petal-power/zero-check-pipeline
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deps: pin pip-audit to project venv via PIPAPI_PYTHON_LOCATION

Browse Source 
`uv run --directory <project> pip-audit` runs the pip-audit BINARY
through uv, but pip-audit's binary lives at
~/.local/share/uv/tools/pip-audit/ with its own embedded Python. When
invoked without `PIPAPI_PYTHON_LOCATION`, pip-audit defaults to using
the python it shipped with for its dependency resolution — so it audits
ITS OWN venv (which has its own bundled pip + urllib3 versions, both
currently flagged with CVEs) instead of the project's venv.

pip-audit emits a stderr warning about this:
    pip-audit will run pip against
    ~/.local/share/uv/tools/pip-audit/bin/python, but you have a virtual
    environment loaded at <project>/.venv. This may result in unintuitive
    audits, since your local environment will not be audited. You can
    forcefully override this behavior by setting PIPAPI_PYTHON_LOCATION
    to the location of your virtual environment's Python interpreter.

Reproduced as a false positive on every uv project on this host —
trellis-mcp and herbylab both got the identical 4 CVEs despite neither
having pip or urllib3 in its dep tree.

Fix: set PIPAPI_PYTHON_LOCATION to the project's .venv/bin/python when
it exists. When it doesn't exist, fall back to the old behavior with a
yellow warning that the audit may be inaccurate (avoids silently
running `uv sync` as a side effect of validation).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Travis Herbranson 2026-05-12 07:52:23 -04:00
parent 145e0b0a98
commit 283dc0a632
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
validate/deps.sh
View File

@ -32,7 +32,21 @@ if [ -n "$has_python" ]; then
if [ -n "$has_uvlock" ]; then if [ -n "$has_uvlock" ]; then
printf " source: %s (uv project)\n" "$has_uvlock" printf " source: %s (uv project)\n" "$has_uvlock"
pyproject_dir=$(dirname "$has_uvlock") pyproject_dir=$(dirname "$has_uvlock")
# Point pip-audit at the project's venv interpreter. Without this,
# `uv run pip-audit` ends up running the pip-audit binary from its
# own uv-tool install (~/.local/share/uv/tools/pip-audit/), and
# pip-audit then audits THAT environment instead of the project's
# — surfacing CVEs in pip-audit's own bundled pip/urllib3 as if
# they were the project's deps. See pip-audit's stderr warning
# ("you have a virtual environment loaded at <project>/.venv ...
# your local environment will not be audited") for context.
project_venv_python="$pyproject_dir/.venv/bin/python"
if [ -x "$project_venv_python" ]; then
audit_cmd="PIPAPI_PYTHON_LOCATION=$project_venv_python uv run --directory $pyproject_dir pip-audit"
else
printf "${YELLOW}!${NC} No project venv at %s — pip-audit may report on its own bundled deps; run \`uv sync\` and retry for an accurate audit.\n" "$project_venv_python"
audit_cmd="uv run --directory $pyproject_dir pip-audit" audit_cmd="uv run --directory $pyproject_dir pip-audit"
fi
elif [ -n "$has_reqtxt" ]; then elif [ -n "$has_reqtxt" ]; then
printf " source: %s (requirements file)\n" "$has_reqtxt" printf " source: %s (requirements file)\n" "$has_reqtxt"
audit_cmd="pip-audit -r $has_reqtxt" audit_cmd="pip-audit -r $has_reqtxt"