CycloneDX / CycloneDX/cyclonedx-python

Feature request: Add native uv project support (pyproject.toml + uv.lock) via cyclonedx-py uv subcommand

Open
#1,029 6 comments 1 reaction 0 assignees Claimed by @m7mdhka View on GitHub
enhancement source: uv
Dominant language
Python
Stars
390
Forks
98
Avg merge
2d 14h
Merged PRs (30d)
1

Description

## Is your feature request related to a problem? Please describe.

Yes. `cyclonedx-py` currently supports generating SBOMs from environments, requirements, Pipenv, and Poetry projects, but there is no first-class `uv` project workflow in released versions.
This makes it harder for teams using `uv` to generate lockfile-based SBOMs directly from `pyproject.toml` + `uv.lock`, and can block adoption in projects where `uv` is the package manager of record.

## Describe the solution you'd like

Add native `uv` project support as a dedicated CLI subcommand (for example, `cyclonedx-py uv`) that:

- accepts a project directory (or `uv.lock` path),
- reads `pyproject.toml` and `uv.lock`,
- resolves dependency groups/extras in a way consistent with `uv`,
- generates CycloneDX JSON/XML output with the same quality and validation behavior as existing subcommands,
- is documented in `README` and `docs/usage.rst`,
- includes integration/unit tests and snapshot coverage.

## Describe alternatives you've considered

- **Environment scan (`cyclonedx-py environment`)**: works for installed packages, but is less lockfile-centric and can differ from the exact declared lock resolution.
- **Converting/exporting through external tools first**: adds extra steps and potential drift between source lock data and generated SBOM.
- **Maintaining custom scripts**: increases maintenance burden and reduces consistency with official tool behavior.

## Additional context

`uv` adoption is growing quickly, and users expect parity with other mainstream Python dependency workflows.
A dedicated `uv` subcommand would improve reproducibility, reduce friction in CI pipelines, and align with lockfile-driven supply chain practices.

## Contribution

- [x] I am willing to provide an implementation
- [ ] I will wait until somebody else implements it

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.