Towards a `pip audit` subcommand for vulnerability analysis & management

[pradyunsg (Pradyun Gedam)]

@dustin

Do you think support for known vulnerability auditing something that would be valuable to have in pip?

I think so!

@dustin

Does the feature set of pip-audit align with what you’d find valuable?

I’m not the right person to ask – but yes, I think this looks like the correct set of features.

@dustin

We’ve designed pip-audit itself in a way that should make it possible to mount it as a vendored subcommand of pip, rather than re-implementing it from scratch. This means that it should be a low maintenance burden on the pip maintainers, as ongoing development & maintenance could continue to happen in the pip-audit repository by pip-audit maintainers (with pip maintainers getting the final say in what makes it into pip itself, of course).

TBH, I’m not too keen on this development model. I’d much rather that pip-audit’s code move into pip as pip audit, and then evolve like any other pip command beyond that point.

FWIW, I’d be happy to trust one or more of pip-audit’s maintainers with the commit bit on pip, to help with continued maintainance of this (and other pieces, if they have the bandwidth/interest) of pip.