dependabot-python 0.393.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 242cdbd71bb6b0424ba7c88daf21d1839db3eb9d3f0beb2ad9e070f3d624cf77
-  data.tar.gz: 40a2faa1353d5fd82480211fee5ac28840996cf483fdf3c884fb558702396f08
+  metadata.gz: 0a1dec50c1cd900eb433c984eb046d5a4b4e327c036d83c09e4d90ce1dd93572
+  data.tar.gz: 608eb3b97ebcc5ee85f66fda06bb4f1f2407e244f3f582c333ec9cf604edd90e
 SHA512:
-  metadata.gz: 9a75d27db29ca5df37ea4e4962da3cbbfa0c05627044fd340d9b0b6f657108d44ff78bc40c206b2d0ac3a6d8387f3f0f30cd7dfeacafee122fd92b3e2d981954
-  data.tar.gz: 7651c73fdab13d9f091cada4a7d7531842e90042825ef0052c67882e90958870a26fd3936ac213bcd69362d9ac3b9d64d422a34ea4f9646344468851c6969b7c
+  metadata.gz: 5b2de818a1e9b73a7b1af590c4f9bdf3c5ecf64d8bdd36e5043831e9d781f6fb829fe3282e0080e129595eb5adc49631c4d956bc1501dcd623fbeab8a8ba7b2a
+  data.tar.gz: 90ae8a95010a4a414c1fdffd2d9ad371c3ff3418852191297d03699abadb62b5d7aa4b7ed9dae5e288bd246c7475f7ee29b8d7ed11f84b822b9efb2cc30ab903

data/helpers/requirements.txt

@@ -1,4 +1,4 @@
-pip==26.1.2
+pip==26.2.1
 pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
@@ -10,4 +10,4 @@ pytest==9.1.1
 tomli==2.4.1
 
 # Some dependencies will only install if Cython is present
-Cython==3.2.9
+Cython==3.3.0

data/lib/dependabot/python/file_parser/pep_dependency.rb

@@ -0,0 +1,53 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PepDependency < T::ImmutableStruct
+        extend T::Sig
+
+        const :name, String
+        const :version, T.nilable(String), default: nil
+        const :markers, T.nilable(String), default: nil
+        const :file, String
+        const :requirement, T.nilable(String), default: nil
+        const :source_requirement, T.nilable(String), default: nil
+        const :extras, T::Array[String]
+        const :requirement_type, T.nilable(String), default: nil
+
+        sig { params(result: Object).returns(T::Array[PepDependency]) }
+        def self.from_helper_result(result)
+          PyprojectValueParser.array(result, "PEP dependency result").map do |value|
+            from_object(value)
+          end
+        end
+
+        sig { params(value: Object).returns(PepDependency) }
+        def self.from_object(value)
+          hash = PyprojectValueParser.object_hash(value, "PEP dependency")
+          new(
+            name: PyprojectValueParser.string(hash["name"], "PEP dependency name"),
+            version: PyprojectValueParser.optional_string(hash["version"], "PEP dependency version"),
+            markers: PyprojectValueParser.optional_string(hash["markers"], "PEP dependency markers"),
+            file: PyprojectValueParser.string(hash["file"], "PEP dependency file"),
+            requirement: PyprojectValueParser.optional_string(hash["requirement"], "PEP dependency requirement"),
+            source_requirement: PyprojectValueParser.optional_string(
+              hash["source_requirement"],
+              "PEP dependency source_requirement"
+            ),
+            extras: PyprojectValueParser.string_array(hash["extras"], "PEP dependency extras"),
+            requirement_type: PyprojectValueParser.optional_string(
+              hash["requirement_type"],
+              "PEP dependency requirement_type"
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/poetry_lock.rb

@@ -0,0 +1,95 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PoetryLock
+        extend T::Sig
+
+        class Package < T::ImmutableStruct
+          extend T::Sig
+
+          const :name, String
+          const :version, String
+          const :source_type, T.nilable(String), default: nil
+
+          sig { params(value: Object).returns(Package) }
+          def self.from_object(value)
+            hash = PyprojectValueParser.object_hash(value, "Poetry lock package")
+            source = hash["source"]
+            source_hash =
+              if source.nil?
+                nil
+              else
+                PyprojectValueParser.object_hash(source, "Poetry lock package source")
+              end
+
+            new(
+              name: PyprojectValueParser.string(hash["name"], "Poetry lock package name"),
+              version: PyprojectValueParser.string(hash["version"], "Poetry lock package version"),
+              source_type: PyprojectValueParser.optional_string(
+                source_hash&.[]("type"),
+                "Poetry lock package source type"
+              )
+            )
+          end
+
+          sig { returns(T::Hash[Symbol, T.nilable(String)]) }
+          def to_h
+            {
+              name: name,
+              version: version,
+              source_type: source_type
+            }
+          end
+        end
+
+        sig { returns(T::Array[Package]) }
+        attr_reader :packages
+
+        sig { params(packages: T::Array[Package]).void }
+        def initialize(packages)
+          @packages = packages
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PoetryLock) }
+        def self.from_file(file)
+          parsed = T.cast(TomlRB.parse(T.must(file.content)), Object)
+          document = PyprojectValueParser.object_hash(parsed, "poetry.lock")
+          value = document["package"]
+          packages =
+            if value.nil?
+              []
+            else
+              PyprojectValueParser.array(value, "poetry.lock package").map do |package|
+                Package.from_object(package)
+              end
+            end
+          new(packages)
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig do
+          params(
+            name: String,
+            _normalizer: T.proc.params(name: String).returns(String)
+          )
+            .returns(T.nilable(String))
+        end
+        def version_for(name, &_normalizer)
+          normalized_name = yield(name)
+          packages.find { |package| yield(package.name) == normalized_name }&.version
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -0,0 +1,284 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      module PyprojectValueParser
+        extend T::Sig
+
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+        PoetryRequirement = T.type_alias { T.any(String, ObjectHash) }
+        PoetryDependencyMap = T.type_alias { T::Hash[String, T::Array[PoetryRequirement]] }
+
+        sig { params(value: Object, context: String).returns(ObjectHash) }
+        def self.object_hash(value, context)
+          raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[Object]) }
+        def self.array(value, context)
+          raise TypeError, "#{context} must be an array" unless value.is_a?(Array)
+
+          value.map { |item| T.cast(item, Object) }
+        end
+
+        sig { params(value: Object, context: String).returns(String) }
+        def self.string(value, context)
+          return value if value.is_a?(String)
+
+          raise TypeError, "#{context} must be a string"
+        end
+
+        sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+        def self.optional_string(value, context)
+          return if value.nil?
+
+          string(value, context)
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[String]) }
+        def self.string_array(value, context)
+          array(value, context).map do |item|
+            raise TypeError, "#{context} must contain only strings" unless item.is_a?(String)
+
+            item
+          end
+        end
+
+        sig { params(value: Object, name: String).returns(T::Array[PoetryRequirement]) }
+        def self.poetry_requirements(value, name)
+          flattened = value.is_a?(Array) ? value.flatten : [value]
+          flattened.compact.map do |item|
+            item = T.cast(item, Object)
+            case item
+            when String
+              item
+            when Hash
+              object_hash(item, "Poetry dependency #{name}")
+            else
+              raise TypeError, "Poetry dependency #{name} must be a string, object, or array"
+            end
+          end
+        end
+
+        sig { params(value: Object, context: String).returns(PoetryDependencyMap) }
+        def self.poetry_dependency_map(value, context)
+          object_hash(value, context).to_h do |name, requirement|
+            [name, poetry_requirements(requirement, name)]
+          end
+        end
+      end
+      private_constant :PyprojectValueParser
+
+      class PyprojectDocument
+        extend T::Sig
+
+        PoetryRequirement = T.type_alias { PyprojectValueParser::PoetryRequirement }
+        PoetryDependencyMap = T.type_alias { PyprojectValueParser::PoetryDependencyMap }
+
+        class PoetrySource < T::ImmutableStruct
+          const :name, String
+          const :url, T.nilable(String), default: nil
+        end
+
+        class ProjectMetadata < T::ImmutableStruct
+          const :name, T.nilable(String), default: nil
+          const :description, T.nilable(String), default: nil
+        end
+
+        sig { params(data: PyprojectValueParser::ObjectHash).void }
+        def initialize(data)
+          @data = data
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PyprojectDocument) }
+        def self.from_file(file)
+          from_content(T.must(file.content))
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { params(content: String).returns(PyprojectDocument) }
+        def self.from_content(content)
+          parsed = T.cast(TomlRB.parse(content), Object)
+          new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
+        end
+
+        sig { returns(T::Boolean) }
+        def poetry?
+          !poetry_root.nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def project?
+          !section(@data, "project", "project").nil?
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def poetry_metadata
+          metadata_from(poetry_root, "tool.poetry")
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def project_metadata
+          metadata_from(section(@data, "project", "project"), "project")
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def build_system_metadata
+          metadata_from(section(@data, "build-system", "build-system"), "build-system")
+        end
+
+        sig { returns(T::Boolean) }
+        def pep621?
+          project = section(@data, "project", "project")
+          build_system = section(@data, "build-system", "build-system")
+
+          !project&.[]("dependencies").nil? ||
+            !project&.[]("optional-dependencies").nil? ||
+            !build_system&.[]("requires").nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def pep735?
+          @data.key?("dependency-groups")
+        end
+
+        sig { params(type: String).returns(PoetryDependencyMap) }
+        def poetry_dependencies(type)
+          root = poetry_root
+          return {} unless root
+
+          value = root[type]
+          return {} if value.nil?
+
+          PyprojectValueParser.poetry_dependency_map(value, "tool.poetry.#{type}")
+        end
+
+        sig { returns(T::Hash[String, PoetryDependencyMap]) }
+        def poetry_groups
+          root = poetry_root
+          return {} unless root
+
+          raw_groups = root["group"]
+          return {} if raw_groups.nil?
+
+          parsed_groups = PyprojectValueParser.object_hash(raw_groups, "tool.poetry.group")
+          parsed_groups.each_with_object({}) do |(name, value), groups|
+            group = PyprojectValueParser.object_hash(value, "tool.poetry.group.#{name}")
+            dependencies = group["dependencies"]
+            next if dependencies.nil?
+
+            groups[name] = PyprojectValueParser.poetry_dependency_map(
+              dependencies,
+              "tool.poetry.group.#{name}.dependencies"
+            )
+          end
+        end
+
+        sig { returns(T::Array[String]) }
+        def dynamic_fields
+          project = section(@data, "project", "project")
+          value = project&.[]("dynamic")
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "project.dynamic")
+        end
+
+        sig { params(name: String).returns(T::Boolean) }
+        def optional_dependency_group?(name)
+          project = section(@data, "project", "project")
+          value = project&.[]("optional-dependencies")
+          return false if value.nil?
+
+          PyprojectValueParser.object_hash(value, "project.optional-dependencies").key?(name)
+        end
+
+        sig { params(name: String).returns(T.nilable(PoetrySource)) }
+        def poetry_source(name)
+          poetry_sources.find { |source| source.name == name }
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          tool = section(@data, "tool", "tool")
+          uv = tool && section(tool, "uv", "tool.uv")
+          workspace = uv && section(uv, "workspace", "tool.uv.workspace")
+          value = workspace&.[](key)
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "tool.uv.workspace.#{key}")
+        end
+
+        private
+
+        sig do
+          params(data: T.nilable(PyprojectValueParser::ObjectHash), context: String)
+            .returns(T.nilable(ProjectMetadata))
+        end
+        def metadata_from(data, context)
+          return unless data
+
+          ProjectMetadata.new(
+            name: PyprojectValueParser.optional_string(data["name"], "#{context}.name"),
+            description: PyprojectValueParser.optional_string(data["description"], "#{context}.description")
+          )
+        end
+
+        sig { returns(T.nilable(PyprojectValueParser::ObjectHash)) }
+        def poetry_root
+          tool = section(@data, "tool", "tool")
+          tool && section(tool, "poetry", "tool.poetry")
+        end
+
+        sig { returns(T::Array[PoetrySource]) }
+        def poetry_sources
+          root = poetry_root
+          return [] unless root
+
+          value = root["source"]
+          return [] if value.nil?
+
+          PyprojectValueParser.array(value, "tool.poetry.source").map do |source|
+            source = PyprojectValueParser.object_hash(source, "tool.poetry.source entry")
+            PoetrySource.new(
+              name: PyprojectValueParser.string(source["name"], "Poetry source name"),
+              url: PyprojectValueParser.optional_string(source["url"], "Poetry source url")
+            )
+          end
+        end
+
+        sig do
+          params(
+            hash: PyprojectValueParser::ObjectHash,
+            key: String,
+            context: String
+          ).returns(T.nilable(PyprojectValueParser::ObjectHash))
+        end
+        def section(hash, key, context)
+          value = hash[key]
+          return if value.nil?
+
+          PyprojectValueParser.object_hash(value, context)
+        end
+      end
+    end
+  end
+end