Add support for transitive dependencies for detect.uv.dependency.groups.only property

[bd-spratikbharti]

Description

What This Fixes

When a customer sets detect.uv.dependency.groups.only (for example, dev) for a UV project scanned via uv.lock, Detect correctly picked only the packages in that group as direct dependencies. However, it was silently dropping those packages' own dependencies.

These dependencies are still part of the actual installation and should therefore be included in the dependency graph and BOM.

What Changed

The only-groups filter was being applied too broadly. It was incorrectly skipping the regular dependencies section for every package in the lockfile, rather than only for the project's own top-level dependencies.

This fix narrows the filter's scope so that it applies only to project/workspace-level dependencies, which is the intended behaviour. All other packages now have their dependency lists parsed normally, ensuring that complete transitive dependency chains are preserved.

Test Coverage

Added a new unit test in UVLockParserTest that reproduces the real-world scenario reported by the customer: a dependency in a selected group with multiple levels of transitive dependencies.

The test verifies that:

• The project's regular dependencies remain excluded (existing behaviour, unchanged).
• The selected group's package is included.
• All transitive dependencies of that package are included.
• Nested dependencies (second-level and beyond) are correctly resolved and preserved.

[Copilot]

🟡 Changes recommended

The new isProjectEntry-gated behavior relies on comparing a normalized rootName to an unnormalized lockfile dependencyName, which can misclassify the project entry and incorrectly include regular/optional deps under onlyGroups.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the UV lockfile parsing logic so detect.uv.dependency.groups.only filters only the project/workspace’s top-level dependency sections, while preserving full transitive dependency chains for selected group members.

Changes:

• Narrows onlyGroups skipping logic to only apply to the root project / workspace entries (not all packages).
• Ensures non-project packages’ dependencies (and related sections) are still parsed even when onlyGroups is set, preserving transitive dependencies.
• Adds a regression unit test that verifies multi-level transitive dependencies are retained when scanning a selected dependency group.

File summaries

File	Description
detectable/src/main/java/com/blackduck/integration/detectable/detectables/uv/transform/UVLockParser.java	Adjusts dependency-section parsing to avoid dropping transitive dependencies when onlyGroups is set.
detectable/src/test/java/com/blackduck/integration/detectable/detectables/uv/unit/UVLockParserTest.java	Adds a regression test covering transitive dependency inclusion for selected dependency groups.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.