---
id: dependency-cve-gate-pip-audit
board: code
section: health
status: shipped
category: Security · Supply chain
complexity: S
impact: Med
wow: 2
note: OSV-backed
order: 2
owner: loop/pip-audit-gate
pr: 134
title: Dependency CVE gate — <code>pip-audit</code>
---
PyPA's <code>pip-audit</code> fails CI when a resolved dependency
           matches a known advisory in the OSV / PyPI Advisory database.
           Dependabot <em>opens</em> update PRs but never blocks a merge on a live
           CVE; a scheduled&nbsp;+&nbsp;PR <code>pip-audit</code> job closes that
           gap and covers the dev/test toolchain that ships nothing but can still
           run malicious code.
