[tool.uv.sources] is how uv points a dependency at a git repository, a local path, or a specific index while the normal requirement in [project.dependencies] stays a plain version range. Only uv reads that table. pip, Poetry and any consumer of a published wheel see just the version range.
That separation is the design, not a limitation: when uv builds a distribution for publishing it does not carry sources into the metadata, so a released package never forces your git checkout on a downstream user. The consequence is that a library whose real dependency only exists at a git URL will resolve to something else, or fail, for anyone installing it with pip.
Use sources for development conveniences such as workspace members and local path overrides, and make sure the version range in [project.dependencies] is honest about what will actually satisfy the import at runtime. If a dependency genuinely has no PyPI release, that is a packaging problem to solve before publishing, not something a source entry hides. uv build followed by inspecting the METADATA file in the wheel confirms what consumers will see.