pep621: array form of tool.uv.sources is silently ignored, lookups go to the wrong registry

[ntsk]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.0.1

Please tell us more about your question or problem

What happens

uv supports two spellings for tool.uv.sources.
The single table form:

[tool.uv.sources]
my-package = { index = "custom" }

and an array form for multiple sources split by environment markers (https://docs.astral.sh/uv/concepts/projects/dependencies/, "Multiple sources").
A single-element array is also valid, since uv only requires markers when there are two or more entries:

[tool.uv.sources]
my-package = [{ index = "custom" }]

Renovate only understands the first one.
With the array form, the source entry is dropped and the lookup falls back to pypi.org.

Root cause

In lib/modules/manager/pep621/schema.ts, sources is LooseRecord(<package name>, UvSource) where UvSource is a union of plain objects, so an array matches nothing and LooseRecord discards it silently.
That's also why there is no config warning.

renovate/lib/modules/manager/pep621/schema.ts

Lines 142 to 149 in ba0182f

	// https://docs.astral.sh/uv/concepts/dependencies/#dependency-sources
	const UvSource = z.union([
	UvIndexSource,
	UvGitSource,
	UvUrlSource,
	UvPathSource,
	UvWorkspaceSource,
	]);

renovate/lib/modules/manager/pep621/schema.ts

Lines 156 to 160 in ba0182f

	sources: LooseRecord(
	// uv applies the same normalization as for Python dependencies on sources
	z.string().transform((source) => normalizePythonDepName(source)),
	UvSource,
	).optional(),

Impact

What you see depends on whether the name exists on pypi.org:

• not on pypi.org (our case, internal packages on a private registry):
  WARN: Package lookup failures, no update PRs.
• also on pypi.org: no warning at all, and Renovate proposes versions from
  pypi.org instead of the declared index. This is the worse case, and it's
  what the typical array-form usage (pinning torch to a PyTorch index per
  platform) would hit.

uv accepts both forms and produces the same uv.lock for both, so there's no hint that Renovate treats them differently.

Expected behavior

The array form is parsed like uv does, e.g. z.union([UvSource, z.array(UvSource)]) in the schema.
For marker-split sources with multiple indexes, using all declared index URLs as registry candidates is probably fine.

Minimal reproduction

https://github.com/ntsk/reproduce-array-form-uv-sources

The repo pins ntsk-reproduce-array-form-uv-sources to test.pypi.org via an array-form source.
The package is an empty placeholder I published for this repro.
It only exists on test.pypi.org, not on pypi.org, and its source is in the repo's package/ directory.
The committed uv.lock was generated by uv 0.11.16 from that exact pyproject, resolving from test.pypi.org, so uv itself is fine with the array form.

To reproduce:

1. LOG_LEVEL=debug npx renovate --platform=local → lookup hits pypi.org
   and fails (logs below).
2. Change the source to the single-table form (one line, see the comment in
   pyproject.toml) and run again → lookup uses test.pypi.org and succeeds.

The repo also has a GitHub Actions workflow that runs both forms and asserts
the behavior above, so you can check the logs without cloning:
https://github.com/ntsk/reproduce-array-form-uv-sources/actions/runs/30464143296

The Mend-hosted app is installed on that repo as well and shows the same
warning in its Dependency Dashboard:
ntsk/reproduce-array-form-uv-sources#3

Logs (if relevant)

Logs

Array form (lookup goes to pypi.org and fails):

DEBUG: GET https://pypi.org/pypi/ntsk-reproduce-array-form-uv-sources/json = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=277) (repository=local)
DEBUG: Failed to look up pypi package ntsk-reproduce-array-form-uv-sources: no-result (repository=local, packageFile=pyproject.toml, dependency=ntsk-reproduce-array-form-uv-sources)
...
  "packageName": "ntsk-reproduce-array-form-uv-sources",
  "datasource": "pypi",
  "depType": "project.dependencies",
  "currentValue": "==0.1.0",
  "warnings": [
    {
      "topic": "ntsk-reproduce-array-form-uv-sources",
      "message": "Failed to look up pypi package ntsk-reproduce-array-form-uv-sources: no-result"
    }
  ]

Single-table form (the only change, declared index is used):

  "packageName": "ntsk-reproduce-array-form-uv-sources",
  "registryUrls": ["https://test.pypi.org/simple/"],
  "registryUrl": "https://test.pypi.org/simple",
  "updates": [],
  "warnings": []

[RahulGautamSingh]

Thanks for the detailed report. PRs are welcome with the fix mentioned in the description.

[ntsk]

Thanks! Opened #44970 with the fix described above, verified against the reproduction repo.