Use osv-scanner to scan `uv.lock` files
Metadata
Current evaluation
Enhancement to add osv-scanner scanning of uv.lock files in the scan-python workflow. Blocked by google/osv-scanner#1406 which is now resolved; implementation pending osv-scanner version update via iosifache/osv-scanner-snap#3.
Suggested action: keep open
Reason: The issue is triaged (Status: Triaged label) and the blocking dependency (google/osv-scanner#1406) has been resolved per the May 2025 comment. The remaining work is updating the osv-scanner version via the referenced snap PR, making this a concrete, actionable enhancement that should stay open until implemented.
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
50
Quick Win:
35.0
Staleness:
45
Complexity:
30
Confidence:
70
Support Request:
0
|
keep open | Enhancement to add osv-scanner scanning of uv.lock files in the scan-python workflow. Blocked by google/osv-scanner#1406 which is now resolved; implementation pending osv-scanner version update via iosifache/osv-scanner-snap#3. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
65
Complexity:
20
Confidence:
90
Support Request:
0
|
keep open | Enhancement to add uv.lock scanning to the scan-python workflow using osv-scanner. Triaged and unblocked after upstream resolution, awaiting implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
30
Confidence:
75
Support Request:
5
|
keep open | Enhancement to scan uv.lock files in the scan-python workflow using osv-scanner. The external blocker is resolved, but implementation has been pending for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
20
Complexity:
25
Confidence:
90
Support Request:
0
|
keep open | Add osv-scanner support to the scan-python workflow for uv.lock files. The upstream blocker is resolved, and a snap update PR is ready. Implementation can proceed. Status: triaged, awaiting assignment. |
Update history
No update history recorded yet.
Related work
-
Blocked By:
google/osv-scanner#1406
(confidence 90%)
Explicitly cited as the blocking issue in the issue body; now resolved per the 2025-05-21 comment
-
Related To:
iosifache/osv-scanner-snap#3
(confidence 75%)
Referenced in the 2025-05-21 comment as the PR that should help resolve the osv-scanner version update needed to implement this
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #153 fix: scan uv.lock natively with osv-scanner | starflow | closed | Closed without merging. The native uv.lock scanning fix was abandoned due to widespread CI test failures across multiple Python environments. |