feat(python): add pylock.toml support by DmitriyLewen · Pull Request #10137 · aquasecurity/trivy

DmitriyLewen · 2026-02-04T11:05:37Z

Description

Add support for pylock.toml (PEP 751) lock file format.
This PR implements:

New pylock analyzer that works in fs and repo modes
PyLock LangType and TypePyLock analyzer type constants
PURL mapping for pylock packages (mapped to PyPi)
detector mapping for pylock type
Integration test with vulnerability detection
Documentation update for Python page

Changes

pkg/fanal/types/const.go: Add PyLock LangType and rename filename constant to PyLockFile
pkg/fanal/analyzer/const.go: Add TypePyLock analyzer type and update slices
pkg/fanal/analyzer/language/python/pylock/: New pylock analyzer package
pkg/dependency/parser/python/pylock/parse.go: Update parser to accept context parameter
pkg/purl/purl.go: Add PyLock to PyPi type mapping
integration/: Add integration test for pylock
docs/guide/coverage/language/python.md: Add pylock documentation

Example

➜ ./trivy -q fs pylock.toml  --table-mode summary

Report Summary

┌─────────────┬────────┬─────────────────┬─────────┐
│   Target    │  Type  │ Vulnerabilities │ Secrets │
├─────────────┼────────┼─────────────────┼─────────┤
│ pylock.toml │ pylock │       12        │    -    │
└─────────────┴────────┴─────────────────┴─────────┘

Related issues

Close Add support for pylock.toml (PEP 751) #9410

Related PRs

feat(python): add pylock.toml (PEP 751) parser #9632

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Add support for pylock.toml (PEP 751) lock file format. - Add PyLock LangType and TypePyLock analyzer type - Add pylock analyzer for fs and repo modes - Update parser to accept context parameter - Update purl package to map PyLock to PyPi - Add integration test and documentation

knqyf263 · 2026-02-18T08:02:38Z

pkg/fanal/analyzer/language/python/pylock/pylock.go

+
+type pylockAnalyzer struct{}
+
+func (a pylockAnalyzer) Analyze(ctx context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {


PEP 751 states that pylock.toml should be placed alongside pyproject.toml:

The lock file(s) SHOULD be located in the directory as appropriate for the scope of the lock file. Locking against a single pyproject.toml, for instance, would place the pylock.toml in the same directory.

Don't we need to parse pyproject.toml (e.g., [project.dependencies]) to determine direct vs indirect dependencies, similar to how the poetry analyzer does it? If so, this would need to be a PostAnalyzer instead of a simple Analyzer.

I initially added the analyzer only for pylock.toml, but it makes sense to support pyproject.toml as well.
Added in 2ad6402

knqyf263 · 2026-02-18T08:02:38Z

pkg/fanal/analyzer/language/python/pylock/pylock.go

+}
+
+func (a pylockAnalyzer) Required(filePath string, _ os.FileInfo) bool {
+	return filepath.Base(filePath) == types.PyLockFile


PEP 751 defines that a lock file must be named pylock.toml or match the regex r"^pylock\.([^.]+)\.toml$" (e.g., pylock.linux.toml, pylock.prod.toml). Do we need to handle the pylock.<IDENTIFIER>.toml pattern as well?

Nice catch!
Added d6ce02c.

I don't think it makes sense to use the regex from PEP 751.
I only added a check for the prefix and suffix.
I believe this should be sufficient for our case.

PEP 751 allows lock files to be named pylock.toml or pylock.<identifier>.toml (e.g., pylock.linux.toml, pylock.prod.toml).

Prepare for pyproject.toml integration to identify direct/indirect dependencies, similar to how poetry analyzer works.

Parse pyproject.toml alongside pylock.toml to identify direct vs indirect dependencies using [project.dependencies] (PEP 621).

knqyf263 · 2026-02-18T11:39:12Z

pkg/fanal/analyzer/language/python/pylock/pylock.go

+func (a pylockAnalyzer) matchLockFile(filePath string) bool {
+	// Match pylock.toml or pylock.<identifier>.toml (PEP 751)
+	base := filepath.Base(filePath)
+	return strings.HasPrefix(base, "pylock.") && strings.HasSuffix(base, ".toml")


PEP 751 defines the regex r"^pylock\.([^.]+)\.toml$" for named lock files, where the identifier must NOT contain dots ([^.]+). The current HasPrefix/HasSuffix approach is more permissive and would also match files like pylock.linux.arm64.toml, which is technically not valid per the spec. Is this intentional, or should we use a stricter regex match?

Yes, this is an intentional trade-off. I prefer to avoid regex unless absolutely necessary, especially in a hot path like this (checking every scanned file).

I think we can afford to be lenient here. The likelihood of encountering a file with a dot in the identifier (e.g., pylock.linux.arm64.toml) is extremely low. Even if we do find such a file:

We scan it successfully. The user likely ignored the PEP 751 naming convention, but I don't think it's Trivy's job to enforce that.

If the file is invalid for some reason, we will simply show a debug log.

At the very least, we should state that detecting files that violate PEP 751 is the intended behavior. Otherwise, it just looks like a bug. Even looking at the tests, they simply expect true, which also makes it look like dots are allowed in PEP 751.

{ name: "named lock file with dots in identifier", filePath: "pylock.linux.arm64.toml", want: true, },

I don't know what I was thinking yesterday 😄 .
I realized I can simply check that there is no dot in the identifier.

Updated the logic in 57006f5

knqyf263 · 2026-02-18T11:39:12Z

pkg/fanal/analyzer/language/python/pylock/pylock.go

+		return xerrors.Errorf("unable to parse %s: %w", path, err)
+	}
+
+	directDeps := p.MainDeps()


Should we also mark dev dependencies (i.e., set Dev: true) here? The poetry analyzer identifies production dependencies by traversing the dependency graph from MainDeps(), and marks packages not reachable from that graph as Dev: true. A similar approach could work here.

make sense. Thanks!

Added in 42a8506

Traverse the dependency graph from production dependencies defined in pyproject.toml [project.dependencies] to identify dev packages. Packages not reachable from production roots are marked with Dev: true.

Use strict regex matching per PEP 751 specification: ^pylock\.([^.]+)\.toml$ - identifier cannot contain dots. Also update documentation with pylock features.

github-actions bot added the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Feb 4, 2026

aqua-bot requested a review from a team February 4, 2026 11:09

DmitriyLewen added 3 commits February 4, 2026 17:25

fix: add missed imports + refactor

2958305

refactor: change PostAnalyze to Analyze for pylock

6a933f2

test(integration): update golden file

3af33f1

DmitriyLewen self-assigned this Feb 4, 2026

aquasecurity deleted a comment from github-actions bot Feb 4, 2026

DmitriyLewen removed the request for review from a team February 4, 2026 11:36

test(unit): update testcases

1e99cf7

DmitriyLewen added autoready Automatically mark PR as ready for review when all checks pass and removed apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) labels Feb 4, 2026

github-actions bot added the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Feb 4, 2026

aqua-bot requested a review from a team February 4, 2026 12:07

github-actions bot marked this pull request as ready for review February 4, 2026 12:26

github-actions bot requested a review from knqyf263 as a code owner February 4, 2026 12:26

github-actions bot removed the autoready Automatically mark PR as ready for review when all checks pass label Feb 4, 2026

aquasecurity deleted a comment from github-actions bot Feb 5, 2026

DmitriyLewen removed the request for review from a team February 5, 2026 05:47

knqyf263 reviewed Feb 18, 2026

View reviewed changes

DmitriyLewen added 4 commits February 18, 2026 15:18

feat(python): support pylock.<identifier>.toml naming pattern

d6ce02c

PEP 751 allows lock files to be named pylock.toml or pylock.<identifier>.toml (e.g., pylock.linux.toml, pylock.prod.toml).

refactor(python): convert pylock analyzer to PostAnalyzer

c7f3ce4

Prepare for pyproject.toml integration to identify direct/indirect dependencies, similar to how poetry analyzer works.

feat(python): add pyproject.toml support for pylock analyzer

2ad6402

Parse pyproject.toml alongside pylock.toml to identify direct vs indirect dependencies using [project.dependencies] (PEP 621).

Merge branch 'main' into feat/pylock-analyzer

018bf29

aqua-bot requested a review from a team February 18, 2026 09:41

aquasecurity deleted a comment from github-actions bot Feb 18, 2026

DmitriyLewen removed the request for review from a team February 18, 2026 09:47

DmitriyLewen removed the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Feb 18, 2026

knqyf263 reviewed Feb 18, 2026

View reviewed changes

feat(python): mark dev dependencies in pylock analyzer

42a8506

Traverse the dependency graph from production dependencies defined in pyproject.toml [project.dependencies] to identify dev packages. Packages not reachable from production roots are marked with Dev: true.

github-actions bot added the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Feb 19, 2026

aqua-bot requested a review from a team February 19, 2026 06:08

aquasecurity deleted a comment from github-actions bot Feb 19, 2026

DmitriyLewen removed the request for review from a team February 19, 2026 06:18

fix(python): enforce strict PEP 751 naming for pylock files

57006f5

Use strict regex matching per PEP 751 specification: ^pylock\.([^.]+)\.toml$ - identifier cannot contain dots. Also update documentation with pylock features.

DmitriyLewen force-pushed the feat/pylock-analyzer branch from cbd1b61 to 57006f5 Compare February 19, 2026 06:28

aqua-bot requested a review from a team February 19, 2026 06:32

DmitriyLewen removed the request for review from a team February 19, 2026 06:33

DmitriyLewen removed the apidiff Indicates Go API changes relevant to library consumers (CLI compatibility may be unaffected) label Feb 19, 2026

aquasecurity deleted a comment from github-actions bot Feb 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat(python): add pylock.toml support#10137

feat(python): add pylock.toml support#10137
DmitriyLewen wants to merge 11 commits intoaquasecurity:mainfrom
DmitriyLewen:feat/pylock-analyzer

DmitriyLewen commented Feb 4, 2026 •

edited

Loading

Uh oh!

knqyf263 Feb 18, 2026

Uh oh!

DmitriyLewen Feb 18, 2026

Uh oh!

knqyf263 Feb 18, 2026

Uh oh!

DmitriyLewen Feb 18, 2026

Uh oh!

knqyf263 Feb 18, 2026

Uh oh!

DmitriyLewen Feb 18, 2026

Uh oh!

knqyf263 Feb 18, 2026

Uh oh!

DmitriyLewen Feb 19, 2026 •

edited

Loading

Uh oh!

knqyf263 Feb 18, 2026

Uh oh!

DmitriyLewen Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		type pylockAnalyzer struct{}

		func (a pylockAnalyzer) Analyze(ctx context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {

Comments

Conversation

DmitriyLewen commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Example

Related issues

Related PRs

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

DmitriyLewen commented Feb 4, 2026 •

edited

Loading

DmitriyLewen Feb 19, 2026 •

edited

Loading