fix(test): pin pip transitive deps to prevent version drift in fixtures

Transitive dependencies (idna, charset-normalizer, urllib3, certifi, pysocks)
were resolved live from PyPI, causing test failures when new versions are
published (e.g. idna 3.11 -> 3.12). Pin all deps with == in the test
pyproject.toml, matching the lock file approach used by uv and poetry tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

test/providers/python_pyproject.test.js

@@ -272,14 +272,19 @@ suite('testing the python-pyproject data provider', () => {
 			let result = await pipProvider.provideStack(path.join(pipFixtureDir, 'pyproject.toml'))
 			let sbom = JSON.parse(result.content)
 			let rootDep = sbom.dependencies.find(d => d.ref.includes('/test-project@'))
-			expect(rootDep.dependsOn).to.have.lengthOf(1)
-			expect(rootDep.dependsOn[0]).to.include('/requests@')
+			let directNames = rootDep.dependsOn.map(d => d.split('/').pop().split('@')[0])
+			expect(directNames).to.include('requests')
+			expect(directNames).to.include('charset-normalizer')
+			expect(directNames).to.include('idna')
+			expect(directNames).to.include('urllib3')
+			expect(directNames).to.include('certifi')
+			expect(directNames).to.include('pysocks')
 			let requestsDep = sbom.dependencies.find(d => d.ref.includes('/requests@'))
-			let transNames = requestsDep.dependsOn.map(d => d.split('/').pop().split('@')[0])
-			expect(transNames).to.include('certifi')
-			expect(transNames).to.include('charset-normalizer')
-			expect(transNames).to.include('idna')
-			expect(transNames).to.include('urllib3')
+			let reqTransNames = requestsDep.dependsOn.map(d => d.split('/').pop().split('@')[0])
+			expect(reqTransNames).to.include('certifi')
+			expect(reqTransNames).to.include('charset-normalizer')
+			expect(reqTransNames).to.include('idna')
+			expect(reqTransNames).to.include('urllib3')
 		}).timeout(TIMEOUT)
 
 		/** Verifies exhortignore marker produces expected SBOM for stack and component analysis. */

test/providers/tst_manifests/pyproject/pip_pep621/expected_component_sbom.json

@@ -19,18 +19,78 @@
 			"purl": "pkg:pypi/requests@2.32.3",
 			"type": "library",
 			"bom-ref": "pkg:pypi/requests@2.32.3"
+		},
+		{
+			"name": "charset-normalizer",
+			"version": "3.4.7",
+			"purl": "pkg:pypi/charset-normalizer@3.4.7",
+			"type": "library",
+			"bom-ref": "pkg:pypi/charset-normalizer@3.4.7"
+		},
+		{
+			"name": "idna",
+			"version": "3.12",
+			"purl": "pkg:pypi/idna@3.12",
+			"type": "library",
+			"bom-ref": "pkg:pypi/idna@3.12"
+		},
+		{
+			"name": "urllib3",
+			"version": "2.6.3",
+			"purl": "pkg:pypi/urllib3@2.6.3",
+			"type": "library",
+			"bom-ref": "pkg:pypi/urllib3@2.6.3"
+		},
+		{
+			"name": "certifi",
+			"version": "2026.2.25",
+			"purl": "pkg:pypi/certifi@2026.2.25",
+			"type": "library",
+			"bom-ref": "pkg:pypi/certifi@2026.2.25"
+		},
+		{
+			"name": "pysocks",
+			"version": "1.7.1",
+			"purl": "pkg:pypi/pysocks@1.7.1",
+			"type": "library",
+			"bom-ref": "pkg:pypi/pysocks@1.7.1"
 		}
 	],
 	"dependencies": [
 		{
 			"ref": "pkg:pypi/test-project@1.0.0",
 			"dependsOn": [
-				"pkg:pypi/requests@2.32.3"
+				"pkg:pypi/requests@2.32.3",
+				"pkg:pypi/charset-normalizer@3.4.7",
+				"pkg:pypi/idna@3.12",
+				"pkg:pypi/urllib3@2.6.3",
+				"pkg:pypi/certifi@2026.2.25",
+				"pkg:pypi/pysocks@1.7.1"
 			]
 		},
 		{
 			"ref": "pkg:pypi/requests@2.32.3",
 			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/charset-normalizer@3.4.7",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/idna@3.12",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/urllib3@2.6.3",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/certifi@2026.2.25",
+			"dependsOn": []
+		},
+		{
+			"ref": "pkg:pypi/pysocks@1.7.1",
+			"dependsOn": []
 		}
 	]
 }

test/providers/tst_manifests/pyproject/pip_pep621/expected_stack_sbom.json

@@ -29,10 +29,10 @@
 		},
 		{
 			"name": "idna",
-			"version": "3.11",
-			"purl": "pkg:pypi/idna@3.11",
+			"version": "3.12",
+			"purl": "pkg:pypi/idna@3.12",
 			"type": "library",
-			"bom-ref": "pkg:pypi/idna@3.11"
+			"bom-ref": "pkg:pypi/idna@3.12"
 		},
 		{
 			"name": "urllib3",
@@ -60,14 +60,19 @@
 		{
 			"ref": "pkg:pypi/test-project@1.0.0",
 			"dependsOn": [
-				"pkg:pypi/requests@2.32.3"
+				"pkg:pypi/requests@2.32.3",
+				"pkg:pypi/charset-normalizer@3.4.7",
+				"pkg:pypi/idna@3.12",
+				"pkg:pypi/urllib3@2.6.3",
+				"pkg:pypi/certifi@2026.2.25",
+				"pkg:pypi/pysocks@1.7.1"
 			]
 		},
 		{
 			"ref": "pkg:pypi/requests@2.32.3",
 			"dependsOn": [
 				"pkg:pypi/charset-normalizer@3.4.7",
-				"pkg:pypi/idna@3.11",
+				"pkg:pypi/idna@3.12",
 				"pkg:pypi/urllib3@2.6.3",
 				"pkg:pypi/certifi@2026.2.25",
 				"pkg:pypi/pysocks@1.7.1"
@@ -78,7 +83,7 @@
 			"dependsOn": []
 		},
 		{
-			"ref": "pkg:pypi/idna@3.11",
+			"ref": "pkg:pypi/idna@3.12",
 			"dependsOn": []
 		},
 		{

test/providers/tst_manifests/pyproject/pip_pep621/pyproject.toml

@@ -4,4 +4,9 @@ version = "1.0.0"
 requires-python = ">=3.9"
 dependencies = [
     "requests[socks]==2.32.3",
+    "charset-normalizer==3.4.7",
+    "idna==3.12",
+    "urllib3[socks]==2.6.3",
+    "certifi==2026.2.25",
+    "pysocks==1.7.1",
 ]