dependabot-python 0.196.3 → 0.198.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef3980fbcf89e55a483039cfab07e6e2fab854570f76104da83353b67e1aac35
-  data.tar.gz: f17461ee6d6abd086bde985fa7c29684b7bd0c510d2cb101afcaa6c15ed44ba6
+  metadata.gz: 941d0fac4b28e5144d4688da00937ed04fbcdfb1c113116e178a51c831b92fde
+  data.tar.gz: 89bbc2f136b6e5170628f689e355b0aa4411f90d92c1e3a2815ed5a04687f1e9
 SHA512:
-  metadata.gz: d5c5fe0994d0cb0ac782f26364f2369240885b9f844380b379361c43277db7c9aa1e87542462a04f7ce50bee4b76ec83879aa2143579996c3d4f461c6d4e5283
-  data.tar.gz: 330835671d11f04d975636b45068c5981d8c963426b81c4b2acded5dfb04d0a2c1637e7c019d58fb23e39d240fa32a4585932f6fe537976eee092e4398574ff1
+  metadata.gz: 9c5b8816596b35eb024f80c57bf9d96a66c59da8635835ac04d6acf6d30559be3b5c6510cb670bbe0c2196b56988ee2e1b9d1fd6a496970cc90aff1ef471555e
+  data.tar.gz: 568c28e3ff03fb48da4ae6799200021abe050dd7d28c163833ce879da00f95a55cd813a4516b0ee4a1976d0fc156220408d2efece7771c52b177d97378512654

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -32,6 +32,8 @@ module Dependabot
           "pip._internal.exceptions.InstallationSubprocessError: Command errored out with exit status 1:"
         # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#configuring-metadata
         PYTHON_PACKAGE_NAME_REGEX = /[A-Za-z0-9_\-]+/.freeze
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+        ERROR_REGEX = /(?<=ERROR\:\W).*$/.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -76,16 +78,13 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe -v "\
-                     "#{pip_compile_options(filename)} -P #{dependency.name} "\
-                     "#{filename}"
+                    "pyenv exec pip-compile -v #{pip_compile_options(filename)} -P #{dependency.name} #{filename}"
                   )
                   # Run pip-compile a second time, without an update argument,
                   # to ensure it handles markers correctly
                   write_original_manifest_files unless dependency.top_level?
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
-                     "#{pip_compile_options(filename)} #{filename}"
+                    "pyenv exec pip-compile #{pip_compile_options(filename)} #{filename}"
                   )
                 end
 
@@ -114,7 +113,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/PerceivedComplexity
         def handle_pip_compile_errors(error)
-          if error.message.include?("Could not find a version")
+          if error.message.include?(RESOLUTION_IMPOSSIBLE_ERROR)
             check_original_requirements_resolvable
             # If the original requirements are resolvable but we get an
             # incompatibility error after unlocking then it's likely to be
@@ -138,7 +137,7 @@ module Dependabot
             return
           end
 
-          if error.message.include?("Could not find a version ") &&
+          if error.message.include?(RESOLUTION_IMPOSSIBLE_ERROR) &&
              !error.message.match?(/#{Regexp.quote(dependency.name)}/i)
             # Sometimes pip-tools gets confused and can't work around
             # sub-dependency incompatibilities. Ignore those cases.
@@ -179,7 +178,7 @@ module Dependabot
 
               filenames_to_compile.each do |filename|
                 run_pip_compile_command(
-                  "pyenv exec pip-compile #{pip_compile_options(filename)} --allow-unsafe #{filename}"
+                  "pyenv exec pip-compile #{pip_compile_options(filename)} #{filename}"
                 )
               end
 
@@ -188,7 +187,7 @@ module Dependabot
               # Pick the error message that includes resolvability errors, this might be the cause from
               # handle_pip_compile_errors (it's unclear if we should always pick the cause here)
               error_message = [e.message, e.cause&.message].compact.find do |msg|
-                ["UnsupportedConstraint", "Could not find a version"].any? { |err| msg.include?(err) }
+                msg.include?(RESOLUTION_IMPOSSIBLE_ERROR)
               end
 
               cleaned_message = clean_error_message(error_message || "")
@@ -220,6 +219,7 @@ module Dependabot
         def pip_compile_options(filename)
           options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
+          options += ["--resolver backtracking", "--allow-unsafe"]
 
           if (requirements_file = compiled_file_for_filename(filename))
             options << "--output-file=#{requirements_file.name}"
@@ -353,25 +353,8 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        VERBOSE_ERROR_OUTPUT_LINES = [
-          "Traceback",
-          "Using indexes:",
-          "Current constraints:",
-          "Finding the best candidates:",
-          "Finding secondary dependencies:",
-          "\n",
-          "  "
-        ].freeze
-
         def clean_error_message(message)
-          msg_lines = message.lines
-          msg = msg_lines.
-                take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
-                join.strip
-
-          # Redact any URLs, as they may include credentials
-          msg.gsub(/http.*?(?=\s)/, "<redacted>")
+          message.scan(ERROR_REGEX).last
         end
 
         def filenames_to_compile

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.196.3
+  version: 0.198.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-12 00:00:00.000000000 Z
+date: 2022-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.3
+        version: 0.198.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.3
+        version: 0.198.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement