dependabot-python 0.351.0 → 0.352.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c903aa6ffa26e4465d5c010013b5cabc39c4ad4efa16466e46a236292d7c108c
-  data.tar.gz: 1b47dff8b567019cb893a8a9f8a87cab6e41b76d9d1e23f0700abfffcb92c6a5
+  metadata.gz: 6003fe06636162867de00796bf0df3145c7de4077eb635c65c52c1ec9a4df50e
+  data.tar.gz: e328a2f8dd8f8c9ae17ce4be35822ab9f3f9e554ee5f82688a0604a342ca39aa
 SHA512:
-  metadata.gz: c9a706daa0d464562df708c7b14f022c0c4c03c26edfeee0ed7951dc829adec06800190c6da2dd53193d520c4bc61e546499c2b8ccb89f14ecdca0847c68e20e
-  data.tar.gz: 0117bbb64ac2c63b93743aadeb5754812b888a4c781dd0adf3d45b05abded169bc9c7f6e26822aea4e28a6518196d0a0e88e558404c983d500fccf1d313b49f3
+  metadata.gz: af573776c4f167c72e6159ece26aef0bebf5d334b23763edd4ba93625764a5998fa4edeb753826915a120a561104305afd65777be3457da6557857162a2b086d
+  data.tar.gz: 4ebb87425b96545882e9efa783959dab8a4f93ab431471ce8d5a836b86a9a18f41fee37a58fed6e1b0c706a4c35b54c7d6d226338fc0dd5e189b3da2ed846d9a

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -108,7 +108,12 @@ module Dependabot
             language_version_manager.install_required_python
 
             filenames_to_compile.each do |filename|
-              compile_file(filename)
+              # Compile the file for each of its output files
+              # A single .in file may generate multiple .txt files with different --output-file options
+              output_files = compiled_files_for_filename(filename)
+              # When no output files are found, compile with nil to use default pip-compile behavior
+              output_files = [nil] if output_files.empty?
+              output_files.each { |output_file| compile_file(filename, output_file) }
             end
 
             # Remove any .python-version file before parsing the reqs
@@ -128,11 +133,11 @@ module Dependabot
           end
         end
 
-        sig { params(filename: String).void }
-        def compile_file(filename)
+        sig { params(filename: String, output_file: T.nilable(Dependabot::DependencyFile)).void }
+        def compile_file(filename, output_file)
           # Shell out to pip-compile, generate a new set of requirements.
           # This is slow, as pip-compile needs to do installs.
-          options = pip_compile_options(filename)
+          options = pip_compile_options(filename, output_file)
           options_fingerprint = pip_compile_options_fingerprint(options)
 
           name_part = "pyenv exec pip-compile " \
@@ -516,14 +521,14 @@ module Dependabot
           )
         end
 
-        sig { params(filename: String).returns(String) }
-        def pip_compile_options(filename)
+        sig { params(filename: String, output_file: T.nilable(Dependabot::DependencyFile)).returns(String) }
+        def pip_compile_options(filename, output_file = nil)
           options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
 
-          if (requirements_file = compiled_file_for_filename(filename))
-            options += pip_compile_options_from_compiled_file(requirements_file)
-          end
+          # Use the explicit output file if provided, otherwise fall back to finding one
+          requirements_file = output_file || compiled_file_for_filename(filename)
+          options += pip_compile_options_from_compiled_file(requirements_file) if requirements_file
 
           options.join(" ")
         end
@@ -584,8 +589,9 @@ module Dependabot
 
           files_from_compiled_files =
             pip_compile_files.map(&:name).select do |fn|
-              compiled_file = compiled_file_for_filename(fn)
-              compiled_file_includes_dependency?(compiled_file)
+              compiled_files_for_filename(fn).any? do |compiled_file|
+                compiled_file_includes_dependency?(compiled_file)
+              end
             end
 
           filenames = [*files_from_reqs, *files_from_compiled_files].uniq
@@ -593,17 +599,27 @@ module Dependabot
           order_filenames_for_compilation(filenames)
         end
 
+        # Returns the first compiled file for a given source filename
+        # Used for backward compatibility in places where only one file is needed
         sig { params(filename: String).returns(T.nilable(Dependabot::DependencyFile)) }
         def compiled_file_for_filename(filename)
-          compiled_file =
-            compiled_files
-            .find { |f| T.must(f.content).match?(output_file_regex(filename)) }
+          compiled_files_for_filename(filename).first
+        end
+
+        # Returns all compiled files (.txt) that were generated from the given source file (.in)
+        # A single .in file may generate multiple .txt files with different --output-file options
+        sig { params(filename: String).returns(T::Array[Dependabot::DependencyFile]) }
+        def compiled_files_for_filename(filename)
+          # First, find all files that have an --output-file header referencing this input file
+          files_with_output_header = compiled_files.select do |f|
+            T.must(f.content).match?(output_file_regex(filename))
+          end
 
-          compiled_file ||=
-            compiled_files
-            .find { |f| f.name == filename.gsub(/\.in$/, ".txt") }
+          return files_with_output_header if files_with_output_header.any?
 
-          compiled_file
+          # Fall back to convention-based matching (input.in -> input.txt)
+          default_output = compiled_files.find { |f| f.name == filename.gsub(/\.in$/, ".txt") }
+          default_output ? [default_output] : []
         end
 
         sig { params(filename: T.any(String, Symbol)).returns(String) }

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -157,8 +157,10 @@ module Dependabot
 
               original_locked_python = TomlRB.parse(T.must(lockfile).content)["metadata"]["python-versions"]
 
-              new_lockfile.gsub!(/\[metadata\]\n.*python-versions[^\n]+\n/m) do |match|
-                match.gsub(/(["']).*(['"])\n\Z/, '\1' + original_locked_python + '\1' + "\n")
+              new_lockfile.gsub!(/\[metadata\](?:\r?\n).*python-versions[^\r\n]+(?:\r?\n)/m) do |match|
+                # Detect the line ending style from the match (CRLF or LF)
+                line_ending = match.include?("\r\n") ? "\r\n" : "\n"
+                match.gsub(/(["']).*\1(?:\r?\n)\Z/, '\1' + original_locked_python + '\1' + line_ending)
               end
 
               tmp_hash =
@@ -331,12 +333,12 @@ module Dependabot
           group = old_req[:groups].first
 
           header_regex = "#{group}(?:\\.dependencies)?\\]\s*(?:\s*#.*?)*?"
-          /#{header_regex}\n.*?(?<declaration>(?:^\s*|["'])#{escape(dep)}["']?\s*=[^\n]*)$/mi
+          /#{header_regex}(?:\r?\n).*?(?<declaration>(?:^\s*|["'])#{escape(dep)}["']?\s*=[^\r\n]*)(?=\r?\n|$)/mi
         end
 
         sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
         def table_declaration_regex(dep, old_req)
-          /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\]\n.*?\s*version\s* =.*?\n/m
+          /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\](?:\r?\n).*?\s*version\s* =.*?(?:\r?\n)/m
         end
 
         sig { params(dep: Dependabot::Dependency, old_req: String).returns(Regexp) }

data/lib/dependabot/python/language.rb

@@ -16,8 +16,8 @@ module Dependabot
       # ARG PY_3_13=3.13.2
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.14.0
-        3.13.9
+        3.14.2
+        3.13.11
         3.12.12
         3.11.14
         3.10.19

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -431,8 +431,9 @@ module Dependabot
 
           files_from_compiled_files =
             pip_compile_files.map(&:name).select do |fn|
-              compiled_file = compiled_file_for_filename(fn)
-              compiled_file_includes_dependency?(compiled_file)
+              compiled_files_for_filename(fn).any? do |compiled_file|
+                compiled_file_includes_dependency?(compiled_file)
+              end
             end
 
           filenames = [*files_from_reqs, *files_from_compiled_files].uniq
@@ -440,17 +441,27 @@ module Dependabot
           order_filenames_for_compilation(filenames)
         end
 
+        # Returns the first compiled file for a given source filename
+        # Used for backward compatibility in places where only one file is needed
         sig { params(filename: String).returns(T.nilable(Dependabot::DependencyFile)) }
         def compiled_file_for_filename(filename)
-          compiled_file =
-            compiled_files
-            .find { |f| T.must(f.content).match?(output_file_regex(filename)) }
+          compiled_files_for_filename(filename).first
+        end
+
+        # Returns all compiled files (.txt) that were generated from the given source file (.in)
+        # A single .in file may generate multiple .txt files with different --output-file options
+        sig { params(filename: String).returns(T::Array[Dependabot::DependencyFile]) }
+        def compiled_files_for_filename(filename)
+          # First, find all files that have an --output-file header referencing this input file
+          files_with_output_header = compiled_files.select do |f|
+            T.must(f.content).match?(output_file_regex(filename))
+          end
 
-          compiled_file ||=
-            compiled_files
-            .find { |f| f.name == filename.gsub(/\.in$/, ".txt") }
+          return files_with_output_header if files_with_output_header.any?
 
-          compiled_file
+          # Fall back to convention-based matching (input.in -> input.txt)
+          default_output = compiled_files.find { |f| f.name == filename.gsub(/\.in$/, ".txt") }
+          default_output ? [default_output] : []
         end
 
         sig { params(filename: String).returns(String) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.351.0
+  version: 0.352.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.352.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.351.0
+        version: 0.352.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.351.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.352.0
 rdoc_options: []
 require_paths:
 - lib