REQUEST: Support uv.lock lockfile used by uv

[Fra9ment]

The uv( https://docs.astral.sh/uv/ ) is a single tool to replace pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and more.

And packages are hosted by PyPI.

This scanner may be able to support uv.lock files with minor modifications.

Note

The uv doesn't have a v1 release yet.

So, the lockfile format may change...

For other uv users

You can indirectly scan uv.lock files by exporting requirements.txt

uv export --frozen --output-file requirements.txt --quiet
# and exec osv-scanner

[lengau]

This would be useful for me, as it would scan the entire lockfile rather than just what gets exported. For example, the lockfiles can contain mutually exclusive dependencies that cannot be exported to requirements files.