yossarianI wrote a new post for the Astral blog about how we’re building more vulnerability and malware defenses directly into uv:
Dirkjan @ RustWeek@yossarian do you have a plan to integrate dependency vulnerability auditing in commands that construct/update or even consume a lockfile?
@djc yes! We’re thinking about doing this with `uv add` and similar, the idea being that it’ll hopefully be less disruptive than what npm and other tools do on every install
Andrew Nesbitt@yossarian @djc integration with uvx would be great too
@andrewnez @djc I’ll need to confirm but the malware check should work on uxv, at least! If not, that’s probably a bug
Thomas Strömberg@yossarian Looks great! If you ever want to collab on embedding malware detection, let me know; I've been hard at work with https://codeberg.org/atomdrift/litmus (also written in Rust!). We similarly train on data labeled by OSV.
While we've only started tuning the Python models, but it's already pretty decent: https://lab.atomdrift.org/python/
