I’ve been setting up my monorepo projects with a Software Composition Analysis (SCA) platform (product security tools to manage/monitor dependencies licensing/vulnerabilities) and it is straight forward export the python dependancies for the whole monorepo (just strip off the comment lines off a python pex lock file and

pex lock export

to a compatible format for the SCA platform). But what I really need is the ability to

pex lock export

per component/target in the monorepo, different artefacts are used/distributed differently, and thus have different risk profiles. I’ve manually determined the steps to go from

pants dependencies --dependencies-transitive

to a requirements.txt for python, and something similar with golang, and now I’m deciding how to best put this into code. Would this be a good candidate for a pants plugin?

So

./pants dependencies --transitive

(note in passing that you can omit the goal name in the flag if it's after the goal) will give you the direct third-party reqs that Pants knows about, but not those reqs transitive reqs

it supports pipfile, requirements.txt, or a poetry lock file for python. It's not able to do transitive resolution itelsef. I've found how to parse the lock file to get the versions etc.

The first thing would definitely be valuable.

Thanks @happy-kitchen-89482 I’ve opened the issue here: https://github.com/pantsbuild/pants/issues/17813