dependabot-python 0.125.5 → 0.127.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 586c89791e3907d5be1c9048e9576394cb599122197622ae699c8e3a57f06884
-  data.tar.gz: b9eb6f6155ba98bc6b3bbebf2b56795f106afb08f43651fe20bba5566c1399bc
+  metadata.gz: fecba5b70968de6b046d3c16aa8b6647835080bed242d8e04ad913f2d251084a
+  data.tar.gz: 6c4bc694d433530aeb09fb77093536dd2a8ce5d19b450106e9f4ab1be6b25ce6
 SHA512:
-  metadata.gz: 360a48d1b31c5a26f3729107d3458213167a83ac370ace55e4e8c96c2835077f81056496ec2b001e4b3da58b0d62a2ec83c320d4bcd9575f385c1948578a9478
-  data.tar.gz: b4be4aad4fd7f0957e220c8ccfc28274376f1e3655cd30c0a6ff4b6483cfc57803a5adf975e04154975953c696e9c4526508cbf0b77b559a87bc0ed1ef1a3d4a
+  metadata.gz: 71c38ec484b340c795e5a167446ecdaa1aaf08157a1f4ab2488d41be7ec05a26ac778ea047a3478e70ed1ed159f89d56ce38bf25f8dcdd44acdef943c471fb7a
+  data.tar.gz: ef6878c1c401db2557d9d5453f56b38589cd4dca921b5b4d4298db40539031e13fb95dba4e0ab62765a3a0fbdc4b0429c47f08243861b0bdb730b152c0f9bdf8

data/helpers/requirements.txt

@@ -1,9 +1,10 @@
-pip==20.1.1
-pip-tools==5.3.1
+pip==20.3.1
+pip-tools==5.4.0
 hashin==0.15.0
 pipenv==2018.11.26
 pipfile==0.0.2
 poetry==1.1.4
+wheel==0.36.1
 
 # Some dependencies will only install if Cython is present
 Cython==0.29.21

data/lib/dependabot/python/requirement.rb

@@ -116,7 +116,7 @@ module Dependabot
       end
 
       def convert_wildcard(req_string)
-        # Note: This isn't perfect. It replaces the "!= 1.0.*" case with
+        # NOTE: This isn't perfect. It replaces the "!= 1.0.*" case with
         # "!= 1.0.0". There's no way to model this correctly in Ruby :'(
         quoted_ops = OPS.keys.sort_by(&:length).reverse.
                      map { |k| Regexp.quote(k) }.join("|")

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -27,8 +27,8 @@ module Dependabot
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /git clone -q (?<url>[^\s]+).* /.freeze
         GIT_REFERENCE_NOT_FOUND_REGEX =
-          %r{git checkout -q (?<tag>[^\n"]+)\n?[^\n]*/(?<name>.*?)(\\n'\]|$)}m.
-          freeze
+          /egg=(?<name>\S+).*.*WARNING: Did not find branch or tag \'(?<tag>[^\n"]+)\'/m.freeze
+        NATIVE_COMPILATION_ERROR = "pip._internal.exceptions.InstallationError: Command errored out with exit status 1"
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -36,6 +36,7 @@ module Dependabot
           @dependency               = dependency
           @dependency_files         = dependency_files
           @credentials              = credentials
+          @build_isolation = true
         end
 
         def latest_resolvable_version(requirement: nil)
@@ -72,7 +73,7 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
+                    "pyenv exec pip-compile --allow-unsafe -v "\
                      "#{pip_compile_options(filename)} -P #{dependency.name} "\
                      "#{filename}"
                   )
@@ -91,10 +92,22 @@ module Dependabot
                 parse_updated_files
               end
             rescue SharedHelpers::HelperSubprocessFailed => e
+              retry_count ||= 0
+              retry_count += 1
+
+              if compilation_error?(e) && retry_count <= 1
+                @build_isolation = false
+                retry
+              end
+
               handle_pip_compile_errors(e)
             end
         end
 
+        def compilation_error?(error)
+          error.message.include?(NATIVE_COMPILATION_ERROR)
+        end
+
         # rubocop:disable Metrics/AbcSize
         def handle_pip_compile_errors(error)
           if error.message.include?("Could not find a version")
@@ -162,15 +175,16 @@ module Dependabot
 
               true
             rescue SharedHelpers::HelperSubprocessFailed => e
-              unless e.message.include?("Could not find a version") ||
-                     e.message.include?("UnsupportedConstraint")
-                raise
+              # Pick the error message that includes resolvability errors, this might be the cause from
+              # handle_pip_compile_errors (it's unclear if we should always pick the cause here)
+              error_message = [e.message, e.cause&.message].compact.find do |msg|
+                ["UnsupportedConstraint", "Could not find a version"].any? { |err| msg.include?(err) }
               end
 
-              msg = clean_error_message(e.message)
-              raise if msg.empty?
+              cleaned_message = clean_error_message(error_message || "")
+              raise if cleaned_message.empty?
 
-              raise DependencyFileNotResolvable, msg
+              raise DependencyFileNotResolvable, cleaned_message
             end
           end
         end
@@ -194,7 +208,7 @@ module Dependabot
         end
 
         def pip_compile_options(filename)
-          options = ["--build-isolation"]
+          options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
 
           if (requirements_file = compiled_file_for_filename(filename))
@@ -365,11 +379,21 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
+        VERBOSE_ERROR_OUTPUT_LINES = [
+          "Traceback",
+          "Using indexes:",
+          "Current constraints:",
+          "Finding the best candidates:",
+          "Finding secondary dependencies:",
+          "\n",
+          "  "
+        ].freeze
+
         def clean_error_message(message)
           msg_lines = message.lines
           msg = msg_lines.
                 take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?("Traceback", "  ") }.
+                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
                 join.strip
 
           # Redact any URLs, as they may include credentials

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -39,6 +39,12 @@ module Dependabot
         UNSUPPORTED_DEP_REGEX =
           /"python setup\.py egg_info".*(?:#{UNSUPPORTED_DEPS.join("|")})/.
           freeze
+        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal."\
+                                    "exceptions.InstallationError: "\
+                                    "Command \"python setup.py egg_info\" "\
+                                    "failed with error code 1 in"
+        PIPENV_INSTALLATION_ERROR_REGEX =
+          %r{#{Regexp.quote(PIPENV_INSTALLATION_ERROR)}.+/(?<name>.+)/$}.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -169,7 +175,6 @@ module Dependabot
             return if error.message.match?(/#{Regexp.quote(dependency.name)}/i)
           end
 
-          puts error.message
           if error.message.match?(GIT_DEPENDENCY_UNREACHABLE_REGEX)
             url = error.message.match(GIT_DEPENDENCY_UNREACHABLE_REGEX).
                   named_captures.fetch("url")
@@ -232,6 +237,10 @@ module Dependabot
             raise DependencyFileNotResolvable, msg
           end
 
+          # NOTE: Pipenv masks the actualy error, see this issue for updates:
+          # https://github.com/pypa/pipenv/issues/2791
+          handle_pipenv_installation_error(error.message) if error.message.match?(PIPENV_INSTALLATION_ERROR_REGEX)
+
           # Raise an unhandled error, as this could be a problem with
           # Dependabot's infrastructure, rather than the Pipfile
           raise
@@ -257,6 +266,19 @@ module Dependabot
           msg.gsub(/http.*?(?=\s)/, "<redacted>")
         end
 
+        def handle_pipenv_installation_error(error_message)
+          # Find the dependency that's causing resolution to fail
+          dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
+          raise unless dependency_name
+
+          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system "\
+                "dependencies that can't be installed by Dependabot or required installation flags.\n\n"\
+                "Error output from running \"pipenv lock\":\n"\
+                "#{clean_error_message(error_message)}"
+
+          raise DependencyFileNotResolvable, msg
+        end
+
         def write_temporary_dependency_files(updated_req: nil,
                                              update_pipfile: true)
           dependency_files.each do |file|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.125.5
+  version: 0.127.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-25 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.5
+        version: 0.127.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.125.5
+        version: 0.127.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.93.0
+        version: 1.6.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: 0.20.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement