Python

Trivy supports three types of Python package managers: pip, Pipenv and Poetry. The following table provides an outline of the features Trivy offers.

Package manager	File	Transitive dependencies	Dev dependencies	Dependency graph	Position	License
pip	requirements.txt	-	Include	-	-	-
Pipenv	Pipfile.lock	✅	Include	-	✅	-
Poetry	poetry.lock	✅	Exclude	✅		-

In addition, Trivy supports two formats of Python packages: egg and wheel.

Packaging	License
Egg	✅
Wheel	✅

These may be enabled or disabled depending on the target. See here for the detail.

Package managers

Trivy parses your files generated by package managers in filesystem/repository scanning.

pip

requirements.txt files contain only the direct dependencies and not contain the transitive dependencies. Therefore, Trivy scans only for the direct dependencies with requirements.txt.

Also, requirements.txt files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment.

License detection is not supported for pip.

Pipenv

Trivy parses Pipfile.lock. Pipfile.lock files don't contain information about dependencies used for development. Trivy could detect vulnerabilities on the development packages, which not affect your production environment.

License detection is not supported for Pipenv.

Poetry

Trivy uses poetry.lock to identify dependencies and find vulnerabilities. To build the correct dependency graph, pyproject.toml also needs to be present next to poetry.lock.

License detection is not supported for Poetry.

Packaging

Trivy parses the manifest files of installed packages in container image scanning and so on. See here for the detail.

Egg

Trivy looks for *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO to identify Python packages.

Wheel

Trivy looks for .dist-info/META-DATA to identify Python packages.