CheckOps home

Tools directory

P

CheckOps

pip-audit

pip-audit is an Apache-2.0 PyPA tool that audits Python environments, requirements files and dependency trees for known vulnerabilities using the Python Packaging Advisory Database, and can fix them.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

pip-audit scans Python environments for packages with known vulnerabilities, using the Python Packaging Advisory Database through PyPI’s JSON API or OSV. It was created by Trail of Bits with support from Google and is maintained under the Python Packaging Authority (PyPA).

The source code is at pypa/pip-audit on GitHub under the Apache-2.0 licence, with about 1,400 stars; the most recent commit was on 10 November 2026.

Features

  1. Environment and requirements scanning: Audit installed packages or requirement files.
  2. Advisory sources: PyPI and OSV.
  3. Automatic fixes: --fix upgrades vulnerable packages.
  4. Output formats: JSON, CycloneDX and more.
  5. GitHub Action: Run in workflows.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 November 2026.

Cons

  1. Python only: Single ecosystem.
  2. Known vulnerabilities only: No code analysis.
pip install pip-audit
pip-audit -r requirements.txt

Resources:

Pricing

pip-audit is free and open source under the Apache-2.0 licence.

  1. Python teams wanting free dependency audits.
  2. CI pipelines for Python packages.
  3. Not a fit for other languages.

Conclusion

pip-audit is the PyPA’s standard tool for Python dependency vulnerability audits.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with pip-audit side by side.