uv-secure

What it is and what it does

uv-secure is a deprecated CLI tool that scans dependency lock files (uv.lock, pylock.toml, requirements.txt) for known security vulnerabilities by querying PyPI metadata. It was created to bridge gaps with pip-audit integration for uv projects but is now superseded by the native `uv audit` command. The tool makes concurrent network requests to PyPI for each dependency, caches responses (default TTL 86400 seconds), and reports vulnerabilities with optional severity, aliases, and descriptions. It also checks the versions of the globally installed uv CLI and uv-secure itself for vulnerabilities.

The package depends on 13 runtime libraries including httpx for HTTP requests, pydantic for validation, rich for terminal output, and typer for CLI scaffolding. It is explicitly marked as abandoned and in alpha phase, meaning command-line arguments may change without notice. The author recommends using `uv audit` for new projects, or pip-audit and pysentry-rs as alternatives if uv audit does not fit your workflow.

Use it for:

• Audit PyPI dependencies in uv.lock files before deployment in CI/CD pipelines.
• Check requirements.txt files for known vulnerabilities in projects not yet migrated to uv.
• Scan PEP 751 pylock.toml files for security issues in lock-file-based workflows.
• Monitor the security status of the uv tool itself and uv-secure package versions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scans uv.lock, pylock.toml, and requirements.txt files for known vulnerabilities in PyPI dependencies by querying the PyPI API.

No. The package is abandoned and explicitly deprecated in favor of `uv audit`, which is now the standard for uv projects. Install uv-secure only if you have a legacy workflow that `uv audit` does not support; otherwise, use the built-in command or consider pip-audit or pysentry-rs instead.

Install

uv-secure on PyPI

pip install uv-secure

uv add uv-secure

poetry add uv-secure

Installing uv-secure

Before you install

Low install friction with 13 runtime dependencies. However, the package is abandoned (last commit 2026-04-18, repository archived) and explicitly deprecated in favor of the built-in `uv audit` command, which should be preferred for new projects.

License in practice

MIT license permits free use, modification, and distribution with minimal restrictions, making it legally straightforward to adopt—though the deprecation status makes this less relevant.

Quickstart

uv tool install uv-secure
uv-secure path/to/uv.lock
# or: uv-secure --help for full options

Requires Python >=3.10 and network access to PyPI API; only works with PyPI-sourced packages, not private or custom package repositories.

Verify before relying

• Whether the tool's alpha-phase command-line interface remains stable or may change without deprecation warning.
• Performance impact of network requests for each PyPI package in large lock files.
• Compatibility with the latest uv versions and whether `uv audit` now covers all uv-secure use cases.

Package facts

Evidence: uv_secure-0.17.2-py3-none-any.whl

Keywords: uv, uv.lock, vulnerabilities

Tags

More Libraries packages