Description

Detects missing lock files for Python projects using a requirements.txt file. Lock files are critical for dependency security as they ensure consistent, vetted dependencies are used across deployments. Without a lock file, projects may be vulnerable to supply chain attacks or dependency confusion.

Detection Strategy

• Skips requirements.txt files with no real declared dependencies (empty, comment-only, or only referencing other files via -r/-c)

• Skips requirements.txt files where every declared dependency is pinned to an exact version with == or === (PEP 440 arbitrary equality), since the file already behaves as its own lock file

• Treats a git dependency pinned to a full 40-character commit SHA as equally pinned, since a commit hash is as deterministic as an exact version and pip freeze always emits the full SHA for a VCS-installed package; an abbreviated SHA, a git dependency with no revision, or one pinned to a branch or tag, is not treated as pinned, since a short hex string could legitimately be a branch or tag name and both branches and tags can move

• Skips the check if a pyproject.toml file alongside requirements.txt is itself a poetry or uv project, since that case is already covered by the pyproject.toml lock file detection; a pyproject.toml present only for build metadata does not suppress the check

• Checks for the existence of a uv.lock, requirements.lock, pylock.toml, or pylock.<name>.toml file (PEP 751's standard lock file format) in the same directory as requirements.txt

• Reports a vulnerability if requirements.txt declares dependencies but no matching lock file is found