Open
Description
Running the tool with and without pyproject.toml makes no difference.
The tool seems to rely on the current virtualenv instead, which seems wrong because:
- the dev dependencies cannot be distinguished from core dependencies
- the system packages are scanned too, and there's sadly lots of crap there
- 3rd party crud is scanned, e.g. if the system has ROS installed, that gets scanned too
I feel that current design just won't cut it, not since year 2020.