Skip to content

Commit e8c32de

Browse files
gukoffknqyf263
andauthored
docs(python): Mention pip-compile (#8484)
Co-authored-by: Teppei Fukuda <[email protected]>
1 parent 9913465 commit e8c32de

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

docs/docs/coverage/language/python.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ keyring >= 4.1.1 # Minimum version 4.1.1
5454
Mopidy-Dirble ~= 1.1 # Minimum version 1.1
5555
python-gitlab==2.0.* # Minimum version 2.0.0
5656
```
57-
Also, there is a way to convert unsupported version specifiers - use the `pip freeze` command.
57+
Also, there is a way to convert unsupported version specifiers - use either the `pip-compile` tool (which doesn't install the packages)
58+
or call `pip freeze` from the virtual environment where the requirements are already installed.
5859

5960
```bash
6061
$ cat requirements.txt
@@ -81,7 +82,8 @@ wheel==0.42.0
8182
`requirements.txt` files usually contain only the direct dependencies and not contain the transitive dependencies.
8283
Therefore, Trivy scans only for the direct dependencies with `requirements.txt`.
8384

84-
To detect transitive dependencies as well, you need to generate `requirements.txt` with `pip freeze`.
85+
To detect transitive dependencies as well, you need to generate `requirements.txt` that contains them.
86+
Like described above, tou can do it with `pip freeze` or `pip-compile`.
8587

8688
```zsh
8789
$ cat requirements.txt # it will only find `[email protected]`.

0 commit comments

Comments
 (0)