Description

Detects missing lock files for Python projects using a requirements.txt file. Lock files are critical for dependency security as they ensure consistent, vetted dependencies are used across deployments. Without a lock file, projects may be vulnerable to supply chain attacks or dependency confusion.

Detection Strategy

• Skips requirements.txt files with no real declared dependencies (empty, comment-only, or only referencing other files via -r/-c)

• Skips the check if a pyproject.toml file alongside requirements.txt is itself a poetry or uv project, since that case is already covered by the pyproject.toml lock file detection; a pyproject.toml present only for build metadata does not suppress the check

• Checks for the existence of a uv.lock or requirements.lock file in the same directory as requirements.txt

• Reports a vulnerability if requirements.txt declares dependencies but no matching lock file is found