Ecosystempip / Python
pip / Python Scanner
Deptic's Python scanner parses dependency definitions and queries the PyPI registry to resolve transitive dependencies without executing Python code or setting up virtual environments.
Manifest files detected:
| File | Priority | Notes |
|---|---|---|
requirements.txt | High | Standard pip requirements |
pyproject.toml | High | Poetry, Flit, Hatchling |
Pipfile.lock | Medium | Pipenv locked dependencies |
setup.py | Low | Legacy setuptools (static parsing only) |
PURL format for PyPI:
pkg:pypi/requests@2.31.0
pkg:pypi/django@4.2.1Note: PyPI package names in PURLs are always lowercased and use hyphens instead of underscores, following the standard specification.
Known limitations:
- Dependencies specified as GitHub repository links (
git+https://...) are not resolved transitively - For
setup.py, Deptic uses AST parsing to extract dependencies. Highly dynamic definitions may be missed.