yossarianI wrote a new post for the Astral blog about how we’re building more vulnerability and malware defenses directly into uv:
Dirkjan @ RustWeek@yossarian do you have a plan to integrate dependency vulnerability auditing in commands that construct/update or even consume a lockfile?
@djc yes! We’re thinking about doing this with `uv add` and similar, the idea being that it’ll hopefully be less disruptive than what npm and other tools do on every install
Andrew Nesbitt@yossarian @djc integration with uvx would be great too
@andrewnez @djc I’ll need to confirm but the malware check should work on uxv, at least! If not, that’s probably a bug