pysentry-rs 0.3.4__tar.gz → 0.3.6__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of pysentry-rs might be problematic. Click here for more details.

Files changed (75) hide show
  1. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/dependabot.yml +0 -6
  2. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/ci.yml +2 -0
  3. pysentry_rs-0.3.6/.pre-commit-hooks.yaml +10 -0
  4. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/Cargo.lock +7 -7
  5. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/Cargo.toml +3 -3
  6. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/PKG-INFO +52 -7
  7. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/README.md +51 -6
  8. pysentry_rs-0.3.6/benchmarks/results/0.3.4.md +141 -0
  9. pysentry_rs-0.3.6/benchmarks/results/0.3.5.md +141 -0
  10. pysentry_rs-0.3.6/benchmarks/results/latest.md +141 -0
  11. pysentry_rs-0.3.6/benchmarks/test_data/uv.lock +2972 -0
  12. pysentry_rs-0.3.6/fixtures/pipfile-tests/Pipfile +27 -0
  13. pysentry_rs-0.3.6/fixtures/pipfile-tests/Pipfile.lock +259 -0
  14. pysentry_rs-0.3.6/fixtures/pipfile-vulnerable-tests/Pipfile +20 -0
  15. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/audit.rs +48 -0
  16. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/storage.rs +2 -0
  17. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cli.rs +167 -71
  18. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/scanner.rs +92 -39
  19. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/lib.rs +5 -2
  20. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/lock.rs +245 -6
  21. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/mod.rs +65 -12
  22. pysentry_rs-0.3.6/src/parsers/pipfile.rs +598 -0
  23. pysentry_rs-0.3.6/src/parsers/pipfile_lock.rs +342 -0
  24. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/poetry_lock.rs +4 -4
  25. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/pyproject.rs +13 -10
  26. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/parsers/requirements.rs +3 -3
  27. pysentry_rs-0.3.4/.pre-commit-hooks.yaml +0 -10
  28. pysentry_rs-0.3.4/benchmarks/results/latest.md +0 -141
  29. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/FUNDING.yml +0 -0
  30. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/benchmark.yml +0 -0
  31. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.github/workflows/release.yml +0 -0
  32. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.gitignore +0 -0
  33. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/.pre-commit-config.yaml +0 -0
  34. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/LICENSE +0 -0
  35. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/.gitignore +0 -0
  36. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/.python-version +0 -0
  37. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/README.md +0 -0
  38. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/main.py +0 -0
  39. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/pyproject.toml +0 -0
  40. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.2.3.md +0 -0
  41. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.1.md +0 -0
  42. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.2.md +0 -0
  43. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/results/0.3.3.md +0 -0
  44. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/benchmark_runner.py +0 -0
  45. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/performance_monitor.py +0 -0
  46. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/report_generator.py +0 -0
  47. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/src/tool_wrapper.py +0 -0
  48. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/test_data/large_requirements.txt +0 -0
  49. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/test_data/small_requirements.txt +0 -0
  50. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/benchmarks/uv.lock +0 -0
  51. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests/requirements-dev.txt +0 -0
  52. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests/requirements.txt +0 -0
  53. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/fixtures/requirements-tests-vulnerable/requirements.txt +0 -0
  54. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/pyproject.toml +0 -0
  55. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/python/pysentry/__init__.py +0 -0
  56. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/cache/mod.rs +0 -0
  57. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/config.rs +0 -0
  58. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/mod.rs +0 -0
  59. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/mod.rs +0 -0
  60. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/pip_tools.rs +0 -0
  61. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/dependency/resolvers/uv.rs +0 -0
  62. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/error.rs +0 -0
  63. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/main.rs +0 -0
  64. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/mod.rs +0 -0
  65. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/report.rs +0 -0
  66. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/output/sarif.rs +0 -0
  67. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/mod.rs +0 -0
  68. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/osv.rs +0 -0
  69. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/pypa.rs +0 -0
  70. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/providers/pypi.rs +0 -0
  71. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/python.rs +0 -0
  72. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/types.rs +0 -0
  73. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/database.rs +0 -0
  74. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/matcher.rs +0 -0
  75. {pysentry_rs-0.3.4 → pysentry_rs-0.3.6}/src/vulnerability/mod.rs +0 -0
@@ -11,16 +11,10 @@ updates:
11
11
  patterns:
12
12
  - "*"
13
13
 
14
- # Python dependencies (pyproject.toml only)
15
14
  - package-ecosystem: "pip"
16
15
  directory: "/"
17
16
  schedule:
18
17
  interval: "weekly"
19
- open-pull-requests-limit: 10
20
- allow:
21
- - dependency-type: "all"
22
- ignore:
23
- - dependency-name: "*"
24
18
  groups:
25
19
  python-dependencies:
26
20
  patterns:
@@ -10,6 +10,7 @@ on:
10
10
  - ".editorconfig"
11
11
  - ".github/dependabot.yml"
12
12
  - ".github/FUNDING.yml"
13
+ - ".pre-commit-hooks.yaml"
13
14
  pull_request:
14
15
  branches: [main]
15
16
  paths-ignore:
@@ -19,6 +20,7 @@ on:
19
20
  - ".editorconfig"
20
21
  - ".github/dependabot.yml"
21
22
  - ".github/FUNDING.yml"
23
+ - ".pre-commit-hooks.yaml"
22
24
 
23
25
  env:
24
26
  CARGO_TERM_COLOR: always
@@ -0,0 +1,10 @@
1
+ - id: pysentry
2
+ name: pysentry (DEPRECATED - moved to nyudenkov/pysentry-pre-commit)
3
+ description: "⚠️ DEPRECATED - See github.com/nyudenkov/pysentry-pre-commit"
4
+ entry: pysentry-rs
5
+ language: python
6
+ always_run: true
7
+ additional_dependencies:
8
+ ["pysentry-rs==0.3.5", "uv==0.8.9", "pip-tools==7.5.0"]
9
+ minimum_pre_commit_version: "2.9.2"
10
+ types: [python]
@@ -108,9 +108,9 @@ dependencies = [
108
108
 
109
109
  [[package]]
110
110
  name = "async-trait"
111
- version = "0.1.88"
111
+ version = "0.1.89"
112
112
  source = "registry+https://github.com/rust-lang/crates.io-index"
113
- checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
113
+ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
114
114
  dependencies = [
115
115
  "proc-macro2",
116
116
  "quote",
@@ -1137,7 +1137,7 @@ dependencies = [
1137
1137
 
1138
1138
  [[package]]
1139
1139
  name = "pysentry"
1140
- version = "0.3.4"
1140
+ version = "0.3.6"
1141
1141
  dependencies = [
1142
1142
  "anyhow",
1143
1143
  "async-trait",
@@ -1699,18 +1699,18 @@ dependencies = [
1699
1699
 
1700
1700
  [[package]]
1701
1701
  name = "thiserror"
1702
- version = "2.0.14"
1702
+ version = "2.0.15"
1703
1703
  source = "registry+https://github.com/rust-lang/crates.io-index"
1704
- checksum = "0b0949c3a6c842cbde3f1686d6eea5a010516deb7085f79db747562d4102f41e"
1704
+ checksum = "80d76d3f064b981389ecb4b6b7f45a0bf9fdac1d5b9204c7bd6714fecc302850"
1705
1705
  dependencies = [
1706
1706
  "thiserror-impl",
1707
1707
  ]
1708
1708
 
1709
1709
  [[package]]
1710
1710
  name = "thiserror-impl"
1711
- version = "2.0.14"
1711
+ version = "2.0.15"
1712
1712
  source = "registry+https://github.com/rust-lang/crates.io-index"
1713
- checksum = "cc5b44b4ab9c2fdd0e0512e6bece8388e214c0749f5862b114cc5b7a25daf227"
1713
+ checksum = "44d29feb33e986b6ea906bd9c3559a856983f92371b3eaa5e83782a351623de0"
1714
1714
  dependencies = [
1715
1715
  "proc-macro2",
1716
1716
  "quote",
@@ -1,6 +1,6 @@
1
1
  [package]
2
2
  name = "pysentry"
3
- version = "0.3.4"
3
+ version = "0.3.6"
4
4
  edition = "2021"
5
5
  rust-version = "1.79"
6
6
  description = "Security vulnerability auditing for Python packages"
@@ -23,7 +23,7 @@ python = ["pyo3"]
23
23
 
24
24
  [dependencies]
25
25
  anyhow = "1.0.99"
26
- async-trait = "0.1.88"
26
+ async-trait = "0.1.89"
27
27
  chrono = { version = "0.4.41", features = ["serde"] }
28
28
  clap = { version = "4.5.45", features = ["derive"] }
29
29
  dirs = "6.0.0"
@@ -40,7 +40,7 @@ serde_json = "1.0.142"
40
40
  serde_yaml = "0.9.34"
41
41
  sha2 = "0.10.9"
42
42
  tempfile = "3.20.0"
43
- thiserror = "2.0.14"
43
+ thiserror = "2.0.15"
44
44
  tokio = { version = "1.47.1", features = ["fs", "io-util", "rt-multi-thread", "macros", "process"] }
45
45
  toml = "0.9.5"
46
46
  tracing = "0.1.41"
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: pysentry-rs
3
- Version: 0.3.4
3
+ Version: 0.3.6
4
4
  Classifier: Development Status :: 4 - Beta
5
5
  Classifier: Intended Audience :: Developers
6
6
  Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
@@ -27,18 +27,21 @@ Project-URL: Issues, https://github.com/nyudenkov/pysentry/issues
27
27
  # 🐍 PySentry
28
28
 
29
29
  [![OSV Integration](https://img.shields.io/badge/OSV-Integrated-blue)](https://google.github.io/osv.dev/)
30
+ [![PyPI Downloads](https://static.pepy.tech/badge/pysentry-rs/week)](https://pepy.tech/projects/pysentry-rs)
30
31
 
31
32
  [Help to test and improve](https://github.com/nyudenkov/pysentry/issues/12) | [Latest PySentry - pip-audit benchmark](benchmarks/results/latest.md)
32
33
 
34
+ Please, send feedback to nikita@pysentry.com
35
+
33
36
  A fast, reliable security vulnerability scanner for Python projects, written in Rust.
34
37
 
35
38
  ## Overview
36
39
 
37
- PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `pyproject.toml`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
40
+ PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
38
41
 
39
42
  ## Key Features
40
43
 
41
- - **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `pyproject.toml`, and `requirements.txt` files
44
+ - **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, and `requirements.txt` files
42
45
  - **External Resolver Integration**: Leverages `uv` and `pip-tools` for accurate requirements.txt constraint solving
43
46
  - **Multiple Data Sources**:
44
47
  - PyPA Advisory Database (default)
@@ -191,7 +194,7 @@ uvx pysentry-rs /path/to/python/project
191
194
  pysentry
192
195
  pysentry /path/to/python/project
193
196
 
194
- # Automatically detects project type (uv.lock, poetry.lock, pyproject.toml, requirements.txt)
197
+ # Automatically detects project type (uv.lock, poetry.lock, Pipfile.lock, pyproject.toml, Pipfile, requirements.txt)
195
198
  pysentry /path/to/project
196
199
 
197
200
  # Force specific resolver
@@ -297,7 +300,8 @@ Add PySentry to your `.pre-commit-config.yaml`:
297
300
 
298
301
  ```yaml
299
302
  repos:
300
- - repo: https://github.com/nyudenkov/pysentry
303
+ - repo: https://github.com/pysentry/pysentry-pre-commit
304
+ rev: v0.3.5
301
305
  hooks:
302
306
  - id: pysentry # default pysentry settings
303
307
  ```
@@ -306,7 +310,8 @@ repos:
306
310
 
307
311
  ```yaml
308
312
  repos:
309
- - repo: https://github.com/nyudenkov/pysentry
313
+ - repo: https://github.com/pysentry/pysentry-pre-commit
314
+ rev: v0.3.5
310
315
  hooks:
311
316
  - id: pysentry
312
317
  args: ["--sources", "pypa,osv", "--fail-on", "high"]
@@ -494,6 +499,46 @@ Full support for Poetry lock files:
494
499
  - Handles Poetry's dependency groups and optional dependencies
495
500
  - Perfect for Poetry-managed projects with established lock files
496
501
 
502
+ ### Pipfile.lock Files
503
+
504
+ Full support for Pipenv lock files with exact version resolution:
505
+
506
+ - **Exact Version Resolution**: Scans exact dependency versions locked by Pipenv
507
+ - **Lock-File Only Analysis**: Relies purely on the lock file structure, no Pipfile parsing needed
508
+ - **Complete Dependency Tree**: Analyzes all resolved dependencies including transitive ones
509
+ - **Dependency Classification**: Distinguishes between default dependencies and development groups
510
+
511
+ **Key Features:**
512
+
513
+ - No external tools required
514
+ - Fast parsing with exact version information
515
+ - Handles Pipenv's dependency groups (default and develop)
516
+ - Perfect for Pipenv-managed projects with established lock files
517
+
518
+ ### Pipfile Files (External Resolution)
519
+
520
+ Support for Pipfile specification files using external dependency resolvers:
521
+
522
+ **Key Features:**
523
+
524
+ - **Dependencies Resolution**: Converts version constraints from Pipfile to exact versions using mature external tools
525
+ - **Multiple Resolver Support**:
526
+ - **uv**: Rust-based resolver, extremely fast and reliable (recommended)
527
+ - **pip-tools**: Python-based resolver using `pip-compile`, widely compatible
528
+ - **Auto-detection**: Automatically detects and uses the best available resolver in your environment
529
+ - **Dependency Groups**: Supports both default packages and dev-packages sections
530
+ - **Complex Constraint Handling**: Supports version ranges, Git dependencies, and environment markers
531
+
532
+ **Resolution Workflow:**
533
+
534
+ 1. Detects `Pipfile` in your project (when `Pipfile.lock` is not present)
535
+ 2. Auto-detects available resolver (`uv` or `pip-tools`) in current environment
536
+ 3. Resolves version constraints to exact dependency versions
537
+ 4. Scans resolved dependencies for vulnerabilities
538
+ 5. Reports findings with dependency group classification
539
+
540
+ **Note**: When both `Pipfile` and `Pipfile.lock` are present, PySentry prioritizes the lock file for better accuracy. Consider using `pipenv lock` to generate a lock file for the most precise vulnerability scanning.
541
+
497
542
  ### requirements.txt Files (External Resolution)
498
543
 
499
544
  Advanced support for `requirements.txt` files using external dependency resolvers:
@@ -732,7 +777,7 @@ pysentry /path/to/python/project
732
777
  pysentry --requirements requirements-dev.txt --requirements requirements-test.txt
733
778
 
734
779
  # Check if higher-priority files exist (they take precedence)
735
- ls uv.lock poetry.lock pyproject.toml
780
+ ls uv.lock poetry.lock Pipfile.lock pyproject.toml Pipfile requirements.txt
736
781
  ```
737
782
 
738
783
  **Performance Issues**
@@ -1,18 +1,21 @@
1
1
  # 🐍 PySentry
2
2
 
3
3
  [![OSV Integration](https://img.shields.io/badge/OSV-Integrated-blue)](https://google.github.io/osv.dev/)
4
+ [![PyPI Downloads](https://static.pepy.tech/badge/pysentry-rs/week)](https://pepy.tech/projects/pysentry-rs)
4
5
 
5
6
  [Help to test and improve](https://github.com/nyudenkov/pysentry/issues/12) | [Latest PySentry - pip-audit benchmark](benchmarks/results/latest.md)
6
7
 
8
+ Please, send feedback to nikita@pysentry.com
9
+
7
10
  A fast, reliable security vulnerability scanner for Python projects, written in Rust.
8
11
 
9
12
  ## Overview
10
13
 
11
- PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `pyproject.toml`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
14
+ PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
12
15
 
13
16
  ## Key Features
14
17
 
15
- - **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `pyproject.toml`, and `requirements.txt` files
18
+ - **Multiple Project Formats**: Supports `uv.lock`, `poetry.lock`, `Pipfile.lock`, `pyproject.toml`, `Pipfile`, and `requirements.txt` files
16
19
  - **External Resolver Integration**: Leverages `uv` and `pip-tools` for accurate requirements.txt constraint solving
17
20
  - **Multiple Data Sources**:
18
21
  - PyPA Advisory Database (default)
@@ -165,7 +168,7 @@ uvx pysentry-rs /path/to/python/project
165
168
  pysentry
166
169
  pysentry /path/to/python/project
167
170
 
168
- # Automatically detects project type (uv.lock, poetry.lock, pyproject.toml, requirements.txt)
171
+ # Automatically detects project type (uv.lock, poetry.lock, Pipfile.lock, pyproject.toml, Pipfile, requirements.txt)
169
172
  pysentry /path/to/project
170
173
 
171
174
  # Force specific resolver
@@ -271,7 +274,8 @@ Add PySentry to your `.pre-commit-config.yaml`:
271
274
 
272
275
  ```yaml
273
276
  repos:
274
- - repo: https://github.com/nyudenkov/pysentry
277
+ - repo: https://github.com/pysentry/pysentry-pre-commit
278
+ rev: v0.3.5
275
279
  hooks:
276
280
  - id: pysentry # default pysentry settings
277
281
  ```
@@ -280,7 +284,8 @@ repos:
280
284
 
281
285
  ```yaml
282
286
  repos:
283
- - repo: https://github.com/nyudenkov/pysentry
287
+ - repo: https://github.com/pysentry/pysentry-pre-commit
288
+ rev: v0.3.5
284
289
  hooks:
285
290
  - id: pysentry
286
291
  args: ["--sources", "pypa,osv", "--fail-on", "high"]
@@ -468,6 +473,46 @@ Full support for Poetry lock files:
468
473
  - Handles Poetry's dependency groups and optional dependencies
469
474
  - Perfect for Poetry-managed projects with established lock files
470
475
 
476
+ ### Pipfile.lock Files
477
+
478
+ Full support for Pipenv lock files with exact version resolution:
479
+
480
+ - **Exact Version Resolution**: Scans exact dependency versions locked by Pipenv
481
+ - **Lock-File Only Analysis**: Relies purely on the lock file structure, no Pipfile parsing needed
482
+ - **Complete Dependency Tree**: Analyzes all resolved dependencies including transitive ones
483
+ - **Dependency Classification**: Distinguishes between default dependencies and development groups
484
+
485
+ **Key Features:**
486
+
487
+ - No external tools required
488
+ - Fast parsing with exact version information
489
+ - Handles Pipenv's dependency groups (default and develop)
490
+ - Perfect for Pipenv-managed projects with established lock files
491
+
492
+ ### Pipfile Files (External Resolution)
493
+
494
+ Support for Pipfile specification files using external dependency resolvers:
495
+
496
+ **Key Features:**
497
+
498
+ - **Dependencies Resolution**: Converts version constraints from Pipfile to exact versions using mature external tools
499
+ - **Multiple Resolver Support**:
500
+ - **uv**: Rust-based resolver, extremely fast and reliable (recommended)
501
+ - **pip-tools**: Python-based resolver using `pip-compile`, widely compatible
502
+ - **Auto-detection**: Automatically detects and uses the best available resolver in your environment
503
+ - **Dependency Groups**: Supports both default packages and dev-packages sections
504
+ - **Complex Constraint Handling**: Supports version ranges, Git dependencies, and environment markers
505
+
506
+ **Resolution Workflow:**
507
+
508
+ 1. Detects `Pipfile` in your project (when `Pipfile.lock` is not present)
509
+ 2. Auto-detects available resolver (`uv` or `pip-tools`) in current environment
510
+ 3. Resolves version constraints to exact dependency versions
511
+ 4. Scans resolved dependencies for vulnerabilities
512
+ 5. Reports findings with dependency group classification
513
+
514
+ **Note**: When both `Pipfile` and `Pipfile.lock` are present, PySentry prioritizes the lock file for better accuracy. Consider using `pipenv lock` to generate a lock file for the most precise vulnerability scanning.
515
+
471
516
  ### requirements.txt Files (External Resolution)
472
517
 
473
518
  Advanced support for `requirements.txt` files using external dependency resolvers:
@@ -706,7 +751,7 @@ pysentry /path/to/python/project
706
751
  pysentry --requirements requirements-dev.txt --requirements requirements-test.txt
707
752
 
708
753
  # Check if higher-priority files exist (they take precedence)
709
- ls uv.lock poetry.lock pyproject.toml
754
+ ls uv.lock poetry.lock Pipfile.lock pyproject.toml Pipfile requirements.txt
710
755
  ```
711
756
 
712
757
  **Performance Issues**
@@ -0,0 +1,141 @@
1
+ # PySentry - pip-audit Benchmark Report
2
+
3
+ **Generated:** 2025-08-14 15:42:52
4
+ **Duration:** 1m 55.57s
5
+ **Total Tests:** 20
6
+
7
+ ## Executive Summary
8
+
9
+ **Overall Success Rate:** 100.0% (20/20 successful runs)
10
+
11
+ ### Small_Requirements Dataset - Cold Cache
12
+ - **Fastest:** pysentry-pypi (0.306s) - 28.70x faster than slowest
13
+ - **Memory Efficient:** pysentry-osv (10.63 MB) - 10.15x less memory than highest
14
+
15
+ ### Small_Requirements Dataset - Hot Cache
16
+ - **Fastest:** pysentry-pypi (0.224s) - 36.53x faster than slowest
17
+ - **Memory Efficient:** pysentry-osv (10.78 MB) - 9.89x less memory than highest
18
+
19
+ ### Large_Requirements Dataset - Cold Cache
20
+ - **Fastest:** pysentry-pypi (0.996s) - 18.56x faster than slowest
21
+ - **Memory Efficient:** pysentry-osv (10.98 MB) - 9.40x less memory than highest
22
+
23
+ ### Large_Requirements Dataset - Hot Cache
24
+ - **Fastest:** pysentry-pypi (0.657s) - 24.63x faster than slowest
25
+ - **Memory Efficient:** pysentry-osv (10.68 MB) - 10.06x less memory than highest
26
+
27
+ ## Test Environment
28
+
29
+ - **Platform:** Linux-6.11.0-1018-azure-x86_64-with-glibc2.39
30
+ - **Python Version:** 3.11.13
31
+ - **CPU Cores:** 4
32
+ - **Total Memory:** 15.62 GB
33
+ - **Available Memory:** 14.62 GB
34
+
35
+ ## Performance Comparison
36
+
37
+ ### Small_Requirements Dataset - Cold Cache
38
+
39
+ #### Execution Time Comparison
40
+
41
+ | Tool Configuration | Execution Time | Relative Performance |
42
+ |---------------------|---------------------|---------------------|
43
+ | 🥇 pysentry-pypi | 0.306s | 1.00x |
44
+ | 🥈 pysentry-osv | 0.992s | 3.24x |
45
+ | pysentry-pypa | 1.225s | 4.00x |
46
+ | pysentry-all-sources | 1.238s | 4.04x |
47
+ | pip-audit-default | 8.785s | 28.70x |
48
+
49
+ #### Memory Usage Comparison
50
+
51
+ | Tool Configuration | Peak Memory | Relative Performance |
52
+ |---------------------|---------------------|---------------------|
53
+ | 🥇 pysentry-osv | 10.63 MB | 1.00x |
54
+ | 🥈 pysentry-pypi | 12.06 MB | 1.13x |
55
+ | pip-audit-default | 45.50 MB | 4.28x |
56
+ | pysentry-pypa | 73.88 MB | 6.95x |
57
+ | pysentry-all-sources | 107.95 MB | 10.15x |
58
+
59
+ ### Small_Requirements Dataset - Hot Cache
60
+
61
+ #### Execution Time Comparison
62
+
63
+ | Tool Configuration | Execution Time | Relative Performance |
64
+ |---------------------|---------------------|---------------------|
65
+ | 🥇 pysentry-pypi | 0.224s | 1.00x |
66
+ | 🥈 pysentry-pypa | 1.027s | 4.59x |
67
+ | pysentry-all-sources | 1.136s | 5.08x |
68
+ | pysentry-osv | 1.142s | 5.11x |
69
+ | pip-audit-default | 8.165s | 36.53x |
70
+
71
+ #### Memory Usage Comparison
72
+
73
+ | Tool Configuration | Peak Memory | Relative Performance |
74
+ |---------------------|---------------------|---------------------|
75
+ | 🥇 pysentry-osv | 10.78 MB | 1.00x |
76
+ | 🥈 pysentry-pypi | 12.29 MB | 1.14x |
77
+ | pip-audit-default | 44.93 MB | 4.17x |
78
+ | pysentry-pypa | 74.12 MB | 6.88x |
79
+ | pysentry-all-sources | 106.62 MB | 9.89x |
80
+
81
+ ### Large_Requirements Dataset - Cold Cache
82
+
83
+ #### Execution Time Comparison
84
+
85
+ | Tool Configuration | Execution Time | Relative Performance |
86
+ |---------------------|---------------------|---------------------|
87
+ | 🥇 pysentry-pypi | 0.996s | 1.00x |
88
+ | 🥈 pysentry-pypa | 1.328s | 1.33x |
89
+ | pysentry-osv | 3.112s | 3.13x |
90
+ | pysentry-all-sources | 3.483s | 3.50x |
91
+ | pip-audit-default | 18.476s | 18.56x |
92
+
93
+ #### Memory Usage Comparison
94
+
95
+ | Tool Configuration | Peak Memory | Relative Performance |
96
+ |---------------------|---------------------|---------------------|
97
+ | 🥇 pysentry-osv | 10.98 MB | 1.00x |
98
+ | 🥈 pysentry-pypi | 13.16 MB | 1.20x |
99
+ | pip-audit-default | 47.48 MB | 4.32x |
100
+ | pysentry-pypa | 72.94 MB | 6.64x |
101
+ | pysentry-all-sources | 103.27 MB | 9.40x |
102
+
103
+ ### Large_Requirements Dataset - Hot Cache
104
+
105
+ #### Execution Time Comparison
106
+
107
+ | Tool Configuration | Execution Time | Relative Performance |
108
+ |---------------------|---------------------|---------------------|
109
+ | 🥇 pysentry-pypi | 0.657s | 1.00x |
110
+ | 🥈 pysentry-pypa | 1.518s | 2.31x |
111
+ | pysentry-all-sources | 3.055s | 4.65x |
112
+ | pysentry-osv | 3.429s | 5.22x |
113
+ | pip-audit-default | 16.172s | 24.63x |
114
+
115
+ #### Memory Usage Comparison
116
+
117
+ | Tool Configuration | Peak Memory | Relative Performance |
118
+ |---------------------|---------------------|---------------------|
119
+ | 🥇 pysentry-osv | 10.68 MB | 1.00x |
120
+ | 🥈 pysentry-pypi | 13.18 MB | 1.23x |
121
+ | pip-audit-default | 48.80 MB | 4.57x |
122
+ | pysentry-pypa | 72.41 MB | 6.78x |
123
+ | pysentry-all-sources | 107.36 MB | 10.06x |
124
+
125
+ ## Detailed Analysis
126
+
127
+ ### Pysentry Performance
128
+
129
+ - **Execution Time:** Avg: 1.554s, Min: 0.224s, Max: 3.483s
130
+
131
+ - **Memory Usage:** Avg: 50.77 MB, Min: 10.63 MB, Max: 107.95 MB
132
+
133
+ - **Success Rate:** 100.0% (16/16)
134
+
135
+ ### Pip-Audit Performance
136
+
137
+ - **Execution Time:** Avg: 12.899s, Min: 8.165s, Max: 18.476s
138
+
139
+ - **Memory Usage:** Avg: 46.68 MB, Min: 44.93 MB, Max: 48.80 MB
140
+
141
+ - **Success Rate:** 100.0% (4/4)
@@ -0,0 +1,141 @@
1
+ # PySentry - pip-audit Benchmark Report
2
+
3
+ **Generated:** 2025-08-18 17:01:27
4
+ **Duration:** 1m 57.61s
5
+ **Total Tests:** 20
6
+
7
+ ## Executive Summary
8
+
9
+ **Overall Success Rate:** 100.0% (20/20 successful runs)
10
+
11
+ ### Small_Requirements Dataset - Cold Cache
12
+ - **Fastest:** pysentry-pypi (0.326s) - 27.96x faster than slowest
13
+ - **Memory Efficient:** pysentry-osv (11.90 MB) - 7.77x less memory than highest
14
+
15
+ ### Small_Requirements Dataset - Hot Cache
16
+ - **Fastest:** pysentry-pypi (0.227s) - 34.73x faster than slowest
17
+ - **Memory Efficient:** pysentry-pypi (9.57 MB) - 10.54x less memory than highest
18
+
19
+ ### Large_Requirements Dataset - Cold Cache
20
+ - **Fastest:** pysentry-pypi (0.810s) - 25.84x faster than slowest
21
+ - **Memory Efficient:** pysentry-osv (11.85 MB) - 7.91x less memory than highest
22
+
23
+ ### Large_Requirements Dataset - Hot Cache
24
+ - **Fastest:** pysentry-pypi (0.667s) - 23.10x faster than slowest
25
+ - **Memory Efficient:** pysentry-pypi (9.42 MB) - 10.74x less memory than highest
26
+
27
+ ## Test Environment
28
+
29
+ - **Platform:** Linux-6.11.0-1018-azure-x86_64-with-glibc2.39
30
+ - **Python Version:** 3.11.13
31
+ - **CPU Cores:** 4
32
+ - **Total Memory:** 15.62 GB
33
+ - **Available Memory:** 14.63 GB
34
+
35
+ ## Performance Comparison
36
+
37
+ ### Small_Requirements Dataset - Cold Cache
38
+
39
+ #### Execution Time Comparison
40
+
41
+ | Tool Configuration | Execution Time | Relative Performance |
42
+ |---------------------|---------------------|---------------------|
43
+ | 🥇 pysentry-pypi | 0.326s | 1.00x |
44
+ | 🥈 pysentry-osv | 1.027s | 3.15x |
45
+ | pysentry-all-sources | 1.188s | 3.65x |
46
+ | pysentry-pypa | 1.232s | 3.78x |
47
+ | pip-audit-default | 9.108s | 27.96x |
48
+
49
+ #### Memory Usage Comparison
50
+
51
+ | Tool Configuration | Peak Memory | Relative Performance |
52
+ |---------------------|---------------------|---------------------|
53
+ | 🥇 pysentry-osv | 11.90 MB | 1.00x |
54
+ | 🥈 pysentry-pypi | 13.23 MB | 1.11x |
55
+ | pip-audit-default | 45.44 MB | 3.82x |
56
+ | pysentry-pypa | 75.45 MB | 6.34x |
57
+ | pysentry-all-sources | 92.43 MB | 7.77x |
58
+
59
+ ### Small_Requirements Dataset - Hot Cache
60
+
61
+ #### Execution Time Comparison
62
+
63
+ | Tool Configuration | Execution Time | Relative Performance |
64
+ |---------------------|---------------------|---------------------|
65
+ | 🥇 pysentry-pypi | 0.227s | 1.00x |
66
+ | 🥈 pysentry-osv | 0.917s | 4.04x |
67
+ | pysentry-all-sources | 1.036s | 4.57x |
68
+ | pysentry-pypa | 1.107s | 4.88x |
69
+ | pip-audit-default | 7.881s | 34.73x |
70
+
71
+ #### Memory Usage Comparison
72
+
73
+ | Tool Configuration | Peak Memory | Relative Performance |
74
+ |---------------------|---------------------|---------------------|
75
+ | 🥇 pysentry-pypi | 9.57 MB | 1.00x |
76
+ | 🥈 pysentry-osv | 10.85 MB | 1.13x |
77
+ | pip-audit-default | 44.36 MB | 4.63x |
78
+ | pysentry-pypa | 53.60 MB | 5.60x |
79
+ | pysentry-all-sources | 100.87 MB | 10.54x |
80
+
81
+ ### Large_Requirements Dataset - Cold Cache
82
+
83
+ #### Execution Time Comparison
84
+
85
+ | Tool Configuration | Execution Time | Relative Performance |
86
+ |---------------------|---------------------|---------------------|
87
+ | 🥇 pysentry-pypi | 0.810s | 1.00x |
88
+ | 🥈 pysentry-pypa | 1.324s | 1.63x |
89
+ | pysentry-osv | 3.834s | 4.73x |
90
+ | pysentry-all-sources | 3.965s | 4.89x |
91
+ | pip-audit-default | 20.942s | 25.84x |
92
+
93
+ #### Memory Usage Comparison
94
+
95
+ | Tool Configuration | Peak Memory | Relative Performance |
96
+ |---------------------|---------------------|---------------------|
97
+ | 🥇 pysentry-osv | 11.85 MB | 1.00x |
98
+ | 🥈 pysentry-pypi | 13.98 MB | 1.18x |
99
+ | pip-audit-default | 47.18 MB | 3.98x |
100
+ | pysentry-pypa | 71.19 MB | 6.01x |
101
+ | pysentry-all-sources | 93.71 MB | 7.91x |
102
+
103
+ ### Large_Requirements Dataset - Hot Cache
104
+
105
+ #### Execution Time Comparison
106
+
107
+ | Tool Configuration | Execution Time | Relative Performance |
108
+ |---------------------|---------------------|---------------------|
109
+ | 🥇 pysentry-pypi | 0.667s | 1.00x |
110
+ | 🥈 pysentry-pypa | 1.321s | 1.98x |
111
+ | pysentry-all-sources | 3.341s | 5.01x |
112
+ | pysentry-osv | 3.600s | 5.40x |
113
+ | pip-audit-default | 15.406s | 23.10x |
114
+
115
+ #### Memory Usage Comparison
116
+
117
+ | Tool Configuration | Peak Memory | Relative Performance |
118
+ |---------------------|---------------------|---------------------|
119
+ | 🥇 pysentry-pypi | 9.42 MB | 1.00x |
120
+ | 🥈 pysentry-osv | 10.72 MB | 1.14x |
121
+ | pip-audit-default | 47.33 MB | 5.02x |
122
+ | pysentry-pypa | 72.12 MB | 7.65x |
123
+ | pysentry-all-sources | 101.22 MB | 10.74x |
124
+
125
+ ## Detailed Analysis
126
+
127
+ ### Pysentry Performance
128
+
129
+ - **Execution Time:** Avg: 1.620s, Min: 0.227s, Max: 3.965s
130
+
131
+ - **Memory Usage:** Avg: 47.01 MB, Min: 9.42 MB, Max: 101.22 MB
132
+
133
+ - **Success Rate:** 100.0% (16/16)
134
+
135
+ ### Pip-Audit Performance
136
+
137
+ - **Execution Time:** Avg: 13.334s, Min: 7.881s, Max: 20.942s
138
+
139
+ - **Memory Usage:** Avg: 46.08 MB, Min: 44.36 MB, Max: 47.33 MB
140
+
141
+ - **Success Rate:** 100.0% (4/4)