dependabot-python 0.368.0 → 0.370.0

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -11,11 +11,13 @@ require "dependabot/requirements_update_strategy"
 module Dependabot
   module Python
     class UpdateChecker
+      # rubocop:disable Metrics/ClassLength
       class RequirementsUpdater
         extend T::Sig
 
         PYPROJECT_OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
         PYPROJECT_SEPARATOR = T.let(/#{PYPROJECT_OR_SEPARATOR}|,/, Regexp)
+        LOWER_BOUND_OPS = T.let(%w(> >=).freeze, T::Array[String])
 
         class UnfixableRequirement < StandardError; end
 
@@ -111,13 +113,25 @@ module Dependabot
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
-          return req if new_version_satisfies?(req) && !has_lockfile
+          return req if skip_pyproject_update?(req)
 
+          pyproject_update_for_strategy(req)
+        rescue UnfixableRequirement
+          req.merge(requirement: :unfixable)
+        end
+
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        def skip_pyproject_update?(req)
+          new_version_satisfies?(req) && !has_lockfile &&
+            update_strategy != RequirementsUpdateStrategy::BumpVersions
+        end
+
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        def pyproject_update_for_strategy(req)
           # If the requirement uses || syntax then we always want to widen it
           return widen_pyproject_requirement(req) if req.fetch(:requirement).match?(PYPROJECT_OR_SEPARATOR)
 
-          # If the requirement is a development dependency we always want to
-          # bump it
+          # If the requirement is a development dependency we always want to bump it
           return update_pyproject_version(req) if req.fetch(:groups).include?("dev-dependencies")
 
           case update_strategy
@@ -126,37 +140,40 @@ module Dependabot
           when RequirementsUpdateStrategy::BumpVersionsIfNecessary then update_pyproject_version_if_needed(req)
           else raise "Unexpected update strategy: #{update_strategy}"
           end
-        rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
         end
 
         sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version_if_needed(req)
           return req if new_version_satisfies?(req)
 
-          update_pyproject_version(req)
+          update_pyproject_version_core(req, bump_lower_bound: false)
         end
 
         sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version(req)
+          return req if req[:requirement] == "*"
+
+          update_pyproject_version_core(req, bump_lower_bound: true)
+        end
+
+        sig do
+          params(
+            req: T::Hash[Symbol, T.untyped],
+            bump_lower_bound: T::Boolean
+          ).returns(T::Hash[Symbol, T.untyped])
+        end
+        def update_pyproject_version_core(req, bump_lower_bound:)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
           new_requirement =
             if requirement_strings.any? { |r| r.match?(/^=|^\d/) }
-              # If there is an equality operator, just update that. It must
-              # be binding and any other requirements will be being ignored
               find_and_update_equality_match(requirement_strings)
             elsif requirement_strings.any? { |r| r.start_with?("~", "^") }
-              # If a compatibility operator is being used, just bump its
-              # version (and remove any other requirements)
               v_req = requirement_strings.find { |r| r.start_with?("~", "^") }
               bump_version(v_req, latest_resolvable_version.to_s)
-            elsif new_version_satisfies?(req)
-              # Otherwise we're looking at a range operator. No change
-              # required if it's already satisfied
-              req.fetch(:requirement)
+            elsif bump_lower_bound
+              bump_requirements_range(requirement_strings)
             else
-              # But if it's not, update it
               update_requirements_range(requirement_strings)
             end
 
@@ -344,6 +361,59 @@ module Dependabot
             .sort_by { |r| requirement_class.new(r).requirements.first.last }.join(",").delete(" ")
         end
 
+        # Bumps the lower bound of a range requirement to the latest version
+        # Used by BumpVersions strategy to increase the minimum version
+        sig { params(requirement_strings: T::Array[String]).returns(String) }
+        def bump_requirements_range(requirement_strings)
+          ruby_requirements = requirement_strings.map { |r| requirement_class.new(r) }
+
+          validate_lower_bounds_not_too_high(ruby_requirements)
+
+          updated_requirement_strings = ruby_requirements.map { |r| bump_single_requirement(r) }
+
+          updated_requirement_strings
+            .sort_by { |r| requirement_class.new(r).requirements.first.last }.join(",").delete(" ")
+        end
+
+        sig { params(ruby_requirements: T::Array[Dependabot::Python::Requirement]).void }
+        def validate_lower_bounds_not_too_high(ruby_requirements)
+          ruby_requirements.each do |r|
+            op, version = r.requirements.first
+            raise UnfixableRequirement if LOWER_BOUND_OPS.include?(op) && version > T.must(latest_resolvable_version)
+          end
+        end
+
+        sig { params(req: Dependabot::Python::Requirement).returns(String) }
+        def bump_single_requirement(req)
+          op, version = req.requirements.first
+
+          case op
+          when ">=" then ">=" + T.must(latest_resolvable_version).to_s
+          # Strict lower bound becomes inclusive because the resolved version
+          # is the exact target — using ">" would exclude it.
+          when ">" then ">=" + T.must(latest_resolvable_version).to_s
+          when "<" then bump_upper_bound_less_than(req, version)
+          when "<=" then bump_upper_bound_less_or_equal(req)
+          when "~>", "~=" then bump_version(req.to_s, T.must(latest_resolvable_version).to_s)
+          when "!=" then req.to_s
+          else req.to_s
+          end
+        end
+
+        sig { params(req: Dependabot::Python::Requirement, version: Gem::Version).returns(String) }
+        def bump_upper_bound_less_than(req, version)
+          return req.to_s if req.satisfied_by?(T.must(latest_resolvable_version))
+
+          "<" + update_greatest_version(version, T.must(latest_resolvable_version))
+        end
+
+        sig { params(req: Dependabot::Python::Requirement).returns(String) }
+        def bump_upper_bound_less_or_equal(req)
+          return req.to_s if req.satisfied_by?(T.must(latest_resolvable_version))
+
+          "<=" + T.must(latest_resolvable_version).to_s
+        end
+
         # Updates the version in a constraint to be the given version
         sig { params(req_string: String, version_to_be_permitted: String).returns(String) }
         def bump_version(req_string, version_to_be_permitted)
@@ -448,6 +518,7 @@ module Dependabot
           Python::Requirement
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/python/update_checker.rb

@@ -409,14 +409,18 @@ module Dependabot
       def check_pypi_for_library_match
         return false unless updating_pyproject? && library_details && !T.must(library_details)["name"].nil?
 
+        # If the project has a description in its pyproject.toml metadata, treat it as a
+        # library when PyPI is unavailable or the package isn't published there yet.
+        has_library_metadata = !T.must(library_details)["description"].nil?
+
         response = Dependabot::RegistryClient.get(
           url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
         )
-        return false unless response.status == 200
+        return has_library_metadata unless response.status == 200
 
         (JSON.parse(response.body)["info"] || {})["summary"] == T.must(library_details)["description"]
       rescue Excon::Error::Timeout, Excon::Error::Socket, URI::InvalidURIError
-        false
+        has_library_metadata
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.368.0
+  version: 0.370.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.370.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.370.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -247,6 +247,32 @@ files:
 - helpers/lib/parser.py
 - helpers/requirements.txt
 - helpers/run.py
+- helpers/test/fixtures/no_dependencies.toml
+- helpers/test/fixtures/pep621_arbitrary_equality.toml
+- helpers/test/fixtures/pep621_dependencies.toml
+- helpers/test/fixtures/pep621_empty_deps.toml
+- helpers/test/fixtures/pep621_extras.toml
+- helpers/test/fixtures/pep621_markers.toml
+- helpers/test/fixtures/pep621_multiple_extras.toml
+- helpers/test/fixtures/pep621_no_version.toml
+- helpers/test/fixtures/pep621_only_build_system.toml
+- helpers/test/fixtures/pep621_spaced_specifiers.toml
+- helpers/test/fixtures/pep735_cycle.toml
+- helpers/test/fixtures/pep735_dependency_groups.toml
+- helpers/test/fixtures/requirements/constraints.txt
+- helpers/test/fixtures/requirements/markers.txt
+- helpers/test/fixtures/requirements/requirements-dev.txt
+- helpers/test/fixtures/requirements/requirements.txt
+- helpers/test/fixtures/requirements/with_constraints.txt
+- helpers/test/fixtures/requirements_empty/.gitkeep
+- helpers/test/fixtures/setup_cfg/setup.cfg
+- helpers/test/fixtures/setup_py/setup.py
+- helpers/test/fixtures/setup_py_comments/setup.py
+- helpers/test/test_hasher.py
+- helpers/test/test_parse_requirements.py
+- helpers/test/test_parse_setup.py
+- helpers/test/test_parser.py
+- helpers/test/test_run.py
 - lib/dependabot/python.rb
 - lib/dependabot/python/authed_url_builder.rb
 - lib/dependabot/python/dependency_grapher.rb
@@ -263,6 +289,7 @@ files:
 - lib/dependabot/python/file_updater/pipfile_manifest_updater.rb
 - lib/dependabot/python/file_updater/pipfile_preparer.rb
 - lib/dependabot/python/file_updater/poetry_file_updater.rb
+- lib/dependabot/python/file_updater/poetry_file_updater/pep621_updater.rb
 - lib/dependabot/python/file_updater/pyproject_preparer.rb
 - lib/dependabot/python/file_updater/requirement_file_updater.rb
 - lib/dependabot/python/file_updater/requirement_replacer.rb
@@ -277,6 +304,7 @@ files:
 - lib/dependabot/python/package_manager.rb
 - lib/dependabot/python/pip_compile_file_matcher.rb
 - lib/dependabot/python/pipenv_runner.rb
+- lib/dependabot/python/poetry_plugin_installer.rb
 - lib/dependabot/python/requirement.rb
 - lib/dependabot/python/requirement_parser.rb
 - lib/dependabot/python/shared_file_fetcher.rb
@@ -294,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.370.0
 rdoc_options: []
 require_paths:
 - lib