Lockfile Python Packages

pip-tools

A set of tools to keep your pinned Python dependencies fresh.

hatch-pip-compile

hatch plugin to use pip-compile (or uv) to manage project dependencies and lockfiles

pyodide-lock

Tooling to manage the `pyodide-lock.json` file

conda-lock

Lightweight lockfile for conda environments

dev-prune

Reclaim disk space from idle Git repositories. A Rust CLI that deletes node_modules, .venv, target and vendor only after the project's own package manager proves a lockfile can rebuild them.

taintrace

Typosquat detector for AI coding agent dependencies

mpat

Lockfile-based upstream drift tracking for Python monkeypatches

poetry-monoranger-plugin

A Poetry plugin to support monorepo setups for Python, enabling shared lockfiles and directory dependency pinning.

mcp-pin

You approve an MCP server. Heldfast records what you approved. Later it tells you what moved, and guard refuses the rest.

pixi-sbom

pixi-sbom is a Pixi extension that generates Software Bills of Materials (SBOMs) from Pixi manifests and lock files, supporting dependency visibility, reproducibility, and supply-chain security workflows.

tox-poetry-installer

A plugin for Tox that lets you install test environment dependencies from the Poetry lockfile

heldfast

You approve an MCP server. Heldfast records what you approved. Later it tells you what moved, and guard refuses the rest.

boundver

A Git-aware lockfile and CI check for contracts shared across components

ud-resolver

Resolve, Lock and audit dependencies across 18+ ecosystems (PyPI, npm, Cargo, Conda, Go, Maven, NuGet..) In one pass. CUDA-aware resolution, CVE scanning, SBOM generation, and a single cross-ecosystem lock file - with CLI, REST API, desktop app, and VS Code extension.

pwned-deps

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

pip-deepfreeze

A simple pip freeze workflow for Python application developers

poetry-plugin-check-yanked

A Poetry plugin to check for yanked packages in the poetry.lock file.

skillock

Blocks risky AI agent skills before they read secrets, run code, or drift unnoticed

knowyourai

Is the model on your machine the model it claims to be? Zero-dependency CLI that verifies open-weight models (GGUF, safetensors, Ollama, Hugging Face) and pins them in a lockfile.

flitenv

📦🐍 Dependency manager for modern Python projects

deptrail

Time-axis forensics for npm supply-chain incidents: did we install it, did it run, what must be rotated

pin-west

Pin and update revisions in west manifests to exact commit SHAs

pybinlock

Read, write, and manage Avid bin locks programmatically

vand

Materialize and pin external source instances, delegate lifecycle actions to native tools, and record provenance independently of the source backend.