dependabot-python 0.211.0 → 0.212.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48410b5617f95831c3ed5aba2c8e6cd9d48d7d9fc812c65e44eb853a9c46b336
-  data.tar.gz: 24c798b98475ad41a3600f7b168921f04c63d02029c87b96410585d9ad88af66
+  metadata.gz: 4862b59513a97a33d51ff8ad57b6d9815842769c87f612426ffbcd8e75a9655c
+  data.tar.gz: 9543935b3ab8027344757b41aa8ff265d823beac956a06d20d4917e75962698d
 SHA512:
-  metadata.gz: 3adfdad038c43c09ec2ce7cb3c04fa4606b4e538ffc418100bbe3bf3a6a4344e243f141a8c13b7215bd5e669cfc52e31b99b888791cbdf8ce9d75bc2d52cd013
-  data.tar.gz: 2b4972ad44a0f39a9a3355630baf7f088b1d988224b66d782c65779ed3f9e4f98956190d1ddb3ec4889796edbebb983b281dad9f79e12a0574bc7da3a71bd17a
+  metadata.gz: fd9e547d19f01addfdc2fcc4eeb7095bf8e886eded086772f81b9bfbd6acfb2fc6076c354c970ae5fad0691a25679d99db8eb0884121e986c1bcf39b17c041ba
+  data.tar.gz: be587fe031f132dd20d4fc023668e31d81c37608d915a9f586ca159b675302993a208b6e93209cfaedad83d08eaae1ca06f6af7eec8933bcc2c44e8a61293ccf

data/helpers/requirements.txt

@@ -4,7 +4,7 @@ flake8==5.0.4
 hashin==0.17.0
 pipenv==2022.4.8
 pipfile==0.0.2
-poetry==1.1.15
+poetry>=1.1.15,<=1.2.0
 wheel==0.37.1
 
 # Some dependencies will only install if Cython is present

data/lib/dependabot/python/file_fetcher.rb

@@ -13,6 +13,7 @@ module Dependabot
     class FileFetcher < Dependabot::FileFetchers::Base
       CHILD_REQUIREMENT_REGEX = /^-r\s?(?<path>.*\.(?:txt|in))/.freeze
       CONSTRAINT_REGEX = /^-c\s?(?<path>.*\.(?:txt|in))/.freeze
+      DEPENDENCY_TYPES = %w(packages dev-packages).freeze
 
       def self.required_files_in?(filenames)
         return true if filenames.any? { |name| name.end_with?(".txt", ".in") }
@@ -32,8 +33,8 @@ module Dependabot
       end
 
       def self.required_files_message
-        "Repo must contain a requirements.txt, setup.py, setup.cfg, pyproject.toml, "\
-        "or a Pipfile."
+        "Repo must contain a requirements.txt, setup.py, setup.cfg, pyproject.toml, " \
+          "or a Pipfile."
       end
 
       private
@@ -372,7 +373,7 @@ module Dependabot
         return [] unless pipfile
 
         paths = []
-        %w(packages dev-packages).each do |dep_type|
+        DEPENDENCY_TYPES.each do |dep_type|
           next unless parsed_pipfile[dep_type]
 
           parsed_pipfile[dep_type].each do |_, req|

data/lib/dependabot/python/file_parser/poetry_files_parser.rb

@@ -61,7 +61,7 @@ module Dependabot
 
         # @param req can be an Array, Hash or String that represents the constraints for a dependency
         def parse_requirements_from(req, type)
-          [req].flatten.compact.map do |requirement|
+          [req].flatten.compact.filter_map do |requirement|
             next if requirement.is_a?(Hash) && (UNSUPPORTED_DEPENDENCY_TYPES & requirement.keys).any?
 
             check_requirements(requirement)
@@ -72,7 +72,7 @@ module Dependabot
               source: nil,
               groups: [type]
             }
-          end.compact
+          end
         end
 
         # Create a DependencySet where each element has no requirement. Any
@@ -81,8 +81,9 @@ module Dependabot
         def lockfile_dependencies
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
+          source_types = %w(directory git url)
           parsed_lockfile.fetch("package", []).each do |details|
-            next if %w(directory git url).include?(details.dig("source", "type"))
+            next if source_types.include?(details.dig("source", "type"))
 
             dependencies <<
               Dependency.new(

data/lib/dependabot/python/file_parser/python_requirement_parser.rb

@@ -33,8 +33,7 @@ module Dependabot
           requirement_files.flat_map do |file|
             file.content.lines.
               select { |l| l.include?(";") && l.include?("python") }.
-              map { |l| l.match(/python_version(?<req>.*?["'].*?['"])/) }.
-              compact.
+              filter_map { |l| l.match(/python_version(?<req>.*?["'].*?['"])/) }.
               map { |re| re.named_captures.fetch("req").gsub(/['"]/, "") }.
               select { |r| valid_requirement?(r) }
           end

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -128,7 +128,7 @@ module Dependabot
           tests_require = get_regexed_req_array(TESTS_REQUIRE_REGEX)
           extras_require = get_regexed_req_dict(EXTRAS_REQUIRE_REGEX)
 
-          tmp = "from setuptools import setup\n\n"\
+          tmp = "from setuptools import setup\n\n" \
                 "setup(name=\"sanitized-package\",version=\"0.0.1\","
 
           tmp += "install_requires=#{install_requires}," if install_requires

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -71,20 +71,20 @@ module Dependabot
             filenames_to_compile.each do |filename|
               # Shell out to pip-compile, generate a new set of requirements.
               # This is slow, as pip-compile needs to do installs.
-              name_part = "pyenv exec pip-compile "\
-                          "#{pip_compile_options(filename)} -P "\
+              name_part = "pyenv exec pip-compile " \
+                          "#{pip_compile_options(filename)} -P " \
                           "#{dependency.name}"
               version_part = "#{dependency.version} #{filename}"
               # Don't escape pyenv `dep-name==version` syntax
               run_pip_compile_command(
-                "#{SharedHelpers.escape_command(name_part)}=="\
+                "#{SharedHelpers.escape_command(name_part)}==" \
                 "#{SharedHelpers.escape_command(version_part)}",
                 allow_unsafe_shell_command: true
               )
               # Run pip-compile a second time, without an update argument, to
               # ensure it resets the right comments.
               run_pip_compile_command(
-                "pyenv exec pip-compile #{pip_compile_options(filename)} "\
+                "pyenv exec pip-compile #{pip_compile_options(filename)} " \
                 "#{filename}"
               )
             end
@@ -92,7 +92,7 @@ module Dependabot
             # Remove any .python-version file before parsing the reqs
             FileUtils.remove_entry(".python-version", true)
 
-            dependency_files.map do |file|
+            dependency_files.filter_map do |file|
               next unless file.name.end_with?(".txt")
 
               updated_content = File.read(file.name)
@@ -102,12 +102,12 @@ module Dependabot
               next if updated_content == file.content
 
               file.dup.tap { |f| f.content = updated_content }
-            end.compact
+            end
           end
         end
 
         def update_manifest_files
-          dependency_files.map do |file|
+          dependency_files.filter_map do |file|
             next unless file.name.end_with?(".in")
 
             file = file.dup
@@ -116,7 +116,7 @@ module Dependabot
 
             file.content = updated_content
             file
-          end.compact
+          end
         end
 
         def update_uncompiled_files(updated_files)
@@ -132,7 +132,7 @@ module Dependabot
                   reject { |file| updated_filenames.include?(file.name) }
 
           args = dependency.to_h
-          args = args.keys.map { |k| [k.to_sym, args[k]] }.to_h
+          args = args.keys.to_h { |k| [k.to_sym, args[k]] }
           args[:requirements] = new_reqs
           args[:previous_requirements] = old_reqs
 
@@ -224,7 +224,7 @@ module Dependabot
 
           run_command("pyenv install -s #{python_version}")
           run_command("pyenv exec pip install --upgrade pip")
-          run_command("pyenv exec pip install -r "\
+          run_command("pyenv exec pip install -r " \
                       "#{NativeHelpers.python_requirements_path}")
         end
 
@@ -352,7 +352,7 @@ module Dependabot
         end
 
         def deps_to_augment_hashes_for(updated_content, original_content)
-          regex = /^#{RequirementParser::INSTALL_REQ_WITH_REQUIREMENT}/
+          regex = /^#{RequirementParser::INSTALL_REQ_WITH_REQUIREMENT}/o
 
           new_matches = []
           updated_content.scan(regex) { new_matches << Regexp.last_match }

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -18,6 +18,8 @@ module Dependabot
         require_relative "pipfile_manifest_updater"
         require_relative "setup_file_sanitizer"
 
+        DEPENDENCY_TYPES = %w(packages dev-packages).freeze
+
         attr_reader :dependencies, :dependency_files, :credentials
 
         def initialize(dependencies:, dependency_files:, credentials:)
@@ -145,7 +147,7 @@ module Dependabot
           pipfile_object = TomlRB.parse(pipfile_content)
 
           dependencies.each do |dep|
-            %w(packages dev-packages).each do |type|
+            DEPENDENCY_TYPES.each do |type|
               names = pipfile_object[type]&.keys || []
               pkg_name = names.find { |nm| normalise(nm) == dep.name }
               next unless pkg_name || subdep_type?(type)
@@ -350,9 +352,9 @@ module Dependabot
 
           # Otherwise we have to raise, giving details of the Python versions
           # that Dependabot supports
-          msg = "Dependabot detected the following Python requirement "\
-                "for your project: '#{requirement_string}'.\n\nCurrently, the "\
-                "following Python versions are supported in Dependabot: "\
+          msg = "Dependabot detected the following Python requirement " \
+                "for your project: '#{requirement_string}'.\n\nCurrently, the " \
+                "following Python versions are supported in Dependabot: " \
                 "#{PythonVersions::SUPPORTED_VERSIONS.join(', ')}."
           raise DependencyFileNotResolvable, msg
         end

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -173,7 +173,7 @@ module Dependabot
               if python_version && !pre_installed_python?(python_version)
                 run_poetry_command("pyenv install -s #{python_version}")
                 run_poetry_command("pyenv exec pip install --upgrade pip")
-                run_poetry_command("pyenv exec pip install -r"\
+                run_poetry_command("pyenv exec pip install -r" \
                                    "#{NativeHelpers.python_requirements_path}")
               end
 

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -55,6 +55,7 @@ module Dependabot
           Dependabot::Python::FileParser::PoetryFilesParser::POETRY_DEPENDENCY_TYPES.each do |key|
             next unless poetry_object[key]
 
+            source_types = %w(directory file url)
             poetry_object.fetch(key).each do |dep_name, _|
               next if excluded_names.include?(normalise(dep_name))
 
@@ -62,7 +63,7 @@ module Dependabot
 
               next unless (locked_version = locked_details&.fetch("version"))
 
-              next if %w(directory file url).include?(locked_details&.dig("source", "type"))
+              next if source_types.include?(locked_details&.dig("source", "type"))
 
               if locked_details&.dig("source", "type") == "git"
                 poetry_object[key][dep_name] = {

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -36,7 +36,7 @@ module Dependabot
         def fetch_updated_dependency_files
           reqs = dependency.requirements.zip(dependency.previous_requirements)
 
-          reqs.map do |(new_req, old_req)|
+          reqs.filter_map do |(new_req, old_req)|
             next if new_req == old_req
 
             file = get_original_file(new_req.fetch(:file)).dup
@@ -46,7 +46,7 @@ module Dependabot
 
             file.content = updated_content
             file
-          end.compact
+          end
         end
 
         def updated_requirement_or_setup_file_content(new_req, old_req)

data/lib/dependabot/python/file_updater/requirement_replacer.rb

@@ -52,7 +52,7 @@ module Dependabot
           if add_space_after_operators?
             new_req_string =
               new_req_string.
-              gsub(/(#{RequirementParser::COMPARISON})\s*(?=\d)/, '\1 ')
+              gsub(/(#{RequirementParser::COMPARISON})\s*(?=\d)/o, '\1 ')
           end
 
           new_req_string
@@ -92,7 +92,7 @@ module Dependabot
         def add_space_after_operators?
           original_dependency_declaration_string(old_requirement).
             match(RequirementParser::REQUIREMENTS).
-            to_s.match?(/#{RequirementParser::COMPARISON}\s+\d/)
+            to_s.match?(/#{RequirementParser::COMPARISON}\s+\d/o)
         end
 
         def original_declaration_replacement_regex

data/lib/dependabot/python/file_updater/setup_file_sanitizer.rb

@@ -19,9 +19,9 @@ module Dependabot
           # install_requires. A name and version are required by don't end up
           # in the lockfile.
           content =
-            "from setuptools import setup\n\n"\
-            "setup(name=\"sanitized-package\",version=\"0.0.1\","\
-            "install_requires=#{install_requires_array.to_json},"\
+            "from setuptools import setup\n\n" \
+            "setup(name=\"sanitized-package\",version=\"0.0.1\"," \
+            "install_requires=#{install_requires_array.to_json}," \
             "extras_require=#{extras_require_hash.to_json}"
 
           content += ',setup_requires=["pbr"],pbr=True' if include_pbr?
@@ -38,22 +38,22 @@ module Dependabot
 
         def install_requires_array
           @install_requires_array ||=
-            parsed_setup_file.dependencies.map do |dep|
+            parsed_setup_file.dependencies.filter_map do |dep|
               next unless dep.requirements.first[:groups].
                           include?("install_requires")
 
               dep.name + dep.requirements.first[:requirement].to_s
-            end.compact
+            end
         end
 
         def setup_requires_array
           @setup_requires_array ||=
-            parsed_setup_file.dependencies.map do |dep|
+            parsed_setup_file.dependencies.filter_map do |dep|
               next unless dep.requirements.first[:groups].
                           include?("setup_requires")
 
               dep.name + dep.requirements.first[:requirement].to_s
-            end.compact
+            end
         end
 
         def extras_require_hash
@@ -66,7 +66,7 @@ module Dependabot
 
                   hash[group.split(":").last] ||= []
                   hash[group.split(":").last] <<
-                    dep.name + dep.requirements.first[:requirement].to_s
+                    (dep.name + dep.requirements.first[:requirement].to_s)
                 end
               end
 

data/lib/dependabot/python/file_updater.rb

@@ -60,8 +60,8 @@ module Dependabot
 
         # Otherwise, this is a top-level dependency, and we can figure out
         # which resolver to use based on the filename of its requirements
-        return :pipfile if changed_req_files.any? { |f| f == "Pipfile" }
-        return :poetry if changed_req_files.any? { |f| f == "pyproject.toml" }
+        return :pipfile if changed_req_files.any?("Pipfile")
+        return :poetry if changed_req_files.any?("pyproject.toml")
         return :pip_compile if changed_req_files.any? { |f| f.end_with?(".in") }
 
         :requirements

data/lib/dependabot/python/native_helpers.rb

@@ -12,7 +12,7 @@ module Dependabot
       end
 
       def self.python_helpers_dir
-        File.join(native_helpers_root, "python/helpers")
+        File.join(native_helpers_root, "python")
       end
 
       def self.native_helpers_root

data/lib/dependabot/python/update_checker/index_finder.rb

@@ -171,7 +171,7 @@ module Dependabot
           authed_url = config_variable_urls.find { |u| u.match?(regexp) }
           return authed_url if authed_url
 
-          cleaned_url = url.gsub(%r{#{ENVIRONMENT_VARIABLE_REGEX}/?}, "")
+          cleaned_url = url.gsub(%r{#{ENVIRONMENT_VARIABLE_REGEX}/?}o, "")
           authed_url = authed_base_url(cleaned_url)
           return authed_url if credential_for(cleaned_url)
 

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -85,14 +85,14 @@ module Dependabot
         end
 
         def filter_unsupported_versions(versions_array, python_version)
-          versions_array.map do |details|
+          versions_array.filter_map do |details|
             python_requirement = details.fetch(:python_requirement)
             next details.fetch(:version) unless python_version
             next details.fetch(:version) unless python_requirement
             next unless python_requirement.satisfied_by?(python_version)
 
             details.fetch(:version)
-          end.compact
+          end
         end
 
         def filter_prerelease_versions(versions_array)
@@ -118,9 +118,9 @@ module Dependabot
         end
 
         def filter_out_of_range_versions(versions_array)
-          reqs = dependency.requirements.map do |r|
+          reqs = dependency.requirements.filter_map do |r|
             requirement_class.requirements_array(r.fetch(:requirement))
-          end.compact
+          end
 
           versions_array.
             select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
@@ -144,11 +144,14 @@ module Dependabot
           @available_versions ||=
             index_urls.flat_map do |index_url|
               sanitized_url = index_url.gsub(%r{(?<=//).*(?=@)}, "redacted")
+
               index_response = registry_response_for_dependency(index_url)
+              if index_response.status == 401 || index_response.status == 403
+                registry_index_response = registry_index_response(index_url)
 
-              if [401, 403].include?(index_response.status) &&
-                 [401, 403].include?(registry_index_response(index_url).status)
-                raise PrivateSourceAuthenticationFailure, sanitized_url
+                if registry_index_response.status == 401 || registry_index_response.status == 403
+                  raise PrivateSourceAuthenticationFailure, sanitized_url
+                end
               end
 
               version_links = []

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -318,7 +318,7 @@ module Dependabot
 
           run_command("pyenv install -s #{python_version}")
           run_command("pyenv exec pip install --upgrade pip")
-          run_command("pyenv exec pip install -r"\
+          run_command("pyenv exec pip install -r" \
                       "#{NativeHelpers.python_requirements_path}")
         end
 

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -29,12 +29,13 @@ module Dependabot
       # just raise if the latest version can't be resolved. Knowing that is
       # still better than nothing, though.
       class PipenvVersionResolver
+        # rubocop:disable Layout/LineLength
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /git clone -q (?<url>[^\s]+).* /.freeze
         GIT_REFERENCE_NOT_FOUND_REGEX =
           %r{git checkout -q (?<tag>[^\n"]+)\n?[^\n]*/(?<name>.*?)(\\n'\]|$)}m.
           freeze
-        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal.exceptions.InstallationError: Command errored out"\
+        PIPENV_INSTALLATION_ERROR = "pipenv.patched.notpip._internal.exceptions.InstallationError: Command errored out" \
                                     " with exit status 1: python setup.py egg_info"
         TRACEBACK = "Traceback (most recent call last):"
         PIPENV_INSTALLATION_ERROR_REGEX =
@@ -44,6 +45,9 @@ module Dependabot
         UNSUPPORTED_DEP_REGEX =
           /Could not find a version that satisfies the requirement.*(?:#{UNSUPPORTED_DEPS.join("|")})/.freeze
         PIPENV_RANGE_WARNING = /Warning:\sPython\s[<>].* was not found/.freeze
+        # rubocop:enable Layout/LineLength
+
+        DEPENDENCY_TYPES = %w(packages dev-packages).freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -136,20 +140,20 @@ module Dependabot
           end
 
           if error.message.match?(UNSUPPORTED_DEP_REGEX)
-            msg = "Dependabot detected a dependency that can't be built on "\
-                  "linux. Currently, all Dependabot builds happen on linux "\
-                  "boxes, so there is no way for Dependabot to resolve your "\
-                  "dependency files.\n\n"\
-                  "Unless you think Dependabot has made a mistake (please "\
-                  "tag us if so) you may wish to disable Dependabot on this "\
+            msg = "Dependabot detected a dependency that can't be built on " \
+                  "linux. Currently, all Dependabot builds happen on linux " \
+                  "boxes, so there is no way for Dependabot to resolve your " \
+                  "dependency files.\n\n" \
+                  "Unless you think Dependabot has made a mistake (please " \
+                  "tag us if so) you may wish to disable Dependabot on this " \
                   "repo."
             raise DependencyFileNotResolvable, msg
           end
 
           if error.message.match?(PIPENV_RANGE_WARNING)
-            msg = "Pipenv does not support specifying Python ranges "\
-              "(see https://github.com/pypa/pipenv/issues/1050 for more "\
-              "details)."
+            msg = "Pipenv does not support specifying Python ranges " \
+                  "(see https://github.com/pypa/pipenv/issues/1050 for more " \
+                  "details)."
             raise DependencyFileNotResolvable, msg
           end
 
@@ -159,7 +163,7 @@ module Dependabot
 
           if error.message.include?("SyntaxError: invalid syntax")
             raise DependencyFileNotResolvable,
-                  "SyntaxError while installing dependencies. Is one of the dependencies not Python 3 compatible? "\
+                  "SyntaxError while installing dependencies. Is one of the dependencies not Python 3 compatible? " \
                   "Pip v21 no longer supports Python 2."
           end
 
@@ -272,9 +276,9 @@ module Dependabot
           dependency_name = error_message.match(PIPENV_INSTALLATION_ERROR_REGEX).named_captures["name"]
           raise unless dependency_name
 
-          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system "\
-                "dependencies that can't be installed by Dependabot or required installation flags.\n\n"\
-                "Error output from running \"pipenv lock\":\n"\
+          msg = "Pipenv failed to install \"#{dependency_name}\". This could be caused by missing system " \
+                "dependencies that can't be installed by Dependabot or required installation flags.\n\n" \
+                "Error output from running \"pipenv lock\":\n" \
                 "#{clean_error_message(error_message)}"
 
           raise DependencyFileNotResolvable, msg
@@ -324,7 +328,7 @@ module Dependabot
           requirements_path = NativeHelpers.python_requirements_path
           run_command("pyenv install -s #{python_version}")
           run_command("pyenv exec pip install --upgrade pip")
-          run_command("pyenv exec pip install -r "\
+          run_command("pyenv exec pip install -r " \
                       "#{requirements_path}")
         end
 
@@ -361,7 +365,7 @@ module Dependabot
 
           pipfile_object = TomlRB.parse(pipfile_content)
 
-          %w(packages dev-packages).each do |type|
+          DEPENDENCY_TYPES.each do |type|
             names = pipfile_object[type]&.keys || []
             pkg_name = names.find { |nm| normalise(nm) == dependency.name }
             next unless pkg_name || subdep_type?(type)
@@ -429,9 +433,9 @@ module Dependabot
 
           # Otherwise we have to raise, giving details of the Python versions
           # that Dependabot supports
-          msg = "Dependabot detected the following Python requirement "\
-                "for your project: '#{requirement_string}'.\n\nCurrently, the "\
-                "following Python versions are supported in Dependabot: "\
+          msg = "Dependabot detected the following Python requirement " \
+                "for your project: '#{requirement_string}'.\n\nCurrently, the " \
+                "following Python versions are supported in Dependabot: " \
                 "#{PythonVersions::SUPPORTED_VERSIONS.join(', ')}."
           raise DependencyFileNotResolvable, msg
         end

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -3,6 +3,7 @@
 require "excon"
 require "toml-rb"
 require "open3"
+require "uri"
 require "dependabot/dependency"
 require "dependabot/errors"
 require "dependabot/shared_helpers"
@@ -23,18 +24,26 @@ module Dependabot
       # This class does version resolution for pyproject.toml files.
       class PoetryVersionResolver
         GIT_REFERENCE_NOT_FOUND_REGEX = /
-          'git'.*pypoetry-git-(?<name>.+?).{8}',
+          (?:'git'.*pypoetry-git-(?<name>.+?).{8}',
           'checkout',
           '(?<tag>.+?)'
-        /x.freeze
+          |
+          ...Failedtoclone
+          (?<url>.+?).gitat'(?<tag>.+?)',
+          verifyrefexistsonremote)
+        /x.freeze # TODO: remove the first clause and | when py3.6 support is EoL
         GIT_DEPENDENCY_UNREACHABLE_REGEX = /
-            '\['git',
-            \s+'clone',
-            \s+'--recurse-submodules',
-            \s+'(--)?',
-            \s+'(?<url>.+?)'.*
-            \s+exit\s+status\s+128
-          /mx.freeze
+          (?:'\['git',
+          \s+'clone',
+          \s+'--recurse-submodules',
+          \s+'(--)?',
+          \s+'(?<url>.+?)'.*
+          \s+exit\s+status\s+128
+          |
+          \s+Failed\sto\sclone
+          \s+(?<url>.+?),
+          \s+check\syour\sgit\sconfiguration)
+        /mx.freeze # TODO: remove the first clause and | when py3.6 support is EoL
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -61,7 +70,8 @@ module Dependabot
                                    false
                                  end
         rescue SharedHelpers::HelperSubprocessFailed => e
-          raise unless e.message.include?("SolverProblemError")
+          raise unless e.message.include?("SolverProblemError") || # TODO: Remove once py3.6 is EoL
+                       e.message.include?("version solving failed.")
 
           @resolvable[version] = false
         end
@@ -82,7 +92,7 @@ module Dependabot
                   run_poetry_command("pyenv install -s #{python_version}")
                   run_poetry_command("pyenv exec pip install --upgrade pip")
                   run_poetry_command(
-                    "pyenv exec pip install -r "\
+                    "pyenv exec pip install -r " \
                     "#{NativeHelpers.python_requirements_path}"
                   )
                 end
@@ -118,8 +128,13 @@ module Dependabot
         def handle_poetry_errors(error)
           if error.message.gsub(/\s/, "").match?(GIT_REFERENCE_NOT_FOUND_REGEX)
             message = error.message.gsub(/\s/, "")
-            name = message.match(GIT_REFERENCE_NOT_FOUND_REGEX).
-                   named_captures.fetch("name")
+            match = message.match(GIT_REFERENCE_NOT_FOUND_REGEX)
+            name = if (url = match.named_captures.fetch("url"))
+                     File.basename(URI.parse(url).path)
+                   else
+                     message.match(GIT_REFERENCE_NOT_FOUND_REGEX).
+                       named_captures.fetch("name")
+                   end
             raise GitDependencyReferenceNotFound, name
           end
 
@@ -130,7 +145,8 @@ module Dependabot
           end
 
           raise unless error.message.include?("SolverProblemError") ||
-                       error.message.include?("PackageNotFound")
+                       error.message.include?("PackageNotFound") ||
+                       error.message.include?("version solving failed.")
 
           check_original_requirements_resolvable
 
@@ -161,7 +177,8 @@ module Dependabot
               @original_reqs_resolvable = true
             rescue SharedHelpers::HelperSubprocessFailed => e
               raise unless e.message.include?("SolverProblemError") ||
-                           e.message.include?("PackageNotFound")
+                           e.message.include?("PackageNotFound") ||
+                           e.message.include?("version solving failed.")
 
               msg = clean_error_message(e.message)
               raise DependencyFileNotResolvable, msg
@@ -214,9 +231,9 @@ module Dependabot
           end
           return version if version
 
-          msg = "Dependabot detected the following Python requirements "\
-                "for your project: '#{requirements}'.\n\nCurrently, the "\
-                "following Python versions are supported in Dependabot: "\
+          msg = "Dependabot detected the following Python requirements " \
+                "for your project: '#{requirements}'.\n\nCurrently, the " \
+                "following Python versions are supported in Dependabot: " \
                 "#{PythonVersions::SUPPORTED_VERSIONS.join(', ')}."
           raise DependencyFileNotResolvable, msg
         end

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -260,7 +260,7 @@ module Dependabot
         # Updates the version in a constraint to be the given version
         def bump_version(req_string, version_to_be_permitted)
           old_version = req_string.
-                        match(/(#{RequirementParser::VERSION})/).
+                        match(/(#{RequirementParser::VERSION})/o).
                         captures.first
 
           req_string.sub(

data/lib/dependabot/python/update_checker.rb

@@ -132,7 +132,6 @@ module Dependabot
         resolver.resolvable?(version: fix_version) ? fix_version : nil
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       def resolver_type
         reqs = dependency.requirements
         req_files = reqs.map { |r| r.fetch(:file) }
@@ -144,8 +143,8 @@ module Dependabot
 
         # Otherwise, this is a top-level dependency, and we can figure out
         # which resolver to use based on the filename of its requirements
-        return :pipenv if req_files.any? { |f| f == "Pipfile" }
-        return :poetry if req_files.any? { |f| f == "pyproject.toml" }
+        return :pipenv if req_files.any?("Pipfile")
+        return :poetry if req_files.any?("pyproject.toml")
         return :pip_compile if req_files.any? { |f| f.end_with?(".in") }
 
         if dependency.version && !exact_requirement?(reqs)
@@ -154,7 +153,6 @@ module Dependabot
           :requirements
         end
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
       def subdependency_resolver
         return :pipenv if pipfile_lock
@@ -238,7 +236,7 @@ module Dependabot
         return ">= #{dependency.version}" if dependency.version
 
         version_for_requirement =
-          dependency.requirements.map { |r| r[:requirement] }.compact.
+          dependency.requirements.filter_map { |r| r[:requirement] }.
           reject { |req_string| req_string.start_with?("<") }.
           select { |req_string| req_string.match?(VERSION_REGEX) }.
           map { |req_string| req_string.match(VERSION_REGEX) }.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.211.0
+  version: 0.212.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-23 00:00:00.000000000 Z
+date: 2022-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
+        version: 0.212.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
+        version: 0.212.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.12.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,14 +142,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.36.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.36.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-performance
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.14.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.14.2
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement