`uv run --directory <project> pip-audit` runs the pip-audit BINARY
through uv, but pip-audit's binary lives at
~/.local/share/uv/tools/pip-audit/ with its own embedded Python. When
invoked without `PIPAPI_PYTHON_LOCATION`, pip-audit defaults to using
the python it shipped with for its dependency resolution — so it audits
ITS OWN venv (which has its own bundled pip + urllib3 versions, both
currently flagged with CVEs) instead of the project's venv.
pip-audit emits a stderr warning about this:
pip-audit will run pip against
~/.local/share/uv/tools/pip-audit/bin/python, but you have a virtual
environment loaded at <project>/.venv. This may result in unintuitive
audits, since your local environment will not be audited. You can
forcefully override this behavior by setting PIPAPI_PYTHON_LOCATION
to the location of your virtual environment's Python interpreter.
Reproduced as a false positive on every uv project on this host —
trellis-mcp and herbylab both got the identical 4 CVEs despite neither
having pip or urllib3 in its dep tree.
Fix: set PIPAPI_PYTHON_LOCATION to the project's .venv/bin/python when
it exists. When it doesn't exist, fall back to the old behavior with a
yellow warning that the audit may be inaccurate (avoids silently
running `uv sync` as a side effect of validation).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
283dc0a632