CycloneDX / CycloneDX/cyclonedx-python

feat: Support for `uv.lock` file from uv package manager

クローズ
#907 コメント 5 件 リアクション 5 件 担当者 0 名 @m7mdhka が担当を希望しています GitHub で見る
enhancement source: uv
主要言語
Python
スター
390
フォーク
98
平均マージ
2日 23時間
マージ済み PR(30日)
2

説明

## Is your feature request related to a problem? Please describe.
The CycloneDX Python tool currently does not explicitly support the `uv.lock` file format used by the [uv](https://github.com/astral-sh/uv) package manager.

While uv’s Python virtual environments are already supported (as mentioned in the documentation), there is no native support for reading the `uv.lock` file directly. This means users must still rely on indirect workarounds to generate an SBOM, which adds unnecessary complexity.

## Describe the solution you'd like
I would like CycloneDX-Python to include native support for parsing and generating SBOMs directly from the `uv.lock` file. This would streamline the process and avoid relying on indirect methods or manually activating environments just to extract dependency metadata.

## Describe alternatives you've considered
- Activating a uv-created virtual environment and using the current environment scan, which works but isn’t as robust or declarative as lockfile-based analysis.

## Additional context
`uv` is gaining popularity as a modern, fast alternative to pip and poetry. Supporting its lockfile format would allow CycloneDX-Python to integrate more seamlessly with modern Python development workflows, and improve SBOM adoption among users of `uv`.

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。