dependabot-python 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 52f2cde620dcbabcf87eb9cbd827b7008699eb6132926fd3d7ace0d4d331586e
-  data.tar.gz: dde99d06a325a2cd4cb0f9f70027369797cabc171fa7753beccd9dd9c9d647d8
+  metadata.gz: 242cdbd71bb6b0424ba7c88daf21d1839db3eb9d3f0beb2ad9e070f3d624cf77
+  data.tar.gz: 40a2faa1353d5fd82480211fee5ac28840996cf483fdf3c884fb558702396f08
 SHA512:
-  metadata.gz: 0c0e331e9893ce5b246313c77cf7820992b32360c264f7544f605893a83d7b84cb9cc37fdaf8917e2b42bda2b56704d96968415e95b35b4cd465cdcdd68d317d
-  data.tar.gz: e6f99d3ed5613acd2692c38fc44af578c57284d3297759dae6f5db464a16c4d57cbbc63b098368bdfea9060f2300ae2230647ace91c62c56385c16b33244071f
+  metadata.gz: 9a75d27db29ca5df37ea4e4962da3cbbfa0c05627044fd340d9b0b6f657108d44ff78bc40c206b2d0ac3a6d8387f3f0f30cd7dfeacafee122fd92b3e2d981954
+  data.tar.gz: 7651c73fdab13d9f091cada4a7d7531842e90042825ef0052c67882e90958870a26fd3936ac213bcd69362d9ac3b9d64d422a34ea4f9646344468851c6969b7c

data/helpers/requirements.txt

@@ -1,5 +1,5 @@
 pip==26.1.2
-pip-tools==7.6.0
+pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
 pipenv==2024.4.1

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -68,10 +68,19 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
 
-            requirements = SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_setup",
-              args: [Dir.pwd]
+            requirements = T.cast(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "parse_setup",
+                args: [Dir.pwd]
+              ),
+              T.nilable(
+                T.any(
+                  T::Hash[String, T.untyped],
+                  String,
+                  T::Array[T::Hash[String, T.untyped]]
+                )
+              )
             )
 
             check_requirements(requirements)
@@ -90,10 +99,19 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_sanitized_setup_file
 
-            requirements = SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_setup",
-              args: [Dir.pwd]
+            requirements = T.cast(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "parse_setup",
+                args: [Dir.pwd]
+              ),
+              T.nilable(
+                T.any(
+                  T::Hash[String, T.untyped],
+                  String,
+                  T::Array[T::Hash[String, T.untyped]]
+                )
+              )
             )
 
             check_requirements(requirements)

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -194,9 +194,9 @@ module Dependabot
         def update_uncompiled_files(updated_files)
           updated_filenames = updated_files.map(&:name)
           old_reqs = T.must(T.must(dependency).previous_requirements)
-                      .reject { |r| updated_filenames.include?(r[:file]) }
+                      .reject { |r| updated_filenames.include?(r.file) }
           new_reqs = T.must(dependency).requirements
-                      .reject { |r| updated_filenames.include?(r[:file]) }
+                      .reject { |r| updated_filenames.include?(r.file) }
 
           return [] if new_reqs.none?
 
@@ -324,15 +324,15 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(T.must(dependency).previous_requirements)
-                     .find { |r| r[:file] == file.name }
+                     .find { |r| r.file == file.name }
 
           return file.content unless old_req
-          return file.content if old_req == "==#{T.must(dependency).version}"
+          return file.content if old_req.requirement_string == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
+            old_requirement: old_req.requirement_string,
             new_requirement: "==#{T.must(dependency).version}",
             index_urls: @index_urls
           ).updated_content
@@ -343,17 +343,17 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(T.must(dependency).previous_requirements)
-                     .find { |r| r[:file] == file.name }
+                     .find { |r| r.file == file.name }
           new_req = T.must(dependency).requirements
-                     .find { |r| r[:file] == file.name }
-          return file.content unless old_req&.fetch(:requirement)
+                     .find { |r| r.file == file.name }
+          return file.content unless old_req&.requirement_string
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
-            new_requirement: T.must(new_req)[:requirement],
+            old_requirement: old_req.requirement_string,
+            new_requirement: T.must(T.must(new_req).requirement_string),
             index_urls: @index_urls
           ).updated_content
         end
@@ -674,7 +674,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             T.must(dependency).requirements
-             .map { |r| r[:file] }
+             .filter_map(&:file)
              .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -345,10 +345,19 @@ module Dependabot
         def pipfile_hash_for(pipfile_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             File.write(File.join(dir, "Pipfile"), pipfile_content)
-            SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "get_pipfile_hash",
-              args: [T.cast(dir, Pathname).to_s]
+            T.cast(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "get_pipfile_hash",
+                args: [T.cast(dir, Pathname).to_s]
+              ),
+              T.nilable(
+                T.any(
+                  T::Hash[String, T.untyped],
+                  String,
+                  T::Array[T::Hash[String, T.untyped]]
+                )
+              )
             )
           end
         end

data/lib/dependabot/python/file_updater/pipfile_manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/python/file_updater"
@@ -53,15 +53,15 @@ module Dependabot
 
           # Loop through each changed requirement
           reqs.each do |new_req, old_req|
-            raise "Bad req match" unless new_req[:file] == T.must(old_req)[:file]
-            next if new_req[:requirement] == T.must(old_req)[:requirement]
-            next unless new_req[:file] == manifest.name
+            raise "Bad req match" unless new_req.file == T.must(old_req).file
+            next if new_req.requirement == T.must(old_req).requirement
+            next unless new_req.file == manifest.name
 
             updated_content = update_manifest_req(
               content: updated_content,
               dep: dependency,
-              old_req: T.must(old_req).fetch(:requirement),
-              new_req: new_req.fetch(:requirement)
+              old_req: T.must(T.must(old_req).requirement_string),
+              new_req: T.must(new_req.requirement_string)
             )
           end
 
@@ -118,7 +118,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == manifest.name }
+          changed_requirements.any? { |f| f.file == manifest.name }
         end
       end
     end

data/lib/dependabot/python/file_updater/poetry_file_updater/pep621_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -19,8 +19,8 @@ module Dependabot
           sig do
             params(
               content: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace(content, new_r, old_r)
@@ -96,8 +96,8 @@ module Dependabot
             params(
               content: String,
               source_req: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace_with_source_requirement(content, source_req, new_r, old_r)
@@ -105,7 +105,11 @@ module Dependabot
             return unless match
 
             declaration = T.must(match[:declaration])
-            new_req_str = rewrite_pep508_requirement(source_req, old_r[:requirement], new_r[:requirement])
+            new_req_str = rewrite_pep508_requirement(
+              source_req,
+              T.must(old_r.requirement_string),
+              T.must(new_r.requirement_string)
+            )
             content.sub(declaration, declaration.sub(source_req, new_req_str))
           end
 
@@ -116,13 +120,13 @@ module Dependabot
           sig do
             params(
               content: String,
-              new_r: T::Hash[Symbol, T.untyped],
-              old_r: T::Hash[Symbol, T.untyped]
+              new_r: Dependabot::DependencyRequirement,
+              old_r: Dependabot::DependencyRequirement
             ).returns(T.nilable(String))
           end
           def replace_with_normalized_requirement(content, new_r, old_r)
-            old_req = old_r[:requirement]
-            new_req = new_r[:requirement]
+            old_req = T.must(old_r.requirement_string)
+            new_req = T.must(new_r.requirement_string)
 
             match = content.match(normalized_declaration_regex(old_req))
             return unless match

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -18,6 +18,16 @@ require "dependabot/package/release_cooldown_options"
 
 module Dependabot
   module Python
+    PoetryPyprojectHashResult = T.type_alias do
+      T.nilable(
+        T.any(
+          T::Hash[String, T.untyped],
+          String,
+          T::Array[T::Hash[String, T.untyped]]
+        )
+      )
+    end
+
     class FileUpdater
       class PoetryFileUpdater
         require_relative "pyproject_preparer"
@@ -99,7 +109,7 @@ module Dependabot
           updated_content = content.dup
 
           dependency.requirements.zip(T.must(dependency.previous_requirements)).each do |new_r, old_r|
-            next unless new_r[:file] == pyproject&.name && T.must(old_r)[:file] == pyproject&.name
+            next unless new_r.file == pyproject&.name && T.must(old_r).file == pyproject&.name
 
             updated_content = replace_dep(dependency, T.must(updated_content), new_r, T.must(old_r))
           end
@@ -109,7 +119,7 @@ module Dependabot
           updated_content
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(String) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(String) }
         def replace_dep(dep, content, new_r, old_r)
           return update_git_tag(dep, content, new_r, old_r) if git_dependency?(new_r) && git_dependency?(old_r)
 
@@ -119,10 +129,10 @@ module Dependabot
             content
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_poetry_dep(dep, content, new_r, old_r)
-          new_req = new_r[:requirement]
-          old_req = old_r[:requirement]
+          new_req = T.must(new_r.requirement_string)
+          old_req = T.must(old_r.requirement_string)
 
           declaration_regex = declaration_regex(dep, old_r)
           declaration_match = content.match(declaration_regex)
@@ -135,10 +145,10 @@ module Dependabot
           content.sub(T.must(declaration), new_declaration)
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_poetry_table_dep(dep, content, new_r, old_r)
-          old_req = old_r[:requirement]
-          new_req = new_r[:requirement]
+          old_req = T.must(old_r.requirement_string)
+          new_req = T.must(new_r.requirement_string)
           regex = table_declaration_regex(dep, new_r)
 
           return unless content.match(regex)
@@ -151,20 +161,20 @@ module Dependabot
           end
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(T.nilable(String)) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
         def replace_pep621_dep(dep, content, new_r, old_r)
           Pep621Updater.new(dep: dep).replace(content, new_r, old_r)
         end
 
-        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def git_dependency?(req)
-          req.dig(:source, :type) == "git"
+          req.source_string("type") == "git"
         end
 
-        sig { params(dep: Dependabot::Dependency, content: String, new_r: T::Hash[Symbol, T.untyped], old_r: T::Hash[Symbol, T.untyped]).returns(String) }
+        sig { params(dep: Dependabot::Dependency, content: String, new_r: Dependabot::DependencyRequirement, old_r: Dependabot::DependencyRequirement).returns(String) }
         def update_git_tag(dep, content, new_r, old_r)
-          old_tag = old_r.dig(:source, :ref)
-          new_tag = new_r.dig(:source, :ref)
+          old_tag = old_r.source_string("ref")
+          new_tag = new_r.source_string("ref")
 
           return content if old_tag == new_tag
 
@@ -172,7 +182,7 @@ module Dependabot
           # Example: fastapi = { git = "...", extras = ["all"], tag = "0.110.0" }
           git_dep_regex = /
             ^(\s*)#{Regexp.escape(dep.name)}(\s*=\s*\{[^}]*tag\s*=\s*)
-            ["']#{Regexp.escape(old_tag)}["']([^}]*\})
+            ["']#{Regexp.escape(T.must(old_tag))}["']([^}]*\})
           /mx
 
           content.gsub(git_dep_regex) do
@@ -233,7 +243,7 @@ module Dependabot
               # Skip Git dependencies - they use tags/refs, not versions
               next if git_dependency_being_updated?(dep)
 
-              if dep.requirements.find { |r| r[:file] == pyproject&.name }
+              if dep.requirements.find { |r| r.file == pyproject&.name }
                 lock_declaration_to_new_version!(poetry_object, dep)
               else
                 create_declaration_at_new_version!(poetry_object, dep)
@@ -302,7 +312,7 @@ module Dependabot
 
         sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
         def git_dependency_being_updated?(dep)
-          dep.requirements.any? { |r| r.dig(:source, :type) == "git" }
+          dep.requirements.any? { |r| r.source_string("type") == "git" }
         end
 
         sig { params(pyproject_content: String).returns(String) }
@@ -367,32 +377,33 @@ module Dependabot
             .add_auth_env_vars(credentials)
         end
 
-        sig { params(pyproject_content: String).returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]]))) }
+        sig { params(pyproject_content: String).returns(PoetryPyprojectHashResult) }
         def pyproject_hash_for(pyproject_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             SharedHelpers.with_git_configured(credentials: credentials) do
               write_temporary_dependency_files(pyproject_content)
 
-              SharedHelpers.run_helper_subprocess(
+              result = SharedHelpers.run_helper_subprocess(
                 command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
                 function: "get_pyproject_hash",
                 args: [T.cast(dir, Pathname).to_s]
               )
+              T.cast(result, PoetryPyprojectHashResult)
             end
           end
         end
 
-        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
+        sig { params(dep: Dependabot::Dependency, old_req: Dependabot::DependencyRequirement).returns(Regexp) }
         def declaration_regex(dep, old_req)
-          group = old_req[:groups].first
+          group = T.must(old_req.groups).first
 
           header_regex = "#{group}(?:\\.dependencies)?\\]\s*(?:\s*#.*?)*?"
           /#{header_regex}(?:\r?\n).*?(?<declaration>(?:^\s*|["'])#{escape(dep)}["']?\s*=[^\r\n]*)(?=\r?\n|$)/mi
         end
 
-        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
+        sig { params(dep: Dependabot::Dependency, old_req: Dependabot::DependencyRequirement).returns(Regexp) }
         def table_declaration_regex(dep, old_req)
-          /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\](?:\r?\n).*?\s*version\s* =.*?(?:\r?\n)/m
+          /tool\.poetry\.#{T.must(old_req.groups).first}\.#{escape(dep)}\](?:\r?\n).*?\s*version\s* =.*?(?:\r?\n)/m
         end
 
         sig { params(dep: Dependency).returns(String) }
@@ -410,7 +421,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
 
         sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -13,6 +13,10 @@ module Dependabot
       class RequirementFileUpdater
         extend T::Sig
 
+        RequirementChange = T.type_alias do
+          [Dependabot::DependencyRequirement, T.nilable(Dependabot::DependencyRequirement)]
+        end
+
         require_relative "requirement_replacer"
 
         sig { returns(T::Array[Dependabot::Dependency]) }
@@ -58,9 +62,9 @@ module Dependabot
           updated_contents = T.let({}, T::Hash[String, String])
 
           unique_requirement_changes.each do |pair|
-            new_req = T.must(pair[0])
+            new_req = pair[0]
             old_req = pair[1]
-            filename = new_req.fetch(:file)
+            filename = T.must(new_req.file)
             content = updated_contents[filename] || T.must(T.must(get_original_file(filename)).content)
             updated_contents[filename] = updated_requirement_or_setup_file_content(content, new_req, old_req)
           end
@@ -77,37 +81,37 @@ module Dependabot
         # Deduplicates requirements that share the same file and requirement strings.
         # The replacer's regex matches all extras variants at once, so one call per
         # unique (file, old_requirement, new_requirement) is sufficient.
-        sig { returns(T::Array[T::Array[T.nilable(T::Hash[Symbol, T.untyped])]]) }
+        sig { returns(T::Array[RequirementChange]) }
         def unique_requirement_changes
           previous_reqs = dependency.previous_requirements || []
 
           changes = dependency.requirements.filter_map do |new_req|
-            old_req = previous_reqs.find { |r| r[:file] == new_req[:file] && r[:groups] == new_req[:groups] }
+            old_req = previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
             next if new_req == old_req
 
-            [new_req, old_req]
+            T.let([new_req, old_req], RequirementChange)
           end
 
           changes.uniq do |pair|
             new_req = pair[0]
             old_req = pair[1]
-            [new_req[:file], old_req&.fetch(:requirement), new_req.fetch(:requirement)]
+            [new_req.file, old_req&.requirement, new_req.requirement]
           end
         end
 
         sig do
           params(
             content: String,
-            new_req: T::Hash[Symbol, T.untyped],
-            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+            new_req: Dependabot::DependencyRequirement,
+            old_req: T.nilable(Dependabot::DependencyRequirement)
           ).returns(String)
         end
         def updated_requirement_or_setup_file_content(content, new_req, old_req)
           RequirementReplacer.new(
             content: content,
             dependency_name: dependency.name,
-            old_requirement: old_req&.fetch(:requirement),
-            new_requirement: new_req.fetch(:requirement),
+            old_requirement: old_req&.requirement_string,
+            new_requirement: T.must(new_req.requirement_string),
             new_hash_version: dependency.version,
             index_urls: @index_urls
           ).updated_content

data/lib/dependabot/python/file_updater/setup_file_sanitizer.rb

@@ -61,10 +61,9 @@ module Dependabot
           @install_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
               first = T.must(dep.requirements.first)
-              next unless first[:groups]
-                          .include?("install_requires")
+              next unless first.groups&.include?("install_requires")
 
-              name_with_extras(dep) + first[:requirement].to_s
+              name_with_extras(dep) + first.requirement.to_s
             end
         end
 
@@ -73,10 +72,9 @@ module Dependabot
           @setup_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
               first = T.must(dep.requirements.first)
-              next unless first[:groups]
-                          .include?("setup_requires")
+              next unless first.groups&.include?("setup_requires")
 
-              name_with_extras(dep) + first[:requirement].to_s
+              name_with_extras(dep) + first.requirement.to_s
             end
         end
 
@@ -87,12 +85,13 @@ module Dependabot
               hash = {}
               parsed_setup_file.dependencies.each do |dep|
                 first = T.must(dep.requirements.first)
-                first[:groups].each do |group|
+                T.must(first.groups).each do |group|
                   next unless group.start_with?("extras_require:")
 
-                  hash[group.split(":").last] ||= []
-                  hash[group.split(":").last] <<
-                    (name_with_extras(dep) + first[:requirement].to_s)
+                  group_name = group.to_s
+                  hash[group_name.split(":").last] ||= []
+                  hash[group_name.split(":").last] <<
+                    (name_with_extras(dep) + first.requirement.to_s)
                 end
               end
 

data/lib/dependabot/python/file_updater.rb

@@ -46,7 +46,7 @@ module Dependabot
         changed_reqs = reqs.zip(dependencies.flat_map(&:previous_requirements))
                            .reject { |(new_req, old_req)| new_req == old_req }
                            .map(&:first)
-        changed_req_files = changed_reqs.map { |r| r.fetch(:file) }
+        changed_req_files = changed_reqs.filter_map(&:file)
 
         # If there are no requirements then this is a sub-dependency. It
         # must come from one of Pipenv, Poetry or pip-tools, and can't come

data/lib/dependabot/python/pipenv_runner.rb

@@ -143,7 +143,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def lockfile_section
         if current_dependency.requirements.any?
-          T.must(current_dependency.requirements.first)[:groups].first
+          T.must(T.must(current_dependency.requirements.first).groups).first&.to_s
         else
           parsed_lockfile = JSON.parse(T.must(T.must(lockfile).content))
           Python::FileParser::DEPENDENCY_GROUP_KEYS.each do |keys|

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -400,14 +400,14 @@ module Dependabot
         def update_req_file(file, updated_req)
           return T.must(file.content) unless file.name.end_with?(".in")
 
-          req = dependency.requirements.find { |r| r[:file] == file.name }
+          req = dependency.requirements.find { |r| r.file == file.name }
 
-          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.fetch(:requirement)
+          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.requirement_string
 
           Python::FileUpdater::RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: dependency.name,
-            old_requirement: req[:requirement],
+            old_requirement: req.requirement_string,
             new_requirement: updated_req
           ).updated_content
         end
@@ -426,7 +426,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             dependency.requirements
-                      .map { |r| r[:file] }
+                      .filter_map(&:file)
                       .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -182,7 +182,9 @@ module Dependabot
         sig { returns(T::Array[[String, String]]) }
         def normalized_requirement_files
           dependency.requirements.filter_map do |req|
-            raw_file = T.cast(req.fetch(:file), String)
+            raw_file = req.file
+            next unless raw_file
+
             [raw_file, normalize_path(raw_file)]
           end
         end

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -333,7 +333,7 @@ module Dependabot
           end
 
           # If this is a sub-dependency, add the new requirement
-          unless dependency.requirements.find { |r| r[:file] == T.must(pyproject).name }
+          unless dependency.requirements.find { |r| r.file == T.must(pyproject).name }
             poetry_object[subdep_type] ||= {}
             poetry_object[subdep_type][dependency.name] = updated_requirement
           end

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -66,45 +66,49 @@ module Dependabot
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            case req[:file]
+            case req.file
             when /setup\.(?:py|cfg)$/ then updated_setup_requirement(req)
             when ->(file) { file.end_with?("pyproject.toml") } then updated_pyproject_requirement(req)
             when "Pipfile" then updated_pipfile_requirement(req)
             when /\.txt$|\.in$/ then updated_requirement(req)
-            else raise "Unexpected filename: #{req[:file]}"
+            else raise "Unexpected filename: #{req.file}"
             end
           end
         end
 
         private
 
-        # rubocop:disable Metrics/PerceivedComplexity
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
-          return req if new_version_satisfies?(req)
 
-          req_strings = req[:requirement].split(",").map(&:strip)
-
-          new_requirement =
-            if req_strings.any? { |r| requirement_class.new(r).exact? }
-              find_and_update_equality_match(req_strings)
-            elsif req_strings.any? { |r| r.start_with?("~=") }
-              tw_req = req_strings.find { |r| r.start_with?("~=") }
-              bump_version(tw_req, latest_resolvable_version.to_s)
-            elsif req_strings.any? { |r| r.start_with?("==") }
-              tw_req = req_strings.find { |r| r.start_with?("==") }
-              convert_to_range(tw_req, T.must(latest_resolvable_version))
-            else
-              update_requirements_range(req_strings)
-            end
+          requirement = req.requirement_string
+          return req unless requirement
+          return req if new_version_satisfies?(req)
 
+          new_requirement = updated_setup_requirement_string(requirement)
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         rescue UnfixableRequirement
           Dependabot::DependencyRequirement.create(req.merge(requirement: :unfixable))
         end
-        # rubocop:enable Metrics/PerceivedComplexity
+
+        sig { params(requirement: String).returns(String) }
+        def updated_setup_requirement_string(requirement)
+          req_strings = requirement.split(",").map(&:strip)
+          return find_and_update_equality_match(req_strings) if req_strings.any? { |r| requirement_class.new(r).exact? }
+
+          if req_strings.any? { |r| r.start_with?("~=") }
+            tw_req = req_strings.find { |r| r.start_with?("~=") }
+            return bump_version(T.must(tw_req), latest_resolvable_version.to_s)
+          end
+
+          if req_strings.any? { |r| r.start_with?("==") }
+            tw_req = req_strings.find { |r| r.start_with?("==") }
+            return convert_to_range(T.must(tw_req), T.must(latest_resolvable_version))
+          end
+
+          update_requirements_range(req_strings)
+        end
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pipfile_requirement(req)
@@ -116,7 +120,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
+          return req unless req.requirement_string
           return req if skip_pyproject_update?(req)
 
           pyproject_update_for_strategy(req)
@@ -132,11 +136,13 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def pyproject_update_for_strategy(req)
+          requirement = T.must(req.requirement_string)
+
           # If the requirement uses || syntax then we always want to widen it
-          return widen_pyproject_requirement(req) if req.fetch(:requirement).match?(PYPROJECT_OR_SEPARATOR)
+          return widen_pyproject_requirement(req) if requirement.match?(PYPROJECT_OR_SEPARATOR)
 
           # If the requirement is a development dependency we always want to bump it
-          return update_pyproject_version(req) if req.fetch(:groups).include?("dev-dependencies")
+          return update_pyproject_version(req) if req.groups&.include?("dev-dependencies")
 
           case update_strategy
           when RequirementsUpdateStrategy::WidenRanges then widen_pyproject_requirement(req)
@@ -155,7 +161,7 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_pyproject_version(req)
-          return req if req[:requirement] == "*"
+          return req if req.requirement == "*"
 
           update_pyproject_version_core(req, bump_lower_bound: true)
         end
@@ -167,14 +173,14 @@ module Dependabot
           ).returns(Dependabot::DependencyRequirement)
         end
         def update_pyproject_version_core(req, bump_lower_bound:)
-          requirement_strings = req[:requirement].split(",").map(&:strip)
+          requirement_strings = T.must(req.requirement_string).split(",").map(&:strip)
 
           new_requirement =
             if requirement_strings.any? { |r| r.match?(/^=|^\d/) }
               find_and_update_equality_match(requirement_strings)
             elsif requirement_strings.any? { |r| r.start_with?("~", "^") }
               v_req = requirement_strings.find { |r| r.start_with?("~", "^") }
-              bump_version(v_req, latest_resolvable_version.to_s)
+              bump_version(T.must(v_req), latest_resolvable_version.to_s)
             elsif bump_lower_bound
               bump_requirements_range(requirement_strings)
             else
@@ -188,11 +194,12 @@ module Dependabot
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
+          requirement = T.must(req.requirement_string)
           new_requirement =
-            if req[:requirement].match?(PYPROJECT_OR_SEPARATOR)
-              add_new_requirement_option(req[:requirement])
+            if requirement.match?(PYPROJECT_OR_SEPARATOR)
+              add_new_requirement_option(requirement)
             else
-              widen_requirement_range(req[:requirement])
+              widen_requirement_range(requirement)
             end
 
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
@@ -248,7 +255,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
-          return req unless req.fetch(:requirement)
+          return req unless req.requirement_string
 
           case update_strategy
           when RequirementsUpdateStrategy::WidenRanges
@@ -279,17 +286,18 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(T.any(String, Symbol)) }
         def updated_requirement_string(req)
-          requirement_strings = req[:requirement].split(",").map(&:strip)
+          requirement = T.must(req.requirement_string)
+          requirement_strings = requirement.split(",").map(&:strip)
 
           if requirement_strings.any? { |r| r.match?(/^[=\d]/) }
             find_and_update_equality_match(requirement_strings)
           elsif requirement_strings.any? { |r| r.start_with?("~=") }
             tw_req = requirement_strings.find { |r| r.start_with?("~=") }
-            bump_version(tw_req, latest_resolvable_version.to_s)
+            bump_version(T.must(tw_req), latest_resolvable_version.to_s)
           elsif bump_lower_bound?(requirement_strings)
             bump_requirements_range(requirement_strings)
           elsif new_version_satisfies?(req)
-            req.fetch(:requirement)
+            requirement
           else
             update_requirements_range(requirement_strings)
           end
@@ -305,7 +313,7 @@ module Dependabot
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
-          new_requirement = widen_requirement_range(req[:requirement])
+          new_requirement = widen_requirement_range(T.must(req.requirement_string))
 
           Dependabot::DependencyRequirement.create(req.merge(requirement: new_requirement))
         end
@@ -313,7 +321,7 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
-            .requirements_array(req.fetch(:requirement))
+            .requirements_array(req.requirement_string)
             .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 

data/lib/dependabot/python/update_checker.rb

@@ -129,7 +129,7 @@ module Dependabot
 
       sig { returns(T.nilable(Gem::Version)) }
       def latest_version_for_git_dependency
-        latest_git_version_details&.fetch(:version)
+        latest_git_version_details&.version
       end
 
       sig { returns(T.nilable(Gem::Version)) }
@@ -152,7 +152,7 @@ module Dependabot
       def updated_git_source
         # Update the git tag if a new version is available
         if git_commit_checker.pinned_ref_looks_like_version? && latest_git_version_details
-          new_tag = T.must(latest_git_version_details).fetch(:tag)
+          new_tag = T.must(latest_git_version_details).tag
           source_details = dependency.source_details
           return source_details.transform_keys(&:to_sym).merge(ref: new_tag) if source_details
         end
@@ -161,11 +161,11 @@ module Dependabot
         dependency.source_details&.transform_keys(&:to_sym)
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(Dependabot::GitTagDetails)) }
       def latest_git_version_details
         @latest_git_version_details ||= T.let(
           git_commit_checker.local_tag_for_latest_version(@update_cooldown),
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(Dependabot::GitTagDetails)
         )
       end
 
@@ -253,10 +253,9 @@ module Dependabot
         :requirements
       end
 
-      sig { params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
+      sig { params(reqs: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def exact_requirement?(reqs)
-        reqs = reqs.map { |r| r.fetch(:requirement) }
-        reqs = reqs.compact
+        reqs = reqs.filter_map(&:requirement_string)
         reqs = reqs.flat_map { |r| r.split(",").map(&:strip) }
         reqs.any? { |r| Python::Requirement.new(r).exact? }
       end
@@ -332,12 +331,13 @@ module Dependabot
         return if reqs.none?
 
         requirement = reqs.find do |r|
-          file = r[:file]
+          file = r.file
+          next false unless file
 
           file == "Pipfile" || file == "pyproject.toml" || file.end_with?(".in") || file.end_with?(".txt")
         end
 
-        requirement&.fetch(:requirement)
+        requirement&.requirement_string
       end
 
       sig { returns(String) }
@@ -361,13 +361,13 @@ module Dependabot
       def updated_version_req_lower_bound
         return ">=#{dependency.version}" if dependency.version
 
-        version_for_requirement =
-          requirements.filter_map { |r| r[:requirement] }
-                      .reject { |req_string| req_string.start_with?("<") }
-                      .select { |req_string| req_string.match?(VERSION_REGEX) }
-                      .map { |req_string| req_string.match(VERSION_REGEX).to_s }
-                      .select { |version| Python::Version.correct?(version) }
-                      .max_by { |version| Python::Version.new(version) }
+        version_for_requirement = requirements
+                                  .filter_map(&:requirement_string)
+                                  .reject { |req_string| req_string.start_with?("<") }
+                                  .select { |req_string| req_string.match?(VERSION_REGEX) }
+                                  .map { |req_string| req_string.match(VERSION_REGEX).to_s }
+                                  .select { |version| Python::Version.correct?(version) }
+                                  .max_by { |version| Python::Version.new(version) }
 
         ">=#{version_for_requirement || 0}"
       end
@@ -450,7 +450,7 @@ module Dependabot
 
       sig { returns(T::Array[String]) }
       def requirement_files
-        requirements.map { |r| r.fetch(:file) }
+        requirements.filter_map(&:file)
       end
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib