A set of tools to keep your pinned Python dependencies fresh.
This report summarizes scanner evidence for jazzband/pip-tools, a Python project with 8,007 GitHub stars. SynthScan examined 21,311 lines of code across 119 source files, recording 466 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 20.2 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 361 finding(s).
Are imports declared and package/API names verified? 96 finding(s).
Are wrappers, guards, and repeated structures necessary? 329 finding(s).
Which changes need focused human review? 466 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 466 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/sync.py | 167 | def _direct_url_has_archive_hash(direct_url: DirectUrl) -> bool: | CODE |
| LOW | piptools/build.py | 55 | def maybe_statically_parse_project_metadata( | CODE |
| LOW | piptools/build.py | 189 | def _temporary_constraints_file_set_for_pip( | CODE |
| LOW | piptools/build.py | 261 | def _build_project_wheel_metadata( | CODE |
| LOW | piptools/build.py | 303 | def _prepare_build_requirements( | CODE |
| LOW | piptools/utils.py | 121 | def _build_direct_reference_best_efforts(ireq: InstallRequirement) -> str: | CODE |
| LOW | piptools/utils.py | 406 | def get_required_pip_specification() -> SpecifierSet: | CODE |
| LOW | piptools/utils.py | 420 | def get_sys_path_for_python_executable(python_executable: str) -> list[str]: | CODE |
| LOW | piptools/utils.py | 447 | def override_defaults_from_config_file( | CODE |
| LOW | piptools/utils.py | 480 | def _assign_config_to_cli_context( | CODE |
| LOW | piptools/utils.py | 624 | def _normalize_keys_in_config(config: dict[str, _t.Any]) -> dict[str, _t.Any]: | CODE |
| LOW | piptools/utils.py | 628 | def _invert_negative_bool_options_in_config( | CODE |
| LOW | piptools/resolver.py | 78 | def combine_install_requirements( | CODE |
| LOW | piptools/resolver.py | 171 | def _filter_out_unsafe_constraints( | STRING |
| LOW | piptools/resolver.py | 716 | def _get_install_requirements( | STRING |
| LOW | piptools/resolver.py | 753 | def _get_reverse_dependencies( | CODE |
| LOW | piptools/resolver.py | 778 | def _get_install_requirement_from_candidate( | CODE |
| LOW | piptools/_internal/_pip_api/command_methods.py | 23 | def make_requirement_preparer_from_command( | CODE |
| LOW | piptools/_internal/_pip_api/install_requirements.py | 14 | def create_install_requirement( | CODE |
| LOW | piptools/_internal/_pip_api/install_requirements.py | 37 | def create_install_requirement_from_line( | CODE |
| LOW | piptools/_internal/_pip_api/package_finder.py | 21 | def get_pip_request_failed_exception_types() -> tuple[type[Exception], ...]: | CODE |
| LOW | piptools/_internal/_pip_api/package_finder.py | 46 | def finder_allows_prereleases_of_req( | CODE |
| LOW | piptools/_internal/_pip_api/package_finder.py | 63 | def finder_allows_all_prereleases(finder: PackageFinder) -> bool: | CODE |
| LOW | piptools/_internal/_pip_api/pip_version.py | 16 | def get_pip_version_for_python_executable(python_executable: str) -> Version: | CODE |
| LOW | piptools/repositories/local.py | 20 | def ireq_satisfied_by_existing_pin( | CODE |
| LOW | piptools/repositories/pypi.py | 492 | def open_local_or_remote_file(link: Link, session: Session) -> Iterator[FileStream]: | CODE |
| LOW | piptools/repositories/pypi.py | 534 | def _get_true_base_from_index_url(url: str) -> str: | CODE |
| LOW | piptools/scripts/sync.py | 174 | def _validate_python_executable(python_executable: str) -> None: | CODE |
| LOW | piptools/scripts/sync.py | 260 | def _get_installed_distributions( | CODE |
| LOW | piptools/scripts/_deprecations.py | 9 | def filter_deprecated_pip_args(args: list[str]) -> list[str]: | CODE |
| LOW | piptools/_compat/pip_compat.py | 133 | def _rewrite_comes_from_to_hardcoded_stdin_value(_: str, /) -> str: | CODE |
| LOW | piptools/_compat/pip_compat.py | 138 | def _relativize_comes_from_location(original_comes_from: str, /) -> str: | CODE |
| LOW | piptools/_compat/pip_compat.py | 170 | def _normalize_comes_from_location(original_comes_from: str, /) -> str: | CODE |
| LOW | tests/test_circular_imports.py | 44 | def _discover_path_importables(pkg_pth: Path, pkg_name: str) -> Iterator[str]: | CODE |
| LOW | tests/test_circular_imports.py | 66 | def _allowed_deprecation_warning_filters() -> list[str]: | CODE |
| LOW | tests/test_repository_local.py | 11 | def test_get_hashes_local_repository_cache_miss( | CODE |
| LOW | tests/test_repository_local.py | 24 | def test_get_hashes_local_repository_cache_hit(from_line, repository): | CODE |
| LOW | tests/test_repository_local.py | 43 | def test_toggle_reuse_hashes_local_repository( | CODE |
| LOW⚡ | tests/test_utils.py | 139 | def test_format_requirement_url(from_line, line, expected): | CODE |
| LOW⚡ | tests/test_utils.py | 144 | def test_format_requirement_editable_vcs(from_editable): | CODE |
| LOW⚡ | tests/test_utils.py | 149 | def test_format_requirement_editable_vcs_with_password(from_editable): | CODE |
| LOW⚡ | tests/test_utils.py | 156 | def test_format_requirement_editable_local_path(from_editable): | CODE |
| LOW⚡ | tests/test_utils.py | 161 | def test_format_requirement_ireq_with_hashes(from_line): | CODE |
| LOW⚡ | tests/test_utils.py | 272 | def test_is_pinned_requirement(from_line, line, expected): | CODE |
| LOW⚡ | tests/test_utils.py | 277 | def test_is_pinned_requirement_editable(from_editable): | CODE |
| LOW⚡ | tests/test_utils.py | 282 | def test_key_from_ireq_normalization(from_line): | CODE |
| LOW⚡ | tests/test_utils.py | 786 | def test_select_config_file_no_files(tmp_path_cwd): | CODE |
| LOW⚡ | tests/test_utils.py | 791 | def test_select_config_file_returns_config_in_cwd(make_config_file, filename): | CODE |
| LOW⚡ | tests/test_utils.py | 796 | def test_select_config_file_returns_empty_config_file_in_cwd(tmp_path_cwd): | CODE |
| LOW⚡ | tests/test_utils.py | 803 | def test_select_config_file_cannot_find_config_in_cwd(tmp_path_cwd, make_config_file): | CODE |
| LOW⚡ | tests/test_utils.py | 808 | def test_select_config_file_with_config_file_in_subdir(tmp_path_cwd, make_config_file): | CODE |
| LOW⚡ | tests/test_utils.py | 817 | def test_select_config_file_prefers_pip_tools_toml_over_pyproject_toml(tmp_path_cwd): | CODE |
| LOW | tests/test_utils.py | 178 | def test_format_requirement_ireq_with_hashes_and_markers(from_line): | CODE |
| LOW | tests/test_utils.py | 243 | def test_get_hashes_from_ireq(from_line): | CODE |
| LOW | tests/test_utils.py | 298 | def test_key_from_req_on_install_requirement( | CODE |
| LOW | tests/test_utils.py | 318 | def test_key_from_req_on_specifier_requirement( | CODE |
| LOW | tests/test_utils.py | 346 | def test_is_url_requirement_filename(caplog, from_line, line): | CODE |
| LOW | tests/test_utils.py | 455 | def test_get_compile_command_with_config(tmp_path_cwd, config_file, expected_command): | CODE |
| LOW | tests/test_utils.py | 463 | def test_get_compile_command_no_index_not_added_by_default(tmp_path_cwd: Path) -> None: | CODE |
| LOW | tests/test_utils.py | 482 | def test_get_compile_command_does_not_include_default_config_if_reqs_file_in_subdir( | CODE |
| 260 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/sync.py | 1 | CODE | |
| LOW | piptools/build.py | 1 | CODE | |
| LOW | piptools/logging.py | 1 | CODE | |
| LOW | piptools/cache.py | 1 | CODE | |
| LOW | piptools/__init__.py | 1 | CODE | |
| LOW | piptools/utils.py | 1 | CODE | |
| LOW | piptools/resolver.py | 1 | CODE | |
| LOW | piptools/exceptions.py | 1 | CODE | |
| LOW | piptools/writer.py | 1 | CODE | |
| LOW | piptools/__main__.py | 1 | CODE | |
| LOW | piptools/locations.py | 1 | CODE | |
| LOW | piptools/_internal/_subprocess.py | 3 | CODE | |
| LOW | piptools/_internal/_environment_variables.py | 1 | CODE | |
| LOW | piptools/_internal/_pip_api/command_methods.py | 9 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 6 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 8 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 9 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 10 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 10 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 10 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 15 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 15 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 15 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 20 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 20 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 20 | CODE | |
| LOW | piptools/_internal/_pip_api/__init__.py | 20 | CODE | |
| LOW | piptools/_internal/_pip_api/cli_options.py | 5 | CODE | |
| LOW | piptools/_internal/_pip_api/install_requirements.py | 1 | CODE | |
| LOW | piptools/_internal/_pip_api/package_finder.py | 8 | CODE | |
| LOW | piptools/_internal/_pip_api/pip_version.py | 1 | CODE | |
| LOW | piptools/repositories/local.py | 1 | CODE | |
| LOW | piptools/repositories/__init__.py | 1 | CODE | |
| LOW | piptools/repositories/__init__.py | 3 | CODE | |
| LOW | piptools/repositories/__init__.py | 4 | CODE | |
| LOW | piptools/repositories/pypi.py | 1 | CODE | |
| LOW | piptools/repositories/base.py | 1 | CODE | |
| LOW | piptools/scripts/sync.py | 1 | CODE | |
| LOW | piptools/scripts/options.py | 1 | CODE | |
| LOW | piptools/scripts/_deprecations.py | 3 | CODE | |
| LOW | piptools/scripts/compile.py | 1 | CODE | |
| LOW | piptools/_compat/_click_compat.py | 5 | CODE | |
| LOW | piptools/_compat/path_compat.py | 6 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 1 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 6 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 6 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 6 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 8 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 8 | CODE | |
| LOW | piptools/_compat/_tomllib_compat.py | 8 | CODE | |
| LOW | piptools/_compat/pip_compat.py | 1 | CODE | |
| LOW | piptools/_compat/pip_compat.py | 37 | CODE | |
| LOW | piptools/_compat/__init__.py | 1 | CODE | |
| LOW | piptools/_compat/__init__.py | 3 | CODE | |
| LOW | piptools/_compat/__init__.py | 3 | CODE | |
| LOW | piptools/_compat/__init__.py | 3 | CODE | |
| LOW | piptools/_compat/__init__.py | 3 | CODE | |
| LOW | piptools/_compat/tempfile_compat.py | 6 | CODE | |
| LOW | tests/test_circular_imports.py | 13 | CODE | |
| LOW | tests/test_repository_local.py | 1 | CODE | |
| 36 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | piptools/writer.py | 133 | "# This file is autogenerated by pip-compile with Python " | CODE |
| MEDIUM | tests/test_repository_local.py | 25 | # Create an install requirement with the hashes included in its options | COMMENT |
| MEDIUM | tests/test_repository_local.py | 46 | # Create an install requirement with the hashes included in its options | COMMENT |
| MEDIUM | tests/conftest.py | 353 | # Create a README to avoid setuptools warnings. | STRING |
| MEDIUM | tests/conftest.py | 356 | # Create a module to make the package importable. | STRING |
| MEDIUM | tests/conftest.py | 519 | # Create a nested directory structure if config_file_name includes directories | COMMENT |
| MEDIUM | tests/test_writer.py | 211 | "# This file is autogenerated by pip-compile with Python " | CODE |
| MEDIUM | tests/test_writer.py | 230 | "# This file is autogenerated by pip-compile with Python " | CODE |
| MEDIUM | tests/test_cache.py | 23 | # Create the file and write to it | COMMENT |
| MEDIUM⚡ | tests/test_cache.py | 85 | # Create a cache object. The keys are packages, and the values are lists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 121 | django==4.1.7 | COMMENT |
| LOW | README.md | 341 | # by the following command: | COMMENT |
| LOW | README.md | 561 | asgiref==3.5.2 | COMMENT |
| LOW | piptools/build.py | 201 | # NOTE: permission error related to this file handle still open in our | COMMENT |
| LOW | tests/test_cli_compile.py | 3081 | COMMENT | |
| LOW | requirements/build-deps.txt | 1 | # | COMMENT |
| LOW | requirements/build-deps.txt | 21 | # pip-tools (pyproject.toml::build-system.requires) | COMMENT |
| LOW | docs/requirements.txt | 1 | # | COMMENT |
| LOW | docs/requirements.txt | 21 | certifi==2026.1.4 | COMMENT |
| LOW | docs/requirements.txt | 41 | # click-extra | COMMENT |
| LOW | docs/requirements.txt | 61 | markupsafe==3.0.3 | COMMENT |
| LOW | docs/requirements.txt | 81 | # furo | COMMENT |
| LOW | docs/requirements.txt | 101 | # via sphinx | COMMENT |
| LOW | docs/requirements.txt | 141 | # via click-extra | COMMENT |
| LOW | docs/requirements.txt | 161 | # pip-tools (pyproject.toml) | COMMENT |
| LOW | docs/how-to/customize-compiled-headers.md | 41 | COMMENT | |
| LOW | examples/readme/constraints.txt | 1 | # | COMMENT |
| LOW | examples/readme/constraints.txt | 21 | # hatchling | COMMENT |
| LOW | .github/workflows/ci.yml | 481 | ${{ runner.os }}-pip- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/sync.py | 54 | CODE | |
| LOW | piptools/sync.py | 108 | CODE | |
| LOW | piptools/utils.py | 304 | CODE | |
| LOW | piptools/resolver.py | 550 | CODE | |
| LOW | piptools/scripts/sync.py | 198 | CODE | |
| LOW | piptools/scripts/compile.py | 51 | CODE | |
| LOW | piptools/scripts/compile.py | 149 | CODE | |
| LOW | tests/_plugins/_coverage/piptools_coverage.py | 104 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tox.ini | 90 | # FIXME: re-enable the "-r" + "-c" paradigm once the pip bug is fixed. | COMMENT |
| MEDIUM | tox.ini | 166 | # FIXME: re-enable the "-r" + "-c" paradigm once the pip bug is fixed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/repositories/__init__.py | 6 | __all__ = ["LocalRequirementsRepository", "PyPIRepository"] | CODE |
| LOW | piptools/_compat/_tomllib_compat.py | 11 | __all__ = ["TOMLDecodeError", "load", "loads"] | CODE |
| LOW | piptools/_compat/__init__.py | 10 | __all__ = [ | CODE |
| LOW | docs/conf.py | 13 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/conf.py | 84 | # ------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/utils.py | 535 | except Exception as e: | CODE |
| LOW | tests/test_cli_compile.py | 3639 | except Exception: # pragma: no cover | STRING |
| LOW | tests/test_cli_compile.py | 3703 | except Exception: # pragma: no cover | STRING |
| LOW | tests/test_cli_compile.py | 3771 | except Exception: # pragma: no cover | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/utils.py | 142 | # Check if there is any fragment to add to the URI. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | piptools/writer.py | 43 | "# WARNING: The following packages were not pinned, but pip requires them to be" | CODE |