dependabot-python 0.296.3 → 0.297.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30df3a9523aa998ae6a3456b8e42c86dee464293e7ecc2d860c3b8edee2a169f
-  data.tar.gz: 3ecf100ac4b853ec962475193ab09435976626e702da4776d6492b8207671234
+  metadata.gz: e54b9c94aaae7bb3492dfccb0543557bf933690b2188145507767ad1b744a883
+  data.tar.gz: 2e4b7f1f43c891382340aa61a742da9ff21dc6c0a5fe77f983f07bd40fd74e76
 SHA512:
-  metadata.gz: 9e53ce08944626d4f823a73fc2eb3cfcec6b137cfec6b2900f5d59ba6bdaa130bfd3563b6ebefee8e9931619695375fdc96cf40ad5dc3d67afe86bd29c81c19b
-  data.tar.gz: 893a7ab9d2456360e5ad8bdba9bed697d0a3e9d3fb61df285f2264068f105e20ea84630cec365f8cd82cf98e0cd639efc2cbebd08380629bd59768ba1ab1ee1f
+  metadata.gz: '03977c4b28c748e339de86459a4b5caaa3e5582b4398bcaccc5b929470cb9d32cd6a6cfc1be7ed7d997ecb34c0413da6beb57fe017185dc21d64b906f72a52e8'
+  data.tar.gz: 6e6e3f1b2dc114b9599294bb756a467a19293d8b280a63bd290c1435da0f4e59aa1bfb3a1d2fde2f4302747fda3aede88790a7db2e9135f72d6fb67b3c0a213b

data/helpers/requirements.txt

@@ -1,8 +1,6 @@
 pip==24.0
 pip-tools==7.4.1
 flake8==7.1.0
-# TODO: Drop the conditions and use the latest version once we drop support for Python 3.8.
-hashin==1.0.2; python_version < '3.9'
 hashin==1.0.3; python_version >= '3.9'
 pipenv==2024.0.2
 plette==2.1.0

data/lib/dependabot/python/file_parser/python_requirement_parser.rb

@@ -60,6 +60,12 @@ module Dependabot
           return unless pyproject
 
           pyproject_object = TomlRB.parse(pyproject.content)
+
+          # Check for PEP621 requires-python
+          pep621_python = pyproject_object.dig("project", "requires-python")
+          return pep621_python if pep621_python
+
+          # Fallback to Poetry configuration
           poetry_object = pyproject_object.dig("tool", "poetry")
 
           poetry_object&.dig("dependencies", "python") ||

data/lib/dependabot/python/file_updater/pipfile_preparer.rb

@@ -49,6 +49,8 @@ module Dependabot
           pipfile_object = TomlRB.parse(pipfile_content)
           parsed_object = TomlRB.parse(parsed_file)
 
+          raise DependencyFileNotResolvable, "Unable to resolve pipfile." unless parsed_object["source"]
+
           # we parse the verify_ssl value from manifest if it exists
           verify_ssl = parsed_object["source"].map { |x| x["verify_ssl"] }.first
 

data/lib/dependabot/python/language.rb

@@ -52,7 +52,6 @@ module Dependabot
       def deprecated?
         return false unless detected_version
         return false if unsupported?
-        return false unless Dependabot::Experiments.enabled?(:python_3_8_deprecation_warning)
 
         deprecated_versions.include?(detected_version)
       end
@@ -60,7 +59,6 @@ module Dependabot
       sig { override.returns(T::Boolean) }
       def unsupported?
         return false unless detected_version
-        return false unless Dependabot::Experiments.enabled?(:python_3_8_unsupported_error)
 
         supported_versions.all? { |supported| supported > detected_version }
       end

data/lib/dependabot/python/language_version_manager.rb

@@ -11,12 +11,11 @@ module Dependabot
       extend T::Sig
       # This list must match the versions specified at the top of `python/Dockerfile`
       PRE_INSTALLED_PYTHON_VERSIONS = %w(
-        3.13.1
-        3.12.7
-        3.11.9
-        3.10.15
-        3.9.18
-        3.8.20
+        3.13.2
+        3.12.9
+        3.11.11
+        3.10.16
+        3.9.21
       ).freeze
 
       sig { params(python_requirement_parser: T.untyped).void }

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -382,6 +382,12 @@ module Dependabot
         time_out_inactivity: /Timed out due to inactivity/
       }.freeze, T::Hash[T.nilable(String), Regexp])
 
+      PACKAGE_RESOLVER_ERRORS = T.let({
+        package_info_error: /Unable to determine package info/,
+        self_dep_error: /Package '(?<path>.*)' is listed as a dependency of itself./,
+        incompatible_constraints: /Incompatible constraints in requirements/
+      }.freeze, T::Hash[T.nilable(String), Regexp])
+
       sig do
         params(
           dependencies: Dependabot::Dependency,
@@ -414,6 +420,7 @@ module Dependabot
 
       # rubocop:disable Metrics/AbcSize
       # rubocop:disable Metrics/PerceivedComplexity
+      # rubocop:disable Metrics/CyclomaticComplexity
       sig { params(error: Exception).void }
       def handle_poetry_error(error)
         Dependabot.logger.warn(error.message)
@@ -456,9 +463,17 @@ module Dependabot
           index_url = URI.extract(error.message.to_s).last .then { sanitize_url(_1) }
           raise PrivateSourceAuthenticationFailure, index_url
         end
+
+        PACKAGE_RESOLVER_ERRORS.each do |(_error_codes, error_regex)|
+          next unless error.message.match?(error_regex)
+
+          message = "Package solving failed while resolving manifest file"
+          raise DependencyFileNotResolvable, message
+        end
       end
       # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
+      # rubocop:enable Metrics/CyclomaticComplexity
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.296.3
+  version: 0.297.1
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-12 00:00:00.000000000 Z
+date: 2025-02-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.296.3
+        version: 0.297.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.296.3
+        version: 0.297.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.296.3
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.297.1
 post_install_message:
 rdoc_options: []
 require_paths: