[Copilot]

What are you trying to accomplish?

Uv::FileFetcher never fetched uv.toml. The uv sandboxes (CompileFileUpdater, PipCompileVersionResolver, and LockFileUpdater when the repo isn't cloned) are built from fetched files only, so settings that exist only in uv.toml were ignored, such as required-version, index and sources. When both files set a value, Dependabot used [tool.uv], while uv itself gives uv.toml precedence and ignores [tool.uv].

• Fetcher: uv.toml in the project directory is now fetched as a support file. All three updaters already write every dependency file into the sandbox, so none of them needed changes.
• Workspaces: only the root's uv.toml is fetched. uv starts config discovery at the workspace root and ignores members' config.

Anything you want to highlight for special attention from reviewers?

• Behaviour change: every uv.toml setting now applies to every uv project that has one. This is the intended fix (Run the uv version that [tool.uv] required-version names #16847 deliberately avoided it). Repos whose uv.toml Dependabot previously ignored may now resolve differently.
• Out of scope: a uv.toml in a directory above the configured one, e.g. a workspace root above a member configured as the Dependabot directory. Dependabot doesn't fetch parent workspace roots today. Placing a parent uv.toml in the sandbox correctly would also mean reproducing uv's ancestor-walk rules (a closer [tool.uv] wins).
• Interaction with Run the uv version that [tool.uv] required-version names #16847: that PR reads the required-version pin from uv's own error, so with this change it picks up uv.toml precedence automatically.

How will you know you've accomplished your goal?

• file_fetcher_spec.rb checks that uv.toml is fetched as a support file, that pyproject.toml stays the only primary file, and that nothing is fetched when uv.toml is absent.

• file_updater_spec.rb adds a regression spec through the public Uv::FileUpdater#updated_dependency_files. It runs a real uv lock, so it needs the uv Docker image, and it has not been run yet:

  # pyproject.toml
  [tool.uv]
  required-version = "<0.1.0"   # unsatisfiable
  
  # uv.toml
  required-version = ">=0.1.0"

  • With uv.toml present, the update should succeed and bump requests from 2.32.3 to 2.32.4.
  • Without it, the update should raise ToolVersionNotSupported with detected_version <0.1.0.

• The same scenario was checked by hand with standalone uv 0.13.7. Without uv.toml, uv lock fails on the version pin; with it, uv warns that [tool.uv] required-version is ignored and updates the lock.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

• Fixes uv: uv.toml is not fetched, so its settings (including required-version) are ignored #16849

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Copilot]

🟡 Changes recommended

Credential matching ignores uv.toml index overrides, risking secret disclosure and authentication failures, while the new success test depends on live PyPI access.

2 open issues

• Match index credentials against the effective uv configuration · New
• Avoid live PyPI resolution in the success example · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Index authentication ignores uv.toml precedence, causing private-registry updates to fail when index names differ, and the regression test depends on live PyPI access.

2 open issues

• Match index credentials against the effective uv configuration
• Avoid live PyPI resolution in the success example

_{Review effort: Balanced}