uv: dependency graph command escapes shell &&, causing uv lock failure and fallback to uv tree

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

uv (Python)

Package manager version

uv version from Dependabot runtime (not pinned in repro)

Language version

Python version from Dependabot runtime (not pinned in repro)

Manifest location and content before the Dependabot update

Path: /pyproject.toml

[project]
name = "dependabot-uv-lock-repro"
version = "0.1.0"
dependencies = ["requests==2.32.3"]

[build-system]
requires = ["setuptools>=61"]
build-backend = "setuptools.build_meta"

Repro condition: no uv.lock committed.

dependabot.yml content

version: 2
updates:
- package-ecosystem: "uv"
directory: "/"
schedule:
interval: "weekly"

Updated dependency

N/A (fails during lock/graph step before normal update diff)

What you expected to see, versus what you actually saw

Expected uv lock --color never --no-progress && cat uv.lock to run as shell command sequence and succeed.
Actual: && is escaped/passed literally, uv lock errors with unexpected argument '&&' found, exits code 2, then Dependabot falls back to parsing uv tree.

Native package manager behavior

Running manually in shell works:
uv lock --color never --no-progress && cat uv.lock

Images of the diff or a link to the PR, issue, or logs

Log excerpt:

INFO  Started process ... pyenv exec uv lock --color never --no-progress \&\& cat uv.lock
INFO  Process ... exit 2
WARN  Failed to build dependency graph from uv.lock: error: unexpected argument '&&' found
INFO  Falling back to parsing uv tree output

Smallest manifest that reproduces the issue

Use the pyproject.toml and .github/dependabot.yml shown above, with no uv.lock in repo.