google-auth and the Cyber Resilience Act

7 of 9 readable security signals are in place for google-auth 3.0.0.dev0 (PyPI). Data checked 2026-10-05.

google-auth 3.0.0.dev07 of 9 signals

passNo known vulnerabilities in the latest version: none listed (Annex I, Part II: address and remediate vulnerabilities without delay)
passNot deprecated: not marked as deprecated (support period and updates)
missingActively maintained: Scorecard Maintained 0/10 (security updates for the whole support period)
passSecurity policy: Scorecard Security-Policy 10/10 (Annex I, Part II: coordinated vulnerability disclosure policy and contact address)
passLicence declared: Apache-2.0 (component documentation and licence notices)
passCode review before merge: Scorecard Code-Review 10/10 (secure development process (Annex VII, development and vulnerability handling processes))
passCI workflow hygiene: Dangerous-Workflow 10, Token-Permissions 10 (integrity of the build and update chain)
missingSigned releases or provenance: not assessed (Annex I, Part II: secure distribution of updates)
passAutomated security testing: SAST 5, Fuzzing 10 (Annex I, Part II: effective and regular tests and reviews)

google-auth 3.0.0.dev0 is the current default version of this PyPI package, published on 2025-12-19. The registry lists 204 versions in total and the licence declared is Apache-2.0. The source repository is googleapis/google-auth-library-python with 883 stars.

The OpenSSF Scorecard for the repository was last computed on 2026-08-24 and gives an overall 7.3/10. Signals that are not in place today: actively maintained; signed releases or provenance.

As of 2026-10-05, deps.dev lists no known advisories for this version. That is a snapshot and not a promise: new advisories can be published at any time.

If you ship a product that includes google-auth, the Cyber Resilience Act expects you to know which components you ship, to follow their vulnerabilities and to exercise due diligence on third-party components (Annex I, Part II and Article 13). In practice: list google-auth 3.0.0.dev0 in your SBOM with its package URL pkg:pypi/[email protected], watch for new advisories, and keep the upstream security contact in your vulnerability handling process.

Put the badge in your README

Check your own project

Run the repository check on googleapis/google-auth-library-python, or check your own SBOM and create the licence notices.

More in the index

platformdirs, filelock, tomlkit, charset-normalizer, packaging, markupsafe · all PyPI packages

Sources and method

Package and version facts, licences, advisories and provenance: deps.dev (generated data under CC BY 4.0; advisories from OSV). Repository signals: the OpenSSF Scorecard. We read them on 2026-10-05 and show them without scoring the people behind a project. The nine signals are our selection; every signal could be read for this package.

Information generated from your inputs, with article references to Regulation (EU) 2024/2847. It is not legal advice and does not replace your own assessment; check the references against the Official Journal.