uv

Bomly uses this chain when it finds uv evidence.

How uv resolves

uv-detector is lockfile-first. A readable uv.lock is the preferred source because it is deterministic and carries transitive dependency data. Bomly only falls back to uv environment inspection when a lockfile exists but cannot be parsed.

The --frozen flag prevents lockfile updates during environment preparation, and --no-sync prevents the inspect command from changing the environment. The inspected graph is accepted only when it contains the packages declared by the selected uv project.

Network behavior

✅ The uv.lock parser is offline and does not execute uv.

⚠️ The frozen sync fallback can download packages from PyPI or configured indexes, but it must not update the lockfile or project manifest.

Prerequisites

• A committed uv.lock.
• pyproject.toml for evidence pattern matching.
• For --install-first: uv on PATH.

--install-first

uv supports --install-first. When passed, Bomly runs uv sync --frozen --no-install-project, then uv pip install pip, before resolving the graph.

⚠️ --install-first can download packages from PyPI and writes to the uv-managed virtualenv without changing uv.lock.

bomly scan --install-first

Customizing the install command

Append flags to uv sync --frozen --no-install-project with repeatable --install-arg. Requires --detectors uv-detector. Bomly records the sanitized sync command in scan JSON under the manifest's resolution metadata.

# Refuse to update the lockfile; sync exactly what's locked
bomly scan --install-first --detectors uv-detector \
  --install-arg --frozen

Examples

Fix a direct vulnerability

[project]
dependencies = [
  "requests>=2.32.0",
]

uv lock --upgrade-package requests. Re-scan.

Pin a transitive vulnerability

uv lock --upgrade-package urllib3

Or add a constraint in pyproject.toml:

[tool.uv]
constraint-dependencies = ["urllib3>=2.2.2"]

Re-lock and re-scan.

Source details

Bomly reads registry, Git, URL, path, and editable sources from each uv.lock package source table. An entry without source evidence stays unknown.

Reachability (experimental)

Experimental. Reachability is opt-in via --analyze. The feature is stable in shape but may evolve; ecosystem coverage is expanding.

For uv-managed packages, the analyzer is pyreach at Tier-3 (package). See REACHABILITY.md.

Limitations

• uv lockfile format is stable but still evolves; track upstream changes if you pin Bomly versions in CI.
• uv workspaces are scanned per workspace member; each is its own subproject.
• No lockfile, no graph. Bomly refuses to inspect an unprepared uv environment when uv.lock is missing because that can produce stale or unrelated dependencies.