Freedom251 › Software Composition Analysis Software
pip-audit
What pip-audit is
pip-audit is a free, open-source Linux tool for checking Python environments, requirements files and dependency trees against known security vulnerabilities. It can use PyPI or OSV advisory services and report results as columns, Markdown, JSON, or CycloneDX JSON and XML. CycloneDX output can provide a software bill of materials. The --fix option can automatically upgrade dependencies identified as vulnerable. The project offers an official GitHub Action and pre-commit support, and can be installed with pip or conda-forge. Python 3.10 or newer is required, and the Apache 2.0 license permits self-hosted deployment. Supported inputs include Python packages, pip, requirements files, pyproject.toml and pylock.*.toml. Its scope is dependency analysis rather than source-code review, and it does not claim to defend against malicious packages. Reports may be noisy, shared-library vulnerabilities may escape detection, and Pipfile or Pipfile.lock files require conversion to a supported requirements file.
Who it suits
It suits Python developers and teams that need vulnerability checks for dependencies, requirements or environments. GitHub Action and pre-commit support fit automated development workflows.
What it does well
- Free and open-source
- Checks PyPI or OSV vulnerability services
- Automatic fixes available with --fix
- CycloneDX SBOM output
- Official GitHub Action and pre-commit support
What to know first
- Does not analyze source code
- Does not claim protection from malicious packages
- Pipfile and Pipfile.lock require conversion
- Vulnerability feeds may produce noisy reports
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| pip-audit | Open-source Python vulnerability auditing tool | Free |
As github.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
pip-audit provides dependency-focused vulnerability auditing with multiple report formats and optional automatic upgrades. Treat its results as dependency checks, not a complete source-code or malicious-package defense.
Facts from pip-audit's own pages
- Advisory sources
- It can check vulnerabilities using PyPI or OSV services. · github.com, 11 Oct 2026
- Automatic fixes
- The --fix option can automatically upgrade vulnerable dependencies. · github.com, 11 Oct 2026
- Input limitations
- It does not process Pipfile or Pipfile.lock directly; the project suggests converting them to a supported requirements file. · github.com, 11 Oct 2026
- Installation
- The project says pip-audit requires Python 3.10 or newer and can be installed with pip; it also lists conda-forge as an installation option. · github.com, 11 Oct 2026
- Integrations
- The project provides an official GitHub Action and supports pre-commit. · github.com, 11 Oct 2026
- License
- pip-audit is licensed under Apache 2.0. · github.com, 11 Oct 2026
- Output formats
- Audit results can be emitted as columns, Markdown, JSON, CycloneDX JSON, or CycloneDX XML. · github.com, 11 Oct 2026
- Private indexes
- Interactive authentication to third-party package indexes is unsupported; pip keyring authentication is supported with limitations. · github.com, 11 Oct 2026
- Purpose
- Audits Python environments, requirements files, and dependency trees for known security vulnerabilities. · github.com, 11 Oct 2026
- SBOM output
- It can emit CycloneDX SBOMs in XML or JSON. · github.com, 11 Oct 2026
- Security scope
- It analyzes dependency trees, not source code, and does not claim to defend against malicious packages. · github.com, 11 Oct 2026
- Vulnerability limitations
- The project cautions that vulnerability feeds may contain noisy reports and that vulnerabilities in shared libraries may not be detected. · github.com, 11 Oct 2026