dependabot-python 0.190.0 → 0.191.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d092ca15f45ec345039cfc40064d237395048806186f788486b362cd728e2d7d
-  data.tar.gz: 8f5a65d64ab011a8e4dff26c71d063eb2cb5de78f132e013d2aa2e575d7f3028
+  metadata.gz: 7c10392c0e666de3e7263d14b4b13b84aed31adf2f93c269a9553c26911565f6
+  data.tar.gz: ca887bf9c1d26aaddfca1619492b6e40a7eef582d428b483b4ce3aa53ec7ddf5
 SHA512:
-  metadata.gz: c2ba6777b8ff02d4d97445f92085b2fa4c7f8edef47fee691dbc2a0250af125992e377f81c94e0902b6618eed3a6914bc47e63ffe961c054f082a7e3c97ad461
-  data.tar.gz: 142c5ce08d06091644ea9872729af6abfc37f697e10b8fdb5509492f821bbc14acf32ad5bbde0ba76c2c8a7e5b238b176ad7131b884fddac247b0c82226e728d
+  metadata.gz: 7b0b91f6d7f7ca6cbb7ea98c92c1fa016a3617e4e590bade50b951b7344f0245b6be0c0456a05d3cf78a3cb93861254cc2ea338fb62adc7f07e7205036213335
+  data.tar.gz: f456f23d35182955837c4befb4fcb19cfdc0149a8911860c3105182bdc3d868f78b6dbc3a8658cef51ee7e66b090ae92926a9d076e446171f77d36f022810971

data/helpers/requirements.txt

@@ -1,5 +1,5 @@
-pip>=21.3.1  # Allow earlier versions to retain python 3.6 support
-pip-tools>=6.4.0  # Allow earlier versions to retain python 3.6 support
+pip>=21.3.1,<22.1.3  # Allow earlier versions to retain python 3.6 support
+pip-tools>=6.4.0,<=6.6.2  # Allow earlier versions to retain python 3.6 support
 flake8==4.0.1
 hashin==0.17.0
 pipenv==2022.4.8

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -223,6 +223,7 @@ module Dependabot
           return if run_command("pyenv versions").include?("#{python_version}\n")
 
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r "\
                       "#{NativeHelpers.python_requirements_path}")
         end

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -105,7 +105,6 @@ module Dependabot
               content = sanitize(content)
               content = freeze_other_dependencies(content)
               content = freeze_dependencies_being_updated(content)
-              content = add_private_sources(content)
               content
             end
         end
@@ -150,12 +149,6 @@ module Dependabot
           poetry_object[subdep_type][dependency.name] = dep.version
         end
 
-        def add_private_sources(pyproject_content)
-          PyprojectPreparer.
-            new(pyproject_content: pyproject_content).
-            replace_sources(credentials)
-        end
-
         def subdep_type
           category =
             TomlRB.parse(lockfile.content).fetch("package", []).
@@ -175,9 +168,11 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do
               write_temporary_dependency_files(pyproject_content)
+              add_auth_env_vars
 
               if python_version && !pre_installed_python?(python_version)
                 run_poetry_command("pyenv install -s #{python_version}")
+                run_poetry_command("pyenv exec pip install --upgrade pip")
                 run_poetry_command("pyenv exec pip install -r"\
                                    "#{NativeHelpers.python_requirements_path}")
               end
@@ -231,6 +226,12 @@ module Dependabot
           File.write("pyproject.toml", pyproject_content)
         end
 
+        def add_auth_env_vars
+          Python::FileUpdater::PyprojectPreparer.
+            new(pyproject_content: pyproject.content).
+            add_auth_env_vars(credentials)
+        end
+
         def python_version
           requirements = python_requirement_parser.user_specified_requirements
           requirements = requirements.

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -18,24 +18,22 @@ module Dependabot
           @lockfile = lockfile
         end
 
-        def replace_sources(credentials)
-          pyproject_object = TomlRB.parse(pyproject_content)
-          poetry_object = pyproject_object.fetch("tool").fetch("poetry")
-
-          sources_hash = pyproject_sources.map { |source| [source["url"], source] }.to_h
-
-          config_variable_sources(credentials).each do |source|
-            if sources_hash.key?(source["original_url"])
-              sources_hash[source["original_url"]]["url"] = source["url"]
-            else
-              source.delete("original_url")
-              sources_hash[source["url"]] = source
-            end
+        # For hosted Dependabot token will be nil since the credentials aren't present.
+        # This is for those running Dependabot themselves and for dry-run.
+        def add_auth_env_vars(credentials)
+          TomlRB.parse(@pyproject_content).dig("tool", "poetry", "source")&.each do |source|
+            cred = credentials&.find { |c| c["index-url"] == source["url"] }
+            next unless cred
+
+            token = cred.fetch("token", nil)
+            next unless token && token.count(":") == 1
+
+            arr = token.split(":")
+            # https://python-poetry.org/docs/configuration/#using-environment-variables
+            name = source["name"]&.upcase&.gsub(/\W/, "_")
+            ENV["POETRY_HTTP_BASIC_#{name}_USERNAME"] = arr[0]
+            ENV["POETRY_HTTP_BASIC_#{name}_PASSWORD"] = arr[1]
           end
-
-          poetry_object["source"] = sources_hash.values unless sources_hash.empty?
-
-          TomlRB.dump(pyproject_object)
         end
 
         def sanitize
@@ -97,32 +95,6 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        def pyproject_sources
-          return @pyproject_sources if @pyproject_sources
-
-          pyproject_sources ||=
-            TomlRB.parse(pyproject_content).
-            dig("tool", "poetry", "source")
-
-          @pyproject_sources ||=
-            (pyproject_sources || []).
-            map { |h| h.dup.merge("url" => h["url"].gsub(%r{/*$}, "") + "/") }
-        end
-
-        def config_variable_sources(credentials)
-          @config_variable_sources ||=
-            credentials.
-            select { |cred| cred["type"] == "python_index" }.
-            map do |c|
-              {
-                "original_url" => c["index-url"],
-                "url" => AuthedUrlBuilder.authed_url(credential: c),
-                "name" => SecureRandom.hex[0..3],
-                "default" => c["replaces-base"]
-              }.compact
-            end
-        end
-
         def parsed_lockfile
           @parsed_lockfile ||= TomlRB.parse(lockfile.content)
         end

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -313,6 +313,7 @@ module Dependabot
           return if run_command("pyenv versions").include?("#{python_version}\n")
 
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r"\
                       "#{NativeHelpers.python_requirements_path}")
         end

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -323,6 +323,7 @@ module Dependabot
 
           requirements_path = NativeHelpers.python_requirements_path
           run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install --upgrade pip")
           run_command("pyenv exec pip install -r "\
                       "#{requirements_path}")
         end

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -76,9 +76,11 @@ module Dependabot
             SharedHelpers.in_a_temporary_directory do
               SharedHelpers.with_git_configured(credentials: credentials) do
                 write_temporary_dependency_files(updated_req: requirement)
+                add_auth_env_vars
 
                 if python_version && !pre_installed_python?(python_version)
                   run_poetry_command("pyenv install -s #{python_version}")
+                  run_poetry_command("pyenv exec pip install --upgrade pip")
                   run_poetry_command(
                     "pyenv exec pip install -r "\
                     "#{NativeHelpers.python_requirements_path}"
@@ -194,6 +196,12 @@ module Dependabot
           end
         end
 
+        def add_auth_env_vars
+          Python::FileUpdater::PyprojectPreparer.
+            new(pyproject_content: pyproject.content).
+            add_auth_env_vars(credentials)
+        end
+
         def python_version
           requirements = python_requirement_parser.user_specified_requirements
           requirements = requirements.
@@ -227,7 +235,6 @@ module Dependabot
         def updated_pyproject_content(updated_requirement:)
           content = pyproject.content
           content = sanitize_pyproject_content(content)
-          content = add_private_sources(content)
           content = freeze_other_dependencies(content)
           content = set_target_dependency_req(content, updated_requirement)
           content
@@ -236,7 +243,6 @@ module Dependabot
         def sanitized_pyproject_content
           content = pyproject.content
           content = sanitize_pyproject_content(content)
-          content = add_private_sources(content)
           content
         end
 
@@ -246,12 +252,6 @@ module Dependabot
             sanitize
         end
 
-        def add_private_sources(pyproject_content)
-          Python::FileUpdater::PyprojectPreparer.
-            new(pyproject_content: pyproject_content).
-            replace_sources(credentials)
-        end
-
         def freeze_other_dependencies(pyproject_content)
           Python::FileUpdater::PyprojectPreparer.
             new(pyproject_content: pyproject_content, lockfile: lockfile).

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.190.0
+  version: 0.191.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-23 00:00:00.000000000 Z
+date: 2022-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.0
+        version: 0.191.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.190.0
+        version: 0.191.1
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement