Add an indirect dependency check

[zsol]

Note

this is not yet ready for review

This PR adds a check that highlights imports that use dependencies that are not declared directly in pyproject.toml (but are present in the environment one way or another).

Overview

To implement this, a hidden --dependency-metadata command line flag is added to the check subcommand, that takes a path to a json file. The json file should be shaped like the output of uv workspace metadata --sync (which is added in astral-sh/uv#19122 ), and provides:

1. each workspace project’s declared dependencies
2. dependency-group dependencies
3. importable modules and the distributions that provide them

The check collects imports from the current project, resolves each import to a module, maps that module to its owning distribution, and compares that distribution against the current project’s declared direct dependencies. If the imported distribution is missing, ty emits missing-direct-dependency with the dependency the user should add.

The check is disabled when no dependency metadata is provided.

Nuances

• Editable distributions are not listed in the metadata’s module-owner map, so ty enriches the metadata by discovering modules from editable install search paths (see 6183fc2).
• Package code is checked only against the project’s direct dependencies. Dependency-group dependencies are allowed for non-package files such as tests or scripts, but transitive dependencies of dependency-group dependencies are still reported.

Future work

• we should teach ty how to invoke uv workspace metadata --sync the right way, instead of expecting the json file -> this way the check will also work in a language server environment
• additional dependency checks: unused dependencies, dependencies that are also provided by the standard library

[astral-sh-bot]

Typing conformance results

No changes detected ✅

Current numbers

The percentage of diagnostics emitted that were expected errors held steady at 94.36%. The percentage of expected errors that received a diagnostic held steady at 88.82%. The number of fully passing files held steady at 93/134.

[astral-sh-bot]

Memory usage report

Memory usage unchanged ✅

[astral-sh-bot]

ecosystem-analyzer results

Lint rule	Added	Removed	Changed
unresolved-import	0	4	0
Total	0	4	0

Large timing changes:

Project	Old Time	New Time	Change
itsdangerous	0.04s	16.91s	+43072%
rclip	0.09s	27.79s	+31524%
AutoSplit	0.16s	29.95s	+19128%
jinja	0.11s	20.25s	+18323%
hydra-zen	0.19s	33.35s	+17887%
egglog-python	0.29s	49.52s	+17150%
pwndbg	0.32s	23.13s	+7226%
git-revise	0.08s	4.76s	+6184%
pydantic	0.72s	30.46s	+4123%
ibis	0.53s	19.04s	+3503%
isort	0.25s	8.00s	+3146%
strawberry	0.13s	2.26s	+1695%
pytest-robotframework	0.17s	2.75s	+1555%
bidict	0.06s	0.92s	+1553%
starlette	0.10s	1.66s	+1525%
svcs	0.06s	0.99s	+1508%
altair	0.28s	4.22s	+1418%
mongo-python-driver	0.26s	3.49s	+1218%
Tanjun	0.16s	1.84s	+1085%
rotki	0.58s	6.50s	+1021%
attrs	0.13s	1.19s	+805%
django-stubs	0.19s	1.68s	+778%
pylox	0.08s	0.72s	+777%
django-modern-rest	0.10s	0.83s	+694%
werkzeug	0.14s	1.01s	+646%
mypy_primer	0.09s	0.60s	+600%
urllib3	0.15s	0.87s	+500%
scipy-stubs	0.51s	2.88s	+463%
operator	0.17s	0.93s	+444%
kornia	0.19s	1.04s	+442%
mypy-protobuf	0.13s	0.70s	+418%
docstring-adder	0.13s	0.65s	+392%
zulip	0.87s	3.66s	+319%
ecosystem-analyzer	0.11s	0.42s	+287%
prefect	1.23s	4.54s	+270%
xarray-dataclasses	0.31s	0.92s	+200%
mitmproxy	0.66s	1.86s	+182%
sphinx	0.31s	0.70s	+125%

Raw diff:

prefect (https://github.com/PrefectHQ/prefect)
- src/prefect/__init__.py:6:15 error[unresolved-import] Module `prefect` has no member `_build_info`
- src/prefect/_internal/analytics/client.py:19:10 error[unresolved-import] Cannot resolve imported module `prefect._internal.analytics._config`

urllib3 (https://github.com/urllib3/urllib3)
- src/urllib3/__init__.py:17:7 error[unresolved-import] Cannot resolve imported module `._version`
- src/urllib3/connection.py:44:7 error[unresolved-import] Cannot resolve imported module `._version`

Full report with detailed diff (timing results)