# New project (CLI) install-locked-env. What about security?

**URL:** <https://discuss.python.org/t/new-project-cli-install-locked-env-what-about-security/105270>\
**Category:** Packaging\
**Created:** [December 10, 2025, 10:15pm UTC](https://discuss.python.org/t/new-project-cli-install-locked-env-what-about-security/105270 "2025-12-10T22:15:54Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![pf\_moore](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/pf_moore/32/35_2.png) [@pf\_moore](https://discuss.python.org/u/pf_moore)\
**Post date:** [December 12, 2025, 4:51pm UTC](https://discuss.python.org/t/new-project-cli-install-locked-env-what-about-security/105270/8 "2025-12-12T16:51:12Z")

</div>

> [@paugier](#):
>
> Nope, with uv 0.9.17 it does not work

Works for me:

```python
❯ uv venv
Using CPython 3.14.0 interpreter at: C:\Users\Gustav\AppData\Local\Python\pythoncore-3.14-64\python.exe
Creating virtual environment at: .venv
Activate with: .venv\Scripts\activate
❯ uv pip install -r http://localhost:8000/requirements.txt
Resolved 5 packages in 445ms
Prepared 2 packages in 354ms
Installed 5 packages in 409ms
 + certifi==2025.11.12
 + charset-normalizer==3.4.4
 + idna==3.11
 + requests==2.32.5
 + urllib3==2.6.2

```

It seems to be a bug in uv, not supportling lockfiles over http. I’d suggest reporting it to them, they are usually very quick to fix reported issues.

---

_[View the full topic](https://discuss.python.org/t/new-project-cli-install-locked-env-what-about-security/105270)._