dependabot-python 0.223.0 → 0.225.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e9e452699158db9bbd06ed1b09401940717de3e44a4838ef41dc322af20b9cd
-  data.tar.gz: b46ae8ae11b9c8379cfe35cfbb3c3b92d33e211d5d13d126891bc6d35f62b439
+  metadata.gz: 9d804625d39f5d3fae7776c1963e2f33347a97fb4e9dae189674abb3dd5b3b99
+  data.tar.gz: 25193d26af70d445a683c82f7a2ea4151f1bd879e2ac35cf55d053dc761ddbac
 SHA512:
-  metadata.gz: 03e2d1ff0d0299365c43513022072b4d1a3c3d3c52ae65d0daf9dade132c84fa0648080711ea1ae3af00648eeca03740072755abb2c8aa50b0fc8bc5ef52d473
-  data.tar.gz: 2cb86e19ce30104bfda9362adc4660efd4e074d452da6d871146f65bfb25a8bc6e6d251368b452511005b9e51dcc89b27f9be6c4c89ee2f6f793cbb69d9424ce
+  metadata.gz: 1cbc7939f48ba24aedc80ce89dd0251ec5573197b2f5e6fe7a859b0192bed3e7009dca46287ebbd39f198d2fb5af4c453d4e84cd425b57175f532260386a9994
+  data.tar.gz: b46f5e9c0dbe616b337bd03d3621ec4a004a7f6e8ff323fa32595af884906908249f126ad1de23467c8a5b936256a5a3c30146113ecccb404b118c1e9383de17

data/helpers/build

@@ -18,8 +18,4 @@ cp -r \
   "$install_dir"
 
 cd "$install_dir"
-PYENV_VERSION=3.11.4 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"
-PYENV_VERSION=3.10.12 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"
-PYENV_VERSION=3.9.17 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"
-PYENV_VERSION=3.8.17 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"
-PYENV_VERSION=3.7.17 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"
+PYENV_VERSION=$1 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"

data/lib/dependabot/python/file_fetcher.rb

@@ -37,6 +37,28 @@ module Dependabot
           "or a Pipfile."
       end
 
+      def ecosystem_versions
+        # Hmm... it's weird that this calls file parser methods, but here we are in the file fetcher... for all
+        # ecosystems our goal is to extract the user specified versions, so we'll need to do file parsing... so should
+        # we move this `ecosystem_versions` metrics method to run in the file parser for all ecosystems? Downside is if
+        # file parsing blows up, this metric isn't emitted, but reality is we have to parse anyway... as we want to know
+        # the user-specified range of versions, not the version Dependabot chose to run.
+        python_requirement_parser = FileParser::PythonRequirementParser.new(dependency_files: files)
+        language_version_manager = LanguageVersionManager.new(python_requirement_parser: python_requirement_parser)
+        {
+          languages: {
+            python: {
+              # TODO: alternatively this could use `python_requirement_parser.user_specified_requirements` which
+              # returns an array... which we could flip to return a hash of manifest name => version
+              # string and then check for min/max versions... today it simply defaults to
+              # array.first which seems rather arbitrary.
+              "raw" => language_version_manager.user_specified_python_version || "unknown",
+              "max" => language_version_manager.python_major_minor || "unknown"
+            }
+          }
+        }
+      end
+
       private
 
       def fetch_files

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.225.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -187,7 +187,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - helpers/build
-- helpers/build_for_version
 - helpers/lib/__init__.py
 - helpers/lib/hasher.py
 - helpers/lib/parser.py
@@ -232,7 +231,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
 post_install_message: 
 rdoc_options: []
 require_paths:

data/helpers/build_for_version

@@ -1,21 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  echo "Unable to build, DEPENDABOT_NATIVE_HELPERS_PATH is not set"
-  exit 1
-fi
-
-install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/python"
-mkdir -p "$install_dir"
-
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cp -r \
-  "$helpers_dir/lib" \
-  "$helpers_dir/run.py" \
-  "$helpers_dir/requirements.txt" \
-  "$install_dir"
-
-cd "$install_dir"
-PYENV_VERSION=$1 pyenv exec pip --disable-pip-version-check install --use-pep517 -r "requirements.txt"