pip-audit

pip-audit -r requirements.txt

Analyze Python dependencies with pip-audit, detecting known vulnerabilities in installed or declared packages.

Run it in the pipeline of Python projects when you want dependency analysis: pip-audit queries the vulnerability database (PyPI/OSV) with the installed packages (or those from requirements) and reports findings — packages with CVEs, severity, and fix version. It's the reference Python SCA (from PyPA): the pipeline check with the ecosystem's format. In Python DevSecOps, pip-audit is the pipeline gate: a high-severity finding blocks the merge, and the fix is applied (the package update).

Don't use it as a complete analysis: pip-audit covers CVEs from the database (OSV/PyPI) — code vulnerabilities (SAST, 002) are out of scope. The database updates: new CVEs require re-scanning (and updating pip-audit's database). And note: pip-audit detects by package version — transitive dependencies are included (with the tree); false positives from reachability are triaged. For commercial coverage, Snyk (019); pip-audit is the open-source Python SCA.