dependabot-python 0.117.10 → 0.118.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff0b995c20ea7f669f01c970443cd4f9abd15302a29ef16d2b256e6ea2d963cf
-  data.tar.gz: 9047700c6f5ca3388458a1b315f0bf10ee3422a10e00d919eeec577435746df0
+  metadata.gz: '096e75f3e4a994ff56563035d72d9f6ab530e401a44ed9b2dbc6311ecb32b387'
+  data.tar.gz: 38e01b056f81def3feab7bab3cdd9288186aa933e77b5397324d235a8f93dde1
 SHA512:
-  metadata.gz: 4297db3887115e681b5d7665dbec297c01f567c35c0a9abb40fe4790b6d5eb77a2a6bcbe4ce8ab81507365a3dbf87ff5a1ab8f63870b4ea2184c7777fd78a521
-  data.tar.gz: e8a7a7c0ff5fb9b0fba30ccca654b81936d6d6ee371ac79727103eba0b9fd52c52c4bcc21f34d464b6e09fce4f196b82f9b8895aa95938bc33a3fb86e2fe786c
+  metadata.gz: 4a72b36509ad0b9b12540306e0bbcf9c0876df144d3e44874603ac3e6b63ef34fefc2ee17d3f172c3f342891ad4f1b264543bb625636c80c9ddb516a8a6726af
+  data.tar.gz: 82b18a2a994a76df0b223a1cf6a73ce6f11dc0512059760a24d4150603e93ece2d63d1dacdb7e2dfc74416a14f0ddbb43ef920700ffd804846864be9400c1ff4

data/helpers/build

@@ -16,5 +16,5 @@ cp -r \
   "$install_dir"
 
 cd "$install_dir"
-PYENV_VERSION=2.7.17 pyenv exec pip install -r "requirements.txt"
-PYENV_VERSION=3.8.2  pyenv exec pip install -r "requirements.txt"
+PYENV_VERSION=2.7.18 pyenv exec pip install -r "requirements.txt"
+PYENV_VERSION=3.8.3  pyenv exec pip install -r "requirements.txt"

data/helpers/lib/parser.py

@@ -8,26 +8,16 @@ import re
 
 import setuptools
 import pip._internal.req.req_file
-from pip._internal.download import PipSession
+from pip._internal.network.session import PipSession
 from pip._internal.models.format_control import FormatControl
-from pip._internal.req.constructors import install_req_from_line
-
-JINJA_DELIMITER_IGNORE_REGEX = r"({{(.*?)}})|({%[-]?(.*?)%})|({#(.*?)#})"
+from pip._internal.req.constructors import (
+        install_req_from_line,
+        install_req_from_parsed_requirement,
+)
 
 def parse_requirements(directory):
     # Parse the requirements.txt
     requirement_packages = []
-    parser_options = optparse.Values(
-            {
-                "skip_requirements_regex": JINJA_DELIMITER_IGNORE_REGEX,
-                # pip._internal assumes parse_requirements will be called from
-                # CLI, which sets default values. When passing parser options,
-                # need to explicitly set those defaults.
-                "isolated_mode": False,
-                "format_control": FormatControl(),
-            }
-        )
-
     requirement_files = glob.glob(os.path.join(directory, '*.txt')) \
                         + glob.glob(os.path.join(directory, '**', '*.txt'))
 
@@ -42,10 +32,10 @@ def parse_requirements(directory):
         try:
             requirements = pip._internal.req.req_file.parse_requirements(
                 reqs_file,
-                options=parser_options,
                 session=PipSession()
             )
-            for install_req in requirements:
+            for parsed_req in requirements:
+                install_req = install_req_from_parsed_requirement(parsed_req)
                 if install_req.original_link:
                     continue
 

data/helpers/requirements.txt

@@ -1,9 +1,9 @@
-pip==19.3.1
-pip-tools==4.5.1
-hashin==0.14.6
+pip==20.1.1
+pip-tools==5.2.1
+hashin==0.15.0
 pipenv==2018.11.26
 pipfile==0.0.2
-poetry==1.0.5
+poetry==1.0.9
 
 # Some dependencies will only install if Cython is present
-Cython==0.29.19
+Cython==0.29.20

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -174,9 +174,9 @@ module Dependabot
 
           raise relevant_error unless error_suggests_bad_python_version?(msg)
           raise relevant_error if user_specified_python_version
-          raise relevant_error if python_version == "2.7.17"
+          raise relevant_error if python_version == "2.7.18"
 
-          @python_version = "2.7.17"
+          @python_version = "2.7.18"
           retry
         ensure
           @python_version = nil

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -280,7 +280,7 @@ module Dependabot
           run_command("pyenv local #{python_version}")
           run_command("pyenv exec pipenv --rm")
 
-          @python_version = "2.7.17"
+          @python_version = "2.7.18"
           retry
         ensure
           @python_version = nil

data/lib/dependabot/python/python_versions.rb

@@ -4,17 +4,17 @@ module Dependabot
   module Python
     module PythonVersions
       PRE_INSTALLED_PYTHON_VERSIONS = %w(
-        3.8.2 2.7.17
+        3.8.3 2.7.18
       ).freeze
 
       # Due to an OpenSSL issue we can only install the following versions in
       # the Dependabot container.
       SUPPORTED_VERSIONS = %w(
-        3.8.2 3.8.1 3.8.0
+        3.8.3 3.8.2 3.8.1 3.8.0
         3.7.7 3.7.6 3.7.5 3.7.4 3.7.3 3.7.2 3.7.1 3.7.0
         3.6.9 3.6.8 3.6.7 3.6.6 3.6.5 3.6.4 3.6.3 3.6.2 3.6.1 3.6.0
         3.5.7 3.5.6 3.5.5 3.5.4 3.5.3
-        2.7.17 2.7.16 2.7.15 2.7.14 2.7.13
+        2.7.18 2.7.17 2.7.16 2.7.15 2.7.14 2.7.13
       ).freeze
 
       # This list gets iterated through to find a valid version, so we have

data/lib/dependabot/python/requirement_parser.rb

@@ -13,11 +13,25 @@ module Dependabot
       HASH = /--hash=(?<algorithm>.*?):(?<hash>.*?)(?=\s|$)/.freeze
       REQUIREMENTS = /#{REQUIREMENT}(\s*,\s*\\?\s*#{REQUIREMENT})*/.freeze
       HASHES = /#{HASH}(\s*\\?\s*#{HASH})*/.freeze
+      MARKER_OP = /\s*(#{COMPARISON}|(\s*in)|(\s*not\s*in))/.freeze
+      PYTHON_STR_C =
+        %r{[a-zA-Z0-9\s\(\)\.\{\}\-_\*#:;/\?\[\]!~`@\$%\^&=\+\|<>]}.freeze
+      PYTHON_STR = /('(#{PYTHON_STR_C}|")*'|"(#{PYTHON_STR_C}|')*")/.freeze
+      ENV_VAR =
+        /python_version|python_full_version|os_name|sys_platform|
+         platform_release|platform_system|platform_version|platform_machine|
+         platform_python_implementation|implementation_name|
+         implementation_version/.freeze
+      MARKER_VAR = /\s*(#{ENV_VAR}|#{PYTHON_STR})/.freeze
+      MARKER_EXPR_ONE = /#{MARKER_VAR}#{MARKER_OP}#{MARKER_VAR}/.freeze
+      MARKER_EXPR =
+        /(#{MARKER_EXPR_ONE}|\(\s*|\s*\)|\s+and\s+|\s+or\s+)+/.freeze
 
       INSTALL_REQ_WITH_REQUIREMENT =
         /\s*\\?\s*(?<name>#{NAME})
           \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
           \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})\)?
+          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
           \s*\\?\s*(?<hashes>#{HASHES})?
           \s*#*\s*(?<comment>.+)?
         /x.freeze
@@ -25,6 +39,7 @@ module Dependabot
       INSTALL_REQ_WITHOUT_REQUIREMENT =
         /^\s*\\?\s*(?<name>#{NAME})
           \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
+          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
           \s*\\?\s*(?<hashes>#{HASHES})?
           \s*#*\s*(?<comment>.+)?$
         /x.freeze
@@ -33,6 +48,7 @@ module Dependabot
         /^\s*\\?\s*(?<name>#{NAME})
           \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
           \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})?\)?
+          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
           \s*\\?\s*(?<hashes>#{HASHES})?
           \s*(\#+\s*(?<comment>.*))?$
         /x.freeze

data/lib/dependabot/python/update_checker.rb

@@ -195,6 +195,7 @@ module Dependabot
           dependency_files: dependency_files,
           credentials: credentials,
           ignored_versions: ignored_versions,
+          raise_on_ignored: @raise_on_ignored,
           security_advisories: security_advisories
         )
       end
@@ -262,6 +263,7 @@ module Dependabot
           dependency_files: dependency_files,
           credentials: credentials,
           ignored_versions: ignored_versions,
+          raise_on_ignored: @raise_on_ignored,
           security_advisories: security_advisories
         )
       end

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -17,11 +17,13 @@ module Dependabot
         require_relative "index_finder"
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, security_advisories:)
+                       ignored_versions:, raise_on_ignored: false,
+                       security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
         end
 
@@ -69,8 +71,8 @@ module Dependabot
           versions = filter_yanked_versions(versions)
           versions = filter_unsupported_versions(versions, python_version)
           versions = filter_prerelease_versions(versions)
-          versions = filter_ignored_versions(versions)
           versions = filter_vulnerable_versions(versions)
+          versions = filter_ignored_versions(versions)
           versions = filter_lower_versions(versions)
           versions.min
         end
@@ -97,8 +99,13 @@ module Dependabot
         end
 
         def filter_ignored_versions(versions_array)
-          versions_array.
-            reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+          filtered = versions_array.
+                     reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+          if @raise_on_ignored && filtered.empty? && versions_array.any?
+            raise Dependabot::AllVersionsIgnored
+          end
+
+          filtered
         end
 
         def filter_vulnerable_versions(versions_array)

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -229,9 +229,9 @@ module Dependabot
           relevant_error = choose_relevant_error(original_err, e)
           raise relevant_error unless error_suggests_bad_python_version?(msg)
           raise relevant_error if user_specified_python_version
-          raise relevant_error if python_version == "2.7.17"
+          raise relevant_error if python_version == "2.7.18"
 
-          @python_version = "2.7.17"
+          @python_version = "2.7.18"
           retry
         ensure
           @python_version = nil

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -9,11 +9,13 @@ module Dependabot
     class UpdateChecker
       class PipVersionResolver
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, security_advisories:)
+                       ignored_versions:, raise_on_ignored: false,
+                       security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
         end
 
@@ -42,6 +44,7 @@ module Dependabot
             dependency_files: dependency_files,
             credentials: credentials,
             ignored_versions: ignored_versions,
+            raise_on_ignored: @raise_on_ignored,
             security_advisories: security_advisories
           )
         end

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -458,7 +458,7 @@ module Dependabot
           run_command("pyenv local #{python_version}")
           run_command("pyenv exec pipenv --rm")
 
-          @python_version = "2.7.17"
+          @python_version = "2.7.18"
           retry
         ensure
           @python_version = nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.117.10
+  version: 0.118.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 2020-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.10
+        version: 0.118.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.10
+        version: 0.118.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement