Thanks! I’m not feeling as strongly about needing it to be explicit-run only. Realistically, I’m gonna set up dependabot or something anyway. I actually like th

Thanks! I’m not feeling as strongly about needing it to be explicit-run only. Realistically, I’m gonna set up dependabot or something anyway. I actually like that part of npm audit - when I’m doing “package management things” it’s convenient to get those alerts. To me, the problem of noise is wholly separate to when/how I run it. Solving noise by making it run less frequently is a bit of a “you’re holding it wrong”. But I see your point that the nature of Python and hopefully the community database are the real solutions. I did install and try pip-audit though and it had very very few notices and none spurious! So already I like it better than npm audit :)