dependabot-python 0.125.4 → 0.126.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49ee7c4f8b233552c4059517cbc4e2f5a9f59c96b0c653193108d08f7203deda
-  data.tar.gz: e566d0569a126b9aaf6d0691e71925e4cd27c7ee51c0ea7875db5ecc88657332
+  metadata.gz: 02be61b09c4b08a5e5c4f05106b29f5c25521a08e82d4c319409bea3f236e780
+  data.tar.gz: d655bbbbfb63dc5f8881bafa2cdd1134164137a1c9c21daeef8dde2160692f6d
 SHA512:
-  metadata.gz: '05891073c63f8f001bd9aee6cc176640b301589bf77b64c75955f3127ac6112c396a2fefc05a141e6331f1e382b86079bc76d172f9f49f56a7316ab929ad488f'
-  data.tar.gz: 66cc41df9d682e1ddbca467472c829e8350e109c37b3d703e1e7d7b85f78f1b09f10c13abfec751263cb15ed448093925ab980ac0640e0bfe198dc2044d6a88c
+  metadata.gz: 977ac562de11c018e3746c895cd6a63bbb912b59e1905d1995f022c4ec851e6e24e7c9939c0116f30521bf2d1cfae08caace4871a0a3a29f620a783e844b009a
+  data.tar.gz: f7950906e2cc5364ec4d1f9b154f909ce58beabe666dad94df8e4fcbf10c0485a5ef6409cdbeb90d2d99269c35521287db1ae5470484e31e9f190d6bc599b187

data/helpers/requirements.txt

@@ -1,9 +1,10 @@
-pip==20.1.1
-pip-tools==5.3.1
+pip==20.3.1
+pip-tools==5.4.0
 hashin==0.15.0
 pipenv==2018.11.26
 pipfile==0.0.2
 poetry==1.1.4
+wheel==0.36.1
 
 # Some dependencies will only install if Cython is present
 Cython==0.29.21

data/lib/dependabot/python/requirement.rb

@@ -116,7 +116,7 @@ module Dependabot
       end
 
       def convert_wildcard(req_string)
-        # Note: This isn't perfect. It replaces the "!= 1.0.*" case with
+        # NOTE: This isn't perfect. It replaces the "!= 1.0.*" case with
         # "!= 1.0.0". There's no way to model this correctly in Ruby :'(
         quoted_ops = OPS.keys.sort_by(&:length).reverse.
                      map { |k| Regexp.quote(k) }.join("|")

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -27,8 +27,8 @@ module Dependabot
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /git clone -q (?<url>[^\s]+).* /.freeze
         GIT_REFERENCE_NOT_FOUND_REGEX =
-          %r{git checkout -q (?<tag>[^\n"]+)\n?[^\n]*/(?<name>.*?)(\\n'\]|$)}m.
-          freeze
+          /egg=(?<name>\S+).*.*WARNING: Did not find branch or tag \'(?<tag>[^\n"]+)\'/m.freeze
+        NATIVE_COMPILATION_ERROR = "pip._internal.exceptions.InstallationError: Command errored out with exit status 1"
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -36,6 +36,7 @@ module Dependabot
           @dependency               = dependency
           @dependency_files         = dependency_files
           @credentials              = credentials
+          @build_isolation = true
         end
 
         def latest_resolvable_version(requirement: nil)
@@ -72,7 +73,7 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
+                    "pyenv exec pip-compile --allow-unsafe -v "\
                      "#{pip_compile_options(filename)} -P #{dependency.name} "\
                      "#{filename}"
                   )
@@ -91,10 +92,22 @@ module Dependabot
                 parse_updated_files
               end
             rescue SharedHelpers::HelperSubprocessFailed => e
+              retry_count ||= 0
+              retry_count += 1
+
+              if compilation_error?(e) && retry_count <= 1
+                @build_isolation = false
+                retry
+              end
+
               handle_pip_compile_errors(e)
             end
         end
 
+        def compilation_error?(error)
+          error.message.include?(NATIVE_COMPILATION_ERROR)
+        end
+
         # rubocop:disable Metrics/AbcSize
         def handle_pip_compile_errors(error)
           if error.message.include?("Could not find a version")
@@ -162,15 +175,16 @@ module Dependabot
 
               true
             rescue SharedHelpers::HelperSubprocessFailed => e
-              unless e.message.include?("Could not find a version") ||
-                     e.message.include?("UnsupportedConstraint")
-                raise
+              # Pick the error message that includes resolvability errors, this might be the cause from
+              # handle_pip_compile_errors (it's unclear if we should always pick the cause here)
+              error_message = [e.message, e.cause&.message].compact.find do |msg|
+                ["UnsupportedConstraint", "Could not find a version"].any? { |err| msg.include?(err) }
               end
 
-              msg = clean_error_message(e.message)
-              raise if msg.empty?
+              cleaned_message = clean_error_message(error_message || "")
+              raise if cleaned_message.empty?
 
-              raise DependencyFileNotResolvable, msg
+              raise DependencyFileNotResolvable, cleaned_message
             end
           end
         end
@@ -194,7 +208,7 @@ module Dependabot
         end
 
         def pip_compile_options(filename)
-          options = ["--build-isolation"]
+          options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
 
           if (requirements_file = compiled_file_for_filename(filename))
@@ -365,11 +379,21 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
+        VERBOSE_ERROR_OUTPUT_LINES = [
+          "Traceback",
+          "Using indexes:",
+          "Current constraints:",
+          "Finding the best candidates:",
+          "Finding secondary dependencies:",
+          "\n",
+          "  "
+        ].freeze
+
         def clean_error_message(message)
           msg_lines = message.lines
           msg = msg_lines.
                 take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?("Traceback", "  ") }.
+                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
                 join.strip
 
           # Redact any URLs, as they may include credentials

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -39,6 +39,12 @@ module Dependabot
         UNSUPPORTED_DEP_REGEX =
           /"python setup\.py egg_info".*(?:#{UNSUPPORTED_DEPS.join("|")})/.
           freeze
+        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal."\
+                                    "exceptions.InstallationError: "\
+                                    "Command \"python setup.py egg_info\" "\
+                                    "failed with error code 1 in"
+        PIPENV_INSTALLATION_ERROR_REGEX =
+          %r{#{Regexp.quote(PIPENV_INSTALLATION_ERROR)}.+/(?<name>.+)/$}.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -169,7 +175,6 @@ module Dependabot
             return if error.message.match?(/#{Regexp.quote(dependency.name)}/i)
           end
 
-          puts error.message
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
             url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX).
                   named_captures.fetch("url")
@@ -232,6 +237,10 @@ module Dependabot
             raise DependencyFileNotResolvable, msg
           end
 
+          # NOTE: Pipenv masks the actualy error, see this issue for updates:
+          # https://github.com/pypa/pipenv/issues/2791
+          handle_pipenv_installation_error(error.message) if error.message.match?(PIPENV_INSTALLATION_ERROR_REGEX)
+
           # Raise an unhandled error, as this could be a problem with
           # Dependabot's infrastructure, rather than the Pipfile
           raise
@@ -257,6 +266,19 @@ module Dependabot
           msg.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        def handle_pipenv_installation_error(error_message)
+          # Find the dependency that's causing resolution to fail
+          dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
+          raise unless dependency_name
+
+          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system "\
+                "dependencies that can't be installed by Dependabot or required installation flags.\n\n"\
+                "Error output from running \"pipenv lock\":\n"\
+                "#{clean_error_message(error_message)}"
+
+          raise DependencyFileNotResolvable, msg
+        end
+
         def write_temporary_dependency_files(updated_req: nil,
                                              update_pipfile: true)
           dependency_files.each do |file|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.125.4
+  version: 0.126.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-17 00:00:00.000000000 Z
+date: 2020-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.4
+        version: 0.126.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.4
+        version: 0.126.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement