dependabot-python 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d1b1deb24d07d3b15f0c1cb2a434bc4014459ff9e52173a6b1aa1608bed9bef
-  data.tar.gz: c2a82f5e34e3f06ecfd16ad0516aa925d7cea4d564b9436befaf50ea5eaeb05f
+  metadata.gz: 0a1dec50c1cd900eb433c984eb046d5a4b4e327c036d83c09e4d90ce1dd93572
+  data.tar.gz: 608eb3b97ebcc5ee85f66fda06bb4f1f2407e244f3f582c333ec9cf604edd90e
 SHA512:
-  metadata.gz: c6f557bb606f5cdd0105035e2569dfb80410716ae0b6eb514c46d92837f4677107e2f22c309dd90fcd983c0b4a0d23a8ef596036f242560670de569b90a01b43
-  data.tar.gz: 7426a6a6748ef14ed637e82fa5757e5a11fc2c56fadb9e549b559a35e0bd831985978be092f6908068ae5cdd787d330ff95bc7e9b54dc0add588523a4a194d6d
+  metadata.gz: 5b2de818a1e9b73a7b1af590c4f9bdf3c5ecf64d8bdd36e5043831e9d781f6fb829fe3282e0080e129595eb5adc49631c4d956bc1501dcd623fbeab8a8ba7b2a
+  data.tar.gz: 90ae8a95010a4a414c1fdffd2d9ad371c3ff3418852191297d03699abadb62b5d7aa4b7ed9dae5e288bd246c7475f7ee29b8d7ed11f84b822b9efb2cc30ab903

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -98,6 +98,11 @@ module Dependabot
           const :url, T.nilable(String), default: nil
         end
 
+        class ProjectMetadata < T::ImmutableStruct
+          const :name, T.nilable(String), default: nil
+          const :description, T.nilable(String), default: nil
+        end
+
         sig { params(data: PyprojectValueParser::ObjectHash).void }
         def initialize(data)
           @data = data
@@ -105,18 +110,42 @@ module Dependabot
 
         sig { params(file: Dependabot::DependencyFile).returns(PyprojectDocument) }
         def self.from_file(file)
-          content = T.must(file.content)
-          parsed = T.cast(TomlRB.parse(content), Object)
-          new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
+          from_content(T.must(file.content))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           raise Dependabot::DependencyFileNotParseable, file.path
         end
 
+        sig { params(content: String).returns(PyprojectDocument) }
+        def self.from_content(content)
+          parsed = T.cast(TomlRB.parse(content), Object)
+          new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
+        end
+
         sig { returns(T::Boolean) }
         def poetry?
           !poetry_root.nil?
         end
 
+        sig { returns(T::Boolean) }
+        def project?
+          !section(@data, "project", "project").nil?
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def poetry_metadata
+          metadata_from(poetry_root, "tool.poetry")
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def project_metadata
+          metadata_from(section(@data, "project", "project"), "project")
+        end
+
+        sig { returns(T.nilable(ProjectMetadata)) }
+        def build_system_metadata
+          metadata_from(section(@data, "build-system", "build-system"), "build-system")
+        end
+
         sig { returns(T::Boolean) }
         def pep621?
           project = section(@data, "project", "project")
@@ -200,6 +229,19 @@ module Dependabot
 
         private
 
+        sig do
+          params(data: T.nilable(PyprojectValueParser::ObjectHash), context: String)
+            .returns(T.nilable(ProjectMetadata))
+        end
+        def metadata_from(data, context)
+          return unless data
+
+          ProjectMetadata.new(
+            name: PyprojectValueParser.optional_string(data["name"], "#{context}.name"),
+            description: PyprojectValueParser.optional_string(data["description"], "#{context}.description")
+          )
+        end
+
         sig { returns(T.nilable(PyprojectValueParser::ObjectHash)) }
         def poetry_root
           tool = section(@data, "tool", "tool")

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -17,7 +17,7 @@ require "dependabot/python/authed_url_builder"
 module Dependabot
   module Python
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class PipCompileFileUpdater
         extend T::Sig
 
@@ -466,6 +466,7 @@ module Dependabot
         end
 
         sig { params(name: String, version: String, algorithm: String).returns(T::Array[String]) }
+        # rubocop:disable-next Metrics/PerceivedComplexity
         def package_hashes_for(name:, version:, algorithm:)
           index_urls = @index_urls || [nil]
           hashes = []
@@ -477,12 +478,17 @@ module Dependabot
             args << index_url if index_url
 
             begin
+              helper_result = SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "get_dependency_hash",
+                args: args
+              )
+
+              # Skip this index if helper returned nil (can happen with unavailable registries)
+              next if helper_result.nil?
+
               native_helper_hashes = T.cast(
-                SharedHelpers.run_helper_subprocess(
-                  command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                  function: "get_dependency_hash",
-                  args: args
-                ),
+                helper_result,
                 T::Array[T::Hash[String, String]]
               ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }
 
@@ -494,9 +500,10 @@ module Dependabot
             end
           end
 
+          raise DependencyFileNotResolvable, "Unable to find hashes for package #{name}" if hashes.empty?
+
           hashes
         end
-
         sig { params(requirement_string: String).returns(T.nilable(String)) }
         def hash_separator(requirement_string)
           hash_regex = RequirementParser::HASH
@@ -807,7 +814,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -19,7 +19,7 @@ module Dependabot
     class UpdateChecker
       # This resolver intentionally co-locates resolution, marker handling, and
       # constraints matching to keep compatibility decisions in one place.
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class PipVersionResolver
         extend T::Sig
 
@@ -575,7 +575,6 @@ module Dependabot
           T.must(@pyproject_content_cache[pyproject.name])
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -12,7 +12,7 @@ require "dependabot/requirements_update_strategy"
 module Dependabot
   module Python
     class UpdateChecker
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class RequirementsUpdater
         extend T::Sig
 
@@ -358,7 +358,7 @@ module Dependabot
           new_segments
             .first(count)
             .map.with_index { |s, i| i < precision ? s : "*" }
-                .join(".")
+            .join(".")
         end
 
         sig { params(requirement_strings: T::Array[String]).returns(String) }
@@ -542,7 +542,6 @@ module Dependabot
           Python::Requirement
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/python/update_checker.rb

@@ -2,12 +2,13 @@
 # frozen_string_literal: true
 
 require "excon"
-require "toml-rb"
+require "json"
 require "sorbet-runtime"
 
 require "dependabot/dependency"
 require "dependabot/dependency_requirement"
 require "dependabot/errors"
+require "dependabot/python/file_parser"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/requirement"
@@ -18,7 +19,7 @@ require "dependabot/update_checkers/base"
 
 module Dependabot
   module Python
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
@@ -29,6 +30,8 @@ module Dependabot
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/latest_version_finder"
 
+      PyprojectDocument = FileParser::PyprojectDocument
+
       MAIN_PYPI_INDEXES = %w(
         https://pypi.python.org/simple/
         https://pypi.org/simple/
@@ -248,7 +251,7 @@ module Dependabot
         # For hybrid projects with both [tool.poetry] and [project] sections but no lockfile,
         # use the requirements resolver to handle PEP 621 dependencies
         # For pure Poetry projects, use Poetry resolver even without lockfile
-        return :poetry if poetry_based? && (poetry_lock || !standard_details)
+        return :poetry if poetry_based? && (poetry_lock || !pyproject_document.project?)
 
         :requirements
       end
@@ -395,7 +398,7 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def poetry_based?
-        updating_pyproject? && !poetry_details.nil?
+        updating_pyproject? && pyproject_document.poetry?
       end
 
       sig { returns(T::Boolean) }
@@ -410,22 +413,41 @@ module Dependabot
       def check_pypi_for_library_match
         return false unless updating_pyproject?
 
-        library_details_temp = library_details
-        return false unless library_details_temp && !library_details_temp["name"].nil?
+        metadata = library_details
+        name = metadata&.name
+        return false unless name
 
-        has_library_metadata = !library_details_temp["description"].nil?
+        local_description = metadata.description
+        has_library_metadata = !local_description.nil?
 
-        response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(library_details_temp['name'])}/json/"
-        )
-        return has_library_metadata unless response.status == 200
+        begin
+          response = Dependabot::RegistryClient.get(
+            url: "https://pypi.org/pypi/#{normalised_name(name)}/json/"
+          )
+          return has_library_metadata unless response.status == 200
 
-        local_description = library_details_temp["description"]
-        return true if local_description.nil?
+          return true if local_description.nil?
 
-        (JSON.parse(response.body)["info"] || {})["summary"] == local_description
-      rescue Excon::Error::Timeout, Excon::Error::Socket, URI::InvalidURIError
-        has_library_metadata
+          pypi_summary(response.body) == local_description
+        rescue Excon::Error::Timeout, Excon::Error::Socket, URI::InvalidURIError
+          has_library_metadata
+        end
+      end
+
+      sig { params(body: String).returns(T.nilable(String)) }
+      def pypi_summary(body)
+        metadata = T.cast(JSON.parse(body), Object)
+        raise TypeError, "PyPI metadata must be an object" unless metadata.is_a?(Hash)
+
+        info = T.cast(metadata["info"], Object)
+        return if info.nil?
+        raise TypeError, "PyPI info must be an object" unless info.is_a?(Hash)
+
+        summary = T.cast(info["summary"], Object)
+        return if summary.nil?
+        return summary if summary.is_a?(String)
+
+        raise TypeError, "PyPI info.summary must be a string"
       end
 
       sig { returns(T::Boolean) }
@@ -483,43 +505,21 @@ module Dependabot
         dependency_files.find { |f| f.name == "poetry.lock" }
       end
 
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { returns(T.nilable(PyprojectDocument::ProjectMetadata)) }
       def library_details
         @library_details ||= T.let(
-          poetry_details || standard_details || build_system_details,
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def poetry_details
-        @poetry_details ||= T.let(
-          toml_content.dig("tool", "poetry"),
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def standard_details
-        @standard_details ||= T.let(
-          toml_content["project"],
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def build_system_details
-        @build_system_details ||= T.let(
-          toml_content["build-system"],
-          T.nilable(T::Hash[String, T.untyped])
+          pyproject_document.poetry_metadata ||
+            pyproject_document.project_metadata ||
+            pyproject_document.build_system_metadata,
+          T.nilable(PyprojectDocument::ProjectMetadata)
         )
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def toml_content
-        @toml_content ||= T.let(
-          TomlRB.parse(T.must(pyproject).content),
-          T.nilable(T::Hash[String, T.untyped])
+      sig { returns(PyprojectDocument) }
+      def pyproject_document
+        @pyproject_document ||= T.let(
+          PyprojectDocument.from_content(T.must(T.must(pyproject).content)),
+          T.nilable(PyprojectDocument)
         )
       end
 
@@ -528,7 +528,6 @@ module Dependabot
         dependency_files.select { |f| f.name.end_with?(".in") }
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -178,19 +178,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -327,7 +327,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib