dependabot-python 0.370.0 → 0.371.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67c1d482dda68f38a7bbc7ea74f0d4cc206debd5c3f0704905911b05f04e4b2f
-  data.tar.gz: bb39f9c0055c2ab9a86d8a2138676c69fbac55e52c45a7a261b7af5b94c28042
+  metadata.gz: e5c59beb6b677e51deac37d95023e448ad921265030b47910e4477249a07d1b4
+  data.tar.gz: 4c91924b433ac4f54c2f4f1bfd649e1124864b789cc459e4ab0aca281c02b603
 SHA512:
-  metadata.gz: 9d0def98050153cafb8f4ce61c39495fd8b24f82f4ca8a4d62f158b86bfa9a695016520b92c4b54025d1df9a5c98be6eb5bba723e54846e3c449feee86d7fa28
-  data.tar.gz: 715ae0908b35409adb0a67afb7aa5c6ca1cbb6036ae596719a8ef5afbe3b326571850a4b026820541e56c1ad70afd9a960cf7a796cf4a1b1986f2e4bb26531b6
+  metadata.gz: ec8aa99e69214eec367ee3dff6e9e4b6f2031f75cca5e7b674eaa41369c8f40e5af4b8ba86dce39420e7affc0316301bacfc0cf2c832902d3d3da22558971d19
+  data.tar.gz: 586dea07cef16ec324974e7983dfbe42314e4782bfb388194bb524dc78ccb8a3448de97b52867e20be55b5304f674ce3eec26ec6f5e6be30632e4b3e1ffdff34

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -69,7 +69,10 @@ module Dependabot
 
           groups = T.must(poetry_root)["group"] || {}
           groups.each do |group, group_spec|
-            dependencies += parse_poetry_dependency_group(group, group_spec["dependencies"])
+            deps = group_spec["dependencies"]
+            next unless deps
+
+            dependencies += parse_poetry_dependency_group(group, deps)
           end
           dependencies
         end

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -33,6 +33,9 @@ module Dependabot
           prefix = T.must(prefix_match[:prefix])
           rest = T.must(entry[prefix.length..])
 
+          # Skip direct references (e.g. "pkg @ git+https://...") — already pinned to a URL
+          return entry if rest.match?(/\A\s*@\s/)
+
           # Extract the environment marker ("; ..." suffix) if present
           marker_match = rest.match(/(\s*;.*)/)
           marker = marker_match ? marker_match[1] : ""

data/lib/dependabot/python/package_manager.rb

@@ -57,9 +57,19 @@ module Dependabot
 
       LOCKFILE_NAME = "poetry.lock"
 
-      SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+      POETRY_V1 = "1"
+      POETRY_V2 = "2"
 
-      DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+      # Keep versions in ascending order
+      SUPPORTED_VERSIONS = T.let(
+        [
+          Version.new(POETRY_V1),
+          Version.new(POETRY_V2)
+        ].freeze,
+        T::Array[Dependabot::Version]
+      )
+
+      DEPRECATED_VERSIONS = T.let([Version.new(POETRY_V1)].freeze, T::Array[Dependabot::Version])
 
       sig do
         params(
@@ -68,25 +78,17 @@ module Dependabot
         ).void
       end
       def initialize(raw_version, requirement = nil)
+        version = Version.new(raw_version)
         super(
           name: NAME,
-          version: Version.new(raw_version),
+          detected_version: Version.new(T.must(version.segments.first).to_s),
+          version: version,
           deprecated_versions: DEPRECATED_VERSIONS,
           supported_versions: SUPPORTED_VERSIONS,
           requirement: requirement,
        )
       end
 
-      sig { override.returns(T::Boolean) }
-      def deprecated?
-        false
-      end
-
-      sig { override.returns(T::Boolean) }
-      def unsupported?
-        false
-      end
-
       # Poetry supports requires-poetry constraints in pyproject.toml;
       # other Python package managers don't have an equivalent mechanism.
       sig { override.void }

data/lib/dependabot/python/shared_file_fetcher.rb

@@ -26,6 +26,19 @@ module Dependabot
       DEPENDENCY_TYPES = T.let(%w(packages dev-packages).freeze, T::Array[String])
       MAX_FILE_SIZE = T.let(500_000, Integer)
 
+      # Regex patterns for detecting Python requirements.txt manifest variants.
+      # Ported from github/dependency-snapshots-api.
+      #
+      # Matches "requirements" preceded by a hyphen, period, underscore, start-of-string, or slash,
+      # followed by non-whitespace chars and ".txt".
+      # Examples: requirements.txt, requirements.prod.txt, requirements/production.txt
+      REQUIREMENTS_TXT_REGEX = T.let(%r{(?:[-._]|^|/)requirements[^\s]*\.txt$}i, Regexp)
+
+      # More lenient: matches "require" with optional prefix (no dots/whitespace)
+      # and optional hyphen/underscore/slash suffix. Does not match "require" as a substring.
+      # Examples: require.txt, require-test.txt, py3-require.txt, pyenv_require_e2e.txt
+      REQUIRE_TXT_REGEX = T.let(%r{[^\s|.]*require(?:[-_/][^\s|.]*)?\.txt$}i, Regexp)
+
       sig { abstract.returns(T::Array[String]) }
       def self.ecosystem_specific_required_files; end
 
@@ -169,7 +182,7 @@ module Dependabot
 
             repo_contents
               .select { |f| f.type == "file" }
-              .select { |f| f.name.end_with?(".txt", ".in") }
+              .select { |f| potential_requirements_file?(f.name) }
               .reject { |f| f.size > MAX_FILE_SIZE }
               .map { |f| fetch_file_from_host(f.name) }
               .select { |f| requirements_file?(f) }
@@ -193,7 +206,7 @@ module Dependabot
 
         repo_contents(dir: relative_reqs_dir)
           .select { |f| f.type == "file" }
-          .select { |f| f.name.end_with?(".txt", ".in") }
+          .select { |f| potential_requirements_file?(File.join(relative_reqs_dir, f.name)) }
           .reject { |f| f.size > MAX_FILE_SIZE }
           .map { |f| fetch_file_from_host("#{relative_reqs_dir}/#{f.name}") }
           .select { |f| requirements_file?(f) }
@@ -379,6 +392,24 @@ module Dependabot
         uneditable_reqs + editable_reqs
       end
 
+      # Checks if a filename matches known Python requirements.txt naming patterns.
+      sig { params(path: String).returns(T::Boolean) }
+      def requirements_txt_filename?(path)
+        path.match?(REQUIREMENTS_TXT_REGEX) || path.match?(REQUIRE_TXT_REGEX)
+      end
+
+      # When the feature flag is enabled, only considers .txt files whose names match
+      # requirements patterns (plus all .in files). When disabled, falls back to the
+      # original behavior of accepting any .txt or .in file.
+      sig { params(path: String).returns(T::Boolean) }
+      def potential_requirements_file?(path)
+        unless Dependabot::Experiments.enabled?(:python_requirements_file_name_filtering)
+          return path.end_with?(".txt", ".in")
+        end
+
+        path.end_with?(".in") || requirements_txt_filename?(path)
+      end
+
       sig { params(path: String).returns(String) }
       def clean_path(path)
         Pathname.new(path).cleanpath.to_path

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -267,24 +267,36 @@ module Dependabot
 
         sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_requirement(req)
-          requirement_strings = req[:requirement].split(",").map(&:strip)
-
-          new_requirement =
-            if requirement_strings.any? { |r| r.match?(/^[=\d]/) }
-              find_and_update_equality_match(requirement_strings)
-            elsif requirement_strings.any? { |r| r.start_with?("~=") }
-              tw_req = requirement_strings.find { |r| r.start_with?("~=") }
-              bump_version(tw_req, latest_resolvable_version.to_s)
-            elsif new_version_satisfies?(req)
-              req.fetch(:requirement)
-            else
-              update_requirements_range(requirement_strings)
-            end
+          new_requirement = updated_requirement_string(req)
           req.merge(requirement: new_requirement)
         rescue UnfixableRequirement
           req.merge(requirement: :unfixable)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T.any(String, Symbol)) }
+        def updated_requirement_string(req)
+          requirement_strings = req[:requirement].split(",").map(&:strip)
+
+          if requirement_strings.any? { |r| r.match?(/^[=\d]/) }
+            find_and_update_equality_match(requirement_strings)
+          elsif requirement_strings.any? { |r| r.start_with?("~=") }
+            tw_req = requirement_strings.find { |r| r.start_with?("~=") }
+            bump_version(tw_req, latest_resolvable_version.to_s)
+          elsif bump_lower_bound?(requirement_strings)
+            bump_requirements_range(requirement_strings)
+          elsif new_version_satisfies?(req)
+            req.fetch(:requirement)
+          else
+            update_requirements_range(requirement_strings)
+          end
+        end
+
+        sig { params(requirement_strings: T::Array[String]).returns(T::Boolean) }
+        def bump_lower_bound?(requirement_strings)
+          update_strategy == RequirementsUpdateStrategy::BumpVersions &&
+            requirement_strings.any? { |r| r.strip.start_with?(">") }
+        end
+
         sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_requirement(req)
           return req if new_version_satisfies?(req)

data/lib/dependabot/python/update_checker.rb

@@ -407,18 +407,22 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def check_pypi_for_library_match
-        return false unless updating_pyproject? && library_details && !T.must(library_details)["name"].nil?
+        return false unless updating_pyproject?
 
-        # If the project has a description in its pyproject.toml metadata, treat it as a
-        # library when PyPI is unavailable or the package isn't published there yet.
-        has_library_metadata = !T.must(library_details)["description"].nil?
+        library_details_temp = library_details
+        return false unless library_details_temp && !library_details_temp["name"].nil?
+
+        has_library_metadata = !library_details_temp["description"].nil?
 
         response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
+          url: "https://pypi.org/pypi/#{normalised_name(library_details_temp['name'])}/json/"
         )
         return has_library_metadata unless response.status == 200
 
-        (JSON.parse(response.body)["info"] || {})["summary"] == T.must(library_details)["description"]
+        local_description = library_details_temp["description"]
+        return true if local_description.nil?
+
+        (JSON.parse(response.body)["info"] || {})["summary"] == local_description
       rescue Excon::Error::Timeout, Excon::Error::Socket, URI::InvalidURIError
         has_library_metadata
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.370.0
+  version: 0.371.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.370.0
+        version: 0.371.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.370.0
+        version: 0.371.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.370.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.371.0
 rdoc_options: []
 require_paths:
 - lib