This project uses hash-based dependency pinning for enhanced security and reproducibility.

Hash pinning provides several security and reliability benefits:

1. Supply Chain Attack Protection: Prevents malicious packages from being substituted during installation
2. Reproducible Builds: Ensures identical dependencies across environments
3. Tamper Detection: Validates package integrity through cryptographic hashes
4. Compliance: Meets security requirements for production environments

Dependencies are managed using:

• pyproject.toml: Defines project metadata and high-level dependencies
• requirements.lock: Contains exact versions with SHA256 hashes generated by uv

To update dependencies while maintaining hash pinning:

# Update lock file with new hashes
uv pip compile pyproject.toml --generate-hashes --output-file requirements.lock

# Install with hash verification
uv pip sync requirements.lock

• Never bypass hash verification in production
• Regularly audit dependencies for known vulnerabilities
• Use osv-scanner to check for security issues in dependencies
• Keep dependencies updated to latest secure versions

• pip Secure Installs Guide
• uv Documentation
• NIST Cybersecurity Framework