research: evaluate uv.lock (Python) support - separate product or in-scope?

[sonukapoor]

Research whether uv.lock support belongs in CVE Lite CLI or warrants a separate product.

Background

uv is rapidly becoming the default Python package manager for modern Python projects. uv.lock is its lockfile format. A DINUM (French government) user running CVE Lite CLI across government digital service repositories requested Python lockfile scanning.

Questions to answer

• Does adding Python/uv.lock support fit the CVE Lite CLI product identity (currently JS/TS focused) or does it dilute it?
• Would a separate cve-lite-cli-python (or similar) be a better home?
• What would the OSV query surface look like for Python packages vs npm packages?
• Are there existing tools in the Python ecosystem this would compete with or complement (pip-audit, Safety)?
• What is the effort to parse uv.lock vs the JS/TS lockfile formats already supported?

Motivation

Requested by a DINUM (French government) user. No implementation commitment yet - this issue is to scope the decision first.

---

If you would like to see Python/uv.lock support, please give this issue a 👍 - it helps us prioritize.

[kaaloo]

Thanks for posting @sonukapoor . A unified CLI would be great as I'm frequently in the situation where we are dealing with polyglot Node / Python monorepos. Hope a polyglot CVE Lite CLI makes sense to others!