RTECO-2728 - Audit Poetry projects that declare dependencies in PEP 621 [project]

audit_test.go

@@ -670,15 +670,21 @@ func TestXrayAuditPoetry(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			validations.ValidateCommandOutput(t, testXrayAuditPoetry(t, tc.format), tc.format, validations.ValidationParams{
+			validations.ValidateCommandOutput(t, testXrayAuditPoetry(t, "poetry-project", tc.format), tc.format, validations.ValidationParams{
+				Total: &validations.TotalCount{Licenses: 1, Vulnerabilities: 3},
+			})
+		})
+		// Same dependencies as "poetry-project", declared in the PEP 621 [project] table (Poetry 2.0+ default layout).
+		t.Run(tc.name+" PEP 621", func(t *testing.T) {
+			validations.ValidateCommandOutput(t, testXrayAuditPoetry(t, "poetry-pep621-project", tc.format), tc.format, validations.ValidationParams{
 				Total: &validations.TotalCount{Licenses: 1, Vulnerabilities: 3},
 			})
 		})
 	}
 }
 
-func testXrayAuditPoetry(t *testing.T, format format.OutputFormat) string {
-	_, cleanUp := securityTestUtils.CreateTestProjectEnvAndChdir(t, filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "projects", "package-managers", "python", "poetry", "poetry-project"))
+func testXrayAuditPoetry(t *testing.T, projectName string, format format.OutputFormat) string {
+	_, cleanUp := securityTestUtils.CreateTestProjectEnvAndChdir(t, filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "projects", "package-managers", "python", "poetry", projectName))
 	defer cleanUp()
 	// Add dummy descriptor file to check that we run only specific audit
 	addDummyPackageDescriptor(t, false)

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-plugin v1.6.3
 	github.com/jedib0t/go-pretty/v6 v6.8.3
-	github.com/jfrog/build-info-go v1.13.1-0.20261028123549-f0cd26bfc2de
+	github.com/jfrog/build-info-go v1.13.1-0.20261105093150-46c74789c5ff
 	github.com/jfrog/froggit-go v1.24.0
 	github.com/jfrog/gofrog v1.7.7
 	github.com/jfrog/jfrog-apps-config v1.0.1

go.sum

@@ -161,8 +161,8 @@ github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFl
 github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
 github.com/jfrog/archiver/v3 v3.6.5 h1:AiNXJoe8jYDOtyykfVuwh26aM4rk/ei+YzBpfBukdzU=
 github.com/jfrog/archiver/v3 v3.6.5/go.mod h1:5V9l+Fte30Y4qe9dUOAd3yNTf8lmtVNuhKNrvI8PMhg=
-github.com/jfrog/build-info-go v1.13.1-0.20261028123549-f0cd26bfc2de h1:ycdUCYyOZ5TCcRIVT0EfjG/oRMk+QtY3u2XOUcjgt0s=
-github.com/jfrog/build-info-go v1.13.1-0.20261028123549-f0cd26bfc2de/go.mod h1:3sv87ey6WTxUckYkj0Iqu9aUaiygQMZKoXNmvT9lK5g=
+github.com/jfrog/build-info-go v1.13.1-0.20261105093150-46c74789c5ff h1:mvjYNq/bHbfsgtGpbBOPf6skAfsNyjnHjjWazl8Yq3M=
+github.com/jfrog/build-info-go v1.13.1-0.20261105093150-46c74789c5ff/go.mod h1:3sv87ey6WTxUckYkj0Iqu9aUaiygQMZKoXNmvT9lK5g=
 github.com/jfrog/froggit-go v1.24.0 h1:qSAywpxlPdQfIFIJPprFzfAkbNfKb/OXMo7YD3dVKrE=
 github.com/jfrog/froggit-go v1.24.0/go.mod h1:wRDryqyp3oe+eHgME2mpnEQmO8XBECIPagFwj0nHmdI=
 github.com/jfrog/gofrog v1.7.7 h1:I2MSi+ytPqfprhOC+MLDk5fVvuRzVjTqNkzrp9RtEvY=

sca/bom/buildinfo/technologies/python/python_test.go

@@ -211,6 +211,28 @@ func TestBuildPoetryDependencyList(t *testing.T) {
 	}
 }
 
+// Poetry 2.0+ declares dependencies in the PEP 621 [project] table by default, instead of [tool.poetry.dependencies].
+func TestBuildPoetryDependencyListPep621(t *testing.T) {
+	_, cleanUp := technologies.CreateTestWorkspace(t, filepath.Join("projects", "package-managers", "python", "poetry", "poetry-pep621-project"))
+	defer cleanUp()
+	expectedPoetryUniqueDeps := []string{
+		PythonPackageTypeIdentifier + "django:1.11.15",
+		PythonPackageTypeIdentifier + "pytz:2026.6",
+		PythonPackageTypeIdentifier + "urllib3:1.22",
+		PythonPackageTypeIdentifier + "werkzeug:0.9.6",
+	}
+	// SkipAutoInstall relies on build-info-go's direct pyproject.toml and poetry.lock parsing, without running `poetry install`.
+	rootNode, uniqueDeps, _, err := BuildDependencyTree(technologies.BuildInfoBomGeneratorParams{SkipAutoInstall: true}, techutils.Poetry)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, uniqueDeps, expectedPoetryUniqueDeps, "First is actual, Second is Expected")
+	require.Len(t, rootNode, 1)
+	assert.Len(t, rootNode[0].Nodes, 3)
+	djangoNode := tests.GetAndAssertNode(t, rootNode[0].Nodes, "django:1.11.15")
+	if assert.NotNil(t, djangoNode) {
+		tests.GetAndAssertNode(t, djangoNode.Nodes, "pytz:2026.6")
+	}
+}
+
 func TestBuildDependencyTreeWhenInstallForbidden(t *testing.T) {
 	// This feature is currently supported and tested for Pip and Poetry only
 	testcases := []struct {

tests/testdata/projects/package-managers/python/poetry/poetry-pep621-project/pyproject.toml

@@ -0,0 +1,19 @@
+[project]
+name = "poetry-pep621-project"
+version = "0.1.0"
+description = ""
+authors = [
+    {name = "Your Name", email = "you@example.com"}
+]
+dependencies = [
+    "urllib3 (<1.24)",
+    "django (<1.11.16)",
+    "Werkzeug (<0.10)"
+]
+
+[tool.poetry]
+package-mode = false
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"