Ecosystem · Python · pip, Poetry, Pipenv
Vulnerabilities in your Python dependencies, with nothing to install.
LibWatch reads requirements.txt, pyproject.toml, poetry.lock or Pipfile.lock, checks every PyPI package and tracks the end of life of your Python version.
What LibWatch reads in the repository
requirements.txtpyproject.tomlpoetry.lockPipfile.lock
Language version: .python-version or pyproject.toml
Nothing else: no cloning, no code run.
What LibWatch checks
The packages, and the Python version
PyPI packages
Known vulnerabilities
Every package in the lockfile checked against OSV, which includes GitHub advisories.
Python version
End of life
The declared version is tracked: you know when it stops getting fixes.
Health
License policy
Licenses that conflict with your project's policy are flagged.
An alert, in practice
A PyPI vulnerability, with the version that fixes it
Django, FastAPI, data scripts: the same analysis.
Real severity
CVSS severity and presence in the CISA KEV catalog
What to do
The fixed version, and the affected project
Where
Email, Slack, Zulip or webhook, set per project
data-api · FastAPI
Example · analysis from October 22
-
Ends October 2026
Python (declared)
3.10
-
Medium severity
jinja2
3.1.3
-
Up to date
fastapi
0.115.0
Rechecked every night at 2 a.m.
End of life
Where your Python version stands
Official python.org schedule, checked on October 22, 2026.
| Version | Status | End of life | Action |
|---|---|---|---|
| 3.13 | Bug fixes | → October 2029 | Recommended version |
| 3.12 | Security only | → October 2028 | Stay up to date |
| 3.11 | Security only | → October 2027 | Plan the upgrade |
| 3.10 | End of life | October 2026 | Upgrade now |
Dates checked on October 22, 2026.
Get started
Your first report in a few minutes
No pipeline to change.
Connect GitHub or GitLab
Self-hosted GitLab instances included.
Choose your Python repositories
LibWatch finds the files listed above on its own, even in a monorepo.
Read the report, set up alerts
Exploited vulnerabilities first, fixed versions, language end of life.
Frequently asked questions
LibWatch and Python
Do I need to install anything in the project?
No. LibWatch reads dependency files through the GitHub or GitLab API, without adding anything to your pipeline.
Are private registries supported?
Yes. A package from a private registry is identified as such: its name is never sent to a third-party service, and it stays in the project's inventory.
Does LibWatch detect the version installed on the server?
No. LibWatch reads the version declared in the repository (version file, lockfile or manifest). It has no access to your servers.