(tooling-trusted-releases) branch sbp updated: Add a uv audit lint

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new 6df6b46f Add a uv audit lint
6df6b46f is described below

commit 6df6b46f2a9cd826a92f2638a7f8b250fe57c8ee
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Thu Jun 11 17:04:41 2026 +0100

    Add a uv audit lint
---
 .pre-commit-config.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 260e192d..95dcda68 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -193,6 +193,14 @@ repos:
       pass_filenames: false
       always_run: true
 
+    - id: uv-audit
+      name: audit dependencies with uv
+      description: Check uv.lock for known vulnerabilities via OSV, trialled alongside pip-audit
+      entry: uv audit --frozen --preview-features audit-command
+      language: system
+      pass_filenames: false
+      always_run: true
+
     - id: check-pth-files
       name: check .pth files in the venv
       description: Refuse unknown .pth files in .venv; Python runs their import lines at interpreter startup, so they are a supply-chain attack vector


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org