NAME

repomatic audit - Report (and optionally fix) vulnerable dependencies

SYNOPSIS

repomatic audit [OPTIONS]

DESCRIPTION

Scan locked dependencies for known security vulnerabilities.

Read-only by default: queries every advisory database enabled in
[tool.repomatic] vulnerable-deps.sources (default: uv-audit and
github-advisories), unions and deduplicates the results, and prints
them. The GitHub Advisory Database needs a repository, so it is skipped
without --repo. The table respects the global --table-format option
(github, json, csv, etc.), so --table-format json yields a
machine-readable report. Report mode exits 1 when any vulnerability is
found (use --exit-zero to override), so it can gate CI.

With --fix, upgrades each fixable package with uv lock --upgrade-package
and:


  - bypasses the exclude-newer cooldown for security fixes


  - persists exclude-newer-package entries in pyproject.toml


  - prints a markdown report of vulnerabilities and version changes

OPTIONS

--lockfile FILE

Path to the uv.lock file.

--repo TEXT

Repository in owner/repo format, for the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

--fix / --no-fix

Upgrade fixable packages and persist cooldown exemptions (mutates uv.lock and pyproject.toml). Default: report only.

--exit-zero / --no-exit-zero

In report mode, exit 0 even when vulnerabilities are found.

-o / --output FILE

Write a markdown report to this file.

--output-format [markdown|github-actions]

Format of the --output file. github-actions writes step outputs, for $GITHUB_OUTPUT.

--sort-by [package|version|advisory|fixed|sources]

Sort table by this column. Repeat to set priority.

--help / -h

Show this message and exit.

ENVIRONMENT

AUDIT_LOCKFILE

Path to the uv.lock file.

GITHUB_REPOSITORY

Repository in owner/repo format, for the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

AUDIT_REPO

Repository in owner/repo format, for the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

AUDIT_FIX

Upgrade fixable packages and persist cooldown exemptions (mutates uv.lock and pyproject.toml). Default: report only.

AUDIT_EXIT_ZERO

In report mode, exit 0 even when vulnerabilities are found.

AUDIT_OUTPUT

Write a markdown report to this file.

AUDIT_OUTPUT_FORMAT

Format of the --output file. github-actions writes step outputs, for $GITHUB_OUTPUT.

AUDIT_SORT_BY

Sort table by this column. Repeat to set priority.

AUDIT__CLICK_DEFAULT_HELP

Show this message and exit.

EXIT STATUS

0

Success.

1

A runtime error, an aborted prompt (Ctrl-D), or a declined confirmation.

2

A usage error: unknown option, invalid value, missing operand, or an unparsable configuration file.

130

Interrupted with Ctrl-C: the process ends by SIGINT, reported as 130.

EXAMPLES

Report known vulnerabilities (read-only)

repomatic audit

Machine-readable output

repomatic \-\-table\-format json audit

Upgrade fixable packages (mutates uv.lock and pyproject.toml)

repomatic audit \-\-fix

CI autofix job: write the markdown report as a step output

repomatic audit \-\-fix \-\-repo owner/name \-\-output "$GITHUB_OUTPUT" \-\-output\-format github\-actions

AUTHORS

Kevin Deldycke