uv grouped security updates silently drop Django due to case-sensitive dependency match

[mridang]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

uv

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

https://github.com/zitadel/example-auth-django/blob/main/pyproject.toml
https://github.com/zitadel/example-auth-django/blob/main/uv.lock

dependabot.yml content

https://github.com/zitadel/example-auth-django/blob/main/.github/dependabot.yml

Updated dependency

Django, from 6.0.3 to 6.0.4 (5 open advisories, all unfixed).

What you expected to see, versus what you actually saw

Expected a security PR bumping django in uv.lock from 6.0.3 to 6.0.4.

Got no PR. The grouped run logs Skipping update group for 'uv-security-updates' as it does not match any allowed dependencies.

The advisory package name is Django (capital D). The uv parser PEP 503-normalises the lockfile name to django. DependencySnapshot#allowed_dependencies then does a case-sensitive Array#include? against job.dependencies, so the match fails and Django is dropped before the group update runs. job_dependencies in the same file already downcases both sides for exactly this reason, and the ungrouped security path uses that one - which is why removing the applies-to: security-updates group makes it work, and why cryptography on the same repo was updated fine.

https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/dependency_snapshot.rb#L78-L84

Native package manager behavior

uv lock --upgrade-package django resolves django==6.0.4 fine.

Images of the diff or a link to the PR, issue, or logs

https://github.com/zitadel/example-auth-django/security/dependabot

Smallest manifest that reproduces the issue

No response

[seifertm]

I see a similar issue related to Django updates. In my specific case, dependabot does create a PR, but misinterprets django-boostrap5 for the Django dependency. As a result, django-bootstrap5 is dropped from pyproject.toml and replaced with django>=6.0.4.

In other words:

dependencies = [
    "Django>=5.0",
    "django-bootstrap5>=24.2",
]

becomes:

dependencies = [
    "Django>=5.0",
    "django>=6.0.4",
]