Install pip-audit (included in the [dev] optional dependency group):

pip install pxeos[dev]

Scan installed packages for known vulnerabilities:

pip-audit

Scan only PxeOS and its direct dependencies:

pip-audit --requirement <(pip freeze | grep -iE 'pxeos|fastapi|uvicorn|jinja2|pydantic|python-multipart|tomli')

pip-audit --requirement pyproject.toml

1. Review current pins -- dependency ranges are specified in pyproject.toml under [project] dependencies.

2. Update within pinned ranges (safe):

   pip install --upgrade pxeos

3. Check for breakage after updating:

   python -m pytest tests/ -q --tb=short

4. Bump upper bounds when a new major version of a dependency is released:

   • Edit the version range in pyproject.toml
   • Run the full test suite
   • Test manually with pxeos server start and pxeos server status

If you discover a security vulnerability in PxeOS, please report it by opening a GitHub issue at https://github.com/FlossWare/PxeOS/issues with the label security. For sensitive issues, contact the maintainer directly at the email listed in pyproject.toml.

• Enable TLS (tls_cert / tls_key in pxeos.toml) for all production deployments.
• Enable API key authentication (auth.enabled = true) and distribute keys with least-privilege roles (viewer, operator, admin).
• Run PxeOS as a non-root user; only the ISO import feature requires mount privileges.
• Restrict network access to the PxeOS API port to your provisioning VLAN.