dependabot-python 0.392.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70504f97ff35fbf437e2895455b6371d858c38921b3f4839a11aaddc31d04911
-  data.tar.gz: 131699694996cabca8daec6c5a96f5a4dba34ec11601a22d7a8f54e6a855852f
+  metadata.gz: 0d1b1deb24d07d3b15f0c1cb2a434bc4014459ff9e52173a6b1aa1608bed9bef
+  data.tar.gz: c2a82f5e34e3f06ecfd16ad0516aa925d7cea4d564b9436befaf50ea5eaeb05f
 SHA512:
-  metadata.gz: 56501fd6454a91206147b03fa795570e6a494e5d5c9733c8945656b174893352cd4adaa3bd2b4ee6c87565c3cc59dc861f62500d4c86fdfa3ea82c50afadda3f
-  data.tar.gz: 8e1983671535f8886b5f7b920893a747d80b16535b74159c07da2ae82c1226dd66276fea515f28503217565955827ab03d51d5ac78dee42dce46d6bcd0cbe869
+  metadata.gz: c6f557bb606f5cdd0105035e2569dfb80410716ae0b6eb514c46d92837f4677107e2f22c309dd90fcd983c0b4a0d23a8ef596036f242560670de569b90a01b43
+  data.tar.gz: 7426a6a6748ef14ed637e82fa5757e5a11fc2c56fadb9e549b559a35e0bd831985978be092f6908068ae5cdd787d330ff95bc7e9b54dc0add588523a4a194d6d

data/helpers/requirements.txt

@@ -1,5 +1,5 @@
-pip==26.1.2
-pip-tools==7.6.0
+pip==26.2.1
+pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
 pipenv==2024.4.1
@@ -10,4 +10,4 @@ pytest==9.1.1
 tomli==2.4.1
 
 # Some dependencies will only install if Cython is present
-Cython==3.2.9
+Cython==3.3.0

data/lib/dependabot/python/file_parser/pep_dependency.rb

@@ -0,0 +1,53 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PepDependency < T::ImmutableStruct
+        extend T::Sig
+
+        const :name, String
+        const :version, T.nilable(String), default: nil
+        const :markers, T.nilable(String), default: nil
+        const :file, String
+        const :requirement, T.nilable(String), default: nil
+        const :source_requirement, T.nilable(String), default: nil
+        const :extras, T::Array[String]
+        const :requirement_type, T.nilable(String), default: nil
+
+        sig { params(result: Object).returns(T::Array[PepDependency]) }
+        def self.from_helper_result(result)
+          PyprojectValueParser.array(result, "PEP dependency result").map do |value|
+            from_object(value)
+          end
+        end
+
+        sig { params(value: Object).returns(PepDependency) }
+        def self.from_object(value)
+          hash = PyprojectValueParser.object_hash(value, "PEP dependency")
+          new(
+            name: PyprojectValueParser.string(hash["name"], "PEP dependency name"),
+            version: PyprojectValueParser.optional_string(hash["version"], "PEP dependency version"),
+            markers: PyprojectValueParser.optional_string(hash["markers"], "PEP dependency markers"),
+            file: PyprojectValueParser.string(hash["file"], "PEP dependency file"),
+            requirement: PyprojectValueParser.optional_string(hash["requirement"], "PEP dependency requirement"),
+            source_requirement: PyprojectValueParser.optional_string(
+              hash["source_requirement"],
+              "PEP dependency source_requirement"
+            ),
+            extras: PyprojectValueParser.string_array(hash["extras"], "PEP dependency extras"),
+            requirement_type: PyprojectValueParser.optional_string(
+              hash["requirement_type"],
+              "PEP dependency requirement_type"
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/poetry_lock.rb

@@ -0,0 +1,95 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PoetryLock
+        extend T::Sig
+
+        class Package < T::ImmutableStruct
+          extend T::Sig
+
+          const :name, String
+          const :version, String
+          const :source_type, T.nilable(String), default: nil
+
+          sig { params(value: Object).returns(Package) }
+          def self.from_object(value)
+            hash = PyprojectValueParser.object_hash(value, "Poetry lock package")
+            source = hash["source"]
+            source_hash =
+              if source.nil?
+                nil
+              else
+                PyprojectValueParser.object_hash(source, "Poetry lock package source")
+              end
+
+            new(
+              name: PyprojectValueParser.string(hash["name"], "Poetry lock package name"),
+              version: PyprojectValueParser.string(hash["version"], "Poetry lock package version"),
+              source_type: PyprojectValueParser.optional_string(
+                source_hash&.[]("type"),
+                "Poetry lock package source type"
+              )
+            )
+          end
+
+          sig { returns(T::Hash[Symbol, T.nilable(String)]) }
+          def to_h
+            {
+              name: name,
+              version: version,
+              source_type: source_type
+            }
+          end
+        end
+
+        sig { returns(T::Array[Package]) }
+        attr_reader :packages
+
+        sig { params(packages: T::Array[Package]).void }
+        def initialize(packages)
+          @packages = packages
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PoetryLock) }
+        def self.from_file(file)
+          parsed = T.cast(TomlRB.parse(T.must(file.content)), Object)
+          document = PyprojectValueParser.object_hash(parsed, "poetry.lock")
+          value = document["package"]
+          packages =
+            if value.nil?
+              []
+            else
+              PyprojectValueParser.array(value, "poetry.lock package").map do |package|
+                Package.from_object(package)
+              end
+            end
+          new(packages)
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig do
+          params(
+            name: String,
+            _normalizer: T.proc.params(name: String).returns(String)
+          )
+            .returns(T.nilable(String))
+        end
+        def version_for(name, &_normalizer)
+          normalized_name = yield(name)
+          packages.find { |package| yield(package.name) == normalized_name }&.version
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -0,0 +1,242 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      module PyprojectValueParser
+        extend T::Sig
+
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+        PoetryRequirement = T.type_alias { T.any(String, ObjectHash) }
+        PoetryDependencyMap = T.type_alias { T::Hash[String, T::Array[PoetryRequirement]] }
+
+        sig { params(value: Object, context: String).returns(ObjectHash) }
+        def self.object_hash(value, context)
+          raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[Object]) }
+        def self.array(value, context)
+          raise TypeError, "#{context} must be an array" unless value.is_a?(Array)
+
+          value.map { |item| T.cast(item, Object) }
+        end
+
+        sig { params(value: Object, context: String).returns(String) }
+        def self.string(value, context)
+          return value if value.is_a?(String)
+
+          raise TypeError, "#{context} must be a string"
+        end
+
+        sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+        def self.optional_string(value, context)
+          return if value.nil?
+
+          string(value, context)
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[String]) }
+        def self.string_array(value, context)
+          array(value, context).map do |item|
+            raise TypeError, "#{context} must contain only strings" unless item.is_a?(String)
+
+            item
+          end
+        end
+
+        sig { params(value: Object, name: String).returns(T::Array[PoetryRequirement]) }
+        def self.poetry_requirements(value, name)
+          flattened = value.is_a?(Array) ? value.flatten : [value]
+          flattened.compact.map do |item|
+            item = T.cast(item, Object)
+            case item
+            when String
+              item
+            when Hash
+              object_hash(item, "Poetry dependency #{name}")
+            else
+              raise TypeError, "Poetry dependency #{name} must be a string, object, or array"
+            end
+          end
+        end
+
+        sig { params(value: Object, context: String).returns(PoetryDependencyMap) }
+        def self.poetry_dependency_map(value, context)
+          object_hash(value, context).to_h do |name, requirement|
+            [name, poetry_requirements(requirement, name)]
+          end
+        end
+      end
+      private_constant :PyprojectValueParser
+
+      class PyprojectDocument
+        extend T::Sig
+
+        PoetryRequirement = T.type_alias { PyprojectValueParser::PoetryRequirement }
+        PoetryDependencyMap = T.type_alias { PyprojectValueParser::PoetryDependencyMap }
+
+        class PoetrySource < T::ImmutableStruct
+          const :name, String
+          const :url, T.nilable(String), default: nil
+        end
+
+        sig { params(data: PyprojectValueParser::ObjectHash).void }
+        def initialize(data)
+          @data = data
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PyprojectDocument) }
+        def self.from_file(file)
+          content = T.must(file.content)
+          parsed = T.cast(TomlRB.parse(content), Object)
+          new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { returns(T::Boolean) }
+        def poetry?
+          !poetry_root.nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def pep621?
+          project = section(@data, "project", "project")
+          build_system = section(@data, "build-system", "build-system")
+
+          !project&.[]("dependencies").nil? ||
+            !project&.[]("optional-dependencies").nil? ||
+            !build_system&.[]("requires").nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def pep735?
+          @data.key?("dependency-groups")
+        end
+
+        sig { params(type: String).returns(PoetryDependencyMap) }
+        def poetry_dependencies(type)
+          root = poetry_root
+          return {} unless root
+
+          value = root[type]
+          return {} if value.nil?
+
+          PyprojectValueParser.poetry_dependency_map(value, "tool.poetry.#{type}")
+        end
+
+        sig { returns(T::Hash[String, PoetryDependencyMap]) }
+        def poetry_groups
+          root = poetry_root
+          return {} unless root
+
+          raw_groups = root["group"]
+          return {} if raw_groups.nil?
+
+          parsed_groups = PyprojectValueParser.object_hash(raw_groups, "tool.poetry.group")
+          parsed_groups.each_with_object({}) do |(name, value), groups|
+            group = PyprojectValueParser.object_hash(value, "tool.poetry.group.#{name}")
+            dependencies = group["dependencies"]
+            next if dependencies.nil?
+
+            groups[name] = PyprojectValueParser.poetry_dependency_map(
+              dependencies,
+              "tool.poetry.group.#{name}.dependencies"
+            )
+          end
+        end
+
+        sig { returns(T::Array[String]) }
+        def dynamic_fields
+          project = section(@data, "project", "project")
+          value = project&.[]("dynamic")
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "project.dynamic")
+        end
+
+        sig { params(name: String).returns(T::Boolean) }
+        def optional_dependency_group?(name)
+          project = section(@data, "project", "project")
+          value = project&.[]("optional-dependencies")
+          return false if value.nil?
+
+          PyprojectValueParser.object_hash(value, "project.optional-dependencies").key?(name)
+        end
+
+        sig { params(name: String).returns(T.nilable(PoetrySource)) }
+        def poetry_source(name)
+          poetry_sources.find { |source| source.name == name }
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          tool = section(@data, "tool", "tool")
+          uv = tool && section(tool, "uv", "tool.uv")
+          workspace = uv && section(uv, "workspace", "tool.uv.workspace")
+          value = workspace&.[](key)
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "tool.uv.workspace.#{key}")
+        end
+
+        private
+
+        sig { returns(T.nilable(PyprojectValueParser::ObjectHash)) }
+        def poetry_root
+          tool = section(@data, "tool", "tool")
+          tool && section(tool, "poetry", "tool.poetry")
+        end
+
+        sig { returns(T::Array[PoetrySource]) }
+        def poetry_sources
+          root = poetry_root
+          return [] unless root
+
+          value = root["source"]
+          return [] if value.nil?
+
+          PyprojectValueParser.array(value, "tool.poetry.source").map do |source|
+            source = PyprojectValueParser.object_hash(source, "tool.poetry.source entry")
+            PoetrySource.new(
+              name: PyprojectValueParser.string(source["name"], "Poetry source name"),
+              url: PyprojectValueParser.optional_string(source["url"], "Poetry source url")
+            )
+          end
+        end
+
+        sig do
+          params(
+            hash: PyprojectValueParser::ObjectHash,
+            key: String,
+            context: String
+          ).returns(T.nilable(PyprojectValueParser::ObjectHash))
+        end
+        def section(hash, key, context)
+          value = hash[key]
+          return if value.nil?
+
+          PyprojectValueParser.object_hash(value, context)
+        end
+      end
+    end
+  end
+end