refactor(python): switch UV provider from pip list/show to uv export

Replace the two-command approach (uv pip list + uv pip show) with a
single uv export --format requirements.txt --frozen --no-hashes
--no-dev --no-emit-project, aligning with the JS client implementation.

Also extract duplicated canonicalize() method from PythonUvProvider and
PythonPyprojectProvider into PyprojectTomlUtils, and convert UvPackage
and UvDependencyData from static final classes to records.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

README.md

@@ -608,7 +608,7 @@ Python support works with both `requirements.txt` and `pyproject.toml` manifest
 
 ##### uv Support
 
-When a `uv.lock` file is present alongside `pyproject.toml`, the client automatically uses the [uv](https://docs.astral.sh/uv/) package manager for dependency resolution instead of pip. Dependency data is collected via `uv pip list --format=json` and `uv pip show`. No additional configuration is required — the provider is selected automatically based on lock file detection.
+When a `uv.lock` file is present alongside `pyproject.toml`, the client automatically uses the [uv](https://docs.astral.sh/uv/) package manager for dependency resolution instead of pip. Dependency data is collected via `uv export --format requirements.txt --frozen --no-hashes --no-dev`. No additional configuration is required — the provider is selected automatically based on lock file detection.
 
 To use a custom uv binary, set `TRUSTIFY_DA_UV_PATH` to the path of your uv executable.
 

src/main/java/io/github/guacsec/trustifyda/providers/PythonPyprojectProvider.java

@@ -132,7 +132,7 @@ private void addDependencyTree(
     PackageURL packageURL = toPurl(pkg.name, pkg.version);
     sbom.addDependency(source, packageURL, null);
 
-    String key = canonicalize(pkg.name);
+    String key = PyprojectTomlUtils.canonicalize(pkg.name);
     if (!visited.add(key)) {
       return;
     }
@@ -263,7 +263,7 @@ PipReportData parsePipReport(String reportJson) throws IOException {
             }
             String name = extractDepName(reqStr);
             if (name != null) {
-              directDepNames.add(canonicalize(name));
+              directDepNames.add(PyprojectTomlUtils.canonicalize(name));
             }
           }
         }
@@ -282,7 +282,7 @@ PipReportData parsePipReport(String reportJson) throws IOException {
       if (name == null) {
         continue;
       }
-      String key = canonicalize(name);
+      String key = PyprojectTomlUtils.canonicalize(name);
       graph.put(key, new PipPackage(name, version, new ArrayList<>()));
     }
 
@@ -296,7 +296,7 @@ PipReportData parsePipReport(String reportJson) throws IOException {
       if (name == null) {
         continue;
       }
-      String key = canonicalize(name);
+      String key = PyprojectTomlUtils.canonicalize(name);
       PipPackage pipPkg = graph.get(key);
       if (pipPkg == null) {
         continue;
@@ -314,7 +314,7 @@ PipReportData parsePipReport(String reportJson) throws IOException {
         if (depName == null) {
           continue;
         }
-        String depKey = canonicalize(depName);
+        String depKey = PyprojectTomlUtils.canonicalize(depName);
         if (graph.containsKey(depKey)) {
           pipPkg.children.add(depKey);
         }
@@ -335,10 +335,6 @@ static String extractDepName(String req) {
     return m.find() ? m.group(1) : null;
   }
 
-  static String canonicalize(String name) {
-    return name.toLowerCase().replaceAll("[-_.]+", "-");
-  }
-
   private TomlParseResult getToml() throws IOException {
     if (cachedToml == null) {
       cachedToml = PyprojectTomlUtils.parseToml(manifestPath);