uv-sbom 2.0.1

SBOM generation tool for uv projects - Generate CycloneDX SBOMs from uv.lock files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

use anyhow::Result;
use std::collections::HashMap;

/// Represents the result of a `uv lock --upgrade-package` simulation
#[allow(dead_code)]
#[derive(Debug, Clone)]
pub struct SimulationResult {
    /// The direct package that was upgraded
    pub upgraded_package: String,
    /// The version it was upgraded to
    pub upgraded_to_version: String,
    /// Map of transitive package name → resolved version after upgrade
    pub resolved_versions: HashMap<String, String>,
}

/// Port for simulating dependency resolution with package upgrades
#[allow(dead_code)]
#[async_trait::async_trait]
pub trait UvLockSimulator: Send + Sync {
    /// Simulate upgrading a specific package and return the resolved dependency versions.
    ///
    /// Runs `uv lock --upgrade-package <package_name>` (or equivalent) and parses
    /// the resulting lock file to determine what versions would be resolved.
    ///
    /// # Arguments
    /// * `package_name` - The direct dependency to upgrade
    /// * `project_path` - Path to the project directory containing pyproject.toml
    async fn simulate_upgrade(
        &self,
        package_name: &str,
        project_path: &std::path::Path,
    ) -> Result<SimulationResult>;
}