Towards a `pip audit` subcommand for vulnerability analysis & management

[dustin (Dustin Ingram)]

@EWDurbin

However, I’m also now wondering if exposing that information via a separate API from the simple index is optimal. If PyPI knows about a vulnerability on a release, what’s keeping us from adding that as part of the Simple API spec via an attribute like requires-python. This can then trivially be part of 691 as well.

Yep! This is the “new PEP to describe additional vulnerability fields for PEP 691” item in the roadmap.