diff --git a/docs/docs/coverage/language/python.md b/docs/docs/coverage/language/python.md index 2266cb9b484b..c4f6b6d83e86 100644 --- a/docs/docs/coverage/language/python.md +++ b/docs/docs/coverage/language/python.md @@ -41,7 +41,7 @@ Trivy parses your files generated by package managers in filesystem/repository s ### pip -#### dependency detection +#### Dependency detection Trivy only parses [version specifiers](https://packaging.python.org/en/latest/specifications/version-specifiers/#id4) with `==` comparison operator and without `.*`. To convert unsupported version specifiers - use the `pip freeze` command. @@ -93,16 +93,16 @@ urllib3==1.26.15 `requirements.txt` files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment. -#### license detection +#### License detection `requirements.txt` files don't contain information about licenses. Therefore, Trivy checks `METADATA` files from `lib/site-packages` directory. Trivy uses 3 ways to detect `site-packages` directory: -- Checks `VIRTUAL_ENV` enveroment. -- detects path to `python`[^1] binary and checks `../lib/pythonX.Y/site-packages` directory. -- detects path to `python`[^1] binary and checks `../../lib/site-packages` directory. +- Checks `VIRTUAL_ENV` environment variable. +- Detects path to `python`[^1] binary and checks `../lib/pythonX.Y/site-packages` directory. +- Detects path to `python`[^1] binary and checks `../../lib/site-packages` directory. ### Pipenv Trivy parses `Pipfile.lock`.