Feature Request: uv.lock support in dependency graph

[lachlankidson]

Select Topic Area

Product Feedback

Body

Dependabot recently added uv support, as covered in this blog post.

Unfortunately dependency graph doesn't currently list uv as a supported package ecosystem. Given the increasing adoption of uv it would be nice to have support for uv.lock files with pyproject.toml as an additional file, similar to the current poetry setup.

[ahpook]

This is coming! We have been adding ecosystem support for transitive dependencies over the past few months, and most recently have integrated microsoft/component-detection as the engine for building out dependency trees. Their uv support is still pretty brand new and had some rough edges when we tried it out, but once it matures you'll have auto-submission support for uv.

You can try it out today by running the component detection action as part of your build steps, let us know how it's working for you! microsoft/component-detection#1425

[mtvx]

So with that PR now merged, the support is there?

However, https://github.com/microsoft/component-detection?tab=readme-ov-file#features doesn't list uv as supported?

There is a page for uv in the docs, though: https://github.com/microsoft/component-detection/blob/main/docs/detectors/uv.md

Maybe uv should be added to the README.md table?

Is it supported by Dependency Graph or not?

What does this mean:

You can try it out today by running the component detection action as part of your build steps, let us know how it's working for you! microsoft/component-detection#1425

How?

---

So https://github.blog/changelog/2025-03-13-dependabot-version-updates-now-support-uv-in-general-availability/ was enabled via dependabot/dependabot-core#10478, and obviously the support was quite a lackluster, judging from the massive amount of comments to that PR. I'm not exactly sure what was missing, I believe at least transitive dependency support. The ticket is so lengthy I don't have time to read through.

Has the migration into using https://github.com/microsoft/component-detection happened since then? Is the microsoft/component-detection#1425 a re-write, to properly support uv, or what?

The whole topic here seems quite complicated, maybe somecould summarize where we are and where are we going?

[rmuir]

For now, I've created a simple action https://github.com/rmuir/uv-dependency-submission to populate the dependency graph from uv.lock files. You will get GH security alerts for transitive dependencies and so on as you expect.

[lachlankidson]

This seems like it might be supported now (unless I've missed something specific to my own org):

The docs aren't updated, but uv.lock is pulling through under the 'pip' ecosystem.

[nicholas-lockhart-indico]

Did you need to do anything special to get this to show? I have a project that was built on poetry but migrated over to uv three weeks ago, and the dependency graph is showing that it is pulling from a non-existent poetry.lock file. It also shows the uv.lock, but has a long list of poetry.lock items.