Skip to content

fix(python-uv): exclude project self-reference from dependency graph#482

Merged
ruromero merged 1 commit into
guacsec:mainfrom
ruromero:TC-4097
Apr 21, 2026
Merged

fix(python-uv): exclude project self-reference from dependency graph#482
ruromero merged 1 commit into
guacsec:mainfrom
ruromero:TC-4097

Conversation

@ruromero

@ruromero ruromero commented Apr 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Fixes off-by-one dependency count for pyproject.toml projects using uv, where uv export includes the project itself as a requirement entry
  • Adds --no-emit-project flag to the uv export command to prevent the project from appearing in the output
  • Adds defensive filter in _parseUvExport to skip packages matching the project name (covers the TRUSTIFY_DA_UV_EXPORT env var bypass path)

Test plan

  • New tests verify project self-reference is excluded from both component and stack SBOM
  • All 23 existing pyproject tests pass with no regressions
  • ESLint passes clean

Implements TC-4097

@ruromero
ruromero force-pushed the TC-4097 branch 4 times, most recently from 87aa770 to 8a43335 Compare April 21, 2026 12:53
@ruromero
ruromero requested a review from Strum355 April 21, 2026 12:54
When uv export includes the project itself as an editable install (-e .),
the global_opt handler resolves it to the root pyproject.toml and adds it
as a dependency, causing an off-by-one error in the total dependency count.

Two fixes applied:
- Add --no-emit-project flag to uv export command
- Skip editable installs that resolve to the root project name

Test fixture uses the reporter's pyproject.toml (with [build-system]) which
triggers uv to emit -e . in the output.

Implements TC-4097
Assisted-by: Claude Code
@ruromero
ruromero merged commit 5047f15 into guacsec:main Apr 21, 2026
4 checks passed
@ruromero
ruromero deleted the TC-4097 branch April 21, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants