NAME

repomatic audit - Report (and optionally fix) vulnerable dependencies

SYNOPSIS

repomatic audit [OPTIONS]

DESCRIPTION

Scan locked dependencies for known security vulnerabilities.

Read-only by default: queries every advisory database enabled in
[tool.repomatic] vulnerable-deps.sources (default: uv-audit and
github-advisories), unions and deduplicates the results, and prints
them. The table respects the global --table-format option (github,
json, csv, etc.), so --table-format json yields a machine-readable
report. Report mode exits 1 when any vulnerability is found (use
--exit-zero to override), so it can gate CI.

With --fix, upgrades each fixable package with uv lock --upgrade-package
and:


  - bypasses the exclude-newer cooldown for security fixes


  - persists exclude-newer-package entries in pyproject.toml


  - prints a markdown report of vulnerabilities and version changes

OPTIONS

--lockfile FILE

Path to the uv.lock file.

--repo TEXT

Repository in OWNER/NAME format. Enables the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

--fix / --no-fix

Upgrade fixable packages and persist cooldown exemptions (mutates uv.lock and pyproject.toml). Default: report only.

--exit-zero / --no-exit-zero

In report mode, exit 0 even when vulnerabilities are found.

--output FILE

Write a markdown report to this file.

--output-format [markdown|github-actions]

Format for --output. github-actions produces format for PR template consumption in workflows.

--sort-by [package|version|advisory|fixed|sources]

Sort table by this column. Repeat to set priority.

--help / -h

Show this message and exit.

ENVIRONMENT

AUDIT_LOCKFILE

Path to the uv.lock file.

GITHUB_REPOSITORY

Repository in OWNER/NAME format. Enables the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

AUDIT_REPO

Repository in OWNER/NAME format. Enables the GitHub Advisory Database source. Defaults to $GITHUB_REPOSITORY.

AUDIT_FIX

Upgrade fixable packages and persist cooldown exemptions (mutates uv.lock and pyproject.toml). Default: report only.

AUDIT_EXIT_ZERO

In report mode, exit 0 even when vulnerabilities are found.

AUDIT_OUTPUT

Write a markdown report to this file.

AUDIT_OUTPUT_FORMAT

Format for --output. github-actions produces format for PR template consumption in workflows.

AUDIT_SORT_BY

Sort table by this column. Repeat to set priority.

AUDIT__CLICK_DEFAULT_HELP

Show this message and exit.

EXIT STATUS

0

Success.

1

A runtime error, or an aborted prompt (Ctrl-C, a declined confirmation).

2

A usage error: unknown option, invalid value, missing operand, or an unparsable configuration file.

EXAMPLES

Report known vulnerabilities (read-only)

repomatic audit

Machine-readable output

repomatic \-\-table\-format json audit

Upgrade fixable packages (mutates uv.lock and pyproject.toml)

repomatic audit \-\-fix

CI autofix job: write the markdown report as a step output

repomatic audit \-\-fix \-\-repo owner/name \-\-output "$GITHUB_OUTPUT" \-\-output\-format github\-actions

AUTHORS

Kevin Deldycke