dependabot-python 0.381.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0477e6159f9fcd2dfd744b603b9bd23ba2df5ad50c3bf3a8fc51fbcd00e6306
-  data.tar.gz: 1271ebda6e197461e2721a7aa0f69d917dc8c506813465931ba01ae143f3c34a
+  metadata.gz: 26031826db5cb07c05ca33adc90a735f803008ac10fe45670311c0d77a0ba738
+  data.tar.gz: c4aa146094305a3941c3fd63360a9375cfdfbe7bd819cee61241148c5bc91f16
 SHA512:
-  metadata.gz: ca638414b000ecf033fa4470316f3858a1f57e9ca496db678b9779da39a292aaaaf66908b037e6b6f0c02ad528c9142cd42a687149a75887b053dc5001dd5ff8
-  data.tar.gz: 34164a7fcbc0eb80ee3cdfe995cd891560fe9b2feaab98ec3be721699117897855be5a6f76bb76cea581b2cf18b60cc378df2a1128042197582894154abb308f
+  metadata.gz: dba3705c8b0458e64b853f97ad170d8a525fae4b89c176d0236eeab2e27b7c186c6eceb92b245181f5ef6f2cee683d2d17baac298adb4061cdbbc2ca88349b96
+  data.tar.gz: 06e507ffbda36680035517f07d11aae8298f6e7b2708e8837589de0cf7d74da73e2e63618088bacee8663c9a4f625724c339a4a1dbbc641ac9d254e71ef78137

data/helpers/build

@@ -15,7 +15,6 @@ cp -r \
   "$helpers_dir/lib" \
   "$helpers_dir/run.py" \
   "$helpers_dir/requirements.txt" \
-  "$helpers_dir/requirements-3.9.txt" \
   "$install_dir"
 
 if [ -d "$helpers_dir/test" ]; then
@@ -25,15 +24,8 @@ fi
 cd "$install_dir"
 
 python_version=$1
-# pip 26.x and several other packages require Python >=3.10.
-# Use 3.9-compatible versions for the deprecated Python 3.9 runtime.
-if [[ "$python_version" == 3.9.* ]]; then
-  req_file="requirements-3.9.txt"
-else
-  req_file="requirements.txt"
-fi
 
-PYENV_VERSION=$python_version pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r "$req_file"
+PYENV_VERSION=$python_version pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r requirements.txt
 
 # Remove the extra objects added during the previous install. Based on
 # https://github.com/docker-library/python/blob/master/Dockerfile-linux.template

data/lib/dependabot/python/dependency_grapher.rb

@@ -65,6 +65,10 @@ module Dependabot
       sig { override.void }
       def prepare!
         if poetry_project_without_lockfile?
+          # Generating an ephemeral lockfile requires executing `poetry lock`. Strictly speaking, that violates our
+          # policy of refusing to run Python tooling when external code execution is disallowed, so fail fast.
+          raise Dependabot::UnexpectedExternalCode if file_parser.reject_external_code?
+
           Dependabot.logger.info("No poetry.lock found, generating ephemeral lockfile for dependency graphing")
           generate_ephemeral_lockfile!
           emit_missing_lockfile_warning! if @ephemeral_lockfile_generated

data/lib/dependabot/python/file_parser/python_requirement_parser.rb

@@ -209,7 +209,10 @@ module Dependabot
 
         sig { returns(T::Array[DependencyFile]) }
         def pip_compile_files
-          @pip_compile_files ||= T.let(dependency_files.select { |f| f.name.end_with?(".in") }, T.untyped)
+          @pip_compile_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?(".in") },
+            T.nilable(T::Array[DependencyFile])
+          )
         end
       end
     end

data/lib/dependabot/python/language.rb

@@ -21,7 +21,6 @@ module Dependabot
         3.12.13
         3.11.15
         3.10.20
-        3.9.25
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(
@@ -47,8 +46,9 @@ module Dependabot
         T::Array[Dependabot::Python::Version]
       )
 
-      # The highest Python version that is no longer fully supported.
-      # Deprecated now (warning); unsupported once removed from PRE_INSTALLED_PYTHON_VERSIONS_RAW.
+      # The highest Python version that is no longer supported.
+      # Python 3.9 reached end-of-life and was removed from PRE_INSTALLED_PYTHON_VERSIONS_RAW,
+      # so a ToolVersionNotSupported error is raised for it (and any lower version).
       NON_SUPPORTED_HIGHEST_VERSION = "3.9"
 
       DEPRECATED_VERSIONS = T.let([Version.new(NON_SUPPORTED_HIGHEST_VERSION)].freeze, T::Array[Dependabot::Version])

data/lib/dependabot/python/requirement_parser.rb

@@ -65,7 +65,7 @@ module Dependabot
       # Parses a single pip requirement string (e.g. "types-requests==2.31.0.10")
       # into a structured hash. Returns nil if the string is not a valid requirement
       # or has no version constraint.
-      sig { params(dependency_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(dependency_string: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)])) }
       def self.parse(dependency_string)
         match = dependency_string.strip.match(VALID_REQ_TXT_REQUIREMENT)
         return nil unless match
@@ -92,17 +92,17 @@ module Dependabot
       sig { params(requirements_string: String).returns(T.nilable(String)) }
       def self.extract_pinned_version(requirements_string)
         requirement = Dependabot::Python::Requirement.new(requirements_string)
-        constraints = T.let(requirement.requirements, T::Array[T::Array[T.untyped]])
+        constraints = T.let(requirement.requirements, T::Array[[String, Gem::Version]])
 
         exact_pin = constraints.find do |pair|
-          op = T.cast(pair[0], String)
+          op = pair[0]
           op == "==" || op == "="
         end
-        return T.cast(exact_pin[1], Gem::Version).to_s if exact_pin
+        return exact_pin[1].to_s if exact_pin
 
         lower_bound_operators = %w(>= > ~>).freeze
-        lower_bound = constraints.find { |pair| lower_bound_operators.include?(T.cast(pair[0], String)) }
-        return T.cast(lower_bound[1], Gem::Version).to_s if lower_bound
+        lower_bound = constraints.find { |pair| lower_bound_operators.include?(pair[0]) }
+        return lower_bound[1].to_s if lower_bound
 
         nil
       rescue Gem::Requirement::BadRequirementError

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency_requirement"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/requirement"
 require "dependabot/python/update_checker"
@@ -21,7 +22,7 @@ module Dependabot
 
         class UnfixableRequirement < StandardError; end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(Dependabot::RequirementsUpdateStrategy) }
@@ -35,7 +36,7 @@ module Dependabot
 
         sig do
           params(
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             has_lockfile: T::Boolean,
             latest_resolvable_version: T.nilable(String)
@@ -47,7 +48,10 @@ module Dependabot
           has_lockfile:,
           latest_resolvable_version:
         )
-          @requirements = T.let(requirements, T::Array[T::Hash[Symbol, T.untyped]])
+          @requirements = T.let(
+            requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
           @has_lockfile = T.let(has_lockfile, T::Boolean)
           @latest_resolvable_version = T.let(nil, T.nilable(Dependabot::Python::Version))
@@ -57,7 +61,7 @@ module Dependabot
           @latest_resolvable_version = Python::Version.new(latest_resolvable_version)
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -75,7 +79,7 @@ module Dependabot
         private
 
         # rubocop:disable Metrics/PerceivedComplexity
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -96,20 +100,20 @@ module Dependabot
               update_requirements_range(req_strings)
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pipfile_requirement(req)
           # For now, we just proxy to updated_requirement. In future this
           # method may treat Pipfile requirements differently.
           updated_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -117,16 +121,16 @@ module Dependabot
 
           pyproject_update_for_strategy(req)
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def skip_pyproject_update?(req)
           new_version_satisfies?(req) && !has_lockfile &&
             update_strategy != RequirementsUpdateStrategy::BumpVersions
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def pyproject_update_for_strategy(req)
           # If the requirement uses || syntax then we always want to widen it
           return widen_pyproject_requirement(req) if req.fetch(:requirement).match?(PYPROJECT_OR_SEPARATOR)
@@ -142,14 +146,14 @@ module Dependabot
           end
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_pyproject_version_core(req, bump_lower_bound: false)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version(req)
           return req if req[:requirement] == "*"
 
@@ -158,9 +162,9 @@ module Dependabot
 
         sig do
           params(
-            req: T::Hash[Symbol, T.untyped],
+            req: Dependabot::DependencyRequirement,
             bump_lower_bound: T::Boolean
-          ).returns(T::Hash[Symbol, T.untyped])
+          ).returns(Dependabot::DependencyRequirement)
         end
         def update_pyproject_version_core(req, bump_lower_bound:)
           requirement_strings = req[:requirement].split(",").map(&:strip)
@@ -177,10 +181,10 @@ module Dependabot
               update_requirements_range(requirement_strings)
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -191,7 +195,7 @@ module Dependabot
               widen_requirement_range(req[:requirement])
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
         sig { params(req_string: String).returns(String) }
@@ -241,7 +245,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -258,22 +262,22 @@ module Dependabot
           end
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_requirement_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_requirement(req)
           new_requirement = updated_requirement_string(req)
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T.any(String, Symbol)) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T.any(String, Symbol)) }
         def updated_requirement_string(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -297,16 +301,16 @@ module Dependabot
             requirement_strings.any? { |r| r.strip.start_with?(">") }
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
           new_requirement = widen_requirement_range(req[:requirement])
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
             .requirements_array(req.fetch(:requirement))

data/lib/dependabot/python/update_checker.rb

@@ -6,6 +6,7 @@ require "toml-rb"
 require "sorbet-runtime"
 
 require "dependabot/dependency"
+require "dependabot/dependency_requirement"
 require "dependabot/errors"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/requirement_parser"
@@ -93,12 +94,12 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         return updated_git_requirements if git_dependency?
 
         RequirementsUpdater.new(
-          requirements: requirements,
+          requirements: dependency.requirements,
           latest_resolvable_version: preferred_resolvable_version&.to_s,
           update_strategy: requirements_update_strategy,
           has_lockfile: !(pipfile_lock || poetry_lock).nil?
@@ -137,13 +138,13 @@ module Dependabot
         latest_version_for_git_dependency
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_git_requirements
         updated_source = updated_git_source
-        return requirements unless updated_source
+        return dependency.requirements unless updated_source
 
-        requirements.map do |req|
-          req.merge(source: updated_source)
+        dependency.requirements.map do |req|
+          Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -245,7 +245,6 @@ files:
 - helpers/lib/__init__.py
 - helpers/lib/hasher.py
 - helpers/lib/parser.py
-- helpers/requirements-3.9.txt
 - helpers/requirements.txt
 - helpers/run.py
 - helpers/test/fixtures/no_dependencies.toml
@@ -323,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib

data/helpers/requirements-3.9.txt

@@ -1,15 +0,0 @@
-# Python 3.9-compatible versions pinned to the last known working set before
-# packages dropped 3.9 support. Python 3.9 reached end-of-life on 2025-10-31.
-pip==24.2
-pip-tools==7.5.3
-flake8==7.3.0
-hashin==1.0.5
-pipenv==2024.4.1
-plette==2.1.0
-poetry==2.2.1
-pytest==8.3.5
-# tomli is required for Python <3.11 (stdlib tomllib was added in 3.11).
-tomli==2.2.1
-
-# Some dependencies will only install if Cython is present
-Cython==3.2.4