New project (CLI) install-locked-env. What about security?

Works for me:

❯ uv venv
Using CPython 3.14.0 interpreter at: C:\Users\Gustav\AppData\Local\Python\pythoncore-3.14-64\python.exe
Creating virtual environment at: .venv
Activate with: .venv\Scripts\activate
❯ uv pip install -r http://localhost:8000/requirements.txt
Resolved 5 packages in 445ms
Prepared 2 packages in 354ms
Installed 5 packages in 409ms
 + certifi==2025.11.12
 + charset-normalizer==3.4.4
 + idna==3.11
 + requests==2.32.5
 + urllib3==2.6.2

It seems to be a bug in uv, not supportling lockfiles over http. I’d suggest reporting it to them, they are usually very quick to fix reported issues.