pip-audit

Generate a pip-audit JSON report, then run ca9.

pip-audit --format json --output pip-audit.json
ca9 check pip-audit.json --repo .

With dynamic evidence

coverage run -m pytest
coverage json -o coverage.json
ca9 check pip-audit.json --repo . --coverage coverage.json --show-confidence

Output options

ca9 check pip-audit.json --repo . -f json -o ca9-report.json
ca9 check pip-audit.json --repo . -f sarif -o ca9.sarif
ca9 check pip-audit.json --repo . -f vex -o openvex.json