dependabot-python 0.361.1 → 0.361.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b86bdd4408b9b75319d320acf226b29c7c6022f8e39f778c427d40b671c7ef1a
-  data.tar.gz: 31b0d1fd45811c34732452edebb06fa83d75e4d43ed5d6ee6e3f01f26b4fb7a9
+  metadata.gz: eda91deb53bd92a9f843c3c06cfbc4cc31eefdca820b40dbc7a54925096255a6
+  data.tar.gz: 279aa5702150e0fabae033d6050023a91c0aae715cef14dae31aa4686410645e
 SHA512:
-  metadata.gz: 1524200ec55a108ac7cc792e09be1103203e539b79b6976c03d7a9c151c6d84f50d6ad9d00e546cec93904733ec42de192e154d7ea6fb2a731e2aa479d1685ac
-  data.tar.gz: a66f639cf7f4b7cd06e014fa0d4514dafbc0263c2b612e7d1dd922d02afca44c7bdf92f521891dbfea3d35a1b434f3239cadced09b579d1d4f323511f42e304f
+  metadata.gz: 5e10a113617879b8b484a08f1b6627824d2d6fafa3bfafec30c896a2ec8b4b166f6a7abed5c8edd0495b37b1ac418ab7963091a254256dc5f95934d3e38bfe3a
+  data.tar.gz: bf71087e14538101af044f780b3de22c37f679bce0e0bf13e292b5c690c2ed9b08275b76186ca1582c3fab3226e4f8fcc720a21d7599b92952557563caeb2dad

data/lib/dependabot/python/requirement_parser.rb

@@ -1,9 +1,15 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/python/name_normaliser"
+require "dependabot/python/requirement"
+
 module Dependabot
   module Python
     class RequirementParser
+      extend T::Sig
+
       NAME = /[a-zA-Z0-9](?:[a-zA-Z0-9\-_\.]*[a-zA-Z0-9])?/
       EXTRA = /[a-zA-Z0-9\-_\.]+/
       COMPARISON = /===|==|>=|<=|<|>|~=|!=/
@@ -55,6 +61,56 @@ module Dependabot
         /\s*\\?\s*(?<name>#{NAME})
           (\s*\\?\s*\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
         /x
+
+      # Parses a single pip requirement string (e.g. "types-requests==2.31.0.10")
+      # into a structured hash. Returns nil if the string is not a valid requirement
+      # or has no version constraint.
+      sig { params(dependency_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      def self.parse(dependency_string)
+        match = dependency_string.strip.match(VALID_REQ_TXT_REQUIREMENT)
+        return nil unless match
+
+        name = T.must(match[:name])
+        requirements_string = match[:requirements]
+        return nil if requirements_string.nil? || requirements_string.strip.empty?
+
+        version = extract_pinned_version(requirements_string)
+        return nil unless version
+
+        {
+          name: name,
+          normalised_name: NameNormaliser.normalise(name),
+          version: version,
+          requirement: requirements_string,
+          extras: match[:extras],
+          markers: match[:markers]
+        }
+      end
+
+      # Extracts the pinned or lower-bound version from a requirement string.
+      # For "==2.31.0" returns "2.31.0", for ">=1.0,<2.0" returns "1.0".
+      sig { params(requirements_string: String).returns(T.nilable(String)) }
+      def self.extract_pinned_version(requirements_string)
+        requirement = Dependabot::Python::Requirement.new(requirements_string)
+        constraints = T.let(requirement.requirements, T::Array[T::Array[T.untyped]])
+
+        exact_pin = constraints.find do |pair|
+          op = T.cast(pair[0], String)
+          op == "==" || op == "="
+        end
+        return T.cast(exact_pin[1], Gem::Version).to_s if exact_pin
+
+        lower_bound_operators = %w(>= > ~>).freeze
+        lower_bound = constraints.find { |pair| lower_bound_operators.include?(T.cast(pair[0], String)) }
+        return T.cast(lower_bound[1], Gem::Version).to_s if lower_bound
+
+        nil
+      rescue Gem::Requirement::BadRequirementError
+        fallback = requirements_string.match(/(?:==|>=|~=)\s*(?<version>[^\s,<>!=]+)/)
+        fallback ? fallback[:version] : nil
+      end
+
+      private_class_method :extract_pinned_version
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.361.1
+  version: 0.361.2
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.1
+        version: 0.361.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.1
+        version: 0.361.2
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.2
 rdoc_options: []
 require_paths:
 - lib