pyproject.toml

[build-system]
requires = ["flit_core >=3.2,<4"]
build-backend = "flit_core.buildapi"

[project]
name = "pip_audit"
dynamic = ["version"]
description = "A tool for scanning Python environments for known vulnerabilities"
readme = "README.md"
license = { file = "LICENSE" }
authors = [
    { name = "Alex Cameron", email = "alex.cameron@trailofbits.com" },
    { name = "Dustin Ingram", email = "di@python.org" },
    { name = "William Woodruff", email = "william@trailofbits.com" },
]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.9",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
]
dependencies = [
    "CacheControl[filecache] >= 0.13.0",
    "cyclonedx-python-lib >= 5,< 9",
    "html5lib>=1.1",
    "packaging>=23.0.0",                 # https://github.com/pypa/pip-audit/issues/464
    "pip-api>=0.0.28",
    "pip-requirements-parser>=32.0.0",
    "requests >= 2.31.0",
    "rich>=12.4",
    "toml>=0.10",
    "platformdirs>=4.2.0",
]
requires-python = ">=3.9"

[project.optional-dependencies]
test = [
    "coverage[toml] ~= 7.0, != 7.3.3", # https://github.com/nedbat/coveragepy/issues/1713
    "pretend",
    "pytest",
    "pytest-cov",
]
lint = [
    # NOTE(ww): ruff is under active development, so we pin conservatively here
    # and let Dependabot periodically perform this update.
    "ruff < 0.7.4",
    # HACK(ww): interrogate needs setuptools to provide `pkg_resources` on Python 3.12+;
    # remove this when https://github.com/econchick/interrogate/issues/164 is resolved.
    "setuptools",
    "interrogate",
    "mypy",
    "types-html5lib",
    "types-requests",
    "types-toml",
]
doc = ["pdoc"]
dev = ["build", "bump>=1.3.2", "pip-audit[doc,test,lint]"]

[project.scripts]
pip-audit = "pip_audit._cli:audit"

[project.urls]
Homepage = "https://pypi.org/project/pip-audit/"
Issues = "https://github.com/pypa/pip-audit/issues"
Source = "https://github.com/pypa/pip-audit"

[tool.interrogate]
# don't enforce documentation coverage for packaging, testing, the virtual
# environment, or the CLI (which is documented separately).
exclude = ["env", "test", "pip_audit/_cli.py"]
ignore-semiprivate = true
fail-under = 100

[tool.mypy]
allow_redefinition = true
check_untyped_defs = true
disallow_incomplete_defs = true
disallow_untyped_defs = true
ignore_missing_imports = true
no_implicit_optional = true
show_error_codes = true
sqlite_cache = true
strict_equality = true
warn_no_return = true
warn_redundant_casts = true
warn_return_any = true
warn_unreachable = true
warn_unused_configs = true
warn_unused_ignores = true

[tool.bump]
input = "pip_audit/__init__.py"
reset = true

[tool.ruff]
line-length = 100

[tool.ruff.lint]
# Never enforce `E501` (line length violations).
ignore = ["E501"]
select = ["E", "F", "I", "W", "UP"]