The uv( https://docs.astral.sh/uv/ ) is a single tool to replace pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and more.

And packages are hosted by PyPI.

This scanner may be able to support uv.lock files with minor modifications.

Note

The uv doesn't have a v1 release yet.

So, the lockfile format may change...

For other uv users

You can indirectly scan uv.lock files by exporting requirements.txt

uv export --frozen --output-file requirements.txt --quiet
# and exec osv-scanner