dependabot-python 0.395.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a1dec50c1cd900eb433c984eb046d5a4b4e327c036d83c09e4d90ce1dd93572
-  data.tar.gz: 608eb3b97ebcc5ee85f66fda06bb4f1f2407e244f3f582c333ec9cf604edd90e
+  metadata.gz: 888f4700108c651abbfd1604d6e2d87a13a836c1939d32617ee9be72a53c3967
+  data.tar.gz: afe0da2c49e3d9f141c14a2e513322ffd4629691c05ebaed078642d00d1f0b17
 SHA512:
-  metadata.gz: 5b2de818a1e9b73a7b1af590c4f9bdf3c5ecf64d8bdd36e5043831e9d781f6fb829fe3282e0080e129595eb5adc49631c4d956bc1501dcd623fbeab8a8ba7b2a
-  data.tar.gz: 90ae8a95010a4a414c1fdffd2d9ad371c3ff3418852191297d03699abadb62b5d7aa4b7ed9dae5e288bd246c7475f7ee29b8d7ed11f84b822b9efb2cc30ab903
+  metadata.gz: fe09edfd56b3d1ccc79bf494528e322bbfcff4bc9d2335265e01af41c5b23a925c22ac0f8fd915c8a73ba355ac9226752f438c63deb0ef6a79d977573169990f
+  data.tar.gz: 6cd05d5203c68ccc9a0e0230a1acf097425fe0ff451c8f43adecf887148bd7c06c20cdd8a350aa281cccd162ed1caa588078645a316c47d953f88fd75ce3e71b

data/lib/dependabot/python/dependency_grapher.rb

@@ -393,7 +393,8 @@ module Dependabot
             dependency: nil,
             lockfile: pipfile_lock,
             language_version_manager: language_version_manager,
-            dependency_files: dependency_files
+            dependency_files: dependency_files,
+            repo_contents_path: file_parser.repo_contents_path
           ),
           T.nilable(PipenvRunner)
         )

data/lib/dependabot/python/file_parser/pep_dependency.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 
+require "dependabot/errors"
 require "dependabot/python/file_parser"
 
 module Dependabot
@@ -27,6 +28,17 @@ module Dependabot
           end
         end
 
+        sig { params(result: Object).returns(T::Array[PepDependency]) }
+        def self.from_requirements_helper_result(result)
+          PyprojectValueParser.array(result, "parse_requirements result").each_with_index.map do |value, index|
+            from_object(value)
+          rescue TypeError => e
+            raise Dependabot::DependencyFileNotEvaluatable, "parse_requirements result[#{index}]: #{e.message}"
+          end
+        rescue TypeError => e
+          raise Dependabot::DependencyFileNotEvaluatable, e.message
+        end
+
         sig { params(value: Object).returns(PepDependency) }
         def self.from_object(value)
           hash = PyprojectValueParser.object_hash(value, "PEP dependency")

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -216,6 +216,37 @@ module Dependabot
           poetry_sources.find { |source| source.name == name }
         end
 
+        # A name pinned to one of these says nothing about what a package index holds. A git source
+        # carrying a tag is left alone: the tag gives an ordering, so such a pin can be updated from
+        # the remote instead of being skipped.
+        UNRESOLVABLE_UV_SOURCE_KEYS = %w(git url).freeze
+
+        sig { returns(T::Array[String]) }
+        def unresolvable_uv_source_names
+          tool = section(@data, "tool", "tool")
+          uv = tool && section(tool, "uv", "tool.uv")
+          sources = uv && section(uv, "sources", "tool.uv.sources")
+          return [] unless sources
+
+          sources.filter_map do |name, config|
+            # uv accepts either a single source or a list of them, each with its own markers.
+            entries = T.let(config.is_a?(Array) ? config : [config], T::Array[Object])
+            next unless entries.any? { |entry| unresolvable_uv_source_entry?(entry) }
+
+            name
+          end
+        end
+
+        sig { params(entry: Object).returns(T::Boolean) }
+        def unresolvable_uv_source_entry?(entry)
+          return false unless entry.is_a?(Hash)
+
+          keys = entry.keys
+          return false unless keys.intersect?(UNRESOLVABLE_UV_SOURCE_KEYS)
+
+          !(keys.include?("git") && keys.include?("tag"))
+        end
+
         sig { params(key: String).returns(T::Array[String]) }
         def workspace_globs(key)
           tool = section(@data, "tool", "tool")

data/lib/dependabot/python/file_parser.rb

@@ -295,16 +295,16 @@ module Dependabot
           # probably blocked. Ignore it.
           next if blocking_marker?(dep)
 
-          name = dep["name"]
-          file = dep["file"]
-          version = dep["version"]
+          name = dep.name
+          file = dep.file
+          version = dep.version
           original_file = get_original_file(file)
 
           requirements =
             if original_file && pip_compile_file_matcher.lockfile_for_pip_compile_file?(original_file) then []
             else
               [{
-                requirement: dep["requirement"],
+                requirement: dep.requirement,
                 file: Pathname.new(file).cleanpath.to_path,
                 source: nil,
                 groups: group_from_filename(file)
@@ -320,7 +320,7 @@ module Dependabot
               version: version&.include?("*") ? nil : version,
               requirements: requirements,
               package_manager: "pip",
-              metadata: extras_metadata(dep["extras"])
+              metadata: extras_metadata(dep.extras)
             )
         end
         dependencies
@@ -342,36 +342,33 @@ module Dependabot
         end
       end
 
-      sig { params(dep: T.untyped).returns(T::Boolean) }
+      sig { params(dep: PepDependency).returns(T::Boolean) }
       def blocking_marker?(dep)
-        return false if dep["markers"] == "None"
+        marker = dep.markers
+        return false if marker.nil? || marker == "None"
 
-        marker = dep["markers"]
         version = python_raw_version
 
         if marker.include?("python_version")
           !marker_satisfied?(marker, version)
         else
-          return true if dep["markers"].include?("<")
-          return false if dep["markers"].include?(">")
-          return false if dep["requirement"].nil?
+          return true if marker.include?("<")
+          return false if marker.include?(">")
 
-          dep["requirement"].include?("<")
+          dep.requirement&.include?("<") || false
         end
       end
 
-      sig do
-        params(marker: T.untyped, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean)
-      end
+      sig { params(marker: String, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean) }
       def marker_satisfied?(marker, python_version)
         conditions = marker.split(/\s+(and|or)\s+/)
 
         # Explicitly define the type of result as T::Boolean
-        result = T.let(evaluate_condition(conditions.shift, python_version), T::Boolean)
+        result = T.let(evaluate_condition(T.must(conditions.shift), python_version), T::Boolean)
 
         until conditions.empty?
           operator = conditions.shift
-          next_condition = conditions.shift
+          next_condition = T.must(conditions.shift)
           next_result = evaluate_condition(next_condition, python_version)
 
           result = if operator == "and"
@@ -386,12 +383,13 @@ module Dependabot
 
       sig do
         params(
-          condition: T.untyped,
+          condition: String,
           python_version: T.any(String, Integer, Gem::Version)
         ).returns(T::Boolean)
       end
       def evaluate_condition(condition, python_version)
         operator, version = condition.match(/([<>=!]=?)\s*"?([\d.]+)"?/)&.captures
+        return false unless version
 
         case operator
         when "<"
@@ -418,17 +416,18 @@ module Dependabot
         )
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T::Array[PepDependency]) }
       def parsed_requirement_files
         SharedHelpers.in_a_temporary_directory do
           write_temporary_dependency_files
 
-          requirements = SharedHelpers.run_helper_subprocess(
+          result = SharedHelpers.run_helper_subprocess(
             command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
             function: "parse_requirements",
             args: [Dir.pwd]
           )
 
+          requirements = PepDependency.from_requirements_helper_result(result)
           check_requirements(requirements)
           requirements
         end
@@ -439,12 +438,13 @@ module Dependabot
         raise Dependabot::DependencyFileNotEvaluatable, e.message
       end
 
-      sig { params(requirements: T.untyped).returns(T.untyped) }
+      sig { params(requirements: T::Array[PepDependency]).void }
       def check_requirements(requirements)
         requirements.each do |dep|
-          next unless dep["requirement"]
+          requirement = dep.requirement
+          next unless requirement
 
-          Python::Requirement.new(dep["requirement"].split(","))
+          Python::Requirement.new(requirement.split(","))
         rescue Gem::Requirement::BadRequirementError => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message
         end

data/lib/dependabot/python/pipenv_runner.rb

@@ -16,15 +16,17 @@ module Dependabot
           dependency: T.nilable(Dependabot::Dependency),
           lockfile: T.nilable(Dependabot::DependencyFile),
           language_version_manager: LanguageVersionManager,
-          dependency_files: T.nilable(T::Array[Dependabot::DependencyFile])
+          dependency_files: T.nilable(T::Array[Dependabot::DependencyFile]),
+          repo_contents_path: T.nilable(String)
         )
           .void
       end
-      def initialize(dependency:, lockfile:, language_version_manager:, dependency_files: nil)
+      def initialize(dependency:, lockfile:, language_version_manager:, dependency_files: nil, repo_contents_path: nil)
         @dependency = dependency
         @lockfile = lockfile
         @language_version_manager = language_version_manager
         @dependency_files = dependency_files
+        @repo_contents_path = repo_contents_path
       end
 
       sig { params(constraint: T.nilable(String)).returns(String) }
@@ -53,7 +55,8 @@ module Dependabot
       # Called by Python::DependencyGrapher.
       sig { returns(String) }
       def run_pipenv_graph
-        SharedHelpers.in_a_temporary_directory do
+        SharedHelpers.in_a_temporary_repo_directory(base_directory, repo_contents_path) do
+          File.write(".python-version", language_version_manager.python_major_minor)
           write_temporary_dependency_files
           language_version_manager.install_required_python
           run_command("pyenv exec pipenv sync --dev", fingerprint: "pyenv exec pipenv sync --dev")
@@ -85,6 +88,9 @@ module Dependabot
       sig { returns(T.nilable(T::Array[Dependabot::DependencyFile])) }
       attr_reader :dependency_files
 
+      sig { returns(T.nilable(String)) }
+      attr_reader :repo_contents_path
+
       sig { returns(Dependabot::Dependency) }
       def current_dependency
         T.must(dependency)
@@ -101,6 +107,11 @@ module Dependabot
         end
       end
 
+      sig { returns(String) }
+      def base_directory
+        dependency_files&.first&.directory || "/"
+      end
+
       sig { returns(String) }
       def extras_specification
         extras = dependency_extras

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -327,7 +327,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib