TLDR Tech / InfoSec
Introducing the Pixi Audit Beta (4 minute read)
Pixi Audit, now in beta, scans Pixi lock files for vulnerable conda-forge and PyPI packages. It can automatically update direct dependencies to the lowest compatible fixed version. The tool leverages Basilisk, prefix.dev's new conda-forge vulnerability database. For CI, a `--severity high` option sets the failure threshold, with JSON and SARIF output available. Statically linked binaries are not yet covered.
Read the full story