cycode 3.18.0__tar.gz → 3.18.1.dev2__tar.gz

{cycode-3.18.0 → cycode-3.18.1.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.18.0
+Version: 3.18.1.dev2
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE
@@ -44,6 +44,8 @@ Description-Content-Type: text/markdown
 
 # Cycode CLI User Guide
 
+[![MCP Toplist](https://mcptoplist.com/badge/glama%2Fcycodehq%2Fcycode-cli.svg)](https://mcptoplist.com/server/glama%2Fcycodehq%2Fcycode-cli)
+
 The Cycode Command Line Interface (CLI) is an application you can install locally to scan your repositories for secrets, infrastructure as code misconfigurations, software composition analysis vulnerabilities, and static application security testing issues.
 
 This guide walks you through both installation and usage.
@@ -858,6 +860,7 @@ The following ecosystems support automatic lockfile restoration:
 | NuGet | `*.csproj` | `packages.lock.json` | `dotnet restore --use-lock-file` |
 | Ruby | `Gemfile` | `Gemfile.lock` | `bundle --quiet` |
 | Poetry | `pyproject.toml` | `poetry.lock` | `poetry lock` |
+| pip | `pyproject.toml` / `requirements.txt` | `pylock.toml` | `pip lock .` / `pip lock -r requirements.txt -o pylock.toml` |
 | Pipenv | `Pipfile` | `Pipfile.lock` | `pipenv lock` |
 | PHP Composer | `composer.json` | `composer.lock` | `composer update --no-cache --no-install --no-scripts --ignore-platform-reqs` |
 

{cycode-3.18.0 → cycode-3.18.1.dev2}/README.md

@@ -1,5 +1,7 @@
 # Cycode CLI User Guide
 
+[![MCP Toplist](https://mcptoplist.com/badge/glama%2Fcycodehq%2Fcycode-cli.svg)](https://mcptoplist.com/server/glama%2Fcycodehq%2Fcycode-cli)
+
 The Cycode Command Line Interface (CLI) is an application you can install locally to scan your repositories for secrets, infrastructure as code misconfigurations, software composition analysis vulnerabilities, and static application security testing issues.
 
 This guide walks you through both installation and usage.
@@ -814,6 +816,7 @@ The following ecosystems support automatic lockfile restoration:
 | NuGet | `*.csproj` | `packages.lock.json` | `dotnet restore --use-lock-file` |
 | Ruby | `Gemfile` | `Gemfile.lock` | `bundle --quiet` |
 | Poetry | `pyproject.toml` | `poetry.lock` | `poetry lock` |
+| pip | `pyproject.toml` / `requirements.txt` | `pylock.toml` | `pip lock .` / `pip lock -r requirements.txt -o pylock.toml` |
 | Pipenv | `Pipfile` | `Pipfile.lock` | `pipenv lock` |
 | PHP Composer | `composer.json` | `composer.lock` | `composer update --no-cache --no-install --no-scripts --ignore-platform-reqs` |
 

{cycode-3.18.0 → cycode-3.18.1.dev2}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.18.0'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.18.1.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.18.0 → cycode-3.18.1.dev2}/cycode/cli/consts.py

@@ -118,6 +118,7 @@ SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'pyproject.toml',
     'uv.lock',
     'poetry.lock',
+    'pylock.toml',
     'pipfile',
     'pipfile.lock',
     'requirements.txt',
@@ -175,8 +176,9 @@ PROJECT_FILES_BY_ECOSYSTEM_MAP = {
     'sbt': ['build.sbt', 'build.scala', 'build.sbt.lock'],
     'pypi_uv': ['pyproject.toml', 'uv.lock'],
     'pypi_poetry': ['pyproject.toml', 'poetry.lock'],
+    'pypi_pip': ['pyproject.toml', 'pylock.toml'],
     'pypi_pipenv': ['Pipfile', 'Pipfile.lock'],
-    'pypi_requirements': ['requirements.txt'],
+    'pypi_requirements': ['requirements.txt', 'pylock.toml'],
     'pypi_setup': ['setup.py'],
     'hex': ['mix.exs', 'mix.lock'],
     'swift_pm': ['Package.swift', 'Package.resolved'],

cycode-3.18.1.dev2/cycode/cli/files_collector/sca/python/restore_pip_dependencies.py

@@ -0,0 +1,69 @@
+from pathlib import Path
+from typing import Optional
+
+import typer
+
+from cycode.cli.files_collector.sca.base_restore_dependencies import BaseRestoreDependencies, build_dep_tree_path
+from cycode.cli.models import Document
+from cycode.cli.utils.path_utils import get_file_content
+from cycode.logger import get_logger
+
+logger = get_logger('Pip Restore Dependencies')
+
+PIP_PYPROJECT_MANIFEST_FILE_NAME = 'pyproject.toml'
+PIP_REQUIREMENTS_MANIFEST_FILE_NAME = 'requirements.txt'
+PIP_LOCK_FILE_NAME = 'pylock.toml'
+
+_POETRY_TOOL_SECTION = '[tool.poetry]'
+_UV_TOOL_SECTION = '[tool.uv]'
+
+
+def _indicates_plain_pip(pyproject_content: Optional[str]) -> bool:
+    """Return True if pyproject.toml content signals a plain-pip project (no Poetry, no uv)."""
+    if not pyproject_content:
+        return False
+    return _POETRY_TOOL_SECTION not in pyproject_content and _UV_TOOL_SECTION not in pyproject_content
+
+
+class RestorePipDependencies(BaseRestoreDependencies):
+    def __init__(self, ctx: typer.Context, is_git_diff: bool, command_timeout: int) -> None:
+        super().__init__(ctx, is_git_diff, command_timeout)
+
+    def is_project(self, document: Document) -> bool:
+        manifest_name = Path(document.path).name
+
+        if manifest_name == PIP_REQUIREMENTS_MANIFEST_FILE_NAME:
+            return True
+
+        if manifest_name != PIP_PYPROJECT_MANIFEST_FILE_NAME:
+            return False
+
+        manifest_dir = self.get_manifest_dir(document)
+        if manifest_dir and (Path(manifest_dir) / PIP_LOCK_FILE_NAME).is_file():
+            return True
+
+        return _indicates_plain_pip(document.content)
+
+    def try_restore_dependencies(self, document: Document) -> Optional[Document]:
+        manifest_dir = self.get_manifest_dir(document)
+        lockfile_path = Path(manifest_dir) / PIP_LOCK_FILE_NAME if manifest_dir else None
+
+        if lockfile_path and lockfile_path.is_file():
+            content = get_file_content(str(lockfile_path))
+            relative_path = build_dep_tree_path(document.path, PIP_LOCK_FILE_NAME)
+            logger.debug('Using existing pylock.toml, %s', {'path': str(lockfile_path)})
+            return Document(relative_path, content, self.is_git_diff)
+
+        return super().try_restore_dependencies(document)
+
+    def get_commands(self, manifest_file_path: str) -> list[list[str]]:
+        if Path(manifest_file_path).name == PIP_REQUIREMENTS_MANIFEST_FILE_NAME:
+            return [['pip', 'lock', '-r', 'requirements.txt', '-o', PIP_LOCK_FILE_NAME]]
+
+        return [['pip', 'lock', '.']]
+
+    def get_lock_file_name(self) -> str:
+        return PIP_LOCK_FILE_NAME
+
+    def get_lock_file_names(self) -> list[str]:
+        return [PIP_LOCK_FILE_NAME]

{cycode-3.18.0 → cycode-3.18.1.dev2}/cycode/cli/files_collector/sca/sca_file_collector.py

@@ -17,6 +17,7 @@ from cycode.cli.files_collector.sca.npm.restore_pnpm_dependencies import Restore
 from cycode.cli.files_collector.sca.npm.restore_yarn_dependencies import RestoreYarnDependencies
 from cycode.cli.files_collector.sca.nuget.restore_nuget_dependencies import RestoreNugetDependencies
 from cycode.cli.files_collector.sca.php.restore_composer_dependencies import RestoreComposerDependencies
+from cycode.cli.files_collector.sca.python.restore_pip_dependencies import RestorePipDependencies
 from cycode.cli.files_collector.sca.python.restore_pipenv_dependencies import RestorePipenvDependencies
 from cycode.cli.files_collector.sca.python.restore_poetry_dependencies import RestorePoetryDependencies
 from cycode.cli.files_collector.sca.python.restore_uv_dependencies import RestoreUvDependencies
@@ -164,6 +165,7 @@ def _get_restore_handlers(ctx: typer.Context, is_git_diff: bool) -> list[BaseRes
         RestoreRubyDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreUvDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be before Poetry for pyproject.toml
         RestorePoetryDependencies(ctx, is_git_diff, build_dep_tree_timeout),
+        RestorePipDependencies(ctx, is_git_diff, build_dep_tree_timeout),  # Must be after Uv & Poetry (pyproject.toml)
         RestorePipenvDependencies(ctx, is_git_diff, build_dep_tree_timeout),
         RestoreComposerDependencies(ctx, is_git_diff, build_dep_tree_timeout),
     ]

{cycode-3.18.0 → cycode-3.18.1.dev2}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.18.0"
+version = "3.18.1.dev2"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"