Q: Can pip-audit scan Docker images for Python vulnerabilities?

No, pip-audit is designed for Python environments and dependency files, not container images. You would need to extract the Python dependencies from the Docker image first, such as by running pip freeze inside the container.

Q: How to suppress pip-audit's exit code in a shell script?

Use shell idioms like pip-audit || true to ignore failures, or capture the exit code with ${?}. The README explicitly states it doesn't support internal suppression and recommends these methods.

Q: Does pip-audit work with poetry lock files?

Not directly; pip-audit currently supports pyproject.toml and pylock.*.toml for local projects with --locked, but for poetry, you might need to convert the lock file to a requirements-style format first, similar to pipenv.

Question 1

How do I ignore a specific vulnerability in pip-audit?

Accepted Answer

Use the --ignore-vuln flag with the vulnerability ID (e.g., CVE-XXX-YYYY or GHSA-xxx), which can be passed multiple times. This is documented in the troubleshooting section for handling noisy reports.

Question 2

pip-audit vs safety: which is better for Python security?

Accepted Answer

pip-audit is officially backed by PyPA and supports automatic fixes and multiple vulnerability sources, while safety may have different coverage. pip-audit integrates better with pip workflows, but safety might be preferred for specific commercial feeds. Choose based on your need for automation and ecosystem alignment.

Question 3

How to use pip-audit with pipenv projects?

Accepted Answer

Convert Pipfile.lock to requirements.txt using pipenv requirements, then run pip-audit with -r. The README provides a tip: pipenv run pip-audit -r <(pipenv requirements) for a one-liner.

Question 4

Can pip-audit scan Docker images for Python vulnerabilities?

Accepted Answer

No, pip-audit is designed for Python environments and dependency files, not container images. You would need to extract the Python dependencies from the Docker image first, such as by running pip freeze inside the container.

Question 5

How to suppress pip-audit's exit code in a shell script?

Accepted Answer

Use shell idioms like pip-audit || true to ignore failures, or capture the exit code with ${?}. The README explicitly states it doesn't support internal suppression and recommends these methods.

Question 6

Does pip-audit work with poetry lock files?

Accepted Answer

Not directly; pip-audit currently supports pyproject.toml and pylock.*.toml for local projects with --locked, but for poetry, you might need to convert the lock file to a requirements-style format first, similar to pipenv.

pip-audit

What is pip-audit?

Overview

Use Cases

Best For

Related Projects

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions