Read poetry.lock file

I would like safety to be able to read dependencies from a poetry.lock file. It is written in TOML format.

Here is an example of how a dependency is written:

[[package]]
category = "dev"
description = "A configurable sidebar-enabled Sphinx theme"
name = "alabaster"
optional = false
python-versions = "*"
version = "0.7.12"

Here is a complete file:

poetry.lock

Currently the only way to use safety when developing a project with poetry is to actually install the dependencies (which is costly in CI) and run something like:

poetry run pip freeze | poetry run safety check --stdin

I would like to be able to run directly safety check -r poetry.lock or something equivalent 🙂 .

[kierun]

Please ignore me. Not enough coffee before I start work… Safety was not installed.

I shall go sit in a corner wearing a dunce hat.

/sigh

[pawamoy]

I’m now using

poetry export -f requirements.txt | safety check --stdin

…instead.

• pip freeze was also showing the current package as an editable install, that I had to filter out with an additionnal grep -v pipe (with ugly regex to match underscores/dashes and upper/lower case). poetry export -f requirements.txt don’t show dev dependencies, which is good since I don’t care if they have CVEs as they are not part of the published package, and it also doesn’t show the current package, fixing the previous pain point.
• safety is not installed as a dev dependency anymore, because doing so make it vulnerable to malicious packages installed in the same env, effectively canceling its usefulness (the malicious packages can override its check function to hide themselves). See https://nvd.nist.gov/vuln/detail/CVE-2020-5252. Instead, I install it with pipx so it’s isolated. You could also always use pipx if you want: poetry export -f requirements.txt | pipx run safety check --stdin