Skip to content

Bump manifest-parser for uv support (AST-173749) - #1551

Open
cx-atish-jadhav wants to merge 4 commits into
mainfrom
feature/add-uv-support
Open

Bump manifest-parser for uv support (AST-173749)#1551
cx-atish-jadhav wants to merge 4 commits into
mainfrom
feature/add-uv-support

Conversation

@cx-atish-jadhav

@cx-atish-jadhav cx-atish-jadhav commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Summary

Bumps the manifest-parser dependency to pick up uv Python support (v0.1.4v0.1.4-prerelease). Jira: AST-173001.

This is a dependency-only changego.mod / go.sum, no source changes.

Why no code changes are needed

uv support was intentionally designed so ast-cli requires nothing beyond the version bump:

  • No new manifest file type. uv projects use a standard PEP 621 pyproject.toml, which is already in ast-cli's OSS-realtime supported-file allowlist (validateSupportedManifestFile). uv.lock is a resolver-only sibling (like poetry.lock) and is never scanned standalone, so it does not need adding to supportedFilenames.
  • No PackageManager change. uv packages report "pypi" — identical to every other Python parser — so pkgToRequest / createPackageMap need no new mapping entry; pypi already passes through unchanged.
  • Real-file scan path already works. RunOssRealtimeScan parses the manifest at its original on-disk path, so a sibling uv.lock next to pyproject.toml is picked up by the new parser logic automatically.

What the bump brings in (from manifest-parser #27)

  • Parsing of PEP 735 [dependency-groups] in pyproject.toml.
  • uv.lock version resolution (plus poetry.lock/uv.lock precedence handling).
  • Correctness fixes to PEP 621 array dependencies that also benefit existing Poetry projects: PEP 508 extras stripping, marker-only requirements, bare unversioned deps, PEP 440 ===, and trailing-comment handling.

Verification

  • go build ./... passes clean.

Note for reviewers

This points at v0.1.4-prerelease. Once manifest-parser #27 merges and a final version is tagged, this pin should be updated to that release before/at merge.

🤖 Generated with Claude Code

Update dependency github.com/Checkmarx/manifest-parser from v0.1.4 to v0.1.4-prerelease in go.mod and refresh corresponding checksums in go.sum. No other modules or code changes included.
@cx-atish-jadhav
cx-atish-jadhav requested a review from a team August 31, 2026 10:20
@cx-atish-jadhav cx-atish-jadhav changed the title Bump manifest-parser for uv support (AST-173001) Bump manifest-parser for uv support (AST-173749) Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant