dependabot-python 0.386.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6743a3b5b5ae514de1fc09550af84d3285ae7fed69a8c74b8d95291b7cb2c1a
-  data.tar.gz: 1bde8ed1421e31bf67c7ca1fab04f7f0c2edd3fbd4afcb2eb38df5c0bba007d1
+  metadata.gz: 4dd911b71806301c46844a3a9ae15edf17258c808c1b23365bd8825a0d335a77
+  data.tar.gz: a687d86e8937f4f4f71d917150a672e75e8ff46b6ed338ecc960be70bc9c72c5
 SHA512:
-  metadata.gz: e484276f80b4690e9f41f471f18adb8f4e0adf1481c73c1912ead78274785d908cea245a50265a3f2e567ae643d5d4759fc1694fbc66ec91903f3c65136f95f7
-  data.tar.gz: f0b4c4092d96440d9e98acb64d750b380712cb456da886ecf4c8a6872ef5cb4b2f3d98551fb0e940878de37fe600dcc5981494e6d9eee978351f8ade1e584f99
+  metadata.gz: a2feda4fb8b37dc8379ebdeb1c52591ed364779db787a2b6114b4d7c3ab25d5158dc33d9309150792dea9971f12415fa8d5ee3138bfe04563e99a2ef7074faa4
+  data.tar.gz: 35ac8d62a443709c4bc21cf4ed6ae797d2c6c00447cf8a8d14531be3e1e473edd46131e26157a963512cb064563fb593b22d908a33a0064a05b3a12174ab8300

data/lib/dependabot/python/dependency_grapher/requirements_layers.rb

@@ -44,7 +44,7 @@ module Dependabot
 
         # More lenient: matches "depend" / "depends" at the start of the filename or after a hyphen/period/
         # underscore/slash delimiter, with an optional hyphen/underscore/slash suffix. The leading delimiter
-        # prevents matching "depend" as a substring of another word (e.g. "independ.txt").
+        # prevents matching "depend" as a substring of another word (e.g. "codependent.txt").
         # Examples: depend.txt, depends.txt, depend-test.txt, py3-depends.txt
         DEPEND_TXT_REGEX = T.let(%r{(?:[-._]|^|/)depend(?:s)?(?:[-_/][^\s.]*)?\.txt$}i, Regexp)
 
@@ -128,7 +128,8 @@ module Dependabot
             f != primary && requirements_stem(f.name) == stem
           end
 
-          referenced = referenced_requirement_files(primary)
+          # When the primary is a compiled `.txt`, the `-r`/`-c` directives live in the paired `.in` files.
+          referenced = referenced_requirement_files([primary] + paired)
 
           support = (paired + referenced + constraints_files).uniq.map do |f|
             as_support_file(f)
@@ -150,15 +151,18 @@ module Dependabot
           requirement_family_files.select { |f| File.basename(f.name).include?("constraint") }
         end
 
-        # Finds sibling files referenced by a requirements file via `-r`/`-c`, following the chain transitively.
+        # Collects sibling files referenced via `-r`/`-c`, walking the chain transitively. Returns only newly
+        # discovered files; the seed files are excluded (they are already in the layer).
         #
-        # A referenced file can itself reference further files (e.g. `develop.in -r test.in`, `test.in -r base.in`),
-        # so we walk the whole closure to gather every sibling the layer needs on disk to parse in isolation.
-        sig { params(file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
-        def referenced_requirement_files(file)
+        # - Seeded from every file in the layer (primary + paired `.in`/`.txt`): a compiled `.txt` primary has
+        #   no live `-r`/`-c` directives, so they must be read from the paired `.in`.
+        # - Walks the full closure: a referenced file can reference more (e.g. `develop.in` -> `test.in` ->
+        #   `base.in`), and the layer needs every sibling on disk to parse in isolation.
+        sig { params(seeds: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile]) }
+        def referenced_requirement_files(seeds)
           by_name = requirement_family_files.to_h { |f| [f.name, f] }
-          seen = T.let(Set.new, T::Set[String])
-          queue = [file]
+          seen = T.let(Set.new(seeds.map(&:name)), T::Set[String])
+          queue = T.let(seeds.dup, T::Array[Dependabot::DependencyFile])
           collected = T.let([], T::Array[Dependabot::DependencyFile])
 
           until queue.empty?

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -62,7 +62,7 @@ module Dependabot
           @constraints_files = T.let(nil, T.nilable(T::Array[String]))
           @constraints_file_basenames = T.let(nil, T.nilable(T::Array[String]))
           @requirement_file_directories = T.let(nil, T.nilable(T::Array[String]))
-          @pyproject_content_cache = T.let({}, T::Hash[String, T::Hash[String, T.untyped]])
+          @pyproject_content_cache = T.let({}, T::Hash[String, T::Hash[String, Object]])
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }
@@ -200,7 +200,7 @@ module Dependabot
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[[String, String]]) }
         def pinned_pyproject_dependencies_for(pyproject)
           pyproject_content = pyproject_content_for(pyproject)
-          project_obj = T.cast(pyproject_content["project"], T.nilable(Object))
+          project_obj = pyproject_content["project"]
           return [] unless project_obj.is_a?(Hash)
 
           project_hash = project_obj
@@ -431,7 +431,7 @@ module Dependabot
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[String]) }
         def constraints_for_pyproject(pyproject)
           pyproject_content = pyproject_content_for(pyproject)
-          tool_obj = T.cast(pyproject_content["tool"], T.nilable(Object))
+          tool_obj = pyproject_content["tool"]
           return [] unless tool_obj.is_a?(Hash)
 
           pip_obj = T.cast(tool_obj["pip"], T.nilable(Object))
@@ -507,8 +507,8 @@ module Dependabot
 
         sig { params(response: Excon::Response).returns(T.nilable(T::Array[String])) }
         def requires_dist_from_response(response)
-          body = T.cast(JSON.parse(response.body), T::Hash[String, T.untyped])
-          info_obj = T.cast(body["info"], T.nilable(Object))
+          body = T.cast(JSON.parse(response.body), T::Hash[String, Object])
+          info_obj = body["info"]
           return nil unless info_obj.is_a?(Hash)
 
           requires_dist_obj = T.cast(info_obj["requires_dist"], T.nilable(Object))
@@ -554,16 +554,16 @@ module Dependabot
           marker_evaluator.marker_satisfied?(marker: marker, python_version: python_version)
         end
 
-        sig { params(pyproject: Dependabot::DependencyFile).returns(T::Hash[String, T.untyped]) }
+        sig { params(pyproject: Dependabot::DependencyFile).returns(T::Hash[String, Object]) }
         def pyproject_content_for(pyproject)
           cache_key = pyproject.name
           return T.must(@pyproject_content_cache[cache_key]) if @pyproject_content_cache.key?(cache_key)
 
           content =
             if pyproject.content
-              T.let(TomlRB.parse(pyproject.content), T::Hash[String, T.untyped])
+              T.let(TomlRB.parse(pyproject.content), T::Hash[String, Object])
             else
-              T.let({}, T::Hash[String, T.untyped])
+              T.let({}, T::Hash[String, Object])
             end
 
           @pyproject_content_cache[cache_key] = content

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib