dependabot-python 0.189.0 → 0.191.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5005a8ffff56a50b66f7d0b08bb6378624f551abfe59b1f6d2dfad60f0a316b8
-  data.tar.gz: 8cd1aa115ba03a2a792b217bbf2062c0c0b60c94191ae42e3aaa2ccfd4e61239
+  metadata.gz: 150269043a3867fcb18117aa1d10218739fbc4c1012aac13f791aab02643d5b5
+  data.tar.gz: 0ac19e084fd83d7c6746745a4df2bedb7bb9b4e14784262559137a2bf395e29f
 SHA512:
-  metadata.gz: a665adab3e2a259d5540b9b8d281135ff95dafa31073780a69aac199567d0f3d0369a0e58c96e0f21ba9a53eff867d7846236edca81f022ced2fcf6fa0ba415d
-  data.tar.gz: eeaa000f63bb8d3d2c483398230497ceabea672c6aaa72b930b568c1f1aab7f7a462174817ca161ef5d3abb876a59859bbc1233953bf0bb771ea0798861efaeb
+  metadata.gz: 642466d5f39522eb5e94c684dc577c6b2c9cfed14235ba9d9b592791c755d6164f315bffae3d0751a5f4338fe6285507eafd792cc098111d61a60f549bccb68f
+  data.tar.gz: 9cfefc6e1b85823611190fb357dac2bd29dd4b6bb523ae072293028388740919e43829adccb9a77d3215aa331098ae1d26f995bf61b84df15f2f92e6dbf7909b

data/helpers/requirements.txt

@@ -1,5 +1,5 @@
-pip>=21.3.1  # Allow earlier versions to retain python 3.6 support
-pip-tools>=6.4.0  # Allow earlier versions to retain python 3.6 support
+pip>=21.3.1,<=22.1.1  # Allow earlier versions to retain python 3.6 support
+pip-tools>=6.4.0,<=6.6.2  # Allow earlier versions to retain python 3.6 support
 flake8==4.0.1
 hashin==0.17.0
 pipenv==2022.4.8

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -223,6 +223,7 @@ module Dependabot
           return if run_command("pyenv versions").include?("#{python_version}\n")
 
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r "\
                       "#{NativeHelpers.python_requirements_path}")
         end

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -105,7 +105,6 @@ module Dependabot
               content = sanitize(content)
               content = freeze_other_dependencies(content)
               content = freeze_dependencies_being_updated(content)
-              content = add_private_sources(content)
               content
             end
         end
@@ -150,12 +149,6 @@ module Dependabot
           poetry_object[subdep_type][dependency.name] = dep.version
         end
 
-        def add_private_sources(pyproject_content)
-          PyprojectPreparer.
-            new(pyproject_content: pyproject_content).
-            replace_sources(credentials)
-        end
-
         def subdep_type
           category =
             TomlRB.parse(lockfile.content).fetch("package", []).
@@ -175,9 +168,11 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do
               write_temporary_dependency_files(pyproject_content)
+              add_auth_env_vars
 
               if python_version && !pre_installed_python?(python_version)
                 run_poetry_command("pyenv install -s #{python_version}")
+                run_poetry_command("pyenv exec pip install --upgrade pip")
                 run_poetry_command("pyenv exec pip install -r"\
                                    "#{NativeHelpers.python_requirements_path}")
               end
@@ -231,6 +226,12 @@ module Dependabot
           File.write("pyproject.toml", pyproject_content)
         end
 
+        def add_auth_env_vars
+          Python::FileUpdater::PyprojectPreparer.
+            new(pyproject_content: pyproject.content).
+            add_auth_env_vars(credentials)
+        end
+
         def python_version
           requirements = python_requirement_parser.user_specified_requirements
           requirements = requirements.

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -18,24 +18,22 @@ module Dependabot
           @lockfile = lockfile
         end
 
-        def replace_sources(credentials)
-          pyproject_object = TomlRB.parse(pyproject_content)
-          poetry_object = pyproject_object.fetch("tool").fetch("poetry")
-
-          sources_hash = pyproject_sources.map { |source| [source["url"], source] }.to_h
-
-          config_variable_sources(credentials).each do |source|
-            if sources_hash.key?(source["original_url"])
-              sources_hash[source["original_url"]]["url"] = source["url"]
-            else
-              source.delete("original_url")
-              sources_hash[source["url"]] = source
-            end
+        # For hosted Dependabot token will be nil since the credentials aren't present.
+        # This is for those running Dependabot themselves and for dry-run.
+        def add_auth_env_vars(credentials)
+          TomlRB.parse(@pyproject_content).dig("tool", "poetry", "source")&.each do |source|
+            cred = credentials&.find { |c| c["index-url"] == source["url"] }
+            next unless cred
+
+            token = cred.fetch("token", nil)
+            next unless token && token.count(":") == 1
+
+            arr = token.split(":")
+            # https://python-poetry.org/docs/configuration/#using-environment-variables
+            name = source["name"]&.upcase&.gsub(/\W/, "_")
+            ENV["POETRY_HTTP_BASIC_#{name}_USERNAME"] = arr[0]
+            ENV["POETRY_HTTP_BASIC_#{name}_PASSWORD"] = arr[1]
           end
-
-          poetry_object["source"] = sources_hash.values unless sources_hash.empty?
-
-          TomlRB.dump(pyproject_object)
         end
 
         def sanitize
@@ -97,32 +95,6 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        def pyproject_sources
-          return @pyproject_sources if @pyproject_sources
-
-          pyproject_sources ||=
-            TomlRB.parse(pyproject_content).
-            dig("tool", "poetry", "source")
-
-          @pyproject_sources ||=
-            (pyproject_sources || []).
-            map { |h| h.dup.merge("url" => h["url"].gsub(%r{/*$}, "") + "/") }
-        end
-
-        def config_variable_sources(credentials)
-          @config_variable_sources ||=
-            credentials.
-            select { |cred| cred["type"] == "python_index" }.
-            map do |c|
-              {
-                "original_url" => c["index-url"],
-                "url" => AuthedUrlBuilder.authed_url(credential: c),
-                "name" => SecureRandom.hex[0..3],
-                "default" => c["replaces-base"]
-              }.compact
-            end
-        end
-
         def parsed_lockfile
           @parsed_lockfile ||= TomlRB.parse(lockfile.content)
         end

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -313,6 +313,7 @@ module Dependabot
           return if run_command("pyenv versions").include?("#{python_version}\n")
 
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r"\
                       "#{NativeHelpers.python_requirements_path}")
         end

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -323,6 +323,7 @@ module Dependabot
 
           requirements_path = NativeHelpers.python_requirements_path
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r "\
                       "#{requirements_path}")
         end

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -76,9 +76,11 @@ module Dependabot
             SharedHelpers.in_a_temporary_directory do
               SharedHelpers.with_git_configured(credentials: credentials) do
                 write_temporary_dependency_files(updated_req: requirement)
+                add_auth_env_vars
 
                 if python_version && !pre_installed_python?(python_version)
                   run_poetry_command("pyenv install -s #{python_version}")
+                  run_poetry_command("pyenv exec pip install --upgrade pip")
                   run_poetry_command(
                     "pyenv exec pip install -r "\
                     "#{NativeHelpers.python_requirements_path}"
@@ -194,6 +196,12 @@ module Dependabot
           end
         end
 
+        def add_auth_env_vars
+          Python::FileUpdater::PyprojectPreparer.
+            new(pyproject_content: pyproject.content).
+            add_auth_env_vars(credentials)
+        end
+
         def python_version
           requirements = python_requirement_parser.user_specified_requirements
           requirements = requirements.
@@ -227,7 +235,6 @@ module Dependabot
         def updated_pyproject_content(updated_requirement:)
           content = pyproject.content
           content = sanitize_pyproject_content(content)
-          content = add_private_sources(content)
           content = freeze_other_dependencies(content)
           content = set_target_dependency_req(content, updated_requirement)
           content
@@ -236,7 +243,6 @@ module Dependabot
         def sanitized_pyproject_content
           content = pyproject.content
           content = sanitize_pyproject_content(content)
-          content = add_private_sources(content)
           content
         end
 
@@ -246,12 +252,6 @@ module Dependabot
             sanitize
         end
 
-        def add_private_sources(pyproject_content)
-          Python::FileUpdater::PyprojectPreparer.
-            new(pyproject_content: pyproject_content).
-            replace_sources(credentials)
-        end
-
         def freeze_other_dependencies(pyproject_content)
           Python::FileUpdater::PyprojectPreparer.
             new(pyproject_content: pyproject_content, lockfile: lockfile).

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.189.0
+  version: 0.191.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-17 00:00:00.000000000 Z
+date: 2022-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.189.0
+        version: 0.191.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.189.0
+        version: 0.191.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement