Summary

• Poetry's show --tree command returns all dependency groups including dev, causing dev-only packages (e.g. black, pytest) to appear in vulnerability scans as false positives
• Fix checks the parsed pyproject.toml for dev group declarations ([tool.poetry.group.dev.dependencies] or [tool.poetry.dev-dependencies]) and passes --without dev to poetry show --tree when present
• Adds test fixtures and tests for both the modern (Poetry 1.2+) and legacy dev dependency formats

Resolves TC-4096

Test plan

• Reproduced the bug locally: black (dev dep) appeared in SBOM before fix
• Verified fix excludes dev deps from both stack and component analysis
• Verified both modern ([tool.poetry.group.dev.dependencies]) and legacy ([tool.poetry.dev-dependencies]) formats are handled
• Verified projects without a dev group still work (no --without dev flag passed)
• Verified custom non-dev groups are preserved (only dev is excluded)
• All 35 pyproject tests pass, no regressions

🤖 Generated with Claude Code