Supplying vulnerability-based constraints to the resolution process

[fridex]

What's the problem this feature will solve?

We have proposed including vulnerability information in the resolution process Python upstream. Unfortunately, the pip community does not seem to be open to include such feature directly in pip.

Before possibly introducing another tool, we would like to raise this feature also here. There is a small prototype, pipctl (using pip-tools), that can resolve application dependencies without known vulnerabilities, or allowing only acceptable ones. Would pip-tools community be interested in such a feature directly in pip-tools codebase?

Describe the solution you'd like

See pipctl prototype that can resolve application dependencies respecting vulnerabilities.

[fridex]

It looks like there is no interest. Closing.