Lightweight Python dependency vulnerability scanner. Reads a requirements.txt and queries the OSV.dev database for known vulnerabilities, returning structured Finding records or formatted CLI output.
pip install dep-auditRequires Python 3.10+. Uses requests for OSV transport (pluggable via the fetcher argument for testing).
dep-audit requirements.txtExits non-zero if any findings are present.
from dep_audit import scan_requirements
findings = scan_requirements([
"requests==2.20.0",
"django==2.2.0",
])
for f in findings:
print(f.package, f.version, f.vuln_id, f.summary)Scan an iterable of requirement lines. Only name==version pinned forms are scanned. The optional fetcher lets you stub out the OSV API for tests.
Frozen dataclass: package, version, vuln_id, summary, severity.
Raised on transport or input errors.
MIT