dependabot-python 0.390.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dae20e628b553254a3e6e3309a2dfcb08ae3bf3647cb819268a2e22177e178f5
-  data.tar.gz: 71599724f9356febf9445b8e534b22c3a8fee051ef27e15f15c14bfe31dcaf43
+  metadata.gz: 70504f97ff35fbf437e2895455b6371d858c38921b3f4839a11aaddc31d04911
+  data.tar.gz: 131699694996cabca8daec6c5a96f5a4dba34ec11601a22d7a8f54e6a855852f
 SHA512:
-  metadata.gz: eff4f144ef97647719580c94eaeed7a27a083300ceac4aab05d952b3e795d806a1776ecc696f14180add8a217fed0200f7b0392f0abe3cd8c9305a3c2fd90dab
-  data.tar.gz: 33c451ea7f321010b17337aabcb161ab0b488ae2c40899ead0b0a4cac2092cc34e9b8fa79737d58e3f9bdd0ef1445cd21331a624e572b5c40eca1b14ba987aa8
+  metadata.gz: 56501fd6454a91206147b03fa795570e6a494e5d5c9733c8945656b174893352cd4adaa3bd2b4ee6c87565c3cc59dc861f62500d4c86fdfa3ea82c50afadda3f
+  data.tar.gz: 8e1983671535f8886b5f7b920893a747d80b16535b74159c07da2ae82c1226dd66276fea515f28503217565955827ab03d51d5ac78dee42dce46d6bcd0cbe869

data/lib/dependabot/python/authed_url_builder.rb

@@ -17,7 +17,8 @@ module Dependabot
         return url unless token
 
         basic_auth_details =
-          if token.ascii_only? && token.include?(":") then token
+          if token.ascii_only? && token.include?(":")
+            token
           elsif Base64.decode64(token).ascii_only? &&
                 Base64.decode64(token).include?(":")
             Base64.decode64(token)

data/lib/dependabot/python/dependency_grapher/requirements_layers.rb

@@ -29,24 +29,24 @@ module Dependabot
         # Matches "requirements" preceded by a hyphen, period, underscore, start-of-string, or slash,
         # followed by non-whitespace chars and ".txt".
         # Examples: requirements.txt, requirements.prod.txt, requirements/production.txt
-        REQUIREMENTS_TXT_REGEX = T.let(%r{(?:[-._]|^|/)requirements[^\s]*\.txt$}i, Regexp)
+        REQUIREMENTS_TXT_REGEX = %r{(?:[-._]|^|/)requirements[^\s]*\.txt$}i
 
         # More lenient: matches "require" at the start of the filename or after a hyphen/period/underscore/
         # slash delimiter, with an optional hyphen/underscore/slash suffix. The leading delimiter prevents
         # matching "require" as a substring of another word (e.g. "prequire.txt", "acquire.txt").
         # Examples: require.txt, require-test.txt, py3-require.txt, pyenv_require_e2e.txt
-        REQUIRE_TXT_REGEX = T.let(%r{(?:[-._]|^|/)require(?:[-_/][^\s.]*)?\.txt$}i, Regexp)
+        REQUIRE_TXT_REGEX = %r{(?:[-._]|^|/)require(?:[-_/][^\s.]*)?\.txt$}i
 
         # Matches "dependencies" / "dependency" preceded by a hyphen, period, underscore,
         # start-of-string, or slash, followed by non-whitespace chars and ".txt".
         # Examples: dependencies.txt, my-dependencies.txt, dependencies/python/ansible-lint.txt
-        DEPENDENCIES_TXT_REGEX = T.let(%r{(?:[-._]|^|/)dependenc(?:y|ies)[^\s]*\.txt$}i, Regexp)
+        DEPENDENCIES_TXT_REGEX = %r{(?:[-._]|^|/)dependenc(?:y|ies)[^\s]*\.txt$}i
 
         # More lenient: matches "depend" / "depends" at the start of the filename or after a hyphen/period/
         # underscore/slash delimiter, with an optional hyphen/underscore/slash suffix. The leading delimiter
         # prevents matching "depend" as a substring of another word (e.g. "codependent.txt").
         # Examples: depend.txt, depends.txt, depend-test.txt, py3-depends.txt
-        DEPEND_TXT_REGEX = T.let(%r{(?:[-._]|^|/)depend(?:s)?(?:[-_/][^\s.]*)?\.txt$}i, Regexp)
+        DEPEND_TXT_REGEX = %r{(?:[-._]|^|/)depend(?:s)?(?:[-_/][^\s.]*)?\.txt$}i
 
         # Whether a .txt filename looks like a real pip manifest rather than an unrelated .txt file.
         sig { params(path: String).returns(T::Boolean) }

data/lib/dependabot/python/file_fetcher.rb

@@ -15,7 +15,7 @@ module Dependabot
     class FileFetcher < Dependabot::Python::SharedFileFetcher
       extend T::Sig
 
-      ECOSYSTEM_SPECIFIC_FILES = T.let(%w(Pipfile setup.py setup.cfg).freeze, T::Array[String])
+      ECOSYSTEM_SPECIFIC_FILES = %w(Pipfile setup.py setup.cfg).freeze
 
       sig { override.returns(T::Array[String]) }
       def self.ecosystem_specific_required_files

data/lib/dependabot/python/file_parser/python_requirement_parser.rb

@@ -114,7 +114,7 @@ module Dependabot
           end.reject(&:empty?)
 
           file_version = content_lines.first
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version
@@ -126,7 +126,7 @@ module Dependabot
 
           file_version = T.must(T.must(runtime_file).content)
                           .match(/(?<=python-).*/)&.to_s&.strip
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -25,23 +25,18 @@ module Dependabot
         require_relative "requirement_file_updater"
         require_relative "setup_file_sanitizer"
 
-        UNSAFE_PACKAGES = T.let(%w(setuptools distribute pip).freeze, T::Array[String])
-        INCOMPATIBLE_VERSIONS_REGEX = T.let(
-          Regexp.new(
-            "(?:not supported between instances of 'InstallationCandidate'" \
-            "|There are incompatible versions in the resolved dependencies).*\\z",
-            Regexp::MULTILINE
-          ),
-          Regexp
-        )
-        WARNINGS = T.let(/\s*# WARNING:.*\Z/m, Regexp)
-        UNSAFE_NOTE = T.let(/\s*# The following packages are considered to be unsafe.*\Z/m, Regexp)
-        RESOLVER_REGEX = T.let(/(?<=--resolver=)(\w+)/, Regexp)
-        UNSAFE_PACKAGE_OPTION_REGEX = T.let(/--unsafe-package(?:=|\s+)(?<name>[^\s\\]+)/, Regexp)
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
+        UNSAFE_PACKAGES = %w(setuptools distribute pip).freeze
+        INCOMPATIBLE_VERSIONS_REGEX = Regexp.new(
+          "(?:not supported between instances of 'InstallationCandidate'" \
+          "|There are incompatible versions in the resolved dependencies).*\\z",
+          Regexp::MULTILINE
         )
+        WARNINGS = /\s*# WARNING:.*\Z/m
+        UNSAFE_NOTE = /\s*# The following packages are considered to be unsafe.*\Z/m
+        RESOLVER_REGEX = /(?<=--resolver=)(\w+)/
+        UNSAFE_PACKAGE_OPTION_REGEX = /--unsafe-package(?:=|\s+)(?<name>[^\s\\]+)/
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
 
         sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
@@ -60,10 +55,10 @@ module Dependabot
             index_urls: T.nilable(T::Array[T.nilable(String)])
           ).void
         end
-        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil) # rubocop:disable Metrics/AbcSize
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          @index_urls = index_urls
           @build_isolation = T.let(true, T::Boolean)
           @sanitized_setup_file_content = T.let({}, T::Hash[String, String])
           @requirement_map = T.let(nil, T.nilable(T::Hash[String, T::Array[String]]))
@@ -73,7 +68,7 @@ module Dependabot
           @setup_cfg_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @pip_compile_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @compiled_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @credentials = credentials
         end
 
         sig { returns(T.nilable(T::Array[Dependabot::DependencyFile])) }
@@ -199,9 +194,9 @@ module Dependabot
         def update_uncompiled_files(updated_files)
           updated_filenames = updated_files.map(&:name)
           old_reqs = T.must(T.must(dependency).previous_requirements)
-                      .reject { |r| updated_filenames.include?(r[:file]) }
+                      .reject { |r| updated_filenames.include?(r.file) }
           new_reqs = T.must(dependency).requirements
-                      .reject { |r| updated_filenames.include?(r[:file]) }
+                      .reject { |r| updated_filenames.include?(r.file) }
 
           return [] if new_reqs.none?
 
@@ -329,15 +324,15 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(T.must(dependency).previous_requirements)
-                     .find { |r| r[:file] == file.name }
+                     .find { |r| r.file == file.name }
 
           return file.content unless old_req
-          return file.content if old_req == "==#{T.must(dependency).version}"
+          return file.content if old_req.requirement_string == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
+            old_requirement: old_req.requirement_string,
             new_requirement: "==#{T.must(dependency).version}",
             index_urls: @index_urls
           ).updated_content
@@ -348,17 +343,17 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(T.must(dependency).previous_requirements)
-                     .find { |r| r[:file] == file.name }
+                     .find { |r| r.file == file.name }
           new_req = T.must(dependency).requirements
-                     .find { |r| r[:file] == file.name }
-          return file.content unless old_req&.fetch(:requirement)
+                     .find { |r| r.file == file.name }
+          return file.content unless old_req&.requirement_string
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
-            new_requirement: T.must(new_req)[:requirement],
+            old_requirement: old_req.requirement_string,
+            new_requirement: T.must(T.must(new_req).requirement_string),
             index_urls: @index_urls
           ).updated_content
         end
@@ -679,7 +674,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             T.must(dependency).requirements
-             .map { |r| r[:file] }
+             .filter_map(&:file)
              .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -22,7 +22,7 @@ module Dependabot
         require_relative "pipfile_manifest_updater"
         require_relative "setup_file_sanitizer"
 
-        DEPENDENCY_TYPES = T.let(%w(packages dev-packages).freeze, T::Array[String])
+        DEPENDENCY_TYPES = %w(packages dev-packages).freeze
 
         sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies

data/lib/dependabot/python/file_updater/pipfile_manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/python/file_updater"
@@ -53,15 +53,15 @@ module Dependabot
 
           # Loop through each changed requirement
           reqs.each do |new_req, old_req|
-            raise "Bad req match" unless new_req[:file] == T.must(old_req)[:file]
-            next if new_req[:requirement] == T.must(old_req)[:requirement]
-            next unless new_req[:file] == manifest.name
+            raise "Bad req match" unless new_req.file == T.must(old_req).file
+            next if new_req.requirement == T.must(old_req).requirement
+            next unless new_req.file == manifest.name
 
             updated_content = update_manifest_req(
               content: updated_content,
               dep: dependency,
-              old_req: T.must(old_req).fetch(:requirement),
-              new_req: new_req.fetch(:requirement)
+              old_req: T.must(T.must(old_req).requirement_string),
+              new_req: T.must(new_req.requirement_string)
             )
           end
 
@@ -118,7 +118,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == manifest.name }
+          changed_requirements.any? { |f| f.file == manifest.name }
         end
       end
     end

data/lib/dependabot/python/file_updater/poetry_file_updater/pep621_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -19,8 +19,8 @@ module Dependabot
           sig do
             params(
               content: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace(content, new_r, old_r)
@@ -96,8 +96,8 @@ module Dependabot
             params(
               content: String,
               source_req: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace_with_source_requirement(content, source_req, new_r, old_r)
@@ -105,7 +105,11 @@ module Dependabot
             return unless match
 
             declaration = T.must(match[:declaration])
-            new_req_str = rewrite_pep508_requirement(source_req, old_r[:requirement], new_r[:requirement])
+            new_req_str = rewrite_pep508_requirement(
+              source_req,
+              T.must(old_r.requirement_string),
+              T.must(new_r.requirement_string)
+            )
             content.sub(declaration, declaration.sub(source_req, new_req_str))
           end
 
@@ -116,13 +120,13 @@ module Dependabot
           sig do
             params(
               content: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace_with_normalized_requirement(content, new_r, old_r)
-            old_req = old_r[:requirement]
-            new_req = new_r[:requirement]
+            old_req = T.must(old_r.requirement_string)
+            new_req = T.must(new_r.requirement_string)
 
             match = content.match(normalized_declaration_regex(old_req))
             return unless match

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -45,7 +45,7 @@ module Dependabot
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
-          @cooldown = T.let(cooldown, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+          @cooldown = cooldown
           @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @prepared_pyproject = T.let(nil, T.nilable(String))
           @pyproject = T.let(nil, T.nilable(Dependabot::DependencyFile))
@@ -99,7 +99,7 @@ module Dependabot
           updated_content = content.dup
 
           dependency.requirements.zip(T.must(dependency.previous_requirements)).each do |new_r, old_r|
-            next unless new_r[:file] == pyproject&.name && T.must(old_r)[:file] == pyproject&.name
+            next unless new_r.file == pyproject&.name && T.must(old_r).file == pyproject&.name
 
             updated_content = replace_dep(dependency, T.must(updated_content), new_r, T.must(old_r))
           end
@@ -109,7 +109,7 @@ module Dependabot
           updated_content
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(String) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(String) }
         def replace_dep(dep, content, new_r, old_r)
           return update_git_tag(dep, content, new_r, old_r) if git_dependency?(new_r) && git_dependency?(old_r)
 
@@ -119,10 +119,10 @@ module Dependabot
             content
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_poetry_dep(dep, content, new_r, old_r)
-          new_req = new_r[:requirement]
-          old_req = old_r[:requirement]
+          new_req = T.must(new_r.requirement_string)
+          old_req = T.must(old_r.requirement_string)
 
           declaration_regex = declaration_regex(dep, old_r)
           declaration_match = content.match(declaration_regex)
@@ -135,10 +135,10 @@ module Dependabot
           content.sub(T.must(declaration), new_declaration)
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_poetry_table_dep(dep, content, new_r, old_r)
-          old_req = old_r[:requirement]
-          new_req = new_r[:requirement]
+          old_req = T.must(old_r.requirement_string)
+          new_req = T.must(new_r.requirement_string)
           regex = table_declaration_regex(dep, new_r)
 
           return unless content.match(regex)
@@ -151,20 +151,20 @@ module Dependabot
           end
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_pep621_dep(dep, content, new_r, old_r)
           Pep621Updater.new(dep: dep).replace(content, new_r, old_r)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def git_dependency?(req)
-          req.dig(:source, :type) == "git"
+          req.source_string("type") == "git"
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(String) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(String) }
         def update_git_tag(dep, content, new_r, old_r)
-          old_tag = old_r.dig(:source, :ref)
-          new_tag = new_r.dig(:source, :ref)
+          old_tag = old_r.source_string("ref")
+          new_tag = new_r.source_string("ref")
 
           return content if old_tag == new_tag
 
@@ -172,7 +172,7 @@ module Dependabot
           # Example: fastapi = { git = "...", extras = ["all"], tag = "0.110.0" }
           git_dep_regex = /
             ^(\s*)#{Regexp.escape(dep.name)}(\s*=\s*\{[^}]*tag\s*=\s*)
-            ["']#{Regexp.escape(old_tag)}["']([^}]*\})
+            ["']#{Regexp.escape(T.must(old_tag))}["']([^}]*\})
           /mx
 
           content.gsub(git_dep_regex) do
@@ -233,7 +233,7 @@ module Dependabot
               # Skip Git dependencies - they use tags/refs, not versions
               next if git_dependency_being_updated?(dep)
 
-              if dep.requirements.find { |r| r[:file] == pyproject&.name }
+              if dep.requirements.find { |r| r.file == pyproject&.name }
                 lock_declaration_to_new_version!(poetry_object, dep)
               else
                 create_declaration_at_new_version!(poetry_object, dep)
@@ -302,7 +302,7 @@ module Dependabot
 
         sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
         def git_dependency_being_updated?(dep)
-          dep.requirements.any? { |r| r.dig(:source, :type) == "git" }
+          dep.requirements.any? { |r| r.source_string("type") == "git" }
         end
 
         sig { params(pyproject_content: String).returns(String) }
@@ -382,17 +382,17 @@ module Dependabot
           end
         end
 
-        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
+        sig { params(dep: Dependabot::Dependency, old_req: Dependabot::DependencyRequirement).returns(Regexp) }
         def declaration_regex(dep, old_req)
-          group = old_req[:groups].first
+          group = T.must(old_req.groups).first
 
           header_regex = "#{group}(?:\\.dependencies)?\\]\s*(?:\s*#.*?)*?"
           /#{header_regex}(?:\r?\n).*?(?<declaration>(?:^\s*|["'])#{escape(dep)}["']?\s*=[^\r\n]*)(?=\r?\n|$)/mi
         end
 
-        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
+        sig { params(dep: Dependabot::Dependency, old_req: Dependabot::DependencyRequirement).returns(Regexp) }
         def table_declaration_regex(dep, old_req)
-          /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\](?:\r?\n).*?\s*version\s* =.*?(?:\r?\n)/m
+          /tool\.poetry\.#{T.must(old_req.groups).first}\.#{escape(dep)}\](?:\r?\n).*?\s*version\s* =.*?(?:\r?\n)/m
         end
 
         sig { params(dep: Dependency).returns(String) }
@@ -410,7 +410,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
 
         sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -18,10 +18,7 @@ module Dependabot
 
         # Fixed regex for extracting the name+extras prefix from a PEP 508 entry.
         # Does not interpolate library input, avoiding polynomial backtracking.
-        PEP508_PREFIX = T.let(
-          /\A(?<prefix>(?<name>[a-zA-Z0-9](?:[a-zA-Z0-9._-]*[a-zA-Z0-9])?)(?:\[[^\]]*\])?)/i,
-          Regexp
-        )
+        PEP508_PREFIX = /\A(?<prefix>(?<name>[a-zA-Z0-9](?:[a-zA-Z0-9._-]*[a-zA-Z0-9])?)(?:\[[^\]]*\])?)/i
 
         # Pins a single PEP 508 dependency entry string to a specific version,
         # preserving extras and environment markers.
@@ -142,7 +139,7 @@ module Dependabot
             .gsub('#{', "{")
         end
 
-        UNSUPPORTED_SOURCE_TYPES = T.let(%w(directory file url).freeze, T::Array[String])
+        UNSUPPORTED_SOURCE_TYPES = %w(directory file url).freeze
 
         sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(String) }
         def freeze_top_level_dependencies_except(dependencies)

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -13,6 +13,10 @@ module Dependabot
       class RequirementFileUpdater
         extend T::Sig
 
+        RequirementChange = T.type_alias do
+          [Dependabot::DependencyRequirement, T.nilable(Dependabot::DependencyRequirement)]
+        end
+
         require_relative "requirement_replacer"
 
         sig { returns(T::Array[Dependabot::Dependency]) }
@@ -33,10 +37,10 @@ module Dependabot
           ).void
         end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @index_urls = index_urls
           @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
         end
 
@@ -58,9 +62,9 @@ module Dependabot
           updated_contents = T.let({}, T::Hash[String, String])
 
           unique_requirement_changes.each do |pair|
-            new_req = T.must(pair[0])
+            new_req = pair[0]
             old_req = pair[1]
-            filename = new_req.fetch(:file)
+            filename = T.must(new_req.file)
             content = updated_contents[filename] || T.must(T.must(get_original_file(filename)).content)
             updated_contents[filename] = updated_requirement_or_setup_file_content(content, new_req, old_req)
           end
@@ -77,37 +81,37 @@ module Dependabot
         # Deduplicates requirements that share the same file and requirement strings.
         # The replacer's regex matches all extras variants at once, so one call per
         # unique (file, old_requirement, new_requirement) is sufficient.
-        sig { returns(T::Array[T::Array[T.nilable(T::Hash[Symbol, T.untyped])]]) }
+        sig { returns(T::Array[RequirementChange]) }
         def unique_requirement_changes
           previous_reqs = dependency.previous_requirements || []
 
           changes = dependency.requirements.filter_map do |new_req|
-            old_req = previous_reqs.find { |r| r[:file] == new_req[:file] && r[:groups] == new_req[:groups] }
+            old_req = previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
             next if new_req == old_req
 
-            [new_req, old_req]
+            T.let([new_req, old_req], RequirementChange)
           end
 
           changes.uniq do |pair|
             new_req = pair[0]
             old_req = pair[1]
-            [new_req[:file], old_req&.fetch(:requirement), new_req.fetch(:requirement)]
+            [new_req.file, old_req&.requirement, new_req.requirement]
           end
         end
 
         sig do
           params(
             content: String,
-            new_req: T::Hash[Symbol, T.untyped],
-            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+            new_req: Dependabot::DependencyRequirement,
+            old_req: T.nilable(Dependabot::DependencyRequirement)
           ).returns(String)
         end
         def updated_requirement_or_setup_file_content(content, new_req, old_req)
           RequirementReplacer.new(
             content: content,
             dependency_name: dependency.name,
-            old_requirement: old_req&.fetch(:requirement),
-            new_requirement: new_req.fetch(:requirement),
+            old_requirement: old_req&.requirement_string,
+            new_requirement: T.must(new_req.requirement_string),
             new_hash_version: dependency.version,
             index_urls: @index_urls
           ).updated_content

data/lib/dependabot/python/file_updater/requirement_replacer.rb

@@ -37,12 +37,12 @@ module Dependabot
           new_hash_version: nil,
           index_urls: nil
         )
-          @content = T.let(content, String)
+          @content = content
           @dependency_name = T.let(normalise(dependency_name), String)
-          @old_requirement = T.let(old_requirement, T.nilable(String))
-          @new_requirement = T.let(new_requirement, T.nilable(String))
-          @new_hash_version = T.let(new_hash_version, T.nilable(String))
-          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @old_requirement = old_requirement
+          @new_requirement = new_requirement
+          @new_hash_version = new_hash_version
+          @index_urls = index_urls
         end
 
         sig { returns(String) }

data/lib/dependabot/python/file_updater/setup_file_sanitizer.rb

@@ -20,8 +20,8 @@ module Dependabot
           ).void
         end
         def initialize(setup_file:, setup_cfg:)
-          @setup_file = T.let(setup_file, T.nilable(Dependabot::DependencyFile))
-          @setup_cfg = T.let(setup_cfg, T.nilable(Dependabot::DependencyFile))
+          @setup_file = setup_file
+          @setup_cfg = setup_cfg
           @install_requires_array = T.let(nil, T.nilable(T::Array[String]))
           @setup_requires_array = T.let(nil, T.nilable(T::Array[String]))
           @extras_require_hash = T.let(nil, T.nilable(T::Hash[String, T::Array[String]]))
@@ -61,10 +61,9 @@ module Dependabot
           @install_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
               first = T.must(dep.requirements.first)
-              next unless first[:groups]
-                          .include?("install_requires")
+              next unless first.groups&.include?("install_requires")
 
-              name_with_extras(dep) + first[:requirement].to_s
+              name_with_extras(dep) + first.requirement.to_s
             end
         end
 
@@ -73,10 +72,9 @@ module Dependabot
           @setup_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
               first = T.must(dep.requirements.first)
-              next unless first[:groups]
-                          .include?("setup_requires")
+              next unless first.groups&.include?("setup_requires")
 
-              name_with_extras(dep) + first[:requirement].to_s
+              name_with_extras(dep) + first.requirement.to_s
             end
         end
 
@@ -87,12 +85,13 @@ module Dependabot
               hash = {}
               parsed_setup_file.dependencies.each do |dep|
                 first = T.must(dep.requirements.first)
-                first[:groups].each do |group|
+                T.must(first.groups).each do |group|
                   next unless group.start_with?("extras_require:")
 
-                  hash[group.split(":").last] ||= []
-                  hash[group.split(":").last] <<
-                    (name_with_extras(dep) + first[:requirement].to_s)
+                  group_name = group.to_s
+                  hash[group_name.split(":").last] ||= []
+                  hash[group_name.split(":").last] <<
+                    (name_with_extras(dep) + first.requirement.to_s)
                 end
               end
 

data/lib/dependabot/python/file_updater.rb

@@ -46,7 +46,7 @@ module Dependabot
         changed_reqs = reqs.zip(dependencies.flat_map(&:previous_requirements))
                            .reject { |(new_req, old_req)| new_req == old_req }
                            .map(&:first)
-        changed_req_files = changed_reqs.map { |r| r.fetch(:file) }
+        changed_req_files = changed_reqs.filter_map(&:file)
 
         # If there are no requirements then this is a sub-dependency. It
         # must come from one of Pipenv, Poetry or pip-tools, and can't come

data/lib/dependabot/python/package/package_registry_finder.rb

@@ -25,9 +25,9 @@ module Dependabot
           ).void
         end
         def initialize(dependency_files:, credentials:, dependency:)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials      = T.let(credentials, T::Array[Dependabot::Credential])
-          @dependency       = T.let(dependency, Dependabot::Dependency)
+          @dependency_files = dependency_files
+          @credentials      = credentials
+          @dependency       = dependency
         end
 
         sig { returns(T::Array[String]) }

data/lib/dependabot/python/pipenv_runner.rb

@@ -143,7 +143,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def lockfile_section
         if current_dependency.requirements.any?
-          T.must(current_dependency.requirements.first)[:groups].first
+          T.must(T.must(current_dependency.requirements.first).groups).first&.to_s
         else
           parsed_lockfile = JSON.parse(T.must(T.must(lockfile).content))
           Python::FileParser::DEPENDENCY_GROUP_KEYS.each do |keys|

data/lib/dependabot/python/poetry_plugin_installer.rb

@@ -27,7 +27,7 @@ module Dependabot
 
       sig { params(pyproject_content: T.nilable(String)).void }
       def initialize(pyproject_content:)
-        @pyproject_content = T.let(pyproject_content, T.nilable(String))
+        @pyproject_content = pyproject_content
         @plugins_installed = T.let(false, T::Boolean)
       end
 

data/lib/dependabot/python/requirement.rb

@@ -12,7 +12,7 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9)*])\s*\|+/, Regexp)
+      OR_SEPARATOR = /(?<=[a-zA-Z0-9)*])\s*\|+/
 
       # Add equality and arbitrary-equality matchers
       OPS = T.let(
@@ -28,8 +28,8 @@ module Dependabot
       version_pattern = Python::Version::VERSION_PATTERN
 
       PATTERN_RAW = T.let("\\s*(?<op>#{quoted})?\\s*(?<version>#{version_pattern})\\s*".freeze, String)
-      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
-      PARENS_PATTERN = T.let(/\A\(([^)]+)\)\z/, Regexp)
+      PATTERN = /\A#{PATTERN_RAW}\z/
+      PARENS_PATTERN = /\A\(([^)]+)\)\z/
 
       sig { params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
       def self.parse(obj)
@@ -107,11 +107,14 @@ module Dependabot
         req_string = req_string.gsub("~=", "~>")
         req_string = req_string.gsub(/(?<=\d)[<=>].*\Z/, "")
 
-        if req_string.match?(/~[^>]/) then convert_tilde_req(req_string)
-        elsif req_string.start_with?("^") then convert_caret_req(req_string)
+        if req_string.match?(/~[^>]/)
+          convert_tilde_req(req_string)
+        elsif req_string.start_with?("^")
+          convert_caret_req(req_string)
         elsif req_string.match?(/^=?={0,2}\s*\d+\.\d+(\.\d+)?(-[a-z0-9.-]+)?(\.\*)?$/i)
           convert_exact(req_string)
-        elsif req_string.include?(".*") then convert_wildcard(req_string)
+        elsif req_string.include?(".*")
+          convert_wildcard(req_string)
         else
           req_string
         end

data/lib/dependabot/python/shared_file_fetcher.rb

@@ -21,10 +21,10 @@ module Dependabot
 
       abstract!
 
-      CHILD_REQUIREMENT_REGEX = T.let(/^-r\s?(?<path>.*\.(?:txt|in))/, Regexp)
-      CONSTRAINT_REGEX = T.let(/^-c\s?(?<path>.*\.(?:txt|in))/, Regexp)
-      DEPENDENCY_TYPES = T.let(%w(packages dev-packages).freeze, T::Array[String])
-      MAX_FILE_SIZE = T.let(500_000, Integer)
+      CHILD_REQUIREMENT_REGEX = /^-r\s?(?<path>.*\.(?:txt|in))/
+      CONSTRAINT_REGEX = /^-c\s?(?<path>.*\.(?:txt|in))/
+      DEPENDENCY_TYPES = %w(packages dev-packages).freeze
+      MAX_FILE_SIZE = 500_000
 
       sig { abstract.returns(T::Array[String]) }
       def self.ecosystem_specific_required_files; end
@@ -34,7 +34,7 @@ module Dependabot
         return true if filenames.any? { |name| name.end_with?(".txt", ".in") }
         return true if filenames.include?("requirements")
         return true if filenames.include?("pyproject.toml")
-        return true if filenames.any? { |name| ecosystem_specific_required_files.include?(name) }
+        return true if filenames.intersect?(ecosystem_specific_required_files)
 
         false
       end

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -27,16 +27,14 @@ module Dependabot
       class PipCompileVersionResolver # rubocop:disable Metrics/ClassLength
         extend T::Sig
 
-        GIT_DEPENDENCY_UNREACHABLE_REGEX = T.let(/git clone --filter=blob:none --quiet (?<url>[^\s]+).* /, Regexp)
-        GIT_REFERENCE_NOT_FOUND_REGEX = T.let(/Did not find branch or tag '(?<tag>[^\n"]+)'/m, Regexp)
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
-        )
+        GIT_DEPENDENCY_UNREACHABLE_REGEX = /git clone --filter=blob:none --quiet (?<url>[^\s]+).* /
+        GIT_REFERENCE_NOT_FOUND_REGEX = /Did not find branch or tag '(?<tag>[^\n"]+)'/m
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
         # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#configuring-metadata
-        PYTHON_PACKAGE_NAME_REGEX = T.let(/[A-Za-z0-9_\-]+/, Regexp)
-        RESOLUTION_IMPOSSIBLE_ERROR = T.let("ResolutionImpossible", String)
-        ERROR_REGEX = T.let(/(?<=ERROR\:\W).*$/, Regexp)
+        PYTHON_PACKAGE_NAME_REGEX = /[A-Za-z0-9_\-]+/
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+        ERROR_REGEX = /(?<=ERROR\:\W).*$/
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
@@ -62,10 +60,10 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @repo_contents_path = T.let(repo_contents_path, T.nilable(String))
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @repo_contents_path = repo_contents_path
           @build_isolation = T.let(true, T::Boolean)
           @error_handler = T.let(PipCompileErrorHandler.new, PipCompileErrorHandler)
         end
@@ -402,14 +400,14 @@ module Dependabot
         def update_req_file(file, updated_req)
           return T.must(file.content) unless file.name.end_with?(".in")
 
-          req = dependency.requirements.find { |r| r[:file] == file.name }
+          req = dependency.requirements.find { |r| r.file == file.name }
 
-          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.fetch(:requirement)
+          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.requirement_string
 
           Python::FileUpdater::RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: dependency.name,
-            old_requirement: req[:requirement],
+            old_requirement: req.requirement_string,
             new_requirement: updated_req
           ).updated_content
         end
@@ -428,7 +426,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             dependency.requirements
-                      .map { |r| r[:file] }
+                      .filter_map(&:file)
                       .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =
@@ -585,13 +583,13 @@ module Dependabot
     class PipCompileErrorHandler
       extend T::Sig
 
-      SUBPROCESS_ERROR = T.let(/subprocess-exited-with-error/, Regexp)
+      SUBPROCESS_ERROR = /subprocess-exited-with-error/
 
-      INSTALLATION_ERROR = T.let(/InstallationError/, Regexp)
+      INSTALLATION_ERROR = /InstallationError/
 
-      INSTALLATION_SUBPROCESS_ERROR = T.let(/InstallationSubprocessError/, Regexp)
+      INSTALLATION_SUBPROCESS_ERROR = /InstallationSubprocessError/
 
-      HASH_MISMATCH = T.let(/HashMismatch/, Regexp)
+      HASH_MISMATCH = /HashMismatch/
 
       sig { params(error: String).void }
       def handle_pipcompile_error(error)

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -182,7 +182,9 @@ module Dependabot
         sig { returns(T::Array[[String, String]]) }
         def normalized_requirement_files
           dependency.requirements.filter_map do |req|
-            raw_file = T.cast(req.fetch(:file), String)
+            raw_file = req.file
+            next unless raw_file
+
             [raw_file, normalize_path(raw_file)]
           end
         end

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -56,10 +56,10 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @repo_contents_path = T.let(repo_contents_path, T.nilable(String))
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @repo_contents_path = repo_contents_path
         end
 
         sig { params(requirement: T.nilable(String)).returns(T.nilable(Dependabot::Python::Version)) }

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -78,10 +78,10 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency               = T.let(dependency, Dependabot::Dependency)
-          @dependency_files         = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials              = T.let(credentials, T::Array[Dependabot::Credential])
-          @repo_contents_path       = T.let(repo_contents_path, T.nilable(String))
+          @dependency               = dependency
+          @dependency_files         = dependency_files
+          @credentials              = credentials
+          @repo_contents_path       = repo_contents_path
           @error_handler = T.let(
             PoetryErrorHandler.new(dependencies: dependency, dependency_files: dependency_files),
             Dependabot::Python::PoetryErrorHandler
@@ -333,7 +333,7 @@ module Dependabot
           end
 
           # If this is a sub-dependency, add the new requirement
-          unless dependency.requirements.find { |r| r[:file] == T.must(pyproject).name }
+          unless dependency.requirements.find { |r| r.file == T.must(pyproject).name }
             poetry_object[subdep_type] ||= {}
             poetry_object[subdep_type][dependency.name] = updated_requirement
           end
@@ -490,8 +490,8 @@ module Dependabot
         ).void
       end
       def initialize(dependencies:, dependency_files:)
-        @dependencies = T.let(dependencies, Dependabot::Dependency)
-        @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+        @dependencies = dependencies
+        @dependency_files = dependency_files
       end
 
       private

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -16,9 +16,9 @@ module Dependabot
       class RequirementsUpdater
         extend T::Sig
 
-        PYPROJECT_OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
-        PYPROJECT_SEPARATOR = T.let(/#{PYPROJECT_OR_SEPARATOR}|,/, Regexp)
-        LOWER_BOUND_OPS = T.let(%w(> >=).freeze, T::Array[String])
+        PYPROJECT_OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
+        PYPROJECT_SEPARATOR = /#{PYPROJECT_OR_SEPARATOR}|,/
+        LOWER_BOUND_OPS = %w(> >=).freeze
 
         class UnfixableRequirement < StandardError; end
 
@@ -52,8 +52,8 @@ module Dependabot
             requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
             T::Array[Dependabot::DependencyRequirement]
           )
-          @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
-          @has_lockfile = T.let(has_lockfile, T::Boolean)
+          @update_strategy = update_strategy
+          @has_lockfile = has_lockfile
           @latest_resolvable_version = T.let(nil, T.nilable(Dependabot::Python::Version))
 
           return unless latest_resolvable_version
@@ -66,45 +66,49 @@ module Dependabot
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            case req[:file]
+            case req.file
             when /setup\.(?:py|cfg)$/ then updated_setup_requirement(req)
             when ->(file) { file.end_with?("pyproject.toml") } then updated_pyproject_requirement(req)
             when "Pipfile" then updated_pipfile_requirement(req)
             when /\.txt$|\.in$/ then updated_requirement(req)
-            else raise "Unexpected filename: #{req[:file]}"
+            else raise "Unexpected filename: #{req.file}"
             end
           end
         end
 
         private
 
-        # rubocop:disable Metrics/PerceivedComplexity
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
-          return req if new_version_satisfies?(req)
 
-          req_strings = req[:requirement].split(",").map(&:strip)
-
-          new_requirement =
-            if req_strings.any? { |r| requirement_class.new(r).exact? }
-              find_and_update_equality_match(req_strings)
-            elsif req_strings.any? { |r| r.start_with?("~=") }
-              tw_req = req_strings.find { |r| r.start_with?("~=") }
-              bump_version(tw_req, latest_resolvable_version.to_s)
-            elsif req_strings.any? { |r| r.start_with?("==") }
-              tw_req = req_strings.find { |r| r.start_with?("==") }
-              convert_to_range(tw_req, T.must(latest_resolvable_version))
-            else
-              update_requirements_range(req_strings)
-            end
+          requirement = req.requirement_string
+          return req unless requirement
+          return req if new_version_satisfies?(req)
 
+          new_requirement = updated_setup_requirement_string(requirement)
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
           Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
-        # rubocop:enable Metrics/PerceivedComplexity
+
+        sig { params(requirement: String).returns(String) }
+        def updated_setup_requirement_string(requirement)
+          req_strings = requirement.split(",").map(&:strip)
+          return find_and_update_equality_match(req_strings) if req_strings.any? { |r| requirement_class.new(r).exact? }
+
+          if req_strings.any? { |r| r.start_with?("~=") }
+            tw_req = req_strings.find { |r| r.start_with?("~=") }
+            return bump_version(T.must(tw_req), latest_resolvable_version.to_s)
+          end
+
+          if req_strings.any? { |r| r.start_with?("==") }
+            tw_req = req_strings.find { |r| r.start_with?("==") }
+            return convert_to_range(T.must(tw_req), T.must(latest_resolvable_version))
+          end
+
+          update_requirements_range(req_strings)
+        end
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pipfile_requirement(req)
@@ -116,7 +120,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
+          return req unless req.requirement_string
           return req if skip_pyproject_update?(req)
 
           pyproject_update_for_strategy(req)
@@ -132,11 +136,13 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def pyproject_update_for_strategy(req)
+          requirement = T.must(req.requirement_string)
+
           # If the requirement uses || syntax then we always want to widen it
-          return widen_pyproject_requirement(req) if req.fetch(:requirement).match?(PYPROJECT_OR_SEPARATOR)
+          return widen_pyproject_requirement(req) if requirement.match?(PYPROJECT_OR_SEPARATOR)
 
           # If the requirement is a development dependency we always want to bump it
-          return update_pyproject_version(req) if req.fetch(:groups).include?("dev-dependencies")
+          return update_pyproject_version(req) if req.groups&.include?("dev-dependencies")
 
           case update_strategy
           when RequirementsUpdateStrategy::WidenRanges then widen_pyproject_requirement(req)
@@ -155,7 +161,7 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version(req)
-          return req if req[:requirement] == "*"
+          return req if req.requirement == "*"
 
           update_pyproject_version_core(req, bump_lower_bound: true)
         end
@@ -167,14 +173,14 @@ module Dependabot
           ).returns(Dependabot::DependencyRequirement)
         end
         def update_pyproject_version_core(req, bump_lower_bound:)
-          requirement_strings = req[:requirement].split(",").map(&:strip)
+          requirement_strings = T.must(req.requirement_string).split(",").map(&:strip)
 
           new_requirement =
             if requirement_strings.any? { |r| r.match?(/^=|^\d/) }
               find_and_update_equality_match(requirement_strings)
             elsif requirement_strings.any? { |r| r.start_with?("~", "^") }
               v_req = requirement_strings.find { |r| r.start_with?("~", "^") }
-              bump_version(v_req, latest_resolvable_version.to_s)
+              bump_version(T.must(v_req), latest_resolvable_version.to_s)
             elsif bump_lower_bound
               bump_requirements_range(requirement_strings)
             else
@@ -188,11 +194,12 @@ module Dependabot
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
+          requirement = T.must(req.requirement_string)
           new_requirement =
-            if req[:requirement].match?(PYPROJECT_OR_SEPARATOR)
-              add_new_requirement_option(req[:requirement])
+            if requirement.match?(PYPROJECT_OR_SEPARATOR)
+              add_new_requirement_option(requirement)
             else
-              widen_requirement_range(req[:requirement])
+              widen_requirement_range(requirement)
             end
 
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
@@ -248,7 +255,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
+          return req unless req.requirement_string
 
           case update_strategy
           when RequirementsUpdateStrategy::WidenRanges
@@ -279,17 +286,18 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(T.any(String, Symbol)) }
         def updated_requirement_string(req)
-          requirement_strings = req[:requirement].split(",").map(&:strip)
+          requirement = T.must(req.requirement_string)
+          requirement_strings = requirement.split(",").map(&:strip)
 
           if requirement_strings.any? { |r| r.match?(/^[=\d]/) }
             find_and_update_equality_match(requirement_strings)
           elsif requirement_strings.any? { |r| r.start_with?("~=") }
             tw_req = requirement_strings.find { |r| r.start_with?("~=") }
-            bump_version(tw_req, latest_resolvable_version.to_s)
+            bump_version(T.must(tw_req), latest_resolvable_version.to_s)
           elsif bump_lower_bound?(requirement_strings)
             bump_requirements_range(requirement_strings)
           elsif new_version_satisfies?(req)
-            req.fetch(:requirement)
+            requirement
           else
             update_requirements_range(requirement_strings)
           end
@@ -305,7 +313,7 @@ module Dependabot
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
-          new_requirement = widen_requirement_range(req[:requirement])
+          new_requirement = widen_requirement_range(T.must(req.requirement_string))
 
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
@@ -313,7 +321,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
-            .requirements_array(req.fetch(:requirement))
+            .requirements_array(req.requirement_string)
             .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 

data/lib/dependabot/python/update_checker.rb

@@ -253,10 +253,9 @@ module Dependabot
         :requirements
       end
 
-      sig { params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
+      sig { params(reqs: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def exact_requirement?(reqs)
-        reqs = reqs.map { |r| r.fetch(:requirement) }
-        reqs = reqs.compact
+        reqs = reqs.filter_map(&:requirement_string)
         reqs = reqs.flat_map { |r| r.split(",").map(&:strip) }
         reqs.any? { |r| Python::Requirement.new(r).exact? }
       end
@@ -332,12 +331,13 @@ module Dependabot
         return if reqs.none?
 
         requirement = reqs.find do |r|
-          file = r[:file]
+          file = r.file
+          next false unless file
 
           file == "Pipfile" || file == "pyproject.toml" || file.end_with?(".in") || file.end_with?(".txt")
         end
 
-        requirement&.fetch(:requirement)
+        requirement&.requirement_string
       end
 
       sig { returns(String) }
@@ -361,13 +361,13 @@ module Dependabot
       def updated_version_req_lower_bound
         return ">=#{dependency.version}" if dependency.version
 
-        version_for_requirement =
-          requirements.filter_map { |r| r[:requirement] }
-                      .reject { |req_string| req_string.start_with?("<") }
-                      .select { |req_string| req_string.match?(VERSION_REGEX) }
-                      .map { |req_string| req_string.match(VERSION_REGEX).to_s }
-                      .select { |version| Python::Version.correct?(version) }
-                      .max_by { |version| Python::Version.new(version) }
+        version_for_requirement = requirements
+                                  .filter_map(&:requirement_string)
+                                  .reject { |req_string| req_string.start_with?("<") }
+                                  .select { |req_string| req_string.match?(VERSION_REGEX) }
+                                  .map { |req_string| req_string.match(VERSION_REGEX).to_s }
+                                  .select { |version| Python::Version.correct?(version) }
+                                  .max_by { |version| Python::Version.new(version) }
 
         ">=#{version_for_requirement || 0}"
       end
@@ -450,7 +450,7 @@ module Dependabot
 
       sig { returns(T::Array[String]) }
       def requirement_files
-        requirements.map { |r| r.fetch(:file) }
+        requirements.filter_map(&:file)
       end
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }

data/lib/dependabot/python/version.rb

@@ -30,7 +30,7 @@ module Dependabot
       sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
       attr_reader :local
 
-      INFINITY = T.let(1000, Integer)
+      INFINITY = 1000
       NEGATIVE_INFINITY = T.let(-INFINITY, Integer)
 
       # See https://peps.python.org/pep-0440/#appendix-b-parsing-version-strings-with-regular-expressions

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib