{"categories":[{"label":"Libraries","url":"https://skillfed.io/packages/category/software-development-libraries/8"},{"label":"Testing","url":"https://skillfed.io/packages/category/software-development-testing/5"},{"label":"Quality Assurance","url":"https://skillfed.io/packages/category/software-development-quality-assurance/3"}],"enrichment":{"capability":"Scans uv.lock, pylock.toml, and requirements.txt files for known vulnerabilities in PyPI dependencies by querying the PyPI API.","skillfed_tags":["deprecated","vulnerability-scanning","uv-ecosystem"],"use_cases":["Audit PyPI dependencies in uv.lock files before deployment in CI/CD pipelines.","Check requirements.txt files for known vulnerabilities in projects not yet migrated to uv.","Scan PEP 751 pylock.toml files for security issues in lock-file-based workflows.","Monitor the security status of the uv tool itself and uv-secure package versions."],"what_it_does":"uv-secure is a deprecated CLI tool that scans dependency lock files (uv.lock, pylock.toml, requirements.txt) for known security vulnerabilities by querying PyPI metadata. It was created to bridge gaps with pip-audit integration for uv projects but is now superseded by the native `uv audit` command. The tool makes concurrent network requests to PyPI for each dependency, caches responses (default TTL 86400 seconds), and reports vulnerabilities with optional severity, aliases, and descriptions. It also checks the versions of the globally installed uv CLI and uv-secure itself for vulnerabilities.\n\nThe package depends on 13 runtime libraries including httpx for HTTP requests, pydantic for validation, rich for terminal output, and typer for CLI scaffolding. It is explicitly marked as abandoned and in alpha phase, meaning command-line arguments may change without notice. The author recommends using `uv audit` for new projects, or pip-audit and pysentry-rs as alternatives if uv audit does not fit your workflow.","worth_installing":"No. The package is abandoned and explicitly deprecated in favor of `uv audit`, which is now the standard for uv projects. Install uv-secure only if you have a legacy workflow that `uv audit` does not support; otherwise, use the built-in command or consider pip-audit or pysentry-rs instead."},"id":"uv-secure","links":{"html":"https://skillfed.io/packages/uv-secure","md":"https://skillfed.io/packages/uv-secure.md","pypi":"https://pypi.org/project/uv-secure/"},"maintenance":{"status":"abandoned"},"meta":{"latest_release":"2026-04-18","license_spdx":"MIT","license_treatment":"permissive","name":"uv-secure","python_support":"supports_current","summary":"Deprecated dependency scanner for uv projects; use uv audit instead"},"popularity":{"monthly_downloads":164291,"position":10554,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.17.2"}