|
|
1
|
+
# PySentry - pip-audit Benchmark Report
|
|
2
|
+
|
|
3
|
+
**Generated:** 2025-08-18 17:01:27
|
|
4
|
+
**Duration:** 1m 57.61s
|
|
5
|
+
**Total Tests:** 20
|
|
6
|
+
|
|
7
|
+
## Executive Summary
|
|
8
|
+
|
|
9
|
+
**Overall Success Rate:** 100.0% (20/20 successful runs)
|
|
10
|
+
|
|
11
|
+
### Small_Requirements Dataset - Cold Cache
|
|
12
|
+
- **Fastest:** pysentry-pypi (0.326s) - 27.96x faster than slowest
|
|
13
|
+
- **Memory Efficient:** pysentry-osv (11.90 MB) - 7.77x less memory than highest
|
|
14
|
+
|
|
15
|
+
### Small_Requirements Dataset - Hot Cache
|
|
16
|
+
- **Fastest:** pysentry-pypi (0.227s) - 34.73x faster than slowest
|
|
17
|
+
- **Memory Efficient:** pysentry-pypi (9.57 MB) - 10.54x less memory than highest
|
|
18
|
+
|
|
19
|
+
### Large_Requirements Dataset - Cold Cache
|
|
20
|
+
- **Fastest:** pysentry-pypi (0.810s) - 25.84x faster than slowest
|
|
21
|
+
- **Memory Efficient:** pysentry-osv (11.85 MB) - 7.91x less memory than highest
|
|
22
|
+
|
|
23
|
+
### Large_Requirements Dataset - Hot Cache
|
|
24
|
+
- **Fastest:** pysentry-pypi (0.667s) - 23.10x faster than slowest
|
|
25
|
+
- **Memory Efficient:** pysentry-pypi (9.42 MB) - 10.74x less memory than highest
|
|
26
|
+
|
|
27
|
+
## Test Environment
|
|
28
|
+
|
|
29
|
+
- **Platform:** Linux-6.11.0-1018-azure-x86_64-with-glibc2.39
|
|
30
|
+
- **Python Version:** 3.11.13
|
|
31
|
+
- **CPU Cores:** 4
|
|
32
|
+
- **Total Memory:** 15.62 GB
|
|
33
|
+
- **Available Memory:** 14.63 GB
|
|
34
|
+
|
|
35
|
+
## Performance Comparison
|
|
36
|
+
|
|
37
|
+
### Small_Requirements Dataset - Cold Cache
|
|
38
|
+
|
|
39
|
+
#### Execution Time Comparison
|
|
40
|
+
|
|
41
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
42
|
+
|---------------------|---------------------|---------------------|
|
|
43
|
+
| 🥇 pysentry-pypi | 0.326s | 1.00x |
|
|
44
|
+
| 🥈 pysentry-osv | 1.027s | 3.15x |
|
|
45
|
+
| pysentry-all-sources | 1.188s | 3.65x |
|
|
46
|
+
| pysentry-pypa | 1.232s | 3.78x |
|
|
47
|
+
| pip-audit-default | 9.108s | 27.96x |
|
|
48
|
+
|
|
49
|
+
#### Memory Usage Comparison
|
|
50
|
+
|
|
51
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
52
|
+
|---------------------|---------------------|---------------------|
|
|
53
|
+
| 🥇 pysentry-osv | 11.90 MB | 1.00x |
|
|
54
|
+
| 🥈 pysentry-pypi | 13.23 MB | 1.11x |
|
|
55
|
+
| pip-audit-default | 45.44 MB | 3.82x |
|
|
56
|
+
| pysentry-pypa | 75.45 MB | 6.34x |
|
|
57
|
+
| pysentry-all-sources | 92.43 MB | 7.77x |
|
|
58
|
+
|
|
59
|
+
### Small_Requirements Dataset - Hot Cache
|
|
60
|
+
|
|
61
|
+
#### Execution Time Comparison
|
|
62
|
+
|
|
63
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
64
|
+
|---------------------|---------------------|---------------------|
|
|
65
|
+
| 🥇 pysentry-pypi | 0.227s | 1.00x |
|
|
66
|
+
| 🥈 pysentry-osv | 0.917s | 4.04x |
|
|
67
|
+
| pysentry-all-sources | 1.036s | 4.57x |
|
|
68
|
+
| pysentry-pypa | 1.107s | 4.88x |
|
|
69
|
+
| pip-audit-default | 7.881s | 34.73x |
|
|
70
|
+
|
|
71
|
+
#### Memory Usage Comparison
|
|
72
|
+
|
|
73
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
74
|
+
|---------------------|---------------------|---------------------|
|
|
75
|
+
| 🥇 pysentry-pypi | 9.57 MB | 1.00x |
|
|
76
|
+
| 🥈 pysentry-osv | 10.85 MB | 1.13x |
|
|
77
|
+
| pip-audit-default | 44.36 MB | 4.63x |
|
|
78
|
+
| pysentry-pypa | 53.60 MB | 5.60x |
|
|
79
|
+
| pysentry-all-sources | 100.87 MB | 10.54x |
|
|
80
|
+
|
|
81
|
+
### Large_Requirements Dataset - Cold Cache
|
|
82
|
+
|
|
83
|
+
#### Execution Time Comparison
|
|
84
|
+
|
|
85
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
86
|
+
|---------------------|---------------------|---------------------|
|
|
87
|
+
| 🥇 pysentry-pypi | 0.810s | 1.00x |
|
|
88
|
+
| 🥈 pysentry-pypa | 1.324s | 1.63x |
|
|
89
|
+
| pysentry-osv | 3.834s | 4.73x |
|
|
90
|
+
| pysentry-all-sources | 3.965s | 4.89x |
|
|
91
|
+
| pip-audit-default | 20.942s | 25.84x |
|
|
92
|
+
|
|
93
|
+
#### Memory Usage Comparison
|
|
94
|
+
|
|
95
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
96
|
+
|---------------------|---------------------|---------------------|
|
|
97
|
+
| 🥇 pysentry-osv | 11.85 MB | 1.00x |
|
|
98
|
+
| 🥈 pysentry-pypi | 13.98 MB | 1.18x |
|
|
99
|
+
| pip-audit-default | 47.18 MB | 3.98x |
|
|
100
|
+
| pysentry-pypa | 71.19 MB | 6.01x |
|
|
101
|
+
| pysentry-all-sources | 93.71 MB | 7.91x |
|
|
102
|
+
|
|
103
|
+
### Large_Requirements Dataset - Hot Cache
|
|
104
|
+
|
|
105
|
+
#### Execution Time Comparison
|
|
106
|
+
|
|
107
|
+
| Tool Configuration | Execution Time | Relative Performance |
|
|
108
|
+
|---------------------|---------------------|---------------------|
|
|
109
|
+
| 🥇 pysentry-pypi | 0.667s | 1.00x |
|
|
110
|
+
| 🥈 pysentry-pypa | 1.321s | 1.98x |
|
|
111
|
+
| pysentry-all-sources | 3.341s | 5.01x |
|
|
112
|
+
| pysentry-osv | 3.600s | 5.40x |
|
|
113
|
+
| pip-audit-default | 15.406s | 23.10x |
|
|
114
|
+
|
|
115
|
+
#### Memory Usage Comparison
|
|
116
|
+
|
|
117
|
+
| Tool Configuration | Peak Memory | Relative Performance |
|
|
118
|
+
|---------------------|---------------------|---------------------|
|
|
119
|
+
| 🥇 pysentry-pypi | 9.42 MB | 1.00x |
|
|
120
|
+
| 🥈 pysentry-osv | 10.72 MB | 1.14x |
|
|
121
|
+
| pip-audit-default | 47.33 MB | 5.02x |
|
|
122
|
+
| pysentry-pypa | 72.12 MB | 7.65x |
|
|
123
|
+
| pysentry-all-sources | 101.22 MB | 10.74x |
|
|
124
|
+
|
|
125
|
+
## Detailed Analysis
|
|
126
|
+
|
|
127
|
+
### Pysentry Performance
|
|
128
|
+
|
|
129
|
+
- **Execution Time:** Avg: 1.620s, Min: 0.227s, Max: 3.965s
|
|
130
|
+
|
|
131
|
+
- **Memory Usage:** Avg: 47.01 MB, Min: 9.42 MB, Max: 101.22 MB
|
|
132
|
+
|
|
133
|
+
- **Success Rate:** 100.0% (16/16)
|
|
134
|
+
|
|
135
|
+
### Pip-Audit Performance
|
|
136
|
+
|
|
137
|
+
- **Execution Time:** Avg: 13.334s, Min: 7.881s, Max: 20.942s
|
|
138
|
+
|
|
139
|
+
- **Memory Usage:** Avg: 46.08 MB, Min: 44.36 MB, Max: 47.33 MB
|
|
140
|
+
|
|
141
|
+
- **Success Rate:** 100.0% (4/4)
|