Skip to content

Commit

Permalink
docs(python): add note to using pip freeze for compatible releases (
Browse files Browse the repository at this point in the history
  • Loading branch information
DmitriyLewen authored Dec 13, 2023
1 parent 6cc00c2 commit b5e3b77
Showing 1 changed file with 25 additions and 0 deletions.
25 changes: 25 additions & 0 deletions docs/docs/coverage/language/python.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,31 @@ See [here](./index.md) for the detail.
Trivy parses your files generated by package managers in filesystem/repository scanning.

### pip
Trivy only parses [version specifiers](https://packaging.python.org/en/latest/specifications/version-specifiers/#id4) with `==` comparison operator and without `.*`.
To convert unsupported version specifiers - use the `pip freeze` command.

```bash
$ cat requirements.txt
boto3~=1.24.60
click>=8.0
json-fix==0.5.*
$ pip install -r requirements.txt
...
$ pip freeze > requirements.txt
$ cat requirements.txt
boto3==1.24.96
botocore==1.27.96
click==8.1.7
jmespath==1.0.1
json-fix==0.5.2
python-dateutil==2.8.2
s3transfer==0.6.2
setuptools==69.0.2
six==1.16.0
urllib3==1.26.18
wheel==0.42.0
```

`requirements.txt` files usually contain only the direct dependencies and not contain the transitive dependencies.
Therefore, Trivy scans only for the direct dependencies with `requirements.txt`.

Expand Down

0 comments on commit b5e3b77

Please sign in to comment.