Phantom Dependencies: is your requirements.txt haunted?
summary
Pip freeze shows only Pillow but the wheel actually bundles native libs in pillow.libs, so scanners miss those phantom dependencies. Auditwheel writes a CycloneDX SBOM into wheels and PEP 770 reserves a dist/distinfo/sboms directory so tools can record every C C++ Rust and JavaScript component. Sift and grype then report the hidden packages, scanners stop giving false negatives, and many manylinux wheels just need an auditwheel upgrade to start emitting SBOMs for hundreds of deps across 5+ languages.
AI-written summary · about
chapters (8)
- 0:00Welcome
- 1:08Phantom dependencies matter
- 6:10Legitimate reasons
- 8:35Solving with SBOMs
- 10:20PEP 770 demo
- 13:54Scan for vulnerabilities
- 18:03Key takeaways
- 18:50Q&A
related talks
36mSolving the Phantom Dependency Problem for Python Packages
27mPython in Bazel
34mAdventures in pip land
44mDeinventing the Wheel
30mThe Evolutionary Saga of Python Packaging
40mBuilding a binary extension
26mSecure Modern and Simple Dependency Management with PDM and Friends
35mThe Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries