--- id: uv-secure version: "0.17.2" license: MIT license_treatment: permissive maintenance: abandoned --- # uv-secure — Deprecated dependency scanner for uv projects; use uv audit instead License: permissive · Maintenance: abandoned · Downloads: 164.3K/mo ## What it is and what it does uv-secure is a deprecated CLI tool that scans dependency lock files (uv.lock, pylock.toml, requirements.txt) for known security vulnerabilities by querying PyPI metadata. It was created to bridge gaps with pip-audit integration for uv projects but is now superseded by the native `uv audit` command. The tool makes concurrent network requests to PyPI for each dependency, caches responses (default TTL 86400 seconds), and reports vulnerabilities with optional severity, aliases, and descriptions. It also checks the versions of the globally installed uv CLI and uv-secure itself for vulnerabilities. The package depends on 13 runtime libraries including httpx for HTTP requests, pydantic for validation, rich for terminal output, and typer for CLI scaffolding. It is explicitly marked as abandoned and in alpha phase, meaning command-line arguments may change without notice. The author recommends using `uv audit` for new projects, or pip-audit and pysentry-rs as alternatives if uv audit does not fit your workflow. Use it for: - Audit PyPI dependencies in uv.lock files before deployment in CI/CD pipelines. - Check requirements.txt files for known vulnerabilities in projects not yet migrated to uv. - Scan PEP 751 pylock.toml files for security issues in lock-file-based workflows. - Monitor the security status of the uv tool itself and uv-secure package versions. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Scans uv.lock, pylock.toml, and requirements.txt files for known vulnerabilities in PyPI dependencies by querying the PyPI API. No. The package is abandoned and explicitly deprecated in favor of `uv audit`, which is now the standard for uv projects. Install uv-secure only if you have a legacy workflow that `uv audit` does not support; otherwise, use the built-in command or consider pip-audit or pysentry-rs instead. ## Install pip install uv-secure uv add uv-secure poetry add uv-secure ## Installing uv-secure Before you install: Low install friction with 13 runtime dependencies. However, the package is abandoned (last commit 2026-04-18, repository archived) and explicitly deprecated in favor of the built-in `uv audit` command, which should be preferred for new projects. License in practice: MIT license permits free use, modification, and distribution with minimal restrictions, making it legally straightforward to adopt—though the deprecation status makes this less relevant. Quickstart: uv tool install uv-secure uv-secure path/to/uv.lock # or: uv-secure --help for full options Requires Python >=3.10 and network access to PyPI API; only works with PyPI-sourced packages, not private or custom package repositories. Verify before relying: - Whether the tool's alpha-phase command-line interface remains stable or may change without deprecation warning. - Performance impact of network requests for each PyPI package in large lock files. - Compatibility with the latest uv versions and whether `uv audit` now covers all uv-secure use cases. ## Package facts - License: MIT (permissive) - Python support: supports_current - Install friction: low - Maintenance: abandoned - Downloads: 164.3K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags uv dependency vulnerability scanner, check uv.lock for security issues, pypi vulnerability auditing, dependency security scanning, uv project security audit, vulnerability detection uv, pypi package vulnerability checker, deprecated, vulnerability-scanning, uv-ecosystem [View on SkillFed](https://skillfed.io/packages/uv-secure) · [View on PyPI](https://pypi.org/project/uv-secure/)