dependabot-python 0.382.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e521f3e297026d2b21597f830c9978e6365a5dd4b99ad7a24a9d0973772db45d
-  data.tar.gz: 446649a64857c3cc95aeed4c7e4c9d37bf55e6b5573e82445c6b0b0e4fc10f33
+  metadata.gz: 26031826db5cb07c05ca33adc90a735f803008ac10fe45670311c0d77a0ba738
+  data.tar.gz: c4aa146094305a3941c3fd63360a9375cfdfbe7bd819cee61241148c5bc91f16
 SHA512:
-  metadata.gz: 2b67ffd686818a7d3e3399a2493a188815959102bc4235086ed16fc47b1bdf93a392e743cc2fb411619f90b9c1b01d0ce27de7e65b53e1ed6e52dfaf67b58107
-  data.tar.gz: 269b0733ac11ef8d19cefa5c972e6e67330c51792981fc98a80e389f6338477a099e62ab184873d28ce26dddf8d8b5213c1c2baed56b5d18b6ee9b8097f86338
+  metadata.gz: dba3705c8b0458e64b853f97ad170d8a525fae4b89c176d0236eeab2e27b7c186c6eceb92b245181f5ef6f2cee683d2d17baac298adb4061cdbbc2ca88349b96
+  data.tar.gz: 06e507ffbda36680035517f07d11aae8298f6e7b2708e8837589de0cf7d74da73e2e63618088bacee8663c9a4f625724c339a4a1dbbc641ac9d254e71ef78137

data/helpers/build

@@ -15,7 +15,6 @@ cp -r \
   "$helpers_dir/lib" \
   "$helpers_dir/run.py" \
   "$helpers_dir/requirements.txt" \
-  "$helpers_dir/requirements-3.9.txt" \
   "$install_dir"
 
 if [ -d "$helpers_dir/test" ]; then
@@ -25,15 +24,8 @@ fi
 cd "$install_dir"
 
 python_version=$1
-# pip 26.x and several other packages require Python >=3.10.
-# Use 3.9-compatible versions for the deprecated Python 3.9 runtime.
-if [[ "$python_version" == 3.9.* ]]; then
-  req_file="requirements-3.9.txt"
-else
-  req_file="requirements.txt"
-fi
 
-PYENV_VERSION=$python_version pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r "$req_file"
+PYENV_VERSION=$python_version pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r requirements.txt
 
 # Remove the extra objects added during the previous install. Based on
 # https://github.com/docker-library/python/blob/master/Dockerfile-linux.template

data/lib/dependabot/python/language.rb

@@ -21,7 +21,6 @@ module Dependabot
         3.12.13
         3.11.15
         3.10.20
-        3.9.25
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(
@@ -47,8 +46,9 @@ module Dependabot
         T::Array[Dependabot::Python::Version]
       )
 
-      # The highest Python version that is no longer fully supported.
-      # Deprecated now (warning); unsupported once removed from PRE_INSTALLED_PYTHON_VERSIONS_RAW.
+      # The highest Python version that is no longer supported.
+      # Python 3.9 reached end-of-life and was removed from PRE_INSTALLED_PYTHON_VERSIONS_RAW,
+      # so a ToolVersionNotSupported error is raised for it (and any lower version).
       NON_SUPPORTED_HIGHEST_VERSION = "3.9"
 
       DEPRECATED_VERSIONS = T.let([Version.new(NON_SUPPORTED_HIGHEST_VERSION)].freeze, T::Array[Dependabot::Version])

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency_requirement"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/requirement"
 require "dependabot/python/update_checker"
@@ -21,7 +22,7 @@ module Dependabot
 
         class UnfixableRequirement < StandardError; end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(Dependabot::RequirementsUpdateStrategy) }
@@ -35,7 +36,7 @@ module Dependabot
 
         sig do
           params(
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             has_lockfile: T::Boolean,
             latest_resolvable_version: T.nilable(String)
@@ -47,7 +48,10 @@ module Dependabot
           has_lockfile:,
           latest_resolvable_version:
         )
-          @requirements = T.let(requirements, T::Array[T::Hash[Symbol, T.untyped]])
+          @requirements = T.let(
+            requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
           @has_lockfile = T.let(has_lockfile, T::Boolean)
           @latest_resolvable_version = T.let(nil, T.nilable(Dependabot::Python::Version))
@@ -57,7 +61,7 @@ module Dependabot
           @latest_resolvable_version = Python::Version.new(latest_resolvable_version)
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -75,7 +79,7 @@ module Dependabot
         private
 
         # rubocop:disable Metrics/PerceivedComplexity
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -96,20 +100,20 @@ module Dependabot
               update_requirements_range(req_strings)
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pipfile_requirement(req)
           # For now, we just proxy to updated_requirement. In future this
           # method may treat Pipfile requirements differently.
           updated_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -117,16 +121,16 @@ module Dependabot
 
           pyproject_update_for_strategy(req)
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def skip_pyproject_update?(req)
           new_version_satisfies?(req) && !has_lockfile &&
             update_strategy != RequirementsUpdateStrategy::BumpVersions
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def pyproject_update_for_strategy(req)
           # If the requirement uses || syntax then we always want to widen it
           return widen_pyproject_requirement(req) if req.fetch(:requirement).match?(PYPROJECT_OR_SEPARATOR)
@@ -142,14 +146,14 @@ module Dependabot
           end
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_pyproject_version_core(req, bump_lower_bound: false)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version(req)
           return req if req[:requirement] == "*"
 
@@ -158,9 +162,9 @@ module Dependabot
 
         sig do
           params(
-            req: T::Hash[Symbol, T.untyped],
+            req: Dependabot::DependencyRequirement,
             bump_lower_bound: T::Boolean
-          ).returns(T::Hash[Symbol, T.untyped])
+          ).returns(Dependabot::DependencyRequirement)
         end
         def update_pyproject_version_core(req, bump_lower_bound:)
           requirement_strings = req[:requirement].split(",").map(&:strip)
@@ -177,10 +181,10 @@ module Dependabot
               update_requirements_range(requirement_strings)
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -191,7 +195,7 @@ module Dependabot
               widen_requirement_range(req[:requirement])
             end
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
         sig { params(req_string: String).returns(String) }
@@ -241,7 +245,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -258,22 +262,22 @@ module Dependabot
           end
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_requirement_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_requirement(req)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_requirement(req)
           new_requirement = updated_requirement_string(req)
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T.any(String, Symbol)) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T.any(String, Symbol)) }
         def updated_requirement_string(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -297,16 +301,16 @@ module Dependabot
             requirement_strings.any? { |r| r.strip.start_with?(">") }
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
           new_requirement = widen_requirement_range(req[:requirement])
 
-          req.merge(requirement: new_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
             .requirements_array(req.fetch(:requirement))

data/lib/dependabot/python/update_checker.rb

@@ -6,6 +6,7 @@ require "toml-rb"
 require "sorbet-runtime"
 
 require "dependabot/dependency"
+require "dependabot/dependency_requirement"
 require "dependabot/errors"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/requirement_parser"
@@ -95,16 +96,14 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        return wrap_requirements(updated_git_requirements) if git_dependency?
-
-        wrap_requirements(
-          RequirementsUpdater.new(
-            requirements: requirements,
-            latest_resolvable_version: preferred_resolvable_version&.to_s,
-            update_strategy: requirements_update_strategy,
-            has_lockfile: !(pipfile_lock || poetry_lock).nil?
-          ).updated_requirements
-        )
+        return updated_git_requirements if git_dependency?
+
+        RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          latest_resolvable_version: preferred_resolvable_version&.to_s,
+          update_strategy: requirements_update_strategy,
+          has_lockfile: !(pipfile_lock || poetry_lock).nil?
+        ).updated_requirements
       end
 
       sig { override.returns(T::Boolean) }
@@ -139,13 +138,13 @@ module Dependabot
         latest_version_for_git_dependency
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_git_requirements
         updated_source = updated_git_source
-        return requirements unless updated_source
+        return dependency.requirements unless updated_source
 
-        requirements.map do |req|
-          req.merge(source: updated_source)
+        dependency.requirements.map do |req|
+          Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -245,7 +245,6 @@ files:
 - helpers/lib/__init__.py
 - helpers/lib/hasher.py
 - helpers/lib/parser.py
-- helpers/requirements-3.9.txt
 - helpers/requirements.txt
 - helpers/run.py
 - helpers/test/fixtures/no_dependencies.toml
@@ -323,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib

data/helpers/requirements-3.9.txt

@@ -1,15 +0,0 @@
-# Python 3.9-compatible versions pinned to the last known working set before
-# packages dropped 3.9 support. Python 3.9 reached end-of-life on 2025-10-31.
-pip==24.2
-pip-tools==7.5.3
-flake8==7.3.0
-hashin==1.0.5
-pipenv==2024.4.1
-plette==2.1.0
-poetry==2.2.1
-pytest==8.3.5
-# tomli is required for Python <3.11 (stdlib tomllib was added in 3.11).
-tomli==2.2.1
-
-# Some dependencies will only install if Cython is present
-Cython==3.2.4