Switch from Poetry to uv

[danyeaw]

Switch to uv to improve environment set up performance.

The only limitation I ran in to is I wasn't able to get the lock file integrity check to work with the exceptiongroup dependency only applicable for older Python versions.

PR Checklist

Please check if your PR fulfills the following requirements:

• I have read, and I am following the Contributor guide
• I have read and understand the Code of Conduct

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Documentation content changes

What is the current behavior?

Poetry is used for dependency management and environment management

Issue Number: N/A

What is the new behavior?

uv is now used.

Does this PR introduce a breaking change?

• Yes
• No

Other information

[danyeaw]

@amolenaar I am not able to access the snyx test failure information.

[amolenaar]

This PR contains many good improvements: tightening security, version updates.

I do not see the need to switch to uv, however. Poetry serves us well, and makes lock files that work on all platforms.

[amolenaar]

I used BaseException here on purpose, so errors are also caught.

[danyeaw]

I was trying this out to have that discussion. Do you see better cross platform support as an advantage of Poetry? I wasn't aware of any cross platform issues with uv.

Definitely the speed of going from zero Python to a fully set up development environment is an advantage for uv, it is game changing fast. On CI even with caching the run time was reduced from 1m 45s to 1m 8s, so about 35% less time running the CI pipeline.

A tradeoff is we are relying on Astral which is a startup to build tools in Rust. They are getting a lot of outside contributions, but it does probably make it more difficult for us to contribute PRs if we find an issue.