← Back to all products

Dependency Auditor

$29

Scan Python requirements for known vulnerabilities, outdated versions, and risky packages.

Sample CVE data, not a live feed. The bundled database uses placeholder CVE ids so the auditor runs offline with zero setup — it will not tell you whether your dependencies are actually vulnerable. You are buying the audit engine: point --cve-db at an OSV/NVD export for real scanning.

📁 10 files
MarkdownPythonDjangoFlaskCI/CD

📄 Product Preview

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview) ⚙ Try Demo Tools 📦 Download Free Sample

📁 File Structure 10 files

dependency-auditor/ ├── LICENSE ├── README.md ├── examples/ │ └── sample_requirements.txt ├── free-sample.zip ├── guide/ │ ├── 01_features.md │ ├── 02_quick-start.md │ ├── 03_sample-input.md │ └── 04_faq.md ├── index.html └── src/ └── dependency_auditor.py

📖 Documentation Preview README excerpt

Dependency Auditor

Scan Python requirements files for known vulnerabilities, outdated versions, and risky packages. Ships with sample CVE data for offline demos — plug in an OSV/NVD feed for live scanning.

Features

  • Pluggable CVE source — offline sample dataset included; point --cve-db at an OSV/NVD export for real scanning
  • Requirements parsing — reads requirements.txt, Pipfile, and pinned version formats
  • Version comparison — semantic version matching with range-aware CVE lookups
  • Severity ratings — findings ranked critical, high, medium, or low
  • Upgrade recommendations — suggests safe target versions for vulnerable packages
  • Strict mode — exit code 1 on any vulnerability found (CI/CD friendly)
  • JSON and console output — structured data or human-readable reports
  • Offline operation — works entirely without internet access

Requirements

  • Python 3.10+
  • No external dependencies (stdlib only)

Quick Start


# Audit your requirements file
python src/dependency_auditor.py --file requirements.txt

# Strict mode — fail on any vulnerability
python src/dependency_auditor.py --file requirements.txt --strict

# Audit a Pipfile with JSON output
python src/dependency_auditor.py --file Pipfile --output report.json

Output

Console output shows a package-by-package breakdown with CVE IDs, severity, and recommended actions. JSON output provides structured findings for integration with dashboards or CI systems.

Sample Input

See examples/sample_requirements.txt — includes intentionally vulnerable versions for testing:


django==4.2.5
flask==2.3.2
requests==2.28.0
pyyaml==5.4

Configuration Reference

CLI FlagTypeDescription
--filestringPath to requirements.txt, Pipfile, or similar
--strictflagExit 1 if any vulnerability found
--outputstringWrite JSON report to this path
--severitystringMinimum severity to report (low, medium, high, critical)

CVE Database Coverage

The built-in database covers frequently exploited packages including:

... continues with setup instructions, usage examples, and more.

📄 Code Sample .py preview

src/dependency_auditor.py#!/usr/bin/env python3 """ Dependency Auditor — Security Kit (DataNest) Scans Python requirements files and package manifests for outdated versions, risky dependencies and policy violations, and reports them with severity ranking and upgrade recommendations. IMPORTANT — the bundled CVE_DATABASE is SAMPLE DATA, not a live vulnerability feed: its CVE identifiers are deliberately non-real placeholders. This tool is the auditing ENGINE; point it at a real feed (OSV, NVD, pip-audit) before using it to make security decisions. See the note above CVE_DATABASE for how. Usage: python dependency_auditor.py --file requirements.txt python dependency_auditor.py --file requirements.txt --strict python dependency_auditor.py --file Pipfile --output report.json python dependency_auditor.py --file requirements.txt --cve-db osv_export.json Dependencies: Python 3.10+ stdlib only (no pip packages) License: MIT """ from __future__ import annotations import argparse import json import logging import re import sys from dataclasses import dataclass, field, asdict from datetime import datetime, timezone from pathlib import Path from typing import Any # --------------------------------------------------------------------------- # Constants # --------------------------------------------------------------------------- logger = logging.getLogger("dependency_auditor")
Buy Now — $29 Back to Products