Type Python and UV library detection metadata

[JamieMagee]

What are you trying to accomplish?

Use typed pyproject metadata for library detection in Python and UV. PyprojectDocument now exposes optional string name and description fields, and the Python checker reads PyPI's info.summary through a typed helper. This removes 12 T.untyped annotations across the two checkers.

Anything you want to highlight for special attention from reviewers?

Python still prefers Poetry, project, then build-system metadata. UV still ignores Poetry metadata. Empty tables remain distinct from missing tables, including when choosing the Poetry resolver. Missing descriptions, network fallbacks, and cached library decisions keep their existing behavior.

Wrongly typed consumed metadata now raises a contextual TypeError. This is intentional: malformed names, descriptions, and PyPI summaries were previously handled inconsistently. Unknown fields remain allowed, and unselected metadata is not validated. TOML syntax errors retain each caller's existing handling.

The types cover fields already used by library detection, not a complete pyproject schema. The build-system metadata fallback is existing Dependabot behavior. Resolver interfaces stay outside this change, so both checker files remain typed: strict.

This PR is independent of the UV version-config change. Both reduce the existing RuboCop offense count; preserve both reductions when merging.

How will you know you've accomplished your goal?

Repository-wide Sorbet and targeted RuboCop passed in containers. The relevant Python and UV document, parser, and checker suites passed all 394 examples, including new cases for malformed metadata, table precedence, empty-table resolver selection, and cached PyPI decisions. I did not run the complete repository suite.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟢 Approval recommended

The typed implementation preserves established behavior and is comprehensively covered by focused tests.

Review tier: Balanced
Findings: None

What changed in this PR

Adds typed pyproject metadata handling for Python and UV library detection while preserving existing precedence and fallback behavior.

Changes:

• Introduces typed project metadata accessors.
• Uses typed PyPI summary parsing with contextual errors.
• Expands precedence, malformed-data, caching, and resolver tests.

File	Description
.rubocop_todo.yml	Reduces the T.untyped offense count.
python/​lib/​dependabot/​python/​file_parser/​pyproject_document.rb	Adds typed metadata parsing.
python/​lib/​dependabot/​python/​update_checker.rb	Uses typed pyproject and PyPI metadata.
python/​spec/​dependabot/​python/​file_parser/​pyproject_document_spec.rb	Tests metadata parsing and validation.
python/​spec/​dependabot/​python/​update_checker_spec.rb	Tests library detection and resolver behavior.
uv/​lib/​dependabot/​uv/​update_checker.rb	Uses typed standard metadata while ignoring Poetry.
uv/​spec/​dependabot/​uv/​update_checker_spec.rb	Tests UV metadata precedence and validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.