dependabot-python 0.383.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26031826db5cb07c05ca33adc90a735f803008ac10fe45670311c0d77a0ba738
-  data.tar.gz: c4aa146094305a3941c3fd63360a9375cfdfbe7bd819cee61241148c5bc91f16
+  metadata.gz: edc98d373ce3e27a5db1080f1ddc5f2a7a60c8be26a734ac889abf8e2298ede0
+  data.tar.gz: fd9d7507adb7b29b972c2f318a785eea5efd4150e12e2a6a3fe5707463d38f8a
 SHA512:
-  metadata.gz: dba3705c8b0458e64b853f97ad170d8a525fae4b89c176d0236eeab2e27b7c186c6eceb92b245181f5ef6f2cee683d2d17baac298adb4061cdbbc2ca88349b96
-  data.tar.gz: 06e507ffbda36680035517f07d11aae8298f6e7b2708e8837589de0cf7d74da73e2e63618088bacee8663c9a4f625724c339a4a1dbbc641ac9d254e71ef78137
+  metadata.gz: 9d328bd3c10cb36152a63a2c3975303e111a540367ec6e464ef7ab8208bd2ee642c12561f72928116069160a39cf1b9aa0527b4efb7411966714ff6e41032cdf
+  data.tar.gz: 2a00eef7b5ac804ee7389022190c84a933e9ae2afa89e37852ffb68729a591ceba986587f823ac1a0df460d6d42e72587979328104af12b2d53a05f99c16b150

data/lib/dependabot/python/authed_url_builder.rb

@@ -1,6 +1,7 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "cgi/escape"
 require "sorbet-runtime"
 
 module Dependabot

data/lib/dependabot/python/file_parser/python_requirement_parser.rb

@@ -73,15 +73,20 @@ module Dependabot
 
           pyproject_object = TomlRB.parse(T.must(pyproject).content)
 
-          # Check for PEP621 requires-python
-          pep621_python = pyproject_object.dig("project", "requires-python")
-          return pep621_python if pep621_python
-
-          # Fallback to Poetry configuration
+          # Check for PEP621 requires-python, falling back to Poetry configuration.
           poetry_object = pyproject_object.dig("tool", "poetry")
-
-          poetry_object&.dig("dependencies", "python") ||
+          value =
+            pyproject_object.dig("project", "requires-python") ||
+            poetry_object&.dig("dependencies", "python") ||
             poetry_object&.dig("dev-dependencies", "python")
+
+          # A manifest can declare the python constraint as a non-string (e.g. an
+          # unquoted TOML float `3.12`, or an array/inline-table for multiple
+          # constraints). Coerce scalars to a String and ignore unsupported shapes.
+          case value
+          when String then value
+          when Numeric then value.to_s
+          end
         end
 
         sig { returns(T.nilable(String)) }

data/lib/dependabot/python/file_updater.rb

@@ -94,7 +94,7 @@ module Dependabot
           dependencies: dependencies,
           dependency_files: dependency_files,
           credentials: credentials,
-          cooldown: options[:update_cooldown]
+          cooldown: T.cast(options[:update_cooldown], T.nilable(Dependabot::Package::ReleaseCooldownOptions))
         ).updated_dependency_files
       end
 

data/lib/dependabot/python/package/package_details_fetcher.rb

@@ -3,7 +3,7 @@
 
 require "json"
 require "time"
-require "cgi"
+require "cgi/escape"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
@@ -416,6 +416,7 @@ module Dependabot
         sig { params(filename: String).returns(T.nilable(String)) }
         def get_version_from_filename(filename)
           filename
+            .strip
             .gsub(/#{name_regex}-/i, "")
             .split(/-|\.tar\.|\.zip|\.whl/)
             .first

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -1,15 +1,12 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "cgi"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
 
 require "dependabot/dependency"
-require "dependabot/git_commit_checker"
 require "dependabot/python/update_checker"
-require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/update_checkers/version_filters"
 require "dependabot/registry_client"
 require "dependabot/python/authed_url_builder"
@@ -24,38 +21,6 @@ module Dependabot
       class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
-        sig do
-          params(git_commit_checker: Dependabot::GitCommitChecker)
-            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
-        end
-        def latest_version_tag(git_commit_checker:)
-          return git_commit_checker.local_tag_for_latest_version unless cooldown_enabled?
-
-          allowed_version_tags = git_commit_checker.local_tags_for_allowed_versions
-          tags_in_cooldown = select_version_tags_in_cooldown_period(git_commit_checker)
-
-          return max_version_from_tags(allowed_version_tags) if tags_in_cooldown.empty?
-
-          filtered_tags = allowed_version_tags.reject do |tag|
-            tags_in_cooldown.include?(tag[:tag])
-          end
-
-          if filtered_tags.empty?
-            Dependabot.logger.info("All git tags filtered by cooldown for #{dependency.name}, returning nil")
-            return nil
-          end
-
-          filtered_count = allowed_version_tags.count - filtered_tags.count
-          if filtered_count.positive?
-            Dependabot.logger.info("Filtered #{filtered_count} git tags due to cooldown for #{dependency.name}")
-          end
-
-          max_version_from_tags(filtered_tags)
-        rescue StandardError => e
-          Dependabot.logger.error("Error fetching latest version tag: #{e.message}")
-          git_commit_checker.local_tag_for_latest_version
-        end
-
         sig do
           override.returns(T.nilable(Dependabot::Package::PackageDetails))
         end
@@ -77,87 +42,6 @@ module Dependabot
             cooldown.semver_minor_days.to_i.positive? ||
             cooldown.semver_patch_days.to_i.positive?
         end
-
-        private
-
-        sig { params(tags: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-        def max_version_from_tags(tags)
-          tags.max_by { |t| t[:version] }
-        end
-
-        sig { params(git_commit_checker: Dependabot::GitCommitChecker).returns(T::Array[String]) }
-        def select_version_tags_in_cooldown_period(git_commit_checker)
-          version_tags_in_cooldown_period = T.let([], T::Array[String])
-
-          git_commit_checker.refs_for_tag_with_detail.each do |git_tag_with_detail|
-            if check_if_version_in_cooldown_period?(git_tag_with_detail)
-              version_tags_in_cooldown_period << git_tag_with_detail.tag
-            end
-          end
-          version_tags_in_cooldown_period
-        rescue StandardError => e
-          Dependabot.logger.error("Error checking if version is in cooldown: #{e.message}")
-          []
-        end
-
-        sig { params(tag_with_detail: Dependabot::GitTagWithDetail).returns(T::Boolean) }
-        def check_if_version_in_cooldown_period?(tag_with_detail)
-          return false unless tag_with_detail.release_date
-
-          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
-          tag_version_str = tag_with_detail.tag.delete_prefix("v")
-          return false unless version_class.correct?(tag_version_str)
-
-          new_version = version_class.new(tag_version_str)
-          days = cooldown_days_for(current_version, new_version)
-
-          release_time = Time.at(release_date_to_seconds(tag_with_detail.release_date))
-          Dependabot::UpdateCheckers::CooldownCalculation
-            .within_cooldown_window?(release_time, days)
-        end
-
-        sig do
-          params(
-            current_version: T.nilable(Dependabot::Version),
-            new_version: Dependabot::Version
-          ).returns(Integer)
-        end
-        def cooldown_days_for(current_version, new_version)
-          return 0 unless cooldown_enabled?
-
-          cooldown = T.must(cooldown_options)
-          return 0 unless cooldown.included?(dependency.name)
-          return cooldown.default_days if current_version.nil?
-
-          current_version_semver = current_version.semver_parts
-          new_version_semver = new_version.semver_parts
-
-          return cooldown.default_days if current_version_semver.nil? || new_version_semver.nil?
-
-          current_major, current_minor, current_patch = current_version_semver
-          new_major, new_minor, new_patch = new_version_semver
-
-          return cooldown.semver_major_days if new_major > current_major
-          return cooldown.semver_minor_days if new_minor > current_minor
-          return cooldown.semver_patch_days if new_patch > current_patch
-
-          cooldown.default_days
-        end
-
-        sig { returns(T.class_of(Dependabot::Version)) }
-        def version_class
-          dependency.version_class
-        end
-
-        sig { params(release_date: T.nilable(String)).returns(Integer) }
-        def release_date_to_seconds(release_date)
-          return 0 unless release_date
-
-          Time.parse(release_date).to_i
-        rescue ArgumentError => e
-          Dependabot.logger.error("Invalid release date format: #{release_date} and error: #{e.message}")
-          0
-        end
       end
     end
   end

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -85,8 +85,10 @@ module Dependabot
             version_string.nil? ? nil : Python::Version.new(version_string)
         end
 
-        sig { params(version: Gem::Version).returns(T::Boolean) }
+        sig { params(version: T.nilable(Gem::Version)).returns(T::Boolean) }
         def resolvable?(version:)
+          return false if version.nil?
+
           @resolvable ||= T.let({}, T.nilable(T::Hash[Gem::Version, T::Boolean]))
           return T.must(@resolvable[version]) if @resolvable.key?(version)
 

data/lib/dependabot/python/update_checker.rb

@@ -164,7 +164,7 @@ module Dependabot
       sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_git_version_details
         @latest_git_version_details ||= T.let(
-          latest_version_finder.latest_version_tag(git_commit_checker: git_commit_checker),
+          git_commit_checker.local_tag_for_latest_version(@update_cooldown),
           T.nilable(T::Hash[Symbol, T.untyped])
         )
       end

data/lib/dependabot/python/version.rb

@@ -78,7 +78,7 @@ module Dependabot
       def initialize(version) # rubocop:disable Metrics/AbcSize
         raise Dependabot::BadRequirementError, "Malformed version string - string is nil" if version.nil?
 
-        @version_string = T.let(version.to_s, String)
+        @version_string = T.let(version.to_s.strip, String)
 
         raise Dependabot::BadRequirementError, "Malformed version string - string is empty" if @version_string.empty?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib
@@ -337,7 +337,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Python
 test_files: []