Features

This chapter covers the core features and capabilities of Dependency Auditor.

Features

• Local CVE database — curated vulnerability data for 50+ popular Python packages, no network needed
• Requirements parsing — reads requirements.txt, Pipfile, and pinned version formats
• Version comparison — semantic version matching with range-aware CVE lookups
• Severity ratings — each CVE tagged as critical, high, medium, or low
• Upgrade recommendations — suggests safe target versions for vulnerable packages
• Strict mode — exit code 1 on any vulnerability found (CI/CD friendly)
• JSON and console output — structured data or human-readable reports
• Offline operation — works entirely without internet access

Requirements

• Python 3.10+
• No external dependencies (stdlib only)

Quick Start

Follow this guide to get Dependency Auditor up and running in your environment.

Quick Start

# Audit your requirements file
python src/dependency_auditor.py --file requirements.txt

# Strict mode — fail on any vulnerability
python src/dependency_auditor.py --file requirements.txt --strict

# Audit a Pipfile with JSON output
python src/dependency_auditor.py --file Pipfile --output report.json

Output

Console output shows a package-by-package breakdown with CVE IDs, severity, and recommended actions. JSON output provides structured findings for integration with dashboards or CI systems.