fix(python-uv): exclude project self-reference from dependency graph

When uv export includes the project itself as a requirement (e.g.
test-project==1.0.0), it was being counted as a dependency, causing an
off-by-one error in the total dependency count.

Three fixes applied:
- Add --no-emit-project flag to uv export command
- Defensive filter in requirement parser to skip packages matching the
  project name
- Defensive filter in editable install handler (-e .) for the same

Implements TC-4097

Assisted-by: Claude Code

Author: ruromero

src/providers/python_uv.js

@@ -44,7 +44,7 @@ export default class Python_uv extends Base_pyproject {
 			return Buffer.from(process.env['TRUSTIFY_DA_UV_EXPORT'], 'base64').toString('ascii')
 		}
 		let uvBin = getCustomPath('uv', opts)
-		return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes', '--no-dev'], { cwd: manifestDir }).toString()
+		return invokeCommand(uvBin, ['export', '--format', 'requirements.txt', '--frozen', '--no-hashes', '--no-dev', '--no-emit-project'], { cwd: manifestDir }).toString()
 	}
 
 	/**
@@ -81,6 +81,7 @@ export default class Python_uv extends Base_pyproject {
 						let version = memberParsed.project?.version || memberParsed.tool?.poetry?.version
 						if (name && version) {
 							let key = this._canonicalize(name)
+							if (key === canonProjectName) { continue }
 							currentPkg = { name, version, parents: new Set() }
 							packages.set(key, currentPkg)
 							collectingVia = false
@@ -109,6 +110,7 @@ export default class Python_uv extends Base_pyproject {
 				}
 
 				let key = this._canonicalize(name)
+				if (key === canonProjectName) { continue }
 				currentPkg = { name, version, parents: new Set() }
 				packages.set(key, currentPkg)
 				collectingVia = false

test/providers/python_pyproject.test.js

@@ -121,6 +121,42 @@ suite('testing the python-pyproject data provider', () => {
 		}).timeout(TIMEOUT)
 	})
 
+	suite('uv projects - self-reference filtering (TC-4097)', () => {
+		const fixtureDir = `${MANIFESTS}/uv_lock`
+
+		function setUvExportFromFixture() {
+			let output = fs.readFileSync(path.join(fixtureDir, 'uv_export_with_self_ref.txt')).toString()
+			process.env['TRUSTIFY_DA_UV_EXPORT'] = Buffer.from(output).toString('base64')
+		}
+
+		teardown(() => { delete process.env['TRUSTIFY_DA_UV_EXPORT'] })
+
+		/** Verifies that the project itself is excluded from the component SBOM when uv export includes it as a requirement. */
+		test('project self-reference excluded from component analysis', async () => {
+			setUvExportFromFixture()
+			let result = await uvProvider.provideComponent(path.join(fixtureDir, 'pyproject.toml'))
+			let sbom = JSON.parse(result.content)
+			let names = sbom.components.map(c => c.name)
+			expect(names).to.not.include('test-project')
+			expect(names).to.include('flask')
+			expect(names).to.include('requests')
+		}).timeout(TIMEOUT)
+
+		/** Verifies that the project itself is excluded from the stack SBOM components and not listed as its own dependency. */
+		test('project self-reference excluded from stack analysis', async () => {
+			setUvExportFromFixture()
+			let result = await uvProvider.provideStack(path.join(fixtureDir, 'pyproject.toml'))
+			let sbom = JSON.parse(result.content)
+			let names = sbom.components.map(c => c.name)
+			expect(names).to.not.include('test-project')
+			expect(names).to.include('flask')
+			expect(names).to.include('requests')
+			let rootDep = sbom.dependencies.find(d => d.ref === 'pkg:pypi/test-project@1.0.0')
+			expect(rootDep).to.exist
+			expect(rootDep.dependsOn).to.not.include('pkg:pypi/test-project@1.0.0')
+		}).timeout(TIMEOUT)
+	})
+
 	suite('uv projects - uv_lock manifest', () => {
 		const fixtureDir = `${MANIFESTS}/uv_lock`
 

test/providers/tst_manifests/pyproject/uv_lock/uv_export_with_self_ref.txt

@@ -0,0 +1,31 @@
+# Test fixture for TC-4097: simulates uv export output that includes the project
+# itself as a requirement (line "test-project==1.0.0"). This cannot be reproduced
+# by running uv export directly because --no-emit-project prevents it. The file is
+# injected via the TRUSTIFY_DA_UV_EXPORT env var to test the defensive filter that
+# skips packages matching the project name.
+certifi==2023.7.22
+    # via requests
+chardet==4.0.0
+    # via requests
+click==8.3.1
+    # via flask
+colorama==0.4.6 ; sys_platform == 'win32'
+    # via click
+flask==2.0.3
+    # via test-project
+idna==2.10
+    # via requests
+itsdangerous==2.0.1
+    # via flask
+jinja2==3.0.3
+    # via flask
+markupsafe==2.0.1
+    # via jinja2
+requests==2.25.1
+    # via test-project
+test-project==1.0.0
+    # via test-project
+urllib3==1.26.16
+    # via requests
+werkzeug==2.0.3
+    # via flask