Add support for uv package manager

[Kymartin45]

Support uv package manager

Implements support for uv package manager with uv sync and uv add integration.

Issue: #181

---

Usage

Configuring uv alias:

$ scfw configure
Thank you for using scfw, the Supply Chain Firewall by Datadog!

Supply Chain Firewall is a tool for preventing the installation of malicious npm and PyPI packages.

This script will walk you through setting up your environment to get the most out of scfw.
You can rerun this script at any time to update your configuration settings.

[?] Enter a directory that Supply Chain Firewall can use as a local cache (default: /home/<user>/.scfw):
[?] Would you like to set a shell alias to run all npm commands through SCFW? (Y/n):
[?] Would you like to set a shell alias to run all pip commands through SCFW? (Y/n):
[?] Would you like to set a shell alias to run all Poetry commands through SCFW? (Y/n):
[?] Would you like to set a shell alias to run all uv commands through SCFW? (Y/n):

...
...
...

$ cat ~/.zshrc 2>/dev/null || cat ~/.bashrc
# BEGIN SCFW MANAGED BLOCK
alias npm="scfw run npm"
alias pip="scfw run pip"
alias poetry="scfw run poetry"
alias uv="scfw run uv"
export SCFW_HOME="/home/<user>/.scfw"
# END SCFW MANAGED BLOCK

Syncing project dependencies:

$ uv sync
Package python-dotenv-1.1.0:
  - An OSV.dev advisory exists for package python-dotenv-1.1.0:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-2270
  - An OSV.dev advisory exists for package python-dotenv-1.1.0:
      * [Medium] https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94
Package requests-2.32.4:
  - An OSV.dev advisory exists for package requests-2.32.4:
      * [Medium] https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2
  - An OSV.dev advisory exists for package requests-2.32.4:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-2275
Package urllib3-2.5.0:
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1996
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-38jv-5279-wg99
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1998
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-141
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-2xpw-w6gg-jr37
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1994
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
[?] Proceed with installation? (y/N): n


The command was blocked. No changes have been made.

Adding single dependency to a project:

$ uv add urllib3==2.5.0
Package urllib3-2.5.0:
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1994
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1998
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-2xpw-w6gg-jr37
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-141
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1996
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-38jv-5279-wg99
[?] Proceed with installation? (y/N): n


The command was blocked. No changes have been made.

Piping scfw with optional flags when installing single dependency in a dev dependency group with uv add:

$ scfw --log-level DEBUG run uv add --dev urllib3==2.5.0
[SCFW] INFO: Starting Supply Chain Firewall on Sun Aug 23 16:00:29 2026
[SCFW] DEBUG: Command line: {'log_level': 'DEBUG', 'subcommand': <Subcommand.Run: 'run'>, 'package_manager': 'uv', 'dry_run': False, 'allow_on_warning': False, 'allow_unsupported': False, 'block_on_warning': False, 'error_on_block': False, 'executable': None, 'command': ['uv', 'add', '--dev', 'urllib3==2.5.0']}
[SCFW] DEBUG: Module dd_logger does not export a logger
[SCFW] INFO: Command: 'uv add --dev urllib3==2.5.0'
[SCFW] DEBUG: Running uv command in temp project: /home/<user>/.local/bin/uv init --bare --name scfw-resolution
[SCFW] DEBUG: Running uv command in temp project: /home/<user>/.local/bin/uv add urllib3==2.5.0
[SCFW] DEBUG: Running uv command in temp project: /home/<user>/.local/bin/uv export --format requirements.txt --no-hashes --no-emit-project -o /tmp/tmp_12flcnd/.scfw-requirements-76e63c73.txt --project /tmp/tmp_12flcnd
[SCFW] INFO: Command would install: [urllib3-2.5.0]
[SCFW] INFO: Using package verifiers: [PackageAgeVerifier, DatadogMaliciousPackagesVerifier, FindingsListVerifier, OsvVerifier]
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package urllib3-2.5.0: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package urllib3-2.5.0: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package urllib3-2.5.0: assuming PyPI registry source
[SCFW] INFO: Verifier DatadogMaliciousPackagesVerifier had no findings for package urllib3-2.5.0
[SCFW] WARNING: OsvVerifier: Unknown source for package urllib3-2.5.0: assuming PyPI registry source
[SCFW] INFO: Verifier FindingsListVerifier had no findings for package urllib3-2.5.0
[SCFW] INFO: Verifier PackageAgeVerifier had no findings for package urllib3-2.5.0
[SCFW] INFO: Verifier OsvVerifier had findings for package urllib3-2.5.0
[SCFW] INFO: Verification of packages complete
Package urllib3-2.5.0:
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-38jv-5279-wg99
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-141
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1994
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-2xpw-w6gg-jr37
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1996
  - An OSV.dev advisory exists for package urllib3-2.5.0:
      * [High] https://osv.dev/vulnerability/PYSEC-2026-1998
[?] Proceed with installation? (y/N): n


The command was blocked. No changes have been made.

Auditing all installed packages in the invoking environment:

$ scfw audit uv
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package certifi-2026.7.22: assuming PyPI registry source
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package charset-normalizer-3.5.1: assuming PyPI registry source
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package idna-3.19: assuming PyPI registry source
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package urllib3-2.7.0: assuming PyPI registry source
[SCFW] WARNING: PackageAgeVerifier: Unknown source for package requests-2.32.3: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package certifi-2026.7.22: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package charset-normalizer-3.5.1: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package urllib3-2.7.0: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package idna-3.19: assuming PyPI registry source
[SCFW] WARNING: DatadogMaliciousPackagesVerifier: Unknown source for package requests-2.32.3: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package charset-normalizer-3.5.1: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package certifi-2026.7.22: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package urllib3-2.7.0: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package idna-3.19: assuming PyPI registry source
[SCFW] WARNING: FindingsListVerifier: Unknown source for package requests-2.32.3: assuming PyPI registry source
[SCFW] WARNING: OsvVerifier: Unknown source for package certifi-2026.7.22: assuming PyPI registry source
[SCFW] WARNING: OsvVerifier: Unknown source for package idna-3.19: assuming PyPI registry source
[SCFW] WARNING: OsvVerifier: Unknown source for package charset-normalizer-3.5.1: assuming PyPI registry source
[SCFW] WARNING: OsvVerifier: Unknown source for package urllib3-2.7.0: assuming PyPI registry source
[SCFW] WARNING: OsvVerifier: Unknown source for package requests-2.32.3: assuming PyPI registry source
Package requests-2.32.3:
  - An OSV.dev advisory exists for package requests-2.32.3:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-1872
  - An OSV.dev advisory exists for package requests-2.32.3:
      * [Medium] https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2
  - An OSV.dev advisory exists for package requests-2.32.3:
      * [Medium] https://osv.dev/vulnerability/PYSEC-2026-2275
  - An OSV.dev advisory exists for package requests-2.32.3:
      * [Medium] https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7