Yes. The uv lockfile is universal, so one uv.lock can cover Linux, macOS and Windows. The catch is the migration: your old per-platform requirements files lack environment markers, so passing them as constraints can conflict. Convert each with uv pip compile and the no strip markers option first, then import.
Why per-platform files exist
A file compiled by pip or pip-tools is only valid on the platform where it was generated. The uv guide gives the example of tqdm: on Linux it compiles to tqdm alone, while on Windows it also pulls in colorama, a Windows only dependency. Teams that ship to several operating systems therefore keep one compiled file per platform and a script that picks the right one.
That works, but it multiplies the files a reviewer has to read and a scanner has to parse.
What a universal lock changes
The uv documentation says the uv lockfile is always universal, so developers on different machines use consistent, locked versions regardless of the platform. Markers such as sys_platform equals win32 carry the platform logic inside the one file. If you only need a subset of platforms, the documentation says to use the tool.uv.environments setting to limit the resolution and the lockfile.
Migration steps
- Keep your loose requirements.in as the source of intent.
- For each platform file, regenerate it with markers so it can be used as a constraint. The guide shows a Windows example and says to repeat with other platform values for each file.
- Import the loose file with every converted file as a constraint.
- Run uv lock, then review the versions.
uv pip compile requirements.in -o requirements-win.txt --python-platform windows --no-strip-markers
uv pip compile requirements.in -o requirements-linux.txt --python-platform linux --no-strip-markers
uv add -r requirements.in -c requirements-win.txt -c requirements-linux.txt
The guide explains that when the output file already exists, uv constrains the versions to match it where it can, which is what keeps your pins stable during the conversion.
Security angles worth checking
| Check | Why |
|---|---|
| Platform only packages appear with markers | Confirms a Windows only package did not leak into Linux images |
| Versions match old files per platform | Catches silent upgrades |
| Scanner reads uv.lock | Make sure your SCA step still has a supported input |
On the last point, uv can export the lockfile to other formats. The documentation lists requirements.txt, pylock.toml and CycloneDX, which helps if a downstream tool does not read uv.lock directly.
Try it yourself
Click through it at your own pace, or open it full screen. See how one inventory lists each component with its version, the output you want from a single universal lockfile.
Safeguard's SBOM and dependency scanning covers inventory and vulnerability matching for the repository. The free scan at gold.safeguard.sh/scan is a quick way to look at both sides of a migration.
Quick check
Do I lose reproducibility by merging platform files?
No, if you import with the old files as constraints and confirm the versions in uv.lock match them per platform.
What if my scanner cannot read uv.lock?
Export the lockfile to requirements.txt, pylock.toml or CycloneDX using the formats the uv documentation lists, and scan that.
Sources
Last reviewed: 19 October 2026.
