feat(pep621): surface uv.lock transitive deps for osvVulnerabilityAlerts

lib/modules/manager/pep621/dep-types.ts

@@ -33,6 +33,11 @@ export const knownDepTypes = [
     depType: 'tool.uv.sources',
     description: 'Listed under `[tool.uv.sources]`',
   },
+  {
+    depType: 'uv.lock',
+    description:
+      'Transitive dependency resolved in `uv.lock`. Only surfaced for `osvVulnerabilityAlerts`; never updated routinely.',
+  },
 ] as const satisfies readonly DepTypeMetadata[];
 
 export const supportsDynamicDepTypesNote =

lib/modules/manager/pep621/extract.spec.ts

@@ -658,6 +658,91 @@ describe('modules/manager/pep621/extract', () => {
       });
     });
 
+    it('should surface transitive deps from uv.lock as disabled deps', async () => {
+      fs.readLocalFile.mockResolvedValue(
+        codeBlock`
+          version = 1
+          requires-python = ">=3.11"
+
+          [[package]]
+          name = "attrs"
+          version = "24.2.0"
+          source = { registry = "https://pypi.org/simple" }
+
+          [[package]]
+          name = "idna"
+          version = "3.10"
+          source = { registry = "https://pypi.org/simple" }
+
+          [[package]]
+          name = "internal-lib"
+          version = "1.2.3"
+          source = { registry = "https://example.com/simple" }
+
+          [[package]]
+          name = "local-pkg"
+          version = "0.1.0"
+          source = { editable = "../local-pkg" }
+
+          [[package]]
+          name = "pep621-uv"
+          version = "0.1.0"
+          source = { virtual = "." }
+          dependencies = [
+              { name = "attrs" },
+          ]
+        `,
+      );
+
+      fs.findLocalSiblingOrParent.mockResolvedValueOnce(null);
+      fs.findLocalSiblingOrParent.mockResolvedValueOnce('uv.lock');
+      fs.findLocalSiblingOrParent.mockResolvedValueOnce('uv.lock');
+
+      const res = await extractPackageFile(
+        codeBlock`
+          [project]
+          name = "pep621-uv"
+          version = "0.1.0"
+          dependencies = ["attrs>=24.1.0"]
+          requires-python = ">=3.11"
+        `,
+        'pyproject.toml',
+      );
+
+      // attrs (direct) keeps its lockedVersion; idna and internal-lib are
+      // surfaced as disabled transitive deps; the editable local-pkg and the
+      // virtual workspace root are skipped.
+      expect(res).toMatchObject({
+        deps: [
+          { packageName: 'python', depType: 'requires-python' },
+          {
+            packageName: 'attrs',
+            depType: 'project.dependencies',
+            currentValue: '>=24.1.0',
+            lockedVersion: '24.2.0',
+          },
+          {
+            packageName: 'idna',
+            depName: 'idna',
+            depType: 'uv.lock',
+            datasource: 'pypi',
+            lockedVersion: '3.10',
+            enabled: false,
+          },
+          {
+            packageName: 'internal-lib',
+            depType: 'uv.lock',
+            lockedVersion: '1.2.3',
+            enabled: false,
+            registryUrls: ['https://example.com/simple'],
+          },
+        ],
+        lockFiles: ['uv.lock'],
+      });
+      // default-PyPI transitive deps don't carry registryUrls
+      expect(res?.deps[2].registryUrls).toBeUndefined();
+    });
+
     it('should resolve dependencies without locked versions on invalid uv.lock', async () => {
       fs.readLocalFile.mockResolvedValue(codeBlock`invalid_toml`);
 

lib/modules/manager/pep621/processors/uv.ts

@@ -32,6 +32,17 @@ import { BasePyProjectProcessor } from './abstract.ts';
 
 const uvUpdateCMD = 'uv lock';
 
+// The public PyPI index, as recorded in `uv.lock` package sources. Transitive
+// deps resolved from it use the datasource default, so no `registryUrls` needed.
+const defaultPypiRegistries = new Set([
+  'https://pypi.org/simple',
+  'https://pypi.org/simple/',
+]);
+
+function isDefaultPypiRegistry(registryUrl: string): boolean {
+  return defaultPypiRegistries.has(registryUrl);
+}
+
 export class UvProcessor extends BasePyProjectProcessor {
   override lockfileName = 'uv.lock';
 
@@ -150,8 +161,38 @@ export class UvProcessor extends BasePyProjectProcessor {
           for (const dep of deps) {
             const packageName = dep.packageName;
             if (packageName && packageName in lockFileMapping) {
-              dep.lockedVersion = lockFileMapping[packageName];
+              dep.lockedVersion = lockFileMapping[packageName].version;
+            }
+          }
+          const knownPackageNames = new Set(
+            deps.map((dep) => dep.packageName).filter(isString),
+          );
+
+          // Surface transitive (lockfile-only) packages as disabled
+          // dependencies. They produce no routine updates, but
+          // `osvVulnerabilityAlerts` can still match them and re-enable a
+          // targeted `uv lock --upgrade-package` when a fixed version exists.
+          for (const [packageName, locked] of Object.entries(lockFileMapping)) {
+            if (knownPackageNames.has(packageName)) {
+              continue;
+            }
+            // Only registry-sourced packages can be remediated by name. Skip
+            // the workspace root and any virtual/editable/path/git packages.
+            if (!locked.registryUrl) {
+              continue;
+            }
+            const indirectDep: PackageDependency = {
+              packageName,
+              depName: packageName,
+              depType: depTypes.uvIndirectDependencies,
+              datasource: PypiDatasource.id,
+              lockedVersion: locked.version,
+              enabled: false,
+            };
+            if (!isDefaultPypiRegistry(locked.registryUrl)) {
+              indirectDep.registryUrls = [locked.registryUrl];
             }
+            deps.push(indirectDep);
           }
         }
       }

lib/modules/manager/pep621/schema.ts

@@ -219,17 +219,29 @@ export const PdmLockfile = Toml.pipe(
   )
   .transform((lock) => ({ lock }));
 
+export interface UvLockedPackage {
+  version: string;
+  // The index a package was resolved from, if any. Absent for the workspace
+  // root and for virtual/editable/path/git packages, which cannot be
+  // remediated by `uv lock --upgrade-package`.
+  registryUrl?: string;
+}
+
 export const UvLockfile = Toml.pipe(
   z.object({
     package: LooseArray(
       z.object({
         name: z.string(),
         version: z.string(),
+        source: z.object({ registry: z.string() }).partial().optional(),
       }),
     ),
   }),
 ).transform(({ package: pkg }) =>
   Object.fromEntries(
-    pkg.map(({ name, version }): [string, string] => [name, version]),
+    pkg.map(({ name, version, source }): [string, UvLockedPackage] => [
+      name,
+      { version, registryUrl: source?.registry },
+    ]),
   ),
 );

lib/modules/manager/pep621/utils.ts

@@ -17,6 +17,7 @@ export const depTypes = {
   pdmDevDependencies: 'tool.pdm.dev-dependencies',
   uvDevDependencies: 'tool.uv.dev-dependencies',
   uvSources: 'tool.uv.sources',
+  uvIndirectDependencies: 'uv.lock',
   buildSystemRequires: 'build-system.requires',
 };
 

lib/workers/repository/process/vulnerabilities.spec.ts

@@ -1127,6 +1127,9 @@ describe('workers/repository/process/vulnerabilities', () => {
           matchPackageNames: ['stdlib'],
           matchCurrentVersion: '1.7.5',
           allowedVersions: '>= 1.7.6',
+          // remediation must override a disabled dependency, e.g. a transitive
+          // dep surfaced from a lockfile
+          enabled: true,
           isVulnerabilityAlert: true,
         },
       ]);

lib/workers/repository/process/vulnerabilities.ts

@@ -600,6 +600,10 @@ export class Vulnerabilities {
       matchCurrentVersion: depVersion,
       versioning,
       allowedVersions: fixedVersion,
+      // Remediate even when updates are otherwise disabled for the dependency,
+      // e.g. transitive deps surfaced from a lockfile. Consistent with how
+      // vulnerability alerts already override schedule and minimumReleaseAge.
+      enabled: true,
       isVulnerabilityAlert: true,
       vulnerabilitySeverity: severityDetails.severityLevel,
       prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),