build(pip): pin SHA256 hashes of dependencies to be secure

Author: amilcarlucas

REUSE.toml

@@ -57,6 +57,11 @@ path = ["pyrightconfig.json", "pyproject.toml", "pytest.ini", "test_pip_package.
 SPDX-FileCopyrightText = "2024-2025 Amilcar Lucas"
 SPDX-License-Identifier = "GPL-3.0-or-later"
 
+[[annotations]]
+path = ["uv.lock"]
+SPDX-FileCopyrightText = "2024-2025 Amilcar Lucas"
+SPDX-License-Identifier = "GPL-3.0-or-later"
+
 [[annotations]]
 path = ["tests/*.po"]
 SPDX-FileCopyrightText = "2024-2025 Amilcar Lucas"