dependabot-python 0.246.0 → 0.248.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 021acc95cd5e4423b135d43272a4bfd3c74a805f34e05b2b645e0d4b724a87ce
-  data.tar.gz: b14c2dac24f37ce9b509d5e4820f07d370ed9671c77a8a75068941cb0d312703
+  metadata.gz: 165e432faa4b40b16ac49232c58dbe9f6a1187bf063cf8c347ed683515f06577
+  data.tar.gz: 0b22f327bbab4b6bc752b1784c02f756000aa21b043a049e34b445c820526056
 SHA512:
-  metadata.gz: 700e8b8dec014024c967612aed60818410b2b227735c0ce03025f65c08cc50e03b67941a9c63a5da8a11dd94a33a1c626be58c84f78f8bfeacfbae511fdc0587
-  data.tar.gz: 50100c7d0a0b5ff95bdae5f09e51f255f375c02d878ada697496a4abc94ea3ef70c615a34039ada19e82f66826711dc755a5a1a50cafbd75bed2b565d1222f4e
+  metadata.gz: 9dc8379104510deef1670b51c960a6a806263cfb47298447c550dd2b9d5b140f3e5f5f981e7038a0b18d3eee3e455e8ae52d3dfca63f5e3d5f9c403b3c270188
+  data.tar.gz: d09814b8cbf11cad971a7188ae7db79772f5426bcdbaac9ccde586b5486695d251723a20430beb9f6e705cfce7622ef0c78150ee97f2648320f316ed4c5723a3

data/helpers/lib/parser.py

@@ -13,6 +13,8 @@ from pip._internal.req.constructors import (
 )
 
 from packaging.requirements import InvalidRequirement, Requirement
+# TODO: Replace 3p package `toml` with 3.11's new stdlib `tomllib` once we drop
+# support for Python 3.10.
 import toml
 
 # Inspired by pips internal check:

data/helpers/requirements.txt

@@ -1,10 +1,12 @@
 pip==23.3.2
-pip-tools==7.3.0
+pip-tools==7.4.1
 flake8==7.0.0
 hashin==0.17.0
 pipenv==2023.11.17
 pipfile==0.0.2
 poetry==1.7.1
+# TODO: Replace 3p package `toml` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
+toml==0.10.2
 
 # Some dependencies will only install if Cython is present
 Cython==3.0.8

data/helpers/run.py

@@ -6,6 +6,8 @@ from lib import parser, hasher
 if __name__ == "__main__":
     args = json.loads(sys.stdin.read())
 
+    # TODO Python 3.10 added native switch statements, so switch this if/elif
+    # to that once we drop support for 3.9.
     if args["function"] == "parse_requirements":
         print(parser.parse_requirements(args["args"][0]))
     elif args["function"] == "parse_setup":

data/lib/dependabot/python/language_version_manager.rb

@@ -9,8 +9,8 @@ module Dependabot
     class LanguageVersionManager
       # This list must match the versions specified at the top of `python/Dockerfile`
       PRE_INSTALLED_PYTHON_VERSIONS = %w(
-        3.12.1
-        3.11.7
+        3.12.2
+        3.11.8
         3.10.13
         3.9.18
         3.8.18

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -4,6 +4,7 @@
 require "cgi"
 require "excon"
 require "nokogiri"
+require "sorbet-runtime"
 
 require "dependabot/dependency"
 require "dependabot/python/update_checker"
@@ -16,6 +17,8 @@ module Dependabot
   module Python
     class UpdateChecker
       class LatestVersionFinder
+        extend T::Sig
+
         require_relative "index_finder"
 
         def initialize(dependency:, dependency_files:, credentials:,
@@ -81,12 +84,21 @@ module Dependabot
           versions.min
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_yanked_versions(versions_array)
-          versions_array.reject { |details| details.fetch(:yanked) }
+          filtered = versions_array.reject { |details| details.fetch(:yanked) }
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} yanked versions")
+          end
+          filtered
         end
 
+        sig do
+          params(versions_array: T::Array[T.untyped], python_version: T.nilable(T.any(String, Version)))
+            .returns(T::Array[T.untyped])
+        end
         def filter_unsupported_versions(versions_array, python_version)
-          versions_array.filter_map do |details|
+          filtered = versions_array.filter_map do |details|
             python_requirement = details.fetch(:python_requirement)
             next details.fetch(:version) unless python_version
             next details.fetch(:version) unless python_requirement
@@ -94,14 +106,27 @@ module Dependabot
 
             details.fetch(:version)
           end
+          if versions_array.count > filtered.count
+            delta = versions_array.count - filtered.count
+            Dependabot.logger.info("Filtered out #{delta} unsupported Python #{python_version} versions")
+          end
+          filtered
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
-          versions_array.reject(&:prerelease?)
+          filtered = versions_array.reject(&:prerelease?)
+
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
+          end
+
+          filtered
         end
 
+        sig { params(versions_array: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_ignored_versions(versions_array)
           filtered = versions_array
                      .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
@@ -109,6 +134,9 @@ module Dependabot
             raise Dependabot::AllVersionsIgnored
           end
 
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
+          end
           filtered
         end
 

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -2,9 +2,10 @@
 # frozen_string_literal: true
 
 require "dependabot/python/requirement_parser"
+require "dependabot/python/requirement"
 require "dependabot/python/update_checker"
 require "dependabot/python/version"
-require "dependabot/python/requirement"
+require "dependabot/requirements_update_strategy"
 
 module Dependabot
   module Python
@@ -31,7 +32,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == :lockfile_only
+          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
 
           requirements.map do |req|
             case req[:file]
@@ -89,9 +90,9 @@ module Dependabot
           return update_pyproject_version(req) if req.fetch(:groups).include?("dev-dependencies")
 
           case update_strategy
-          when :widen_ranges then widen_pyproject_requirement(req)
-          when :bump_versions then update_pyproject_version(req)
-          when :bump_versions_if_necessary then update_pyproject_version_if_needed(req)
+          when RequirementsUpdateStrategy::WidenRanges then widen_pyproject_requirement(req)
+          when RequirementsUpdateStrategy::BumpVersions then update_pyproject_version(req)
+          when RequirementsUpdateStrategy::BumpVersionsIfNecessary then update_pyproject_version_if_needed(req)
           else raise "Unexpected update strategy: #{update_strategy}"
           end
         rescue UnfixableRequirement
@@ -190,11 +191,11 @@ module Dependabot
           return req unless req.fetch(:requirement)
 
           case update_strategy
-          when :widen_ranges
+          when RequirementsUpdateStrategy::WidenRanges
             widen_requirement(req)
-          when :bump_versions
+          when RequirementsUpdateStrategy::BumpVersions
             update_requirement(req)
-          when :bump_versions_if_necessary
+          when RequirementsUpdateStrategy::BumpVersionsIfNecessary
             update_requirement_if_needed(req)
           else
             raise "Unexpected update strategy: #{update_strategy}"

data/lib/dependabot/python/update_checker.rb

@@ -5,13 +5,14 @@ require "excon"
 require "toml-rb"
 
 require "dependabot/dependency"
-require "dependabot/update_checkers"
-require "dependabot/update_checkers/base"
-require "dependabot/registry_client"
 require "dependabot/errors"
-require "dependabot/python/requirement"
-require "dependabot/python/requirement_parser"
 require "dependabot/python/name_normaliser"
+require "dependabot/python/requirement_parser"
+require "dependabot/python/requirement"
+require "dependabot/registry_client"
+require "dependabot/requirements_update_strategy"
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
 
 module Dependabot
   module Python
@@ -80,15 +81,15 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        requirements_update_strategy != :lockfile_only
+        requirements_update_strategy != RequirementsUpdateStrategy::LockfileOnly
       end
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+        return @requirements_update_strategy if @requirements_update_strategy
 
         # Otherwise, check if this is a library or not
-        library? ? :widen_ranges : :bump_versions
+        library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersions
       end
 
       private

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.246.0
+  version: 0.248.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-01 00:00:00.000000000 Z
+date: 2024-03-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.246.0
+        version: 0.248.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.246.0
+        version: 0.248.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -136,6 +136,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -274,7 +288,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.246.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.248.0
 post_install_message: 
 rdoc_options: []
 require_paths: