Skip to content

uv audit #770

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AdrianSosic wants to merge 1 commit into
base: main
Choose a base branch
from
Open

uv audit #770

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ jobs:
id: setup-python
with:
python-version: ${{ matrix.py-version.semantic }}
- name: Run pip-audit
- name: Run uv audit
run: |
pip install tox-uv
tox -e audit-${{ matrix.py-version.tox }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/regular.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ jobs:
id: setup-python
with:
python-version: ${{ matrix.py-version.semantic }}
- name: Run pip-audit
- name: Run uv audit
run: |
pip install tox-uv
tox -e audit-${{ matrix.py-version.tox }}
Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ If you have questions or problems, simply ask for advice.
| [pytest](https://docs.pytest.org/) | testing |
| [pytest-cov](https://pytest-cov.readthedocs.io/) | measuring test coverage |
| [sphinx](https://www.sphinx-doc.org/) | generating our documentation |
| [pip-audit](https://github.com/pypa/pip-audit) | detecting vulnerabilities in dependencies |
| [uv audit](https://docs.astral.sh/uv/reference/cli/#uv-audit) | detecting vulnerabilities in dependencies |
| [tox](https://tox.wiki/) | orchestrating all the above |

Executing a specific one of these tools is easiest by using the corresponding
Expand Down
5 changes: 2 additions & 3 deletions pyproject.toml
View file
Open in desktop
Copy link
Copy Markdown
Collaborator Author

@AdrianSosic AdrianSosic Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AdrianSosic @Scienfitz does a tool replacement deserve a CHANGELOG entry? Imo it would

I'd say no because not user-facing, but I'll let @Scienfitz tip the scales

Copy link
Copy Markdown
Collaborator

@Scienfitz Scienfitz Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dont want to tip the scale because on the one hand I agree this is not userfacing and theres no strict requirement to mention it, on the other hand it doesnt really hurt

Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ Issues = "https://github.com/emdgroup/baybe/issues/"

# AUDIT NOTE: The marked packages are secondary dependencies but their versions are
# set explicitly because the otherwise installed default versions have been flagged
# for vulnerabilities by pip-audit
# for vulnerabilities by uv audit

[project.optional-dependencies]
extras = [
Expand Down Expand Up @@ -86,10 +86,9 @@ dev = [
"baybe[mypy]",
"baybe[test]",
"baybe[benchmarking]",
"pip-audit>=2.5.5",
"setuptools-scm>=7.1.0",
"tox-uv>=1.7.0",
"uv>=0.9.25",
"uv>=0.11.2",
]

insights = [
Expand Down
17 changes: 5 additions & 12 deletions tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,25 +66,18 @@ commands =
mypy

[testenv:audit,audit-py{310,311,312,313}]
description = Run pip-audit
extras = dev # audit entire environment
setenv =
# Add pip-audit exceptions here, like:
# EXCLUDES=--ignore-vuln EXCEPTION_ID1 --ignore-vuln EXCEPTION_ID2 ...
description = Run uv audit
extras = dev # audit entire environment
commands =
python --version
pip-audit {env:EXCLUDES:}
uv audit
Copy link
Copy Markdown
Collaborator

@Scienfitz Scienfitz Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the excludes functionality was handy int he past, do you really have to remove it?

Copy link
Copy Markdown
Collaborator Author

@AdrianSosic AdrianSosic Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does not exist yet but has been merged into uv main 4 days ago, so will be available in the next couple of days. Let's just wait until it's there 👍🏼

astral-sh/uv#18737


# This is separated from the other audit block because in 3.14 only core deps are tested
[testenv:audit-py314]
description = Run pip-audit
deps = pip-audit
setenv =
# Add pip-audit exceptions here, like:
# EXCLUDES=--ignore-vuln EXCEPTION_ID1 --ignore-vuln EXCEPTION_ID2 ...
description = Run uv audit
commands =
python --version
pip-audit {env:EXCLUDES:}
uv audit

[testenv:docs-py310]
description = Build documentation, passing posargs to control what should be built
Expand Down
Loading
Loading