pip.parse with uv_lock fails when lock file contains git sourced package

[scasagrande]

🐞 bug report

Affected Rule

pip.parse

Is this a regression?

unsure

Description

pip.parse with uv_lock fails when the lock file contains a package with a git source entry with a rev hash due to ? being not a valid character for names.

🔬 Minimal Reproduction

pyproject.toml

...
mypackage = { git = "https://github.com/foo/bar", rev = "6323b05075dcb2347279e966a5a3b15b5ddc1d5b" }
...

uv.lock

...
[[package]]
name = "mypackage"
version = "0.0.1"
source = { git = "https://github.com/foo/bar?rev=6323b05075dcb2347279e966a5a3b15b5ddc1d5b#6323b05075dcb2347279e966a5a3b15b5ddc1d5b" }
dependencies = [
    ...
]
...

🔥 Exception or Error

ERROR: /Users/steven/Library/Caches/bazel/_bazel_steven/d71d77490eeb3a6c5a6efc45dc1ed897/external/rules_python+/python/private/pypi/whl_library.bzl:817:20: Traceback (most recent call last):
        File "/Users/steven/Library/Caches/bazel/_bazel_steven/d71d77490eeb3a6c5a6efc45dc1ed897/external/rules_python+/python/private/pypi/extension.bzl", line 615, column 20, in _pip_impl
                whl_library(name = name, **args)
        File "/Users/steven/Library/Caches/bazel/_bazel_steven/d71d77490eeb3a6c5a6efc45dc1ed897/external/rules_python+/python/private/pypi/whl_library.bzl", line 817, column 20, in whl_library
                pip_archive(name = name, **kwargs)
Error in repository_rule: invalid user-provided repo name 'py_deps_311__mypackage?rev=6323b05075dcb2347279e966a5a3b15b5ddc1d5b#6323b05075dcb2347279e966a5a3b15b5ddc1d5b': valid names may contain only A-Z, a-z, 0-9, '-', '_', '.', and must start with a letter or a number

🌍 Your Environment

Operating System:

  
macOS 26
  

Output of bazel version:

  
Bazelisk version: 1.29.0
Build label: 9.2.0
Build target: @@//src/main/java/com/google/devtools/build/lib/bazel:BazelServer
Build time: Mon Jul 13 18:19:39 2026 (1783966779)
Build timestamp: 1783966779
Build timestamp as int: 1783966779
  

Rules_python version:

  
2.3.1
  

Anything else relevant?

Hopefully its just as simple as replacing ?=# with _