The pyproject.toml uses version ranges (>=7.0, >=4.0) which is standard, but a lockfile that pins exact versions with hashes prevents dependency confusion and typosquatting attacks on the supply chain.
Options:
pip-tools (pip-compile): generates requirements.txt with hashesuv lock: generates uv.lock in TOML format
Either approach ensures reproducible installs and makes supply chain attacks detectable. The lockfile should be checked in and kept updated via Dependabot or a CI step.
The
pyproject.tomluses version ranges (>=7.0,>=4.0) which is standard, but a lockfile that pins exact versions with hashes prevents dependency confusion and typosquatting attacks on the supply chain.Options:
pip-tools(pip-compile): generatesrequirements.txtwith hashesuv lock: generatesuv.lockin TOML formatEither approach ensures reproducible installs and makes supply chain attacks detectable. The lockfile should be checked in and kept updated via Dependabot or a CI step.