Python Dependency Security PyUp

PyUp can automatically open PRs to update dependency versions. This can be customized to happen as they come, or batched daily, weekly or monthly.

You can set this to only update security updates, and can customize which dependency files to track and which version ranges to consider for each dependency.

PyUp's Safety CI integrates with GitHub and will scan all new branches and pull requests for vulnerabilties. This way you can keep your code secure and be aware of problems before they hit production.

PyUp fits easily into your CI pipeline. For example, it returns a non-zero exit status if it finds a vulnerability.

Run it before or after your tests. If Safety finds something, your tests will fail.

install:
  - pip install safety

script:
  - safety check --key=<YOUR_PYUP_API_KEY>

Read more about Safety's command line tool options on GitHub.

PyUp's command line tools allow you to customize and build the perfect workflow for your needs.

Safety CLI

Safety CLI scans your local repository's dependency files and reports on security vulnerabilities. It is highly configurable to scan the files you want, and give the output that works for your workflow. Read more about Safety CLI on GitHub.

Note that Safety CLI is not an antivirus tool and should not be considered a viable solution for detecting harmful or malicious code in the larger operating environment.

PyUp CLI

The PyUp CLI can update the dependencies in your GitHub or GitLab repository directly from the command line. Learn more about PyUp CLI on GitHub.

Safety can be easily executed as Docker container. To build the container just execute:

docker build -t safety-docker .

The container can be used just as described in the examples README section.

cat requirements_dev.txt | \
docker run -i --rm safety-docker safety check --stdin

PyUp scans and lists the OSS licenses of each of your dependencies. Never worry again about using a dependency with a license that isn't compliant with your teams' needs.