python CVE scanning

[mcandre]

There's a FOSS CLI tool for this called "safety". dependabot should start scanning Python projects for CVE's.

Check both requirements.txt and requirements-dev.text.

[jhutchings1]

Thanks for your suggestion. Dependabot already supports Python today. We don't alert on requirements-dev, but we do support requirements.txt. https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

[mcandre]

The request is for requirements-dev.txt. This ensures that buildtime environments remain free of malware.