CycloneDX / CycloneDX/cyclonedx-python
Feature request: Add native uv project support (pyproject.toml + uv.lock) via cyclonedx-py uv subcommand
- Dominant language
- Python
- Stars
- 390
- Forks
- 98
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 2
Description
## Is your feature request related to a problem? Please describe.
Yes. `cyclonedx-py` currently supports generating SBOMs from environments, requirements, Pipenv, and Poetry projects, but there is no first-class `uv` project workflow in released versions.
This makes it harder for teams using `uv` to generate lockfile-based SBOMs directly from `pyproject.toml` + `uv.lock`, and can block adoption in projects where `uv` is the package manager of record.
## Describe the solution you'd like
Add native `uv` project support as a dedicated CLI subcommand (for example, `cyclonedx-py uv`) that:
- accepts a project directory (or `uv.lock` path),
- reads `pyproject.toml` and `uv.lock`,
- resolves dependency groups/extras in a way consistent with `uv`,
- generates CycloneDX JSON/XML output with the same quality and validation behavior as existing subcommands,
- is documented in `README` and `docs/usage.rst`,
- includes integration/unit tests and snapshot coverage.
## Describe alternatives you've considered
- **Environment scan (`cyclonedx-py environment`)**: works for installed packages, but is less lockfile-centric and can differ from the exact declared lock resolution.
- **Converting/exporting through external tools first**: adds extra steps and potential drift between source lock data and generated SBOM.
- **Maintaining custom scripts**: increases maintenance burden and reduces consistency with official tool behavior.
## Additional context
`uv` adoption is growing quickly, and users expect parity with other mainstream Python dependency workflows.
A dedicated `uv` subcommand would improve reproducibility, reduce friction in CI pipelines, and align with lockfile-driven supply chain practices.
## Contribution
- [x] I am willing to provide an implementation
- [ ] I will wait until somebody else implements it
Contributor guide
Research direction
Start by reviewing the existing cyclonedx-py subcommands and the linked pull request #1028, then read README and docs/usage.rst for the documented CLI patterns. Done means a dedicated uv workflow accepts pyproject.toml and uv.lock, produces the requested CycloneDX outputs, and has the requested unit, integration, and snapshot coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, documentation, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100