fix(utils): look up package versions without scanning all installed packages (#8215)

### Description
`package_version()` in `sentry_sdk/utils.py` rebuilt the full
installed-package mapping on every call: `_get_installed_modules()`
iterates `importlib.metadata.distributions()` (parsing every installed
distribution's metadata), and `package_version` additionally
re-normalized that whole mapping per call. Integrations call
`package_version` during `sentry_sdk.init()` to check minimum versions,
so in environments with a few hundred installed packages this scan
measurably slowed SDK startup.

This change makes `package_version` look up the single requested
distribution with `importlib.metadata.version()` instead:

- Top-level guarded `from importlib import metadata as
importlib_metadata` (no inline imports, per the repo guidelines);
`PackageNotFoundError` maps to `None`, matching the previous behaviour
for missing packages.
- The existing `_get_installed_modules()` scan remains as the fallback
for environments without `importlib.metadata` (Python < 3.8), so
supported old interpreters keep working.
- Name handling is unchanged: the requested name is PEP 503-normalized
first, which is also how `importlib.metadata.version()` resolves
distribution names.

Tests in `tests/test_utils.py`:
- `test_package_version_installed_package` asserts an installed package
(`pytest`) resolves to the same parsed version as `importlib.metadata`.
- `test_package_version_does_not_scan_all_installed_packages`
monkeypatches `_get_installed_modules` to fail if invoked (the only way
to assert the scan no longer happens) and asserts both hit and miss
lookups still work.

Validation:
- `TESTPATH=tests/test_utils.py uv run tox -e py3.12-common -- -k
package_version` — 3 passed.
- `uv run ruff check` / `ruff format --check` on the changed files —
clean.
- `uv run --group typing mypy sentry_sdk` — no issues in 203 files.

#### Issues
* resolves: #8190

#### Reminders
- Tests added and linted with `uv run ruff` as requested.
- PR title uses conventional-commit style.

Co-authored-by: Adityaaa <144815351+addydude@users.noreply.github.com>

Author: Shellghostt

sentry_sdk/utils.py

@@ -28,6 +28,11 @@
     # Python 3.10 and below
     BaseExceptionGroup = None  # type: ignore
 
+try:
+    from importlib import metadata as importlib_metadata
+except ImportError:
+    importlib_metadata = None  # type: ignore[assignment]
+
 from typing import TYPE_CHECKING
 
 import sentry_sdk
@@ -1841,6 +1846,14 @@ def package_version(package: str) -> "Optional[Tuple[int, ...]]":
         _replace_hyphens_dots_and_underscores_with_dashes(package)
     )
 
+    if importlib_metadata is not None:
+        # Look up the single distribution instead of scanning (and parsing
+        # the metadata of) every installed package on each call.
+        try:
+            return parse_version(importlib_metadata.version(normalized_package))
+        except importlib_metadata.PackageNotFoundError:
+            return None
+
     installed_packages = {
         _replace_hyphens_dots_and_underscores_with_dashes(module): v
         for module, v in _get_installed_modules().items()

tests/test_utils.py

@@ -1412,6 +1412,24 @@ def test_package_version_is_none():
     assert package_version("non_existent_package") is None
 
 
+@pytest.mark.skipif(sys.version_info < (3, 8), reason="requires importlib.metadata")
+def test_package_version_installed_package():
+    from importlib import metadata
+
+    assert package_version("pytest") == parse_version(metadata.version("pytest"))
+
+
+@pytest.mark.skipif(sys.version_info < (3, 8), reason="requires importlib.metadata")
+def test_package_version_does_not_scan_all_installed_packages(monkeypatch):
+    def _fail():
+        raise AssertionError("package_version must not scan all installed packages")
+
+    monkeypatch.setattr("sentry_sdk.utils._get_installed_modules", _fail)
+
+    assert package_version("pytest") is not None
+    assert package_version("non_existent_package") is None
+
+
 @pytest.mark.parametrize(
     "kwargs, expected",
     [