Warn when a tool.setuptools.dynamic field is not listed in project.dynamic - #5372

Summary of changes

Entries in tool.setuptools.dynamic are only used for fields that are also listed in project.dynamic. Until now any other entry was silently ignored, so a pyproject.toml like the one from #4523

[project]
name = "package"
dynamic = ["version"]  # "dependencies" accidentally omitted

[tool.setuptools.dynamic]
version = {file = "VERSION"}
dependencies = {file = ["requirements.txt"]}

built a wheel without any Requires-Dist, with no indication of the mistake (the _MissingDynamic warning only covers values given in setup.py).

This PR adds a SetuptoolsWarning subclass, _UnlistedDynamic, which _ConfigExpander emits for every tool.setuptools.dynamic entry whose field is not listed in project.dynamic, right before the dynamic fields are expanded (setuptools/config/pyprojecttoml.py, one of the two places @abravalheri pointed to in #4523). The entry-points entry counts as used when scripts or gui-scripts are dynamic, since _obtain_entry_points reads it for those too. The behaviour is otherwise unchanged: the unlisted entry is still ignored, so no existing build breaks; the user just gets told why their metadata is missing.

Building the example above with this branch now prints:

WARNING `tool.setuptools.dynamic.dependencies` is ignored because `dependencies` is not listed in `project.dynamic`.
!!

        ********************************************************************************
        According to the spec (see the link below), setuptools can only compute
        `dependencies` from `tool.setuptools.dynamic` when `dependencies` is listed as `dynamic`
        in the `[project]` table of `pyproject.toml`. Otherwise this configuration
        is ignored, which can result in metadata missing from the built package.

        To prevent this problem, you can add `dependencies` to `project.dynamic`,
        or alternatively remove `tool.setuptools.dynamic.dependencies`.

        See https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html#dynamic-metadata for details.
        ********************************************************************************

!!
Successfully built package-1.2.3-py3-none-any.whl

(python -m build --no-isolation --wheel with this checkout on PYTHONPATH; the resulting METADATA still has no Requires-Dist, as before.)

Also included:

• TestUnlistedDynamic in setuptools/tests/config/test_pyprojecttoml.py: warning raised through read_configuration and apply_configuration (and the value still ignored), no warning when everything is listed, and no false positive for entry-points when only scripts/gui-scripts are dynamic.
• A note in the "Dynamic Metadata" section of docs/userguide/pyproject_config.rst (the warning's _SEE_DOCS points there).
• newsfragments/4523.feature.rst.

Testing (macOS, Python 3.12, with the test/core extras installed by name since tox is not available here):

pytest setuptools/tests/config/test_pyprojecttoml.py setuptools/tests/config/test_apply_pyprojecttoml.py setuptools/tests/config/test_pyprojecttoml_dynamic_deps.py
105 passed, 1 xfailed   (main: 90 passed, 1 xfailed)
ruff format --check / ruff check   -> clean
mypy setuptools/config/pyprojecttoml.py   -> Success: no issues found
cd docs && python -m sphinx -W --keep-going . ../build/html && python -m sphinxlint   -> clean

I also ran the other test modules that use tool.setuptools.dynamic fixtures (test_build_meta.py, test_config_discovery.py, test_sdist.py, test_bdist_wheel.py, test_editable_install.py, test_core_metadata.py): 585 passed, 5 skipped, 4 xfailed, 1 failed. The failure, TestCustomBuildPy::test_safeguarded_from_errors, fails identically on an unmodified main checkout in this environment (the SetuptoolsDeprecationWarning text does not appear in pip 26.3's output), so it is unrelated to this change.

Closes #4523

Pull Request Checklist

• Changes have tests
• News fragment added in newsfragments/.
  (See documentation for details)

I used Claude Code to help prepare this change; I reviewed the diff and ran the checks above.

🤖 Generated with Claude Code