fix: update mixed case dependencies in python to be normalized by spiffcs · Pull Request #4573 · anchore/syft

spiffcs · 2026-01-26T15:56:20Z

Description

When generating a CycloneDX SBOM from a Python project that uses poetry.lock, Syft was failing to resolve dependency edges when the dependency name used different casing than the package name.

For example, in a poetry.lock file, dj-rest-auth declares a dependency on Django (capitalized), but the actual package is listed as django (lowercase).

Per the https://packaging.python.org/en/latest/specifications/name-normalization/, package names should be treated as case-insensitive.

Root Cause

The packageRef function in the poetry dependency resolver was not normalizing package names before using them for dependency matching.

Fix

Fix: Apply the existing normalize() function to package names and extras in packageRef(), ensuring case-insensitive matching that complies with Python packaging standards.

Before: The dependency edge dj-rest-auth@7.0.1 → django@5.2.6 was missing from the SBOM dependency graph.
After: Dependency edges are correctly resolved regardless of package name casing in poetry.lock.

Some other tests have been updated that were missing this relationship previously

Type of Change

Bug fix (non-breaking change which fixes an issue)

Issue references
Fixes #4562

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

willmurphyscode · 2026-01-26T16:01:26Z

syft/pkg/cataloger/python/dependency_test.go

+			name:  "package name with mixed case and extra",
+			pkg:   "Django",
+			extra: "argon2",
+			want:  "django[argon2]",


How do the extras interact with the resolution in requires/provides?

So here is the current behavior:

When a package requires another with extras:

provides is always the base package no extras in the name

then we always have the base package requirements without any extras so those resolutions can always happen

If there are extras, the extra variants also get added (now run through the normalize logic)

1

syft/syft/pkg/cataloger/python/dependency.go

Lines 24 to 27 in e8b4527

// this package reference always includes the package name and no extras

provides := []string{packageRef(p.Name, "")}

2

syft/syft/pkg/cataloger/python/dependency.go

Lines 34 to 37 in e8b4527

// we always have the base package requirement without any extras to get base dependencies

requires = append(requires, packageRef(dep.Name, ""))

3

syft/syft/pkg/cataloger/python/dependency.go

Lines 38 to 47 in e8b4527

// if there are extras, we need to add a requirement for each extra individually

// for example:

// uvicorn = {version = ">=0.12.0", extras = ["standard", "else"]}

// then we must install uvicorn with the extras "standard" and "else" to satisfy the requirement

for _, extra := range dep.Extras {

// always refer to extras with the package name (e.g. name[extra])

// note: this must always be done independent of other extras (e.g. name[extra1] and name[extra2] separately

// is correct and name[extra1,extra2] will result in dependency resolution failure)

requires = append(requires, packageRef(dep.Name, extra))

}

This change does not update any of the above flow. It just makes sure that we are respecting the casing correctly in both instances of creating the provides:requires and the extras variant.

We reviewed this offline, and I think the behavior currently in main is correct. Provides and requires are include both a plain and a with extras variant as appropriate, like mashumaro and mashumaro[orjson], and this is unit tested.

No more changes needed for this PR then and we are 🟢 ❤️

* main: (114 commits) fix: lookup alternate scheme on url->licenseID (anchore#4588) chore(deps): bump the go-minor-patch group with 2 updates (anchore#4583) feat: add Qt6 binary detection (anchore#4550) chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (anchore#4584) fix: snap cataloger incorrectly identifies snap container as deb package (anchore#4500) chore(deps): update tools to latest versions (anchore#4577) fix: update mixed case dependencies in python to be normalized (anchore#4573) chore(deps): update anchore dependencies (anchore#4575) chore(deps): update tools to latest versions (anchore#4570) feat: detect Debian version from /etc/debian_version (anchore#4569) fix: correctly report supporting evidence for binary packages (anchore#4558) chore(deps): bump the actions-minor-patch group across 2 directories with 3 updates (anchore#4568) chore(deps): bump the go-minor-patch group with 6 updates (anchore#4567) chore(deps): update tools to latest versions (anchore#4565) chore(deps): bump github.com/spdx/tools-golang (anchore#4557) ci: enable zizmor to fail PRs (anchore#4556) Chore new slack action (anchore#4553) chore(deps): update anchore dependencies (anchore#4552) chore(deps): update tools to latest versions (anchore#4551) chore(deps): update tools to latest versions (anchore#4545) ... Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

spiffcs added 2 commits January 26, 2026 10:52

fix: update mixed case dependencies to have correct relationship

eab3ebc

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

test: remove issue reference from test

a9bcd95

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

willmurphyscode reviewed Jan 26, 2026

View reviewed changes

willmurphyscode approved these changes Jan 27, 2026

View reviewed changes

spiffcs merged commit 9a250a4 into main Jan 27, 2026
10 checks passed

spiffcs deleted the 4562-poetry-bug branch January 27, 2026 20:16

spiffcs changed the title ~~fix: update mixed case dependencies to have correct relationship~~ fix: update mixed case dependencies in python to be normalized Jan 27, 2026

spiffcs mentioned this pull request Jan 27, 2026

[Bug Report] Missing some dependencies on cyclonedx formatted SBOM using syft #4562

Closed

BrewTestBot mentioned this pull request Jan 29, 2026

syft 1.41.1 Homebrew/homebrew-core#265097

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: update mixed case dependencies in python to be normalized#4573

fix: update mixed case dependencies in python to be normalized#4573
spiffcs merged 2 commits intomainfrom
4562-poetry-bug

spiffcs commented Jan 26, 2026

Uh oh!

willmurphyscode Jan 26, 2026

Uh oh!

spiffcs Jan 27, 2026 •

edited

Loading

Uh oh!

willmurphyscode Jan 27, 2026

Uh oh!

spiffcs Jan 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


	// this package reference always includes the package name and no extras
	provides := []string{packageRef(p.Name, "")}


	// we always have the base package requirement without any extras to get base dependencies
	requires = append(requires, packageRef(dep.Name, ""))

	// if there are extras, we need to add a requirement for each extra individually
	// for example:
	// uvicorn = {version = ">=0.12.0", extras = ["standard", "else"]}
	// then we must install uvicorn with the extras "standard" and "else" to satisfy the requirement
	for _, extra := range dep.Extras {
	// always refer to extras with the package name (e.g. name[extra])
	// note: this must always be done independent of other extras (e.g. name[extra1] and name[extra2] separately
	// is correct and name[extra1,extra2] will result in dependency resolution failure)
	requires = append(requires, packageRef(dep.Name, extra))
	}

Conversation

spiffcs commented Jan 26, 2026

Description

Root Cause

Fix

Type of Change

Uh oh!

willmurphyscode Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

spiffcs Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

willmurphyscode Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

spiffcs Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

spiffcs Jan 27, 2026 •

edited

Loading