283dc0a632
`uv run --directory <project> pip-audit` runs the pip-audit BINARY
through uv, but pip-audit's binary lives at
~/.local/share/uv/tools/pip-audit/ with its own embedded Python. When
invoked without `PIPAPI_PYTHON_LOCATION`, pip-audit defaults to using
the python it shipped with for its dependency resolution — so it audits
ITS OWN venv (which has its own bundled pip + urllib3 versions, both
currently flagged with CVEs) instead of the project's venv.
pip-audit emits a stderr warning about this:
pip-audit will run pip against
~/.local/share/uv/tools/pip-audit/bin/python, but you have a virtual
environment loaded at <project>/.venv. This may result in unintuitive
audits, since your local environment will not be audited. You can
forcefully override this behavior by setting PIPAPI_PYTHON_LOCATION
to the location of your virtual environment's Python interpreter.
Reproduced as a false positive on every uv project on this host —
trellis-mcp and herbylab both got the identical 4 CVEs despite neither
having pip or urllib3 in its dep tree.
Fix: set PIPAPI_PYTHON_LOCATION to the project's .venv/bin/python when
it exists. When it doesn't exist, fall back to the old behavior with a
yellow warning that the audit may be inaccurate (avoids silently
running `uv sync` as a side effect of validation).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| skills/zero-check | ||
| templates | ||
| validate | ||
| .gitignore | ||
| .python-version | ||
| check-deps.sh | ||
| main.py | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||