Is there a Python/Django equivalent to Rails bundler-audit?

Question

I'm fairly new to Django so apologies in advance if this is obvious.

In Rails projects, I use a gem called bundler-audit to check that the patch level of the gems I'm installing don't include security vulnerabilities. Normally, I incorporate running bundler-audit into my CI pipeline so that any time I deploy, I get a warning (and fail) if a gem has a security vulnerability.

Is there a similar system for checking vulnerabilities in Python packages?

Answer 1

After writing out this question, I searched around some more and found Safety, which was exactly what I was looking for.

In case anyone else is setting up CircleCI for a Django project and wants to check their packages for vulnerabilities, here is the configuration I used in my .circleci/config.yml:

version: 2
jobs:
    build:
        # build and run tests

    safety_check:
        docker:
            - image: circleci/python:3.6.1
        steps:
            - checkout
            - run:
                command: |
                    python3 -m venv env3
                    . env3/bin/activate
                    pip install safety
                    # specify requirements.txt
                    safety check -r requirements.txt
     merge_master:
         # merge passing code into master

workflows:
    version: 2
    test_and_merge:
        jobs:
            - build:
                filters:
                    branches:
                        ignore: master
            - safety_check:
                filters:
                    branches:
                        ignore: master
            - merge_master:
                filters:
                    branches:
                        only: develop
                requires:
                    - build
                    # code is only merged if safety check passes
                    - safety_check

To check that this works, run pip install insecure-package && pip freeze > requirements.txt then push and watch for Circle to fail.