refactor: replace poetry with uv

[Michael Matzka (mima0815)]

Description

Replaces Poetry with uv for dependency management, virtual envs, and packaging, and modernizes the surrounding tooling:

• Migrated pyproject.toml from [tool.poetry] to standard [project] metadata + [dependency-groups], and switched the build backend from poetry-core to uv's native uv_build (production-stable as of uv 0.11.19). Added [tool.uv.build-backend] with module-name = "fds.sdk.utils" and namespace = true so the backend correctly resolves the fds/fds.sdk namespace-package layout. Added uv.lock, removed poetry.lock.
• Replaced black with ruff for linting/formatting, and added pyright for static type checking.
• Removed tox/tox-gh-actions (tox.ini deleted) — the version matrix is now run directly via uv run pytest per Python version in CI.
• Updated .github/workflows/ci.yml and publish.yml to install uv (astral-sh/setup-uv) and use uv sync / uv build / uv publish instead of Poetry; pinned third-party actions to commit SHAs. CI now also runs ruff format --check, ruff check, and pyright, and the test matrix includes Python 3.14.
• Removed .github/workflows/codeql-analysis.yml — CodeQL scanning is superseded by the Checkmarx workflow added in chore(workflow): remove fortify scans in favor of checkmarx #159.
• Added .python-version (3.10) and reformatted README.md code samples to match ruff format output.

While migrating, also fixed the issues surfaced by the new ruff/pyright checks:

• ruff: implicit-Optional parameter annotations in ConfidentialClient.__init__, and mutable class-level default values (CONFIG_JWK_REQUIRED_KEYS, mock headers dicts in tests) now use ClassVar/| None.
• pyright: suppressed a requests_oauthlib stub limitation (verify typed as bool | None though a CA bundle path string is also valid) and a CONSTS singleton typing conflict (removed the redundant class-to-instance reassignment). Also fixed two test bugs pyright caught: test_constructor_bad_params was passing the example_config fixture function instead of its value, and the abstract-class instantiation checks in test_oauth2client.py now have targeted pyright: ignore annotations since they intentionally exercise a TypeError at runtime.

No functional/runtime behavior changes to the package itself.

Links

• N/A

Testing

• uv run ruff check . / uv run ruff format --check — clean
• uv run pyright — clean
• uv run pytest — all 23 tests pass
• uv build — verified wheel and sdist contain the same fds/sdk/utils/... layout as before (no tests/ included)
• CI workflows (ci.yml, publish.yml) updated and exercised via the PR checks

Checklist

Ensure the following things have been met before requesting a review:

• Follows all project developer guide and coding standards.
• Tests have been written for the change, when applicable.
• Confidential information (credentials, auth tokens, etc...) is not included.

[Rico (RicoFactset)]

Checkmarx One – Scan Summary & Details – 629439fb-7ee5-4118-81a5-ee8706a3f61b

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2026-48990	Python-joserfc-1.6.5

---

Communicate with Checkmarx by submitting a PR comment with Checkmarx (@Checkmarx) followed by one of the supported commands. Learn about the supported commands here.