pipenv
Last updated July 30, 2026View source (v0.21.1)
Bomly uses this chain when it finds pipenv evidence.
| Property | Value |
|---|---|
| Package manager | pipenv |
| Ecosystem | python |
| Detector chain | pipenv-detector, syft-detector |
| Evidence patterns | Pipfile, Pipfile.lock |
| Ignored directories | __pycache__ |
| Ignored directory markers | pyvenv.cfg |
| Multi-module resolution | No |
| Install-first support | Yes |
| Remediation hints | direct-bump1, transitive-override2 |
| Native command hints | pipenv, syft for bomly-lite |
How pipenv resolves
pipenv-detector is project-env first with a lockfile fallback. It prefers an inspected Pipenv virtualenv because that includes transitive edges from package metadata, but it validates the environment against the selected Pipfile / Pipfile.lock before returning it.
| Path | Strategy | Command |
|---|---|---|
| Existing Pipenv venv | Project environment | pipenv run python -m pip inspect --local |
No valid venv and Pipfile.lock present | Locked sync + inspect | pipenv sync (plus --dev unless --scope runtime), then pipenv run python -m pip inspect --local |
| Sync unavailable or invalid | Manifest-only fallback | Parse Pipfile.lock (no exec) |
The inspected graph is accepted only when declared packages are present in the virtualenv. If the environment is stale or belongs to another project, Bomly rejects it and tries the locked sync path before falling back to Pipfile.lock.
Network behavior
✅ The Pipfile.lock parser is offline and does not execute Pipenv.
⚠️ The sync path can download packages from PyPI or configured indexes, but it installs into Pipenv's managed virtualenv and should not update the lockfile.
Prerequisites
- One of:
- A valid Pipenv-managed virtualenv, or
- A committed
Pipfile.lock.
- For
--install-first:pipenvonPATH. - Inspecting a Pipenv virtualenv needs pip 22.2 or newer inside it (
pip inspectdoes not exist before that). Older environments fall back to parsingPipfile.lock.
--install-first
pipenv supports --install-first. With a lockfile, Bomly runs pipenv sync before resolving the graph, adding --dev unless --scope runtime is selected. Without a lockfile, Bomly falls back to pipenv install.
⚠️ --install-first can download packages from PyPI and creates / updates the Pipenv-managed virtualenv.
bomly scan --install-first
Customizing the install command
Append flags to the Pipenv install/sync command with repeatable --install-arg. Requires --detectors pipenv-detector. Bomly records the sanitized command in scan JSON under the manifest's resolution metadata.
# Include dev dependencies; fail fast on a lockfile drift
bomly scan --install-first --detectors pipenv-detector \
--install-arg --dev --install-arg --deploy
Source details
Bomly reads registry, Git, URL, and local-file sources from Pipfile.lock.
When Pipenv uses pip inspection, Bomly uses pip's direct_url record instead.
Reachability (experimental)
Experimental. Reachability is opt-in via
--analyze. The feature is stable in shape but may evolve; ecosystem coverage is expanding.
For Pipenv-managed packages, the analyzer is pyreach at Tier-3 (package). See REACHABILITY.md.
Limitations
- Pipenv 2024+ lock format is preferred; older formats parse but with reduced detail.
[dev-packages]is recorded withdevelopmentscope.- Lockfile fallback is flatter.
Pipfile.lockdoes not encode parent-child edges, so the fallback graph is less precise than a validated virtualenv inspection.