Make UpgradeTransitiveDependencyVersion package-manager-aware

Add pdmOverrides field to PythonResolutionResult and detect package
manager from pyproject.toml table names (tool.uv → Uv, tool.pdm → Pdm).
UpgradeTransitiveDependencyVersion now branches by package manager:
uv uses constraint-dependencies, PDM uses tool.pdm.overrides, and
unknown managers fall back to adding a direct dependency.

Author: knutwannheden

rewrite-python/src/main/java/org/openrewrite/python/PyProjectTomlParser.java

@@ -92,6 +92,7 @@ private PythonResolutionResult resolveFromLockFile(PythonResolutionResult marker
         marker = marker.withDependencyGroups(linkResolvedMap(marker.getDependencyGroups(), resolvedDeps));
         marker = marker.withConstraintDependencies(linkResolved(marker.getConstraintDependencies(), resolvedDeps));
         marker = marker.withOverrideDependencies(linkResolved(marker.getOverrideDependencies(), resolvedDeps));
+        marker = marker.withPdmOverrides(linkResolved(marker.getPdmOverrides(), resolvedDeps));
 
         return marker;
     }

rewrite-python/src/main/java/org/openrewrite/python/UpgradeTransitiveDependencyVersion.java

@@ -35,8 +35,12 @@
 
 /**
  * Pin a transitive dependency version by adding or upgrading a constraint in the
- * appropriate tool-specific section. For uv projects, this uses
- * {@code [tool.uv].constraint-dependencies}.
+ * appropriate tool-specific section. The strategy depends on the detected package manager:
+ * <ul>
+ *   <li><b>uv</b>: uses {@code [tool.uv].constraint-dependencies}</li>
+ *   <li><b>PDM</b>: uses {@code [tool.pdm.overrides]}</li>
+ *   <li><b>Other/unknown</b>: adds as a direct dependency in {@code [project].dependencies}</li>
+ * </ul>
  */
 @EqualsAndHashCode(callSuper = false)
 @Value
@@ -64,15 +68,18 @@ public String getInstanceNameSuffix() {
 
     @Override
     public String getDescription() {
-        return "Pin a transitive dependency version by adding or upgrading a constraint. " +
-                "For uv projects, this uses `[tool.uv].constraint-dependencies`. " +
-                "When `uv` is available, the `uv.lock` file is regenerated.";
+        return "Pin a transitive dependency version using the appropriate strategy for the " +
+                "detected package manager: uv uses `[tool.uv].constraint-dependencies`, " +
+                "PDM uses `[tool.pdm.overrides]`, and other managers add a direct dependency.";
     }
 
     enum Action {
         NONE,
         ADD_CONSTRAINT,
-        UPGRADE_CONSTRAINT
+        UPGRADE_CONSTRAINT,
+        ADD_PDM_OVERRIDE,
+        UPGRADE_PDM_OVERRIDE,
+        ADD_DIRECT_DEPENDENCY
     }
 
     static class Accumulator {
@@ -108,23 +115,40 @@ public Toml.Document visitDocument(Toml.Document document, ExecutionContext ctx)
                     return document;
                 }
 
-                // For uv projects, require resolved dependencies to verify it's transitive
-                if (marker.getResolvedDependency(packageName) == null) {
-                    return document;
-                }
-
-                // Check if a constraint already exists
-                Dependency existingConstraint = PyProjectHelper.findDependencyInScope(
-                        marker, packageName, "tool.uv.constraint-dependencies", null);
+                PythonResolutionResult.PackageManager pm = marker.getPackageManager();
+                Action action = null;
 
-                if (existingConstraint == null) {
-                    acc.actions.put(sourcePath, Action.ADD_CONSTRAINT);
-                } else if (!version.equals(existingConstraint.getVersionConstraint())) {
-                    acc.actions.put(sourcePath, Action.UPGRADE_CONSTRAINT);
+                if (pm == PythonResolutionResult.PackageManager.Uv) {
+                    // Uv: require resolved deps, use constraint-dependencies
+                    if (marker.getResolvedDependency(packageName) == null) {
+                        return document;
+                    }
+                    Dependency existing = PyProjectHelper.findDependencyInScope(
+                            marker, packageName, "tool.uv.constraint-dependencies", null);
+                    if (existing == null) {
+                        action = Action.ADD_CONSTRAINT;
+                    } else if (!version.equals(existing.getVersionConstraint())) {
+                        action = Action.UPGRADE_CONSTRAINT;
+                    }
+                } else if (pm == PythonResolutionResult.PackageManager.Pdm) {
+                    // PDM: use tool.pdm.overrides
+                    Dependency existing = PyProjectHelper.findDependencyInScope(
+                            marker, packageName, "tool.pdm.overrides", null);
+                    if (existing == null) {
+                        action = Action.ADD_PDM_OVERRIDE;
+                    } else if (!version.equals(existing.getVersionConstraint())) {
+                        action = Action.UPGRADE_PDM_OVERRIDE;
+                    }
                 } else {
+                    // Fallback: add as direct dependency
+                    action = Action.ADD_DIRECT_DEPENDENCY;
+                }
+
+                if (action == null) {
                     return document;
                 }
 
+                acc.actions.put(sourcePath, action);
                 acc.projectsToUpdate.add(sourcePath);
                 return document;
             }
@@ -141,9 +165,15 @@ public Toml.Document visitDocument(Toml.Document document, ExecutionContext ctx)
                 if (sourcePath.endsWith("pyproject.toml") && acc.projectsToUpdate.contains(sourcePath)) {
                     Action action = acc.actions.get(sourcePath);
                     if (action == Action.ADD_CONSTRAINT) {
-                        return addConstraint(document, ctx, acc);
+                        return addToArray(document, ctx, acc, "tool.uv.constraint-dependencies");
                     } else if (action == Action.UPGRADE_CONSTRAINT) {
                         return upgradeConstraint(document, ctx, acc);
+                    } else if (action == Action.ADD_PDM_OVERRIDE) {
+                        return addPdmOverride(document, ctx, acc);
+                    } else if (action == Action.UPGRADE_PDM_OVERRIDE) {
+                        return upgradePdmOverride(document, ctx, acc);
+                    } else if (action == Action.ADD_DIRECT_DEPENDENCY) {
+                        return addToArray(document, ctx, acc, null);
                     }
                 }
 
@@ -160,15 +190,15 @@ public Toml.Document visitDocument(Toml.Document document, ExecutionContext ctx)
         };
     }
 
-    private Toml.Document addConstraint(Toml.Document document, ExecutionContext ctx, Accumulator acc) {
+    private Toml.Document addToArray(Toml.Document document, ExecutionContext ctx, Accumulator acc, @Nullable String scope) {
         String pep508 = packageName + version;
 
         Toml.Document updated = (Toml.Document) new TomlIsoVisitor<ExecutionContext>() {
             @Override
             public Toml.Array visitArray(Toml.Array array, ExecutionContext ctx) {
                 Toml.Array a = super.visitArray(array, ctx);
 
-                if (!PyProjectHelper.isInsideDependencyArray(getCursor(), "tool.uv.constraint-dependencies", null)) {
+                if (!PyProjectHelper.isInsideDependencyArray(getCursor(), scope, null)) {
                     return a;
                 }
 
@@ -289,4 +319,83 @@ private boolean isInsideConstraintDependencies() {
 
         return updated;
     }
+
+    private Toml.Document addPdmOverride(Toml.Document document, ExecutionContext ctx, Accumulator acc) {
+        Toml.Document updated = (Toml.Document) new TomlIsoVisitor<ExecutionContext>() {
+            @Override
+            public Toml.Table visitTable(Toml.Table table, ExecutionContext ctx) {
+                Toml.Table t = super.visitTable(table, ctx);
+                if (t.getName() == null || !"tool.pdm.overrides".equals(t.getName().getName())) {
+                    return t;
+                }
+
+                // Build a new KeyValue: packageName = "version"
+                Toml.Identifier key = new Toml.Identifier(
+                        randomId(), Space.EMPTY, Markers.EMPTY, packageName, packageName);
+                Toml.Literal value = new Toml.Literal(
+                        randomId(), Space.SINGLE_SPACE, Markers.EMPTY,
+                        TomlType.Primitive.String, "\"" + version + "\"", version);
+                Toml.KeyValue newKv = new Toml.KeyValue(
+                        randomId(), Space.EMPTY, Markers.EMPTY,
+                        new TomlRightPadded<>(key, Space.SINGLE_SPACE, Markers.EMPTY),
+                        value);
+
+                // Determine prefix for new entry
+                List<Toml> values = t.getValues();
+                Space entryPrefix;
+                if (!values.isEmpty()) {
+                    entryPrefix = values.get(values.size() - 1).getPrefix();
+                } else {
+                    entryPrefix = Space.format("\n");
+                }
+                newKv = newKv.withPrefix(entryPrefix);
+
+                List<Toml> newValues = new ArrayList<>(values);
+                newValues.add(newKv);
+                return t.withValues(newValues);
+            }
+        }.visitNonNull(document, ctx);
+
+        if (updated != document) {
+            updated = PyProjectHelper.regenerateLockAndRefreshMarker(updated, acc.updatedLockFiles);
+        }
+
+        return updated;
+    }
+
+    private Toml.Document upgradePdmOverride(Toml.Document document, ExecutionContext ctx, Accumulator acc) {
+        String normalizedName = PythonResolutionResult.normalizeName(packageName);
+
+        Toml.Document updated = (Toml.Document) new TomlIsoVisitor<ExecutionContext>() {
+            @Override
+            public Toml.KeyValue visitKeyValue(Toml.KeyValue keyValue, ExecutionContext ctx) {
+                Toml.KeyValue kv = super.visitKeyValue(keyValue, ctx);
+
+                if (!PyProjectHelper.isInsidePdmOverridesTable(getCursor())) {
+                    return kv;
+                }
+
+                if (!(kv.getKey() instanceof Toml.Identifier)) {
+                    return kv;
+                }
+                String keyName = ((Toml.Identifier) kv.getKey()).getName();
+                if (!PythonResolutionResult.normalizeName(keyName).equals(normalizedName)) {
+                    return kv;
+                }
+
+                if (!(kv.getValue() instanceof Toml.Literal)) {
+                    return kv;
+                }
+
+                Toml.Literal literal = (Toml.Literal) kv.getValue();
+                return kv.withValue(literal.withSource("\"" + version + "\"").withValue(version));
+            }
+        }.visitNonNull(document, ctx);
+
+        if (updated != document) {
+            updated = PyProjectHelper.regenerateLockAndRefreshMarker(updated, acc.updatedLockFiles);
+        }
+
+        return updated;
+    }
 }

rewrite-python/src/main/java/org/openrewrite/python/internal/PyProjectHelper.java

@@ -253,10 +253,31 @@ public static boolean isInsideDependencyArray(Cursor cursor, @Nullable String sc
             return findInList(marker.getConstraintDependencies(), packageName);
         } else if ("tool.uv.override-dependencies".equals(scope)) {
             return findInList(marker.getOverrideDependencies(), packageName);
+        } else if ("tool.pdm.overrides".equals(scope)) {
+            return findInList(marker.getPdmOverrides(), packageName);
         }
         return null;
     }
 
+    /**
+     * Check whether a cursor path represents a position inside the
+     * {@code [tool.pdm.overrides]} table in a pyproject.toml.
+     */
+    public static boolean isInsidePdmOverridesTable(Cursor cursor) {
+        Cursor c = cursor;
+        while (c != null) {
+            Object val = c.getValue();
+            if (val instanceof Toml.Table) {
+                Toml.Table table = (Toml.Table) val;
+                if (table.getName() != null && "tool.pdm.overrides".equals(table.getName().getName())) {
+                    return true;
+                }
+            }
+            c = c.getParent();
+        }
+        return false;
+    }
+
     private static @Nullable Dependency findInList(List<Dependency> deps, String packageName) {
         String normalized = PythonResolutionResult.normalizeName(packageName);
         for (Dependency dep : deps) {

rewrite-python/src/main/java/org/openrewrite/python/internal/PythonDependencyParser.java

@@ -66,6 +66,11 @@ public class PythonDependencyParser {
         List<Dependency> constraintDependencies = getDependencyList(uvTable, "constraint-dependencies");
         List<Dependency> overrideDependencies = getDependencyList(uvTable, "override-dependencies");
 
+        List<Dependency> pdmOverrides = getPdmOverrides(tables);
+
+        // Detect package manager from tool sections
+        PythonResolutionResult.PackageManager packageManager = detectPackageManager(tables);
+
         String path = doc.getSourcePath().toString();
 
         return new PythonResolutionResult(
@@ -83,8 +88,9 @@ public class PythonDependencyParser {
                 dependencyGroups,
                 constraintDependencies,
                 overrideDependencies,
+                pdmOverrides,
                 Collections.emptyList(),
-                null,
+                packageManager,
                 null
         );
     }
@@ -273,6 +279,46 @@ private static Map<String, List<Dependency>> parseOptionalDependenciesFromTable(
         return result;
     }
 
+    /**
+     * Extract PDM overrides from [tool.pdm.overrides].
+     * Each entry is a key-value pair where key = package name, value = version constraint string.
+     */
+    private static List<Dependency> getPdmOverrides(Map<String, Toml.Table> tables) {
+        Toml.Table pdmOverridesTable = tables.get("tool.pdm.overrides");
+        if (pdmOverridesTable == null) {
+            return Collections.emptyList();
+        }
+        List<Dependency> result = new ArrayList<>();
+        for (Toml value : pdmOverridesTable.getValues()) {
+            if (value instanceof Toml.KeyValue) {
+                Toml.KeyValue kv = (Toml.KeyValue) value;
+                if (kv.getKey() instanceof Toml.Identifier && kv.getValue() instanceof Toml.Literal) {
+                    String pkgName = ((Toml.Identifier) kv.getKey()).getName();
+                    Object val = ((Toml.Literal) kv.getValue()).getValue();
+                    if (val instanceof String) {
+                        result.add(new Dependency(pkgName, (String) val, null, null, null));
+                    }
+                }
+            }
+        }
+        return result;
+    }
+
+    /**
+     * Detect the package manager from tool-specific table names.
+     */
+    private static PythonResolutionResult.@Nullable PackageManager detectPackageManager(Map<String, Toml.Table> tables) {
+        for (String tableName : tables.keySet()) {
+            if ("tool.pdm".equals(tableName) || tableName.startsWith("tool.pdm.")) {
+                return PythonResolutionResult.PackageManager.Pdm;
+            }
+            if ("tool.uv".equals(tableName) || tableName.startsWith("tool.uv.")) {
+                return PythonResolutionResult.PackageManager.Uv;
+            }
+        }
+        return null;
+    }
+
     // PEP 508 parsing: name[extras](version_constraint);marker
     // Examples:
     //   requests

rewrite-python/src/main/java/org/openrewrite/python/marker/PythonResolutionResult.java

@@ -99,6 +99,12 @@ public class PythonResolutionResult implements Marker, RpcCodec<PythonResolution
      */
     List<Dependency> overrideDependencies;
 
+    /**
+     * PDM overrides from [tool.pdm.overrides].
+     * These force specific versions for packages in PDM-managed projects.
+     */
+    List<Dependency> pdmOverrides;
+
     List<ResolvedDependency> resolvedDependencies;
 
     @Nullable PackageManager packageManager;
@@ -176,6 +182,11 @@ public class PythonResolutionResult implements Marker, RpcCodec<PythonResolution
                 return dep;
             }
         }
+        for (Dependency dep : pdmOverrides) {
+            if (normalizeName(dep.getName()).equals(normalized)) {
+                return dep;
+            }
+        }
         return null;
     }
 
@@ -194,6 +205,7 @@ public List<Dependency> getAllDeclaredDependencies() {
         }
         all.addAll(constraintDependencies);
         all.addAll(overrideDependencies);
+        all.addAll(pdmOverrides);
         return all;
     }
 
@@ -228,6 +240,9 @@ public void rpcSend(PythonResolutionResult after, RpcSendQueue q) {
         q.getAndSendListAsRef(after, PythonResolutionResult::getOverrideDependencies,
                 dep -> dep.getName() + "@" + dep.getVersionConstraint(),
                 dep -> dep.rpcSend(dep, q));
+        q.getAndSendListAsRef(after, PythonResolutionResult::getPdmOverrides,
+                dep -> dep.getName() + "@" + dep.getVersionConstraint(),
+                dep -> dep.rpcSend(dep, q));
         q.getAndSendListAsRef(after, PythonResolutionResult::getResolvedDependencies,
                 resolved -> resolved.getName() + "@" + resolved.getVersion(),
                 resolved -> resolved.rpcSend(resolved, q));
@@ -258,6 +273,8 @@ public PythonResolutionResult rpcReceive(PythonResolutionResult before, RpcRecei
                         dep -> dep.rpcReceive(dep, q)))
                 .withOverrideDependencies(q.receiveList(before.overrideDependencies,
                         dep -> dep.rpcReceive(dep, q)))
+                .withPdmOverrides(q.receiveList(before.pdmOverrides,
+                        dep -> dep.rpcReceive(dep, q)))
                 .withResolvedDependencies(q.receiveList(before.resolvedDependencies,
                         resolved -> resolved.rpcReceive(resolved, q)))
                 .withPackageManager(q.receiveAndGet(before.packageManager, toEnum(PackageManager.class)))