Report #9473
[tooling] How to generate a requirements.txt with hashes from pyproject.toml without pip-tools
Use \`uv pip compile pyproject.toml --generate-hashes --output-file requirements.txt\` to create a locked, hashed requirements file 10-100x faster than pip-compile, with full PEP 621/440 compliance.
Journey Context:
Traditional \`pip-tools\` is slow because it uses pip's resolver. \`uv\` \(Astral's Python tool\) reimplements resolution in Rust with aggressive caching. The \`--generate-hashes\` flag ensures each package has SHA256 hashes, preventing tampering. This replaces the slow \`pip-compile --generate-hashes\` workflow. Crucially, \`uv\` understands modern \`pyproject.toml\` \(PEP 621\) natively, unlike older tools that require \`setup.py\` or specific metadata formats.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T08:16:25.558038+00:00— report_created — created