Skip to content

Use uv audit for local deps-audit #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tsvikas merged 2 commits into from
May 15, 2026
Merged

Use uv audit for local deps-audit #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b56fcc
feat: audit with uv
tsvikas May 15, 2026
c070e44
chore: bump minimum uv version to 0.10.12 for `uv audit`
tsvikas May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/uv-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
strategy:
fail-fast: false
matrix:
uv-version: ["0.9.17", "latest"]
uv-version: ["0.10.12", "latest"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ A modern Python project template using recommended development tools and best pr

## TL;DR

Assuming that you have `uv` installed (version `>=0.9.17`)
Assuming that you have `uv` installed (version `>=0.10.12`)

1. `uvx copier copy gh:tsvikas/python-template path/to/project/directory/`

Expand Down
5 changes: 1 addition & 4 deletions project_name/justfile.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,7 @@ deps-update: && deps-list-outdated

# Audit dependencies
deps-audit:
uv run --exact --all-extras --all-groups --with pip-audit -- \
pip-audit \
--skip-editable
uv run --exact true
uv audit --locked
Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: Consider behavior when no lockfile is present for uv audit --locked.

uv audit --locked will fail if no lockfile exists, whereas pip-audit worked directly against the environment. If this is meant to run before a lock is created (or in repos that deliberately avoid locks), consider either (a) guarding and skipping/falling back when no lockfile is present, or (b) explicitly requiring uv lock to be run before deps-audit.



### code quality ###
Expand Down
2 changes: 1 addition & 1 deletion project_name/pyproject.toml.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ typing = [


[tool.uv]
required-version = ">=0.9.17"
required-version = ">=0.10.12"
default-groups = ["dev", "test", "typing"]
# Minimum age guard: only consider package versions released at least 24h ago,
# as a lightweight supply-chain defense against just-published malicious releases.
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ dev = [
]

[tool.uv]
required-version = ">=0.9.17"
required-version = ">=0.10.12"
# Minimum age guard: only consider package versions released at least 24h ago,
# as a lightweight supply-chain defense against just-published malicious releases.
exclude-newer = "24 hours"
Loading