Auditing dependencies¶

audit runs uv audit --frozen against a workspace's uv.lock and reports known vulnerabilities. It reads the lockfile as committed, without re-resolving against package indexes, so it needs no index credentials. It mounts only the lockfile, uv.toml and the members' pyproject.toml files, so a source edit doesn't re-run it.

Auditing a whole source tree¶

workspaces is a collection with one item per uv.lock in the source tree, keyed by the workspace's path.

Install the module into your workspace, then run its checks:

$ dagger install github.com/typesafe-ai/daggerverse/uv
$ dagger check --uv

List the workspaces it found:

$ dagger check -l -a --uv

Skipping workspaces¶

Test fixtures and intentionally vulnerable sample projects shouldn't fail your build. The exclude setting takes glob patterns, matched against each workspace's source-relative path, and leaves matching workspaces out of workspaces:

[modules.uv.settings]
exclude = ["**/tests/_packages/**"]

Auditing a single workspace¶

Select one workspace by its path (see Select collection items):

$ dagger check --uv --uv-workspace-source=services/api

await uv(ws).workspace("services/api").audit().pass_()