PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Moving Away from requirements.txt for More Secure Python Dependencies

hackerone.com | blog | #supply-chain | #dependency-management | #python | #package-management | #poetry | #supply-chain-security | #pipenv
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Why Python projects should move past requirements.txt: it lacks dependency resolution and sub-dependency management, and modern tools like Pipenv and Poetry provide lockfiles and better security.
Published
Collected

Related coverage

blog · about.gitlab.com
curl removed from Omnibus-GitLab FIPS packages in 19.0
From Omnibus-GitLab 19.0, FIPS packages drop GitLab's bundled curl for the distribution's package, mirroring the OpenSSL approach; customers must track OS-level curl security updates themselves.
blog · aikido.dev
Introducing Aikido Package Health: a Better Way to Trust Your Dependencies
Aikido Package Health surfaces the true health of an open source package with a single score. It helps devs understand stability, maintenance quality, and supply-chain risk before installing a dependency.
blog · aikido.dev
Why Lockfiles Matter for Supply Chain Security
Lockfiles pin exact dependency versions, ensuring reproducible builds and blocking automatic updates to potentially compromised packages—a simple but critical defense against supply chain attacks.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · hackerone.com
Why is NPM Fetching a Dependency Not in My package-lock.json?
npm can fetch dependencies missing from package-lock.json when packages come from GitHub repos, relative paths, or carry peer dependencies; the post explains why and how to manage it safely.
blog · hackerone.com
Securing the Supply Chain by Working With Ethical Hackers
HackerOne experts discuss securing the software supply chain with ethical hackers, citing SolarWinds and ENISA supplier-compromise data, and announce an expanded Internet Bug Bounty for open source.
Back