# Vulnerabilities in your Python dependencies, with nothing to install.

Source: https://libwatch.com/en/ecosystems/python

Ecosystem · Python · pip, Poetry, Pipenv

LibWatch reads requirements.txt, pyproject.toml, poetry.lock or Pipfile.lock, checks every PyPI package and tracks the end of life of your Python version.

[Analyze a Python project](https://app.libwatch.com/users/sign_up?source=eco_python)

[See a sample alert](#alerte)

What LibWatch reads in the repository

- `requirements.txt`
- `pyproject.toml`
- `poetry.lock`
- `Pipfile.lock`

Language version: .python-version or pyproject.toml

Nothing else: no cloning, no code run.

What LibWatch checks

## The packages, and the Python version

PyPI packages

### Known vulnerabilities

Every package in the lockfile checked against OSV, which includes GitHub advisories.

Python version

### End of life

The declared version is tracked: you know when it stops getting fixes.

Health

### License policy

Licenses that conflict with your project's policy are flagged.

An alert, in practice

## A PyPI vulnerability, with the version that fixes it

Django, FastAPI, data scripts: the same analysis.

Real severity

CVSS severity and presence in the CISA KEV catalog

What to do

The fixed version, and the affected project

Where

Email, Slack, Zulip or webhook, set per project

End of life

## Where your Python version stands

Official python.org schedule, checked on October 22, 2026.

| Version | Status | End of life | Action |
| --- | --- | --- | --- |
| 3.13 | Bug fixes | → October 2029 | Recommended version |
| 3.12 | Security only | → October 2028 | Stay up to date |
| 3.11 | Security only | → October 2027 | Plan the upgrade |
| 3.10 | End of life | October 2026 | Upgrade now |

Dates checked on October 22, 2026.

Get started

## Your first report in a few minutes

No pipeline to change.

### Connect GitHub or GitLab

Self-hosted GitLab instances included.

### Choose your Python repositories

LibWatch finds the files listed above on its own, even in a monorepo.

### Read the report, set up alerts

Exploited vulnerabilities first, fixed versions, language end of life.

## Learn more

End of life

### Your language too

Why LibWatch tracks your language version.

[Learn more: Your language too](/en/features/end-of-life)

SBOM

### Export to CycloneDX or SPDX

A machine-readable bill of materials, for your customers and the CRA.

[See the export: Export to CycloneDX or SPDX](/en/features/sbom-export)

Pricing

### Per project, seats included

From €39 to €299 excl. VAT per month.

[See pricing: Per project, seats included](/en/pricing)

Frequently asked questions

## LibWatch and Python

### Do I need to install anything in the project?

No. LibWatch reads dependency files through the GitHub or GitLab API, without adding anything to your pipeline.

### Are private registries supported?

Yes. A package from a private registry is identified as such: its name is never sent to a third-party service, and it stays in the project's inventory.

### Does LibWatch detect the version installed on the server?

No. LibWatch reads the version declared in the repository (version file, lockfile or manifest). It has no access to your servers.

## Your Python projects, checked tonight.

[Analyze a project](https://app.libwatch.com/users/sign_up?source=eco_python)

Hosted in France by OVHcloud