[Bug]: dependency-confusion scanner misses standard [project] dependencies in pyproject.toml

[DhineshPonnarasan]

Package

Other

Description

Summary

scripts/check_dependency_confusion.py currently looks for a non-standard section marker ([project.dependencies]) when scanning pyproject.toml files.

In this repository, Python packages use standard PEP 621 layout ([project] + dependencies = [...]), so this path can miss dependency entries in strict scanning mode.

Affected file

• scripts/check_dependency_confusion.py (function: check_pyproject_toml)

Root cause

The parser toggles dependency scanning only when a line starts with [project.dependencies], but standard pyproject files declare dependencies under [project] as an array key.

Why this matters

This script is used by CI security gates and weekly audit workflows. Missing standard dependency declarations reduces dependency-confusion coverage for Python manifests.

Proposed fix

Update check_pyproject_toml to parse standard PEP 621 dependency structure ([project] dependencies and optional-dependencies) robustly.

Suggested tests

Add dedicated tests for scripts/check_dependency_confusion.py to verify:

1. Standard [project] dependencies = [...] entries are scanned.
2. [project.optional-dependencies] entries are scanned.
3. Registered packages are accepted.
4. Unregistered packages are flagged.
5. Existing local-only package severity behavior is preserved.

Acceptance criteria

• Scanner flags unregistered packages declared in standard [project] dependencies.
• Existing strict scan behavior for requirements/notebooks/package.json/Cargo.toml remains unchanged.
• New regression tests cover the pyproject parsing path.

Code of Conduct

• I agree to follow the Microsoft Open Source Code of Conduct

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	NONE
Overall	MEDIUM

Automated check by AGT Contributor Check.

[github-actions]

🤖 AI Agent: contributor-guide

Welcome to the microsoft/agent-governance-toolkit community! 🎉

Your issue relates to the scripts/check_dependency_confusion.py package, specifically in how it handles dependencies in pyproject.toml files.

For more information on contributing, please check out our CONTRIBUTING.md. Thank you for your valuable input!