Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cli, dependency_source: support --no-deps #255

Merged
merged 13 commits into from
May 3, 2022
Merged

cli, dependency_source: support --no-deps #255

merged 13 commits into from
May 3, 2022

Conversation

woodruffw
Copy link
Member

This adds pip-audit --no-deps, allowing a user to explicitly skip the dependency resolution step when auditing a requirements source (e.g. -r requirement.txt). This functions similarly to the extant --require-hashes mode in terms of disabling dependency resolution, albeit without actually enforcing a hash policy.

Needs docs and unit tests.

Closes #168.

@woodruffw woodruffw added enhancement New feature or request component:cli CLI components component:dep-sources Dependency sources labels Apr 30, 2022
@woodruffw woodruffw requested review from di and tetsuo-cpp April 30, 2022 17:26
@woodruffw woodruffw self-assigned this Apr 30, 2022
Copy link
Contributor

@tetsuo-cpp tetsuo-cpp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

pip_audit/_cli.py Show resolved Hide resolved
@tetsuo-cpp tetsuo-cpp merged commit 5275228 into main May 3, 2022
@tetsuo-cpp tetsuo-cpp deleted the ww/no-deps branch May 3, 2022 03:37
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request May 28, 2022
## [2.3.0] - 2022-05-18

### Added

* CLI: The `--ignore-vuln` option has been added, allowing users to
  specify vulnerability IDs to ignore during the final report
  ([#275](pypa/pip-audit#275))

* CLI: The `--no-deps` flag has been added, allowing users to skip dependency
  resolution entirely when `pip-audit` is used in requirements mode
  ([#255](pypa/pip-audit#255))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:cli CLI components component:dep-sources Dependency sources enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

scan without resolving/downloading dependencies
3 participants