Add Dependency Scanning support for Python projects using the uv package manager

Proposal

Add support for uv, the new package manager for Python, which was released this year (2024).

The customer uses uv which generates a uv.lock file.

Implementation

  • Add parser and uv.lock detection support in the dependency-scanning analyzer.
  • Import new parser logic into gemnasium and update file detection to include support for uv.lock.
  • Update the CI/CD template to include **/uv.lock in the file match pattern.
  • Update documentation for dependency scanning to mention support for uv.lock.

Workaround

It may be possible to use uv pip compile or uv export (https://docs.astral.sh/uv/reference/cli/#uv-export) to generate a requirements.txt file, which is one of the supported package managers by Dependency Scanning.

Edited by Oscar Tovar