CycloneDX / CycloneDX/cyclonedx-python

feat: Support for `uv.lock` file from uv package manager

已关闭
#907 5 条评论 5 个 reaction 已指派 0 人 已被 @m7mdhka 认领 在 GitHub 查看
enhancement source: uv
主要语言
Python
星标
390
派生
98
平均合并
2 天 23 小时
30 天内合并 PR
2

描述

## Is your feature request related to a problem? Please describe.
The CycloneDX Python tool currently does not explicitly support the `uv.lock` file format used by the [uv](https://github.com/astral-sh/uv) package manager.

While uv’s Python virtual environments are already supported (as mentioned in the documentation), there is no native support for reading the `uv.lock` file directly. This means users must still rely on indirect workarounds to generate an SBOM, which adds unnecessary complexity.

## Describe the solution you'd like
I would like CycloneDX-Python to include native support for parsing and generating SBOMs directly from the `uv.lock` file. This would streamline the process and avoid relying on indirect methods or manually activating environments just to extract dependency metadata.

## Describe alternatives you've considered
- Activating a uv-created virtual environment and using the current environment scan, which works but isn’t as robust or declarative as lockfile-based analysis.

## Additional context
`uv` is gaining popularity as a modern, fast alternative to pip and poetry. Supporting its lockfile format would allow CycloneDX-Python to integrate more seamlessly with modern Python development workflows, and improve SBOM adoption among users of `uv`.

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

贡献指南

打开贡献指南

调研方向

首先查看开放的 pull request #1028 以及现有的关于 uv 创建的虚拟环境的文档。将所请求的原生 uv.lock 解析和 SBOM 生成与当前的环境扫描方法进行比较;当无需激活环境即可直接分析 uv.lock 依赖项时,即视为完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
tooling
Issue 类型
功能
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。