uv-secure 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- uv_secure-0.1.0/.github/workflows/pre-commit.yml +17 -0
- uv_secure-0.1.0/.github/workflows/pytest.yml +75 -0
- uv_secure-0.1.0/.github/workflows/release.yml +25 -0
- uv_secure-0.1.0/.gitignore +167 -0
- uv_secure-0.1.0/.markdownlint.yaml +19 -0
- uv_secure-0.1.0/.pre-commit-config.yaml +60 -0
- uv_secure-0.1.0/.python-version +1 -0
- uv_secure-0.1.0/.yamllint +4 -0
- uv_secure-0.1.0/LICENSE +21 -0
- uv_secure-0.1.0/PKG-INFO +110 -0
- uv_secure-0.1.0/README.md +66 -0
- uv_secure-0.1.0/pyproject.toml +195 -0
- uv_secure-0.1.0/src/uv_secure/__init__.py +5 -0
- uv_secure-0.1.0/src/uv_secure/__version__.py +1 -0
- uv_secure-0.1.0/src/uv_secure/py.typed +0 -0
- uv_secure-0.1.0/src/uv_secure/run.py +204 -0
- uv_secure-0.1.0/tests/smoke_test.py +10 -0
- uv_secure-0.1.0/tests/uv_secure/conftest.py +0 -0
- uv_secure-0.1.0/tests/uv_secure/test_run.py +98 -0
- uv_secure-0.1.0/uv.lock +2301 -0
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
name: Pre-commit checks
|
|
2
|
+
on:
|
|
3
|
+
pull_request:
|
|
4
|
+
jobs:
|
|
5
|
+
pre-commit:
|
|
6
|
+
runs-on: ubuntu-latest
|
|
7
|
+
steps:
|
|
8
|
+
- name: Checkout repository
|
|
9
|
+
uses: actions/checkout@v4
|
|
10
|
+
- name: Install uv
|
|
11
|
+
uses: astral-sh/setup-uv@v4
|
|
12
|
+
- name: Install pre-commit globally
|
|
13
|
+
run: uv tool install pre-commit --with pre-commit-uv --force
|
|
14
|
+
- name: Run pre-commit hooks
|
|
15
|
+
env:
|
|
16
|
+
SKIP: no-commit-to-branch # Skip the main branch protection hook in CI
|
|
17
|
+
run: pre-commit run --all-files
|
|
@@ -0,0 +1,75 @@
|
|
|
1
|
+
name: Pytest
|
|
2
|
+
on:
|
|
3
|
+
pull_request:
|
|
4
|
+
jobs:
|
|
5
|
+
pytest:
|
|
6
|
+
runs-on: ubuntu-latest
|
|
7
|
+
permissions:
|
|
8
|
+
contents: read
|
|
9
|
+
pull-requests: write
|
|
10
|
+
steps:
|
|
11
|
+
- name: Checkout repository
|
|
12
|
+
uses: actions/checkout@v4
|
|
13
|
+
- name: Install uv
|
|
14
|
+
uses: astral-sh/setup-uv@v4
|
|
15
|
+
with:
|
|
16
|
+
enable-cache: true
|
|
17
|
+
cache-dependency-glob: "uv.lock"
|
|
18
|
+
- name: Set up Python
|
|
19
|
+
uses: actions/setup-python@v5
|
|
20
|
+
with:
|
|
21
|
+
python-version-file: ".python-version"
|
|
22
|
+
- name: Install the project
|
|
23
|
+
run: uv sync --all-extras --dev
|
|
24
|
+
- name: Run tests with Coverage
|
|
25
|
+
run: uv run pytest tests --cov=. --cov-report=term > coverage_summary.txt
|
|
26
|
+
- name: Prepare Comment Body
|
|
27
|
+
run: |
|
|
28
|
+
echo '### Coverage Report' >> comment_body.md
|
|
29
|
+
echo '```txt' >> comment_body.md
|
|
30
|
+
cat coverage_summary.txt >> comment_body.md
|
|
31
|
+
echo '' >> comment_body.md
|
|
32
|
+
echo '```' >> comment_body.md
|
|
33
|
+
- name: Find Coverage Report Comment
|
|
34
|
+
id: find-comment
|
|
35
|
+
uses: peter-evans/find-comment@v3
|
|
36
|
+
with:
|
|
37
|
+
issue-number: ${{ github.event.pull_request.number }}
|
|
38
|
+
comment-author: github-actions[bot]
|
|
39
|
+
body-includes: '### Coverage Report'
|
|
40
|
+
- name: Create or Update Coverage Comment
|
|
41
|
+
uses: peter-evans/create-or-update-comment@v4
|
|
42
|
+
with:
|
|
43
|
+
token: ${{ secrets.GITHUB_TOKEN }}
|
|
44
|
+
issue-number: ${{ github.event.pull_request.number }}
|
|
45
|
+
body-path: comment_body.md
|
|
46
|
+
comment-id: ${{ steps.find-comment.outputs.comment-id }}
|
|
47
|
+
edit-mode: replace
|
|
48
|
+
pytest-additional-versions:
|
|
49
|
+
runs-on: ubuntu-latest
|
|
50
|
+
strategy:
|
|
51
|
+
matrix:
|
|
52
|
+
python-version:
|
|
53
|
+
- "3.10"
|
|
54
|
+
- "3.11"
|
|
55
|
+
- "3.12"
|
|
56
|
+
- "3.13"
|
|
57
|
+
permissions:
|
|
58
|
+
contents: read
|
|
59
|
+
pull-requests: write
|
|
60
|
+
steps:
|
|
61
|
+
- name: Checkout repository
|
|
62
|
+
uses: actions/checkout@v4
|
|
63
|
+
- name: Install uv
|
|
64
|
+
uses: astral-sh/setup-uv@v4
|
|
65
|
+
with:
|
|
66
|
+
enable-cache: true
|
|
67
|
+
cache-dependency-glob: "uv.lock"
|
|
68
|
+
- name: Set up Python
|
|
69
|
+
uses: actions/setup-python@v5
|
|
70
|
+
with:
|
|
71
|
+
python-version: ${{ matrix.python-version }}
|
|
72
|
+
- name: Install the project
|
|
73
|
+
run: uv sync --all-extras --dev
|
|
74
|
+
- name: Run tests
|
|
75
|
+
run: uv run pytest tests
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
name: Release
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
tags:
|
|
6
|
+
# Publish on any tag that looks like a semantic version e.g. 1.2.3
|
|
7
|
+
- '*.*.*'
|
|
8
|
+
|
|
9
|
+
jobs:
|
|
10
|
+
pypi:
|
|
11
|
+
name: Publish to PyPI
|
|
12
|
+
runs-on: ubuntu-latest
|
|
13
|
+
environment:
|
|
14
|
+
name: release
|
|
15
|
+
permissions:
|
|
16
|
+
id-token: write
|
|
17
|
+
steps:
|
|
18
|
+
- uses: actions/checkout@v4
|
|
19
|
+
- uses: astral-sh/setup-uv@v4
|
|
20
|
+
- run: uv build
|
|
21
|
+
- name: Smoke test (wheel)
|
|
22
|
+
run: uv run --isolated --no-project -p 3.9 --with dist/*.whl tests/smoke_test.py
|
|
23
|
+
- name: Smoke test (source distribution)
|
|
24
|
+
run: uv run --isolated --no-project -p 3.9 --with dist/*.tar.gz tests/smoke_test.py
|
|
25
|
+
- run: uv publish --trusted-publishing always
|
|
@@ -0,0 +1,167 @@
|
|
|
1
|
+
# Byte-compiled / optimized / DLL files
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[cod]
|
|
4
|
+
*$py.class
|
|
5
|
+
|
|
6
|
+
# C extensions
|
|
7
|
+
*.so
|
|
8
|
+
|
|
9
|
+
# Distribution / packaging
|
|
10
|
+
.Python
|
|
11
|
+
build/
|
|
12
|
+
develop-eggs/
|
|
13
|
+
dist/
|
|
14
|
+
downloads/
|
|
15
|
+
eggs/
|
|
16
|
+
.eggs/
|
|
17
|
+
lib/
|
|
18
|
+
lib64/
|
|
19
|
+
parts/
|
|
20
|
+
sdist/
|
|
21
|
+
var/
|
|
22
|
+
wheels/
|
|
23
|
+
share/python-wheels/
|
|
24
|
+
*.egg-info/
|
|
25
|
+
.installed.cfg
|
|
26
|
+
*.egg
|
|
27
|
+
MANIFEST
|
|
28
|
+
|
|
29
|
+
# PyInstaller
|
|
30
|
+
# Usually these files are written by a python script from a template
|
|
31
|
+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
|
32
|
+
*.manifest
|
|
33
|
+
*.spec
|
|
34
|
+
|
|
35
|
+
# Installer logs
|
|
36
|
+
pip-log.txt
|
|
37
|
+
pip-delete-this-directory.txt
|
|
38
|
+
|
|
39
|
+
# Unit test / coverage reports
|
|
40
|
+
htmlcov/
|
|
41
|
+
.tox/
|
|
42
|
+
.nox/
|
|
43
|
+
.coverage
|
|
44
|
+
.coverage.*
|
|
45
|
+
.cache
|
|
46
|
+
nosetests.xml
|
|
47
|
+
coverage.xml
|
|
48
|
+
*.cover
|
|
49
|
+
*.py,cover
|
|
50
|
+
.hypothesis/
|
|
51
|
+
.pytest_cache/
|
|
52
|
+
cover/
|
|
53
|
+
|
|
54
|
+
# Translations
|
|
55
|
+
*.mo
|
|
56
|
+
*.pot
|
|
57
|
+
|
|
58
|
+
# Django stuff:
|
|
59
|
+
*.log
|
|
60
|
+
local_settings.py
|
|
61
|
+
db.sqlite3
|
|
62
|
+
db.sqlite3-journal
|
|
63
|
+
|
|
64
|
+
# Flask stuff:
|
|
65
|
+
instance/
|
|
66
|
+
.webassets-cache
|
|
67
|
+
|
|
68
|
+
# Scrapy stuff:
|
|
69
|
+
.scrapy
|
|
70
|
+
|
|
71
|
+
# Sphinx documentation
|
|
72
|
+
docs/_build/
|
|
73
|
+
|
|
74
|
+
# PyBuilder
|
|
75
|
+
.pybuilder/
|
|
76
|
+
target/
|
|
77
|
+
|
|
78
|
+
# Jupyter Notebook
|
|
79
|
+
.jupyter/
|
|
80
|
+
.ipynb_checkpoints/
|
|
81
|
+
*.ipynb
|
|
82
|
+
|
|
83
|
+
# IPython
|
|
84
|
+
profile_default/
|
|
85
|
+
ipython_config.py
|
|
86
|
+
|
|
87
|
+
# pyenv
|
|
88
|
+
# For a library or package, you might want to ignore these files since the code is
|
|
89
|
+
# intended to run in multiple environments; otherwise, check them in:
|
|
90
|
+
# .python-version
|
|
91
|
+
|
|
92
|
+
# pipenv
|
|
93
|
+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
|
|
94
|
+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
|
|
95
|
+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
|
|
96
|
+
# install all needed dependencies.
|
|
97
|
+
#Pipfile.lock
|
|
98
|
+
|
|
99
|
+
# poetry
|
|
100
|
+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
|
|
101
|
+
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
|
102
|
+
# commonly ignored for libraries.
|
|
103
|
+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
|
|
104
|
+
#poetry.lock
|
|
105
|
+
|
|
106
|
+
# pdm
|
|
107
|
+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
|
|
108
|
+
#pdm.lock
|
|
109
|
+
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
|
|
110
|
+
# in version control.
|
|
111
|
+
# https://pdm.fming.dev/latest/usage/project/#working-with-version-control
|
|
112
|
+
.pdm.toml
|
|
113
|
+
.pdm-python
|
|
114
|
+
.pdm-build/
|
|
115
|
+
|
|
116
|
+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
|
|
117
|
+
__pypackages__/
|
|
118
|
+
|
|
119
|
+
# Celery stuff
|
|
120
|
+
celerybeat-schedule
|
|
121
|
+
celerybeat.pid
|
|
122
|
+
|
|
123
|
+
# SageMath parsed files
|
|
124
|
+
*.sage.py
|
|
125
|
+
|
|
126
|
+
# Environments
|
|
127
|
+
.env
|
|
128
|
+
.venv
|
|
129
|
+
env/
|
|
130
|
+
venv/
|
|
131
|
+
ENV/
|
|
132
|
+
env.bak/
|
|
133
|
+
venv.bak/
|
|
134
|
+
|
|
135
|
+
# Spyder project settings
|
|
136
|
+
.spyderproject
|
|
137
|
+
.spyproject
|
|
138
|
+
|
|
139
|
+
# Rope project settings
|
|
140
|
+
.ropeproject
|
|
141
|
+
|
|
142
|
+
# mkdocs documentation
|
|
143
|
+
/site
|
|
144
|
+
|
|
145
|
+
# mypy
|
|
146
|
+
.mypy_cache/
|
|
147
|
+
.dmypy.json
|
|
148
|
+
dmypy.json
|
|
149
|
+
|
|
150
|
+
# Pyre type checker
|
|
151
|
+
.pyre/
|
|
152
|
+
|
|
153
|
+
# pytype static type analyzer
|
|
154
|
+
.pytype/
|
|
155
|
+
|
|
156
|
+
# Cython debug symbols
|
|
157
|
+
cython_debug/
|
|
158
|
+
|
|
159
|
+
# PyCharm
|
|
160
|
+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
|
|
161
|
+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
|
|
162
|
+
# and can be added to the global gitignore or merged into this file. For a more nuclear
|
|
163
|
+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
|
|
164
|
+
.idea/
|
|
165
|
+
|
|
166
|
+
# VS Code
|
|
167
|
+
.code/
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
# See rule descriptions here:
|
|
2
|
+
# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
|
|
3
|
+
# See yaml schema here:
|
|
4
|
+
# https://github.com/DavidAnson/markdownlint/blob/main/schema/.markdownlint.yaml
|
|
5
|
+
|
|
6
|
+
default: true
|
|
7
|
+
|
|
8
|
+
MD013:
|
|
9
|
+
line_length: 88
|
|
10
|
+
heading_line_length: 88
|
|
11
|
+
code_block_line_length: 88
|
|
12
|
+
code_blocks: true
|
|
13
|
+
tables: true
|
|
14
|
+
headings: true
|
|
15
|
+
strict: false
|
|
16
|
+
stern: false
|
|
17
|
+
|
|
18
|
+
MD035:
|
|
19
|
+
style: "---"
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
# See https://pre-commit.com for more information
|
|
2
|
+
# See https://pre-commit.com/hooks.html for more hooks
|
|
3
|
+
repos:
|
|
4
|
+
- repo: https://github.com/kynan/nbstripout
|
|
5
|
+
rev: 0.8.1
|
|
6
|
+
hooks:
|
|
7
|
+
- id: nbstripout
|
|
8
|
+
args: [--drop-empty-cells]
|
|
9
|
+
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
10
|
+
rev: v5.0.0
|
|
11
|
+
hooks:
|
|
12
|
+
- id: trailing-whitespace
|
|
13
|
+
- id: end-of-file-fixer
|
|
14
|
+
- id: check-toml
|
|
15
|
+
- id: check-xml
|
|
16
|
+
- id: check-yaml
|
|
17
|
+
- id: check-added-large-files
|
|
18
|
+
- id: no-commit-to-branch
|
|
19
|
+
- id: pretty-format-json
|
|
20
|
+
args: [--autofix]
|
|
21
|
+
exclude: '\.ipynb$'
|
|
22
|
+
- id: mixed-line-ending
|
|
23
|
+
args: [--fix=lf]
|
|
24
|
+
- repo: https://github.com/PyCQA/bandit
|
|
25
|
+
rev: 1.8.0
|
|
26
|
+
hooks:
|
|
27
|
+
- id: bandit
|
|
28
|
+
args: [ "-c", "pyproject.toml" ]
|
|
29
|
+
additional_dependencies: [ "bandit[toml]" ]
|
|
30
|
+
- repo: https://github.com/igorshubovych/markdownlint-cli
|
|
31
|
+
rev: v0.43.0
|
|
32
|
+
hooks:
|
|
33
|
+
- id: markdownlint
|
|
34
|
+
args: [--fix]
|
|
35
|
+
- repo: https://github.com/pre-commit/mirrors-mypy
|
|
36
|
+
rev: v1.13.0
|
|
37
|
+
hooks:
|
|
38
|
+
- id: mypy
|
|
39
|
+
additional_dependencies:
|
|
40
|
+
- pydantic
|
|
41
|
+
- repo: https://github.com/charliermarsh/ruff-pre-commit
|
|
42
|
+
rev: v0.8.4
|
|
43
|
+
hooks:
|
|
44
|
+
- id: ruff-format
|
|
45
|
+
types_or: [python, pyi, jupyter]
|
|
46
|
+
- id: ruff
|
|
47
|
+
args: [--fix, --exit-non-zero-on-fix]
|
|
48
|
+
types_or: [python, pyi, jupyter]
|
|
49
|
+
- repo: https://github.com/crate-ci/typos
|
|
50
|
+
rev: v1.28.4
|
|
51
|
+
hooks:
|
|
52
|
+
- id: typos
|
|
53
|
+
args: [
|
|
54
|
+
--force-exclude,
|
|
55
|
+
# --write-changes (Don't use this to stop typos making auto-corrections)
|
|
56
|
+
]
|
|
57
|
+
- repo: https://github.com/adrienverge/yamllint.git
|
|
58
|
+
rev: v1.35.1
|
|
59
|
+
hooks:
|
|
60
|
+
- id: yamllint
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
3.9
|
uv_secure-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2024 Owen Lamont
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
uv_secure-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: uv-secure
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Scan your uv.lock file for dependencies with known vulnerabilities
|
|
5
|
+
Project-URL: Repository, https://github.com/owenlamont/uv-secure
|
|
6
|
+
Project-URL: Releases, https://github.com/owenlamont/uv-secure/releases
|
|
7
|
+
Author-email: Owen Lamont <owenrlamont@gmail.com>
|
|
8
|
+
License-File: LICENSE
|
|
9
|
+
Keywords: uv,uv.lock,vulnerabilities
|
|
10
|
+
Classifier: Development Status :: 3 - Alpha
|
|
11
|
+
Classifier: Environment :: Console
|
|
12
|
+
Classifier: Intended Audience :: Developers
|
|
13
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
14
|
+
Classifier: Natural Language :: English
|
|
15
|
+
Classifier: Operating System :: OS Independent
|
|
16
|
+
Classifier: Programming Language :: Python
|
|
17
|
+
Classifier: Programming Language :: Python :: 3 :: Only
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
23
|
+
Classifier: Topic :: Software Development :: Libraries
|
|
24
|
+
Classifier: Topic :: Software Development :: Quality Assurance
|
|
25
|
+
Classifier: Topic :: Software Development :: Testing
|
|
26
|
+
Requires-Python: >=3.9
|
|
27
|
+
Requires-Dist: httpx>=0.28.1
|
|
28
|
+
Requires-Dist: inflect>=7.4.0
|
|
29
|
+
Requires-Dist: pydantic>=2.10.3
|
|
30
|
+
Requires-Dist: rich>=13.9.4
|
|
31
|
+
Requires-Dist: tomli; python_version < '3.11'
|
|
32
|
+
Requires-Dist: typer>=0.15.1
|
|
33
|
+
Provides-Extra: jupyter
|
|
34
|
+
Requires-Dist: ipywidgets>=8.1.5; extra == 'jupyter'
|
|
35
|
+
Requires-Dist: jupyterlab-code-formatter>=3.0.2; extra == 'jupyter'
|
|
36
|
+
Requires-Dist: jupyterlab>=4.2.5; extra == 'jupyter'
|
|
37
|
+
Requires-Dist: lckr-jupyterlab-variableinspector>=3.2.4; extra == 'jupyter'
|
|
38
|
+
Requires-Dist: nbdime>=4.0.2; extra == 'jupyter'
|
|
39
|
+
Requires-Dist: nbstripout>=0.7.1; extra == 'jupyter'
|
|
40
|
+
Requires-Dist: notebook>=7.2.2; extra == 'jupyter'
|
|
41
|
+
Requires-Dist: ruff>=0.6.4; extra == 'jupyter'
|
|
42
|
+
Requires-Dist: tqdm>=4.66.6; extra == 'jupyter'
|
|
43
|
+
Description-Content-Type: text/markdown
|
|
44
|
+
|
|
45
|
+
# uv-secure
|
|
46
|
+
|
|
47
|
+
Scan your uv.lock file for dependencies with known vulnerabilities
|
|
48
|
+
|
|
49
|
+
## Usage
|
|
50
|
+
|
|
51
|
+
After installation you can run uv-secure --help to see the options.
|
|
52
|
+
|
|
53
|
+
```text
|
|
54
|
+
>> uv-secure --help
|
|
55
|
+
|
|
56
|
+
Usage: uv-secure [OPTIONS]
|
|
57
|
+
|
|
58
|
+
Parse a uv.lock file, check vulnerabilities, and display summary.
|
|
59
|
+
|
|
60
|
+
╭─ Options ────────────────────────────────────────────────────────────────────────────╮
|
|
61
|
+
│ --uv-lock-path -p PATH Path to the uv.lock file [default: uv.lock] │
|
|
62
|
+
│ --ignore -i TEXT Comma-separated list of vulnerability IDs to │
|
|
63
|
+
│ ignore, e.g. VULN-123,VULN-456 │
|
|
64
|
+
│ --version Show the application's version │
|
|
65
|
+
│ --install-completion Install completion for the current shell. │
|
|
66
|
+
│ --show-completion Show completion for the current shell, to copy │
|
|
67
|
+
│ it or customize the installation. │
|
|
68
|
+
│ --help Show this message and exit. │
|
|
69
|
+
╰──────────────────────────────────────────────────────────────────────────────────────╯
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
By default if run with no options uv-secure will look for a uv.lock file in the current
|
|
73
|
+
working directory and scan that for known vulnerabilities. E.g.
|
|
74
|
+
|
|
75
|
+
```text
|
|
76
|
+
>> uv-secure
|
|
77
|
+
Checking dependencies for vulnerabilities...
|
|
78
|
+
╭──────────────────────────────────╮
|
|
79
|
+
│ No vulnerabilities detected! │
|
|
80
|
+
│ Checked: 160 dependencies │
|
|
81
|
+
│ All dependencies appear safe! 🎉 │
|
|
82
|
+
╰──────────────────────────────────╯
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
## Related Work and Motivation
|
|
86
|
+
|
|
87
|
+
I created this package as I wanted a dependency vulnerability scanner but I wasn't
|
|
88
|
+
completely happy with the options that seemed available. I use
|
|
89
|
+
[uv](https://docs.astral.sh/uv/) and wanted something that works with uv.lock files but
|
|
90
|
+
neither of the main package options I found fitted my requirements:
|
|
91
|
+
|
|
92
|
+
- [pip-audit](https://pypi.org/project/pip-audit/) only works with requirements.txt
|
|
93
|
+
files but even if you convert a uv.lock file to a requirements.txt file, pip-audit
|
|
94
|
+
wants to create a whole virtual environment to check all transitive dependencies (but
|
|
95
|
+
that should be completely unnecessary when the lock file already contains the full
|
|
96
|
+
dependencies).
|
|
97
|
+
- [safety](https://pypi.org/project/safety/) also doesn't work with uv.lock file out of
|
|
98
|
+
the box, it does apparently work statically without needing to build a virtual
|
|
99
|
+
environment but it does require you to create an account on the
|
|
100
|
+
[safety site](https://platform.safetycli.com/). They have some limited free account
|
|
101
|
+
but require a paid account to use seriously. If you already have a safety account
|
|
102
|
+
though there is a [uv-audit](https://pypi.org/project/uv-audit/) package that wraps
|
|
103
|
+
safety to support scanning uv.lock files.
|
|
104
|
+
- [Python Security PyCharm Plugin](https://plugins.jetbrains.com/plugin/13609-python-security)
|
|
105
|
+
Lastly I was inspired by Anthony Shaw's Python Security plugin - which does CVE
|
|
106
|
+
dependency scanning within PyCharm.
|
|
107
|
+
|
|
108
|
+
I build uv-secure because I wanted a CLI tool I could run with pre-commit. Statically
|
|
109
|
+
analyse the uv.lock file without needing to create a virtual environment, and finally
|
|
110
|
+
doesn't require you to create (and pay for) an account with any service.
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
# uv-secure
|
|
2
|
+
|
|
3
|
+
Scan your uv.lock file for dependencies with known vulnerabilities
|
|
4
|
+
|
|
5
|
+
## Usage
|
|
6
|
+
|
|
7
|
+
After installation you can run uv-secure --help to see the options.
|
|
8
|
+
|
|
9
|
+
```text
|
|
10
|
+
>> uv-secure --help
|
|
11
|
+
|
|
12
|
+
Usage: uv-secure [OPTIONS]
|
|
13
|
+
|
|
14
|
+
Parse a uv.lock file, check vulnerabilities, and display summary.
|
|
15
|
+
|
|
16
|
+
╭─ Options ────────────────────────────────────────────────────────────────────────────╮
|
|
17
|
+
│ --uv-lock-path -p PATH Path to the uv.lock file [default: uv.lock] │
|
|
18
|
+
│ --ignore -i TEXT Comma-separated list of vulnerability IDs to │
|
|
19
|
+
│ ignore, e.g. VULN-123,VULN-456 │
|
|
20
|
+
│ --version Show the application's version │
|
|
21
|
+
│ --install-completion Install completion for the current shell. │
|
|
22
|
+
│ --show-completion Show completion for the current shell, to copy │
|
|
23
|
+
│ it or customize the installation. │
|
|
24
|
+
│ --help Show this message and exit. │
|
|
25
|
+
╰──────────────────────────────────────────────────────────────────────────────────────╯
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
By default if run with no options uv-secure will look for a uv.lock file in the current
|
|
29
|
+
working directory and scan that for known vulnerabilities. E.g.
|
|
30
|
+
|
|
31
|
+
```text
|
|
32
|
+
>> uv-secure
|
|
33
|
+
Checking dependencies for vulnerabilities...
|
|
34
|
+
╭──────────────────────────────────╮
|
|
35
|
+
│ No vulnerabilities detected! │
|
|
36
|
+
│ Checked: 160 dependencies │
|
|
37
|
+
│ All dependencies appear safe! 🎉 │
|
|
38
|
+
╰──────────────────────────────────╯
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
## Related Work and Motivation
|
|
42
|
+
|
|
43
|
+
I created this package as I wanted a dependency vulnerability scanner but I wasn't
|
|
44
|
+
completely happy with the options that seemed available. I use
|
|
45
|
+
[uv](https://docs.astral.sh/uv/) and wanted something that works with uv.lock files but
|
|
46
|
+
neither of the main package options I found fitted my requirements:
|
|
47
|
+
|
|
48
|
+
- [pip-audit](https://pypi.org/project/pip-audit/) only works with requirements.txt
|
|
49
|
+
files but even if you convert a uv.lock file to a requirements.txt file, pip-audit
|
|
50
|
+
wants to create a whole virtual environment to check all transitive dependencies (but
|
|
51
|
+
that should be completely unnecessary when the lock file already contains the full
|
|
52
|
+
dependencies).
|
|
53
|
+
- [safety](https://pypi.org/project/safety/) also doesn't work with uv.lock file out of
|
|
54
|
+
the box, it does apparently work statically without needing to build a virtual
|
|
55
|
+
environment but it does require you to create an account on the
|
|
56
|
+
[safety site](https://platform.safetycli.com/). They have some limited free account
|
|
57
|
+
but require a paid account to use seriously. If you already have a safety account
|
|
58
|
+
though there is a [uv-audit](https://pypi.org/project/uv-audit/) package that wraps
|
|
59
|
+
safety to support scanning uv.lock files.
|
|
60
|
+
- [Python Security PyCharm Plugin](https://plugins.jetbrains.com/plugin/13609-python-security)
|
|
61
|
+
Lastly I was inspired by Anthony Shaw's Python Security plugin - which does CVE
|
|
62
|
+
dependency scanning within PyCharm.
|
|
63
|
+
|
|
64
|
+
I build uv-secure because I wanted a CLI tool I could run with pre-commit. Statically
|
|
65
|
+
analyse the uv.lock file without needing to create a virtual environment, and finally
|
|
66
|
+
doesn't require you to create (and pay for) an account with any service.
|