Conversation
Member
Author
|
Built the branch locally with It ran successfully! Check out the output below Details |
Nishnha
force-pushed
the
uv-dependency-grapher
branch
from
f41dfd5 to
f74818f
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request adds a dependency grapher for the uv package manager ecosystem, enabling Dependabot to generate dependency graph information for UV projects. The implementation follows established patterns from other ecosystems (go_modules, npm_and_yarn) and provides a robust fallback strategy for parsing dependency relationships.
Changes:
- Adds
DependencyGrapherclass that extracts dependency relationships from uv.lock, generates ephemeral lockfiles when needed, or falls back to parsinguv treeoutput - Extends
FileParserwithrun_in_parsed_contextmethod to execute native UV commands in the project context - Includes comprehensive test coverage for all three relationship extraction strategies (lockfile, generated lockfile, tree command)
Reviewed changes
Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| uv/lib/dependabot/uv/dependency_grapher.rb | Main implementation: parses dependency relationships from lockfile or tree output with fallback strategies |
| uv/lib/dependabot/uv/file_parser.rb | Adds run_in_parsed_context method to execute commands in temporary directory with dependency files |
| uv/lib/dependabot/uv.rb | Registers the new dependency grapher component |
| uv/spec/dependabot/uv/dependency_grapher_spec.rb | Comprehensive test suite covering all relationship extraction paths and edge cases |
| uv/spec/fixtures/* | Test fixtures for lockfiles and tree output |
Member
Author
|
The package urls all say pypi instead of uv. Not sure if that's what DG expects? |
brrygrdn
reviewed
Feb 27, 2026
Comment on lines
+14
to
+15
| UV_LOCK_COMMAND = T.let("pyenv exec uv lock --color never --no-progress && cat uv.lock", String) | ||
| UV_TREE_COMMAND = T.let("pyenv exec uv tree -q --color never --no-progress --frozen", String) |
Contributor
There was a problem hiding this comment.
Not something that needs to be addressed as part of this PR - I'm not super familiar with which uv commands access remote registries so I wonder if there are private dependencies involved will either of these commands fail if the credentials haven't been configured?
With golang, we have some handling for go mod graph iirc as it could fail without creds but we could fall back to getting a snapshot of the dependencies without subdependencies.
Member
There was a problem hiding this comment.
It should work as is, I built the fallback into the Base DependencyGrapher. So if any error occurs we'll still post the high level data from the FileParser.
Member
Author
There was a problem hiding this comment.
Good spot. I'll investigate this in a follow up. DG isn't sending graph job requests for uv yet, so this should be safe to merge even if it is broken for private dependencies.
brrygrdn
approved these changes
Feb 27, 2026
Contributor
brrygrdn
left a comment
brrygrdn
left a comment
There was a problem hiding this comment.
👍🏻 LGTM, one question but its non-blocking
jakecoffman
approved these changes
Feb 27, 2026
Nishnha
force-pushed
the
uv-dependency-grapher
branch
from
f74818f to
9d097d4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
Add a dependency grapher for the uv package manager.
Anything you want to highlight for special attention from reviewers?
This expects at least a pyproject.toml. If a uv.lock is not present an ephemeral one is generated.
The dependency tree is parsed from the lockfile, ephemeral lockfile, or
uv treecommand if the lockfile parsing fails.How will you know you've accomplished your goal?
uv projects send dependency graph information to the dependency graph
Checklist