[ozenyunus35]

Description

In pylock.toml (PEP 751), an entry in [[packages.dependencies]] may give only a name, as long as that name picks a single package. Trivy always built the dependency ID from name and version, so { name = "beta" } turned into beta@ and matched nothing. The relationship was dropped, and beta showed up directly under pylock.toml in the SBOM.

This follows the approach agreed in the issue:

• A dependency with a version works as before.
• A dependency without a version resolves to the package ID when exactly one package has that name.
• If no package or several packages have that name, the dependency is skipped with a debug log. Trivy doesn't read the other keys that could narrow it down (e.g. marker, vcs).

I also bumped the analyzer version so cached results get re-analyzed.

Before, with the reproducer from the issue:

{"ref":"pkg:pypi/alpha@1.0.0","dependsOn":[]}
{"ref":"pkg:pypi/beta@2.0.0","dependsOn":[]}

After:

{"ref":"pkg:pypi/alpha@1.0.0","dependsOn":["pkg:pypi/beta@2.0.0"]}
{"ref":"pkg:pypi/beta@2.0.0","dependsOn":[]}

The pylock.toml component now depends only on alpha, instead of both. The parser test covers a unique name, an ambiguous one and an unknown one.

Related issues

• Close bug(python): pylock.toml dependencies without a version are dropped from the dependency graph #11411

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

I used an AI assistant to help draft parts of the code and tests; I reviewed the changes and ran the tests myself.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}