CycloneDX / CycloneDX/cyclonedx-python

feat: Support for `uv.lock` file from uv package manager

Đã đóng
#907 5 bình luận 5 reaction 0 người được giao Được @m7mdhka nhận Xem trên GitHub
enhancement source: uv
Ngôn ngữ chính
Python
Star
390
Fork
98
Merge trung bình
2 ngày 23 giờ
Pull request đã merge (30 ngày)
2

Mô tả

## Is your feature request related to a problem? Please describe.
The CycloneDX Python tool currently does not explicitly support the `uv.lock` file format used by the [uv](https://github.com/astral-sh/uv) package manager.

While uv’s Python virtual environments are already supported (as mentioned in the documentation), there is no native support for reading the `uv.lock` file directly. This means users must still rely on indirect workarounds to generate an SBOM, which adds unnecessary complexity.

## Describe the solution you'd like
I would like CycloneDX-Python to include native support for parsing and generating SBOMs directly from the `uv.lock` file. This would streamline the process and avoid relying on indirect methods or manually activating environments just to extract dependency metadata.

## Describe alternatives you've considered
- Activating a uv-created virtual environment and using the current environment scan, which works but isn’t as robust or declarative as lockfile-based analysis.

## Additional context
`uv` is gaining popularity as a modern, fast alternative to pip and poetry. Supporting its lockfile format would allow CycloneDX-Python to integrate more seamlessly with modern Python development workflows, and improve SBOM adoption among users of `uv`.

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.