dependabot-python 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34c523af279e445c79d075ebf5b490c037d934602da7f626250e10e421be7dd2
-  data.tar.gz: 55c074f5276a81f6fd3f6194fd8241106bcc1d1bea16bc0b2eba7a3890b97461
+  metadata.gz: e243e407de697945437e9818b4a451ab39ecb274ea6281b9ddcd2270d1bd16e7
+  data.tar.gz: 2ff42e6c9c205775d467942431d3c8aa51e2c4db9557b7bfbea733e2b201cfae
 SHA512:
-  metadata.gz: 24f9cd2e78f256a02a6d4808a899476c441b32142050d845e5f238e37b01a45fefe4f874d661da5e535e9fdebd1006cd0891ef5f9b67199203fcd849fc5fe54a
-  data.tar.gz: 39d66f3dc7fe82c0f0a89ccf7133cf400602cbd284cb2412fef799d80637ea2b83a6cc155bd94cd7837918463ef7dd0e556e809cc083009aaeb449e8aef1190a
+  metadata.gz: '0297caeec2ee5d809878d232089fabb5015966cb703bf59f3fcbdd295ca87908be3bffbe447d9c32b79b2945796f4c7d2a985574643496fe45e69116fb77a7fc'
+  data.tar.gz: 9f2c74c8fca0e487014943a033c030c67907c0f9135ae802bf4bd8d38dab8c876f18e0f05f98f7cae033906555ce0981c54b48671dd5d4d345e9b892576dda96

data/helpers/requirements.txt

@@ -1,10 +1,10 @@
 pip==26.2.1
 pip-tools==7.6.1
-flake8==7.3.0
+flake8==7.4.1
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.4.1
+poetry==2.5.1
 pytest==9.1.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1

data/lib/dependabot/python/file_parser/pipfile_document.rb

@@ -0,0 +1,105 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PipfileDocument
+        extend T::Sig
+
+        class Entry
+          extend T::Sig
+
+          sig { params(name: String, value: Object, context: String).void }
+          def initialize(name:, value:, context:)
+            @name = name
+            @context = context
+            @value = T.let(
+              value.is_a?(String) ? value : PyprojectValueParser.object_hash(value, context),
+              T.any(String, PyprojectValueParser::ObjectHash)
+            )
+          end
+
+          sig { returns(String) }
+          attr_reader :name
+
+          sig { returns(T::Boolean) }
+          def specifies_version?
+            value = @value
+            return true if value.is_a?(String)
+
+            version = value["version"]
+            return false if version.nil? || version == false
+            return true if version.is_a?(String) || version == true
+
+            raise TypeError, "#{@context} version must be a string or boolean"
+          end
+
+          sig { returns(T::Boolean) }
+          def git_or_path?
+            value = @value
+            value.is_a?(Hash) && (value.key?("git") || value.key?("path"))
+          end
+
+          sig { returns(String) }
+          def requirement
+            value = @value
+            return value.empty? ? "*" : value if value.is_a?(String)
+
+            PyprojectValueParser.string(value["version"], "#{@context} version")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def lookup_version
+            value = @value
+            return value.strip if value.is_a?(String)
+
+            PyprojectValueParser.optional_string(value["version"], "#{@context} version")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def lockfile_version
+            value = @value
+            version = value.is_a?(String) ? value : value["version"]
+            return unless version
+            return if git_or_path?
+
+            PyprojectValueParser.string(version, "#{@context} version")
+          end
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PipfileDocument) }
+        def self.from_file(file)
+          new(data: T.cast(TomlRB.parse(T.must(file.content)), Object), context: file.path)
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { params(data: Object, context: String).void }
+        def initialize(data:, context:)
+          @data = T.let(PyprojectValueParser.object_hash(data, context), PyprojectValueParser::ObjectHash)
+          @context = context
+        end
+
+        sig { params(group: String).returns(T::Array[Entry]) }
+        def entries(group)
+          value = @data[group]
+          return [] unless value
+          return [] if value.is_a?(Array) && value.empty?
+
+          context = "#{@context} #{group}"
+          PyprojectValueParser.object_hash(value, context).map do |name, requirement|
+            Entry.new(name: name, value: requirement, context: "#{context} entry")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pipfile_files_parser.rb

@@ -1,17 +1,14 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "toml-rb"
-
 require "dependabot/dependency"
 require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/python/file_parser"
-require "dependabot/errors"
 require "dependabot/python/name_normaliser"
 
 module Dependabot
   module Python
-    class FileParser
+    class FileParser < Dependabot::FileParsers::Base
       class PipfileFilesParser
         extend T::Sig
 
@@ -54,30 +51,24 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           DEPENDENCY_GROUP_KEYS.each do |keys|
-            next unless parsed_pipfile[T.must(keys[:pipfile])]
-
-            parsed_pipfile[T.must(keys[:pipfile])].map do |dep_name, req|
-              group = keys[:lockfile]
-              next unless specifies_version?(req)
-              next if git_or_path_requirement?(req)
-              next if pipfile_lock && !dependency_version(dep_name, req, T.must(group))
-
-              # Empty requirements are not allowed in Dependabot::Dependency and
-              # equivalent to "*" (latest available version)
-              req = "*" if req == ""
+            pipfile_document.entries(keys.fetch(:pipfile)).each do |entry|
+              group = keys.fetch(:lockfile)
+              next unless entry.specifies_version?
+              next if entry.git_or_path?
+              next if pipfile_lock && !dependency_version(entry, group)
 
               dependencies <<
                 Dependency.new(
-                  name: normalised_name(dep_name),
-                  version: dependency_version(dep_name, req, T.must(group)),
+                  name: normalised_name(entry.name),
+                  version: dependency_version(entry, group),
                   requirements: [{
-                    requirement: req.is_a?(String) ? req : req["version"],
+                    requirement: entry.requirement,
                     file: T.must(pipfile).name,
                     source: nil,
                     groups: [group]
                   }],
                   package_manager: "pip",
-                  metadata: { original_name: dep_name }
+                  metadata: { original_name: entry.name }
                 )
             end
           end
@@ -94,21 +85,14 @@ module Dependabot
           return dependencies unless pipfile_lock
 
           DEPENDENCY_GROUP_KEYS.map { |h| h.fetch(:lockfile) }.each do |key|
-            section_data = parsed_pipfile_lock_section(key)
-            next unless section_data
-
-            section_data.each do |dep_name, details|
-              version = case details
-                        when String then details
-                        when Hash then details["version"]
-                        end
+            pipfile_lock_document.entries(key).each do |entry|
+              version = entry.lockfile_version
               next unless version
-              next if git_or_path_requirement?(details)
 
               dependencies <<
                 Dependency.new(
-                  name: dep_name,
-                  version: version&.gsub(/^===?/, ""),
+                  name: entry.name,
+                  version: version.gsub(/^===?/, ""),
                   requirements: [],
                   package_manager: "pip",
                   subdependency_metadata: [{ production: key != "develop" }]
@@ -119,78 +103,34 @@ module Dependabot
           dependencies
         end
 
-        sig do
-          params(
-            dep_name: String,
-            requirement: T.any(String, T::Hash[String, T.untyped]),
-            group: String
-          ).returns(T.nilable(String))
-        end
-        def dependency_version(dep_name, requirement, group)
-          req = version_from_hash_or_string(requirement)
+        sig { params(entry: PipfileDocument::Entry, group: String).returns(T.nilable(String)) }
+        def dependency_version(entry, group)
+          req = entry.lookup_version
 
           if pipfile_lock
-            details = parsed_pipfile_lock_section(group)&.[](normalised_name(dep_name))
-
-            version = version_from_hash_or_string(details)
+            version = pipfile_lock_document.version_for(group, normalised_name(entry.name))
             version&.gsub(/^===?/, "")
           elsif T.must(req).start_with?("==") && !T.must(req).include?("*")
             T.must(req).strip.gsub(/^===?/, "")
           end
         end
 
-        sig do
-          params(obj: T.nilable(T.any(String, T::Array[String], T::Hash[String, T.untyped]))).returns(T.nilable(String))
-        end
-        def version_from_hash_or_string(obj)
-          case obj
-          when String then obj.strip
-          when Hash then obj["version"]
-          end
-        end
-
-        sig { params(req: T.any(String, T::Hash[String, T.untyped])).returns(T.nilable(T.any(T::Boolean, String))) }
-        def specifies_version?(req)
-          return true if req.is_a?(String)
-
-          req["version"]
-        end
-
-        sig { params(req: T.any(String, T::Hash[String, T.untyped])).returns(T::Boolean) }
-        def git_or_path_requirement?(req)
-          return false unless req.is_a?(Hash)
-
-          %w(git path).any? { |k| req.key?(k) }
-        end
-
         sig { params(name: String, extras: T::Array[String]).returns(String) }
         def normalised_name(name, extras = [])
           NameNormaliser.normalise_including_extras(name, extras)
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pipfile
-          @parsed_pipfile ||= T.let(TomlRB.parse(T.must(pipfile).content), T.nilable(T::Hash[String, T.untyped]))
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(pipfile).path
+        sig { returns(PipfileDocument) }
+        def pipfile_document
+          @pipfile_document ||= T.let(PipfileDocument.from_file(T.must(pipfile)), T.nilable(PipfileDocument))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pipfile_lock
-          @parsed_pipfile_lock ||= T.let(
-            JSON.parse(T.must(T.must(pipfile_lock).content)),
-            T.nilable(T::Hash[String, T.untyped])
+        sig { returns(PipfileLockDocument) }
+        def pipfile_lock_document
+          @pipfile_lock_document ||= T.let(
+            PipfileLockDocument.from_file(T.must(pipfile_lock)),
+            T.nilable(PipfileLockDocument)
           )
-        rescue JSON::ParserError
-          raise Dependabot::DependencyFileNotParseable, T.must(pipfile_lock).path
-        end
-
-        sig { params(section: String).returns(T.nilable(T::Hash[String, T.untyped])) }
-        def parsed_pipfile_lock_section(section)
-          section_data = parsed_pipfile_lock[section]
-          return section_data if section_data.is_a?(Hash)
-
-          nil
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/python/file_parser/pipfile_lock_document.rb

@@ -0,0 +1,67 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+require "dependabot/python/file_parser/pipfile_document"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PipfileLockDocument
+        extend T::Sig
+
+        sig { params(file: Dependabot::DependencyFile).returns(PipfileLockDocument) }
+        def self.from_file(file)
+          new(data: T.cast(JSON.parse(T.must(file.content)), Object), context: file.path)
+        rescue JSON::ParserError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { params(data: Object, context: String).void }
+        def initialize(data:, context:)
+          @data = T.let(PyprojectValueParser.object_hash(data, context), PyprojectValueParser::ObjectHash)
+          @context = context
+        end
+
+        sig { params(group: String).returns(T::Array[PipfileDocument::Entry]) }
+        def entries(group)
+          entries = section(group)
+          return [] unless entries
+
+          entries.filter_map do |name, value|
+            next unless value.is_a?(String) || value.is_a?(Hash)
+
+            PipfileDocument::Entry.new(name: name, value: value, context: "#{@context} #{group} entry")
+          end
+        end
+
+        sig { params(group: String, name: String).returns(T.nilable(String)) }
+        def version_for(group, name)
+          value = section(group)&.[](name)
+          return if value.nil? || value.is_a?(Array)
+
+          unless value.is_a?(String) || value.is_a?(Hash)
+            raise TypeError, "#{@context} #{group} entry must be a string, object, or array"
+          end
+
+          PipfileDocument::Entry.new(name: name, value: value, context: "#{@context} #{group} entry").lookup_version
+        end
+
+        private
+
+        sig { params(group: String).returns(T.nilable(PyprojectValueParser::ObjectHash)) }
+        def section(group)
+          value = @data[group]
+          return unless value.is_a?(Hash)
+
+          PyprojectValueParser.object_hash(value, "#{@context} #{group}")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -202,6 +202,34 @@ module Dependabot
           PyprojectValueParser.string_array(value, "project.dynamic")
         end
 
+        # Pip resolution ignores malformed containers and non-string entries in these fields.
+        sig { returns(T::Array[String]) }
+        def pip_dependencies
+          project = @data["project"]
+          return [] unless project.is_a?(Hash)
+
+          dependencies = T.cast(project["dependencies"], Object)
+          return [] unless dependencies.is_a?(Array)
+
+          dependencies.grep(String)
+        end
+
+        sig { returns(T::Array[String]) }
+        def pip_constraint_paths
+          tool = @data["tool"]
+          return [] unless tool.is_a?(Hash)
+
+          pip = T.cast(tool["pip"], Object)
+          return [] unless pip.is_a?(Hash)
+
+          constraints = T.cast(pip["constraints"], Object)
+          case constraints
+          when String then [constraints]
+          when Array then constraints.grep(String)
+          else []
+          end
+        end
+
         sig { params(name: String).returns(T::Boolean) }
         def optional_dependency_group?(name)
           project = section(@data, "project", "project")

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -12,10 +12,21 @@ require "sorbet-runtime"
 
 module Dependabot
   module Python
-    class FileParser
+    class FileParser < Dependabot::FileParsers::Base
       class SetupFileParser
         extend T::Sig
 
+        class SetupDependency < T::ImmutableStruct
+          const :name, String
+          const :version, T.nilable(String)
+          const :markers, T.nilable(String)
+          const :file, String
+          const :requirement, T.nilable(String)
+          const :requirement_type, String
+          const :extras, T::Array[String]
+        end
+        private_constant :SetupDependency
+
         INSTALL_REQUIRES_REGEX = /install_requires\s*=\s*\[/m
         SETUP_REQUIRES_REGEX = /setup_requires\s*=\s*\[/m
         TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m
@@ -35,24 +46,24 @@ module Dependabot
           parsed_setup_file.each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
-            next if dep["markers"].include?("<")
+            next if dep.markers&.include?("<")
 
             # If the requirement is our inserted version, ignore it
             # (we wouldn't be able to update it)
-            next if dep["version"] == "0.0.1+dependabot"
+            next if dep.version == "0.0.1+dependabot"
 
             dependencies <<
               Dependency.new(
-                name: normalise(dep["name"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
+                name: normalise(dep.name),
+                version: dep.version&.include?("*") ? nil : dep.version,
                 requirements: [{
-                  requirement: dep["requirement"],
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
+                  requirement: dep.requirement,
+                  file: Pathname.new(dep.file).cleanpath.to_path,
                   source: nil,
-                  groups: [dep["requirement_type"]]
+                  groups: [dep.requirement_type]
                 }],
                 package_manager: "pip",
-                metadata: extras_metadata(dep["extras"])
+                metadata: extras_metadata(dep.extras)
               )
           end
           dependencies
@@ -63,59 +74,26 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Array[SetupDependency]) }
         def parsed_setup_file
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
-
-            requirements = T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                function: "parse_setup",
-                args: [Dir.pwd]
-              ),
-              T.nilable(
-                T.any(
-                  T::Hash[String, T.untyped],
-                  String,
-                  T::Array[T::Hash[String, T.untyped]]
-                )
-              )
-            )
-
-            check_requirements(requirements)
-            requirements
+            run_setup_helper
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message if e.message.start_with?("InstallationError")
 
-          return [] unless setup_file
+          file = setup_file
+          return [] unless file
 
-          parsed_sanitized_setup_file
+          parsed_sanitized_setup_file(file)
         end
 
-        sig { returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]]))) }
-        def parsed_sanitized_setup_file
+        sig { params(file: Dependabot::DependencyFile).returns(T::Array[SetupDependency]) }
+        def parsed_sanitized_setup_file(file)
           SharedHelpers.in_a_temporary_directory do
-            write_sanitized_setup_file
-
-            requirements = T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                function: "parse_setup",
-                args: [Dir.pwd]
-              ),
-              T.nilable(
-                T.any(
-                  T::Hash[String, T.untyped],
-                  String,
-                  T::Array[T::Hash[String, T.untyped]]
-                )
-              )
-            )
-
-            check_requirements(requirements)
-            requirements
+            write_sanitized_setup_file(T.must(file.content))
+            run_setup_helper
           end
         rescue SharedHelpers::HelperSubprocessFailed
           # Assume there are no dependencies in setup.py files that fail to
@@ -125,15 +103,36 @@ module Dependabot
           []
         end
 
-        sig { params(requirements: T.untyped).returns(T.untyped) }
-        def check_requirements(requirements)
-          requirements&.each do |dep|
-            next unless dep["requirement"]
+        sig { returns(T::Array[SetupDependency]) }
+        def run_setup_helper
+          result = SharedHelpers.run_helper_subprocess(
+            command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+            function: "parse_setup",
+            args: [Dir.pwd]
+          )
+          parse_setup_result(result)
+        end
 
-            Python::Requirement.new(dep["requirement"].split(","))
-          rescue Gem::Requirement::BadRequirementError => e
-            raise Dependabot::DependencyFileNotEvaluatable, e.message
+        sig { params(result: Object).returns(T::Array[SetupDependency]) }
+        def parse_setup_result(result)
+          PyprojectValueParser.array(result, "parse_setup result").each_with_index.map do |value, index|
+            context = "parse_setup result[#{index}]"
+            fields = PyprojectValueParser.object_hash(value, context)
+            requirement = PyprojectValueParser.optional_string(fields["requirement"], "#{context}.requirement")
+            Python::Requirement.new(requirement.split(",")) unless requirement.nil?
+
+            SetupDependency.new(
+              name: PyprojectValueParser.string(fields["name"], "#{context}.name"),
+              version: PyprojectValueParser.optional_string(fields["version"], "#{context}.version"),
+              markers: PyprojectValueParser.optional_string(fields["markers"], "#{context}.markers"),
+              file: PyprojectValueParser.string(fields["file"], "#{context}.file"),
+              requirement: requirement,
+              requirement_type: PyprojectValueParser.string(fields["requirement_type"], "#{context}.requirement_type"),
+              extras: PyprojectValueParser.string_array(fields["extras"], "#{context}.extras")
+            )
           end
+        rescue TypeError, Gem::Requirement::BadRequirementError => e
+          raise Dependabot::DependencyFileNotEvaluatable, e.message
         end
 
         sig { void }
@@ -152,12 +151,12 @@ module Dependabot
         # This sanitization is far from perfect (it will fail if any of the
         # entries are dynamic), but it is an alternative approach to the one
         # used in parser.py which sometimes succeeds when that has failed.
-        sig { void }
-        def write_sanitized_setup_file
-          install_requires = get_regexed_req_array(INSTALL_REQUIRES_REGEX)
-          setup_requires = get_regexed_req_array(SETUP_REQUIRES_REGEX)
-          tests_require = get_regexed_req_array(TESTS_REQUIRE_REGEX)
-          extras_require = get_regexed_req_dict(EXTRAS_REQUIRE_REGEX)
+        sig { params(content: String).void }
+        def write_sanitized_setup_file(content)
+          install_requires = get_regexed_req_array(content, INSTALL_REQUIRES_REGEX)
+          setup_requires = get_regexed_req_array(content, SETUP_REQUIRES_REGEX)
+          tests_require = get_regexed_req_array(content, TESTS_REQUIRE_REGEX)
+          extras_require = get_regexed_req_dict(content, EXTRAS_REQUIRE_REGEX)
 
           tmp = "from setuptools import setup\n\n" \
                 "setup(name=\"sanitized-package\",version=\"0.0.1\","
@@ -171,16 +170,16 @@ module Dependabot
           File.write("setup.py", tmp)
         end
 
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_array(regex)
-          return unless (mch = setup_file.content.match(regex))
+        sig { params(content: String, regex: Regexp).returns(T.nilable(String)) }
+        def get_regexed_req_array(content, regex)
+          return unless (mch = content.match(regex))
 
           "[#{mch.post_match[0..closing_bracket_index(mch.post_match, '[')]}"
         end
 
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_dict(regex)
-          return unless (mch = setup_file.content.match(regex))
+        sig { params(content: String, regex: Regexp).returns(T.nilable(String)) }
+        def get_regexed_req_dict(content, regex)
+          return unless (mch = content.match(regex))
 
           "{#{mch.post_match[0..closing_bracket_index(mch.post_match, '{')]}"
         end
@@ -215,7 +214,7 @@ module Dependabot
           { extras: extras.join(",") }
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def setup_file
           dependency_files.find { |f| f.name == "setup.py" }
         end

data/lib/dependabot/python/file_parser.rb

@@ -24,6 +24,8 @@ module Dependabot
       require_relative "file_parser/pyproject_document"
       require_relative "file_parser/poetry_lock"
       require_relative "file_parser/pep_dependency"
+      require_relative "file_parser/pipfile_document"
+      require_relative "file_parser/pipfile_lock_document"
       require_relative "file_parser/pipfile_files_parser"
       require_relative "file_parser/pyproject_files_parser"
       require_relative "file_parser/setup_file_parser"

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -363,9 +363,19 @@ module Dependabot
           content = replace_header_with_original(updated_content, T.must(file.content))
           content = remove_new_warnings(content, T.must(file.content))
           content = update_hashes_if_required(content, T.must(file.content))
+          content = scrub_index_url_credentials(content)
           replace_absolute_file_paths(content, T.must(file.content))
         end
 
+        # Index URLs are passed to pip-compile with credentials embedded so the
+        # private index can be fetched, and pip-tools emits those URLs verbatim
+        # into the compiled file when index-url emission is active. Strip any
+        # userinfo so tokens are never written into the regenerated file.
+        sig { params(content: String).returns(String) }
+        def scrub_index_url_credentials(content)
+          content.gsub(%r{^(--(?:extra-)?index-url[= ]https?://)[^/\s]+@}, "\\1")
+        end
+
         sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_header_with_original(updated_content, original_content)
           original_header_lines =

data/lib/dependabot/python/language.rb

@@ -16,7 +16,7 @@ module Dependabot
       # e.g. ARG PY_3_13=3.13.x
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.14.5
+        3.14.7
         3.13.13
         3.12.13
         3.11.15

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -13,6 +13,7 @@ require "dependabot/python/package/package_registry_finder"
 require "dependabot/python/update_checker"
 require "dependabot/python/update_checker/latest_version_finder"
 require "dependabot/python/file_parser/python_requirement_parser"
+require "dependabot/python/file_parser/pyproject_document"
 
 module Dependabot
   module Python
@@ -62,7 +63,7 @@ module Dependabot
           @constraints_files = T.let(nil, T.nilable(T::Array[String]))
           @constraints_file_basenames = T.let(nil, T.nilable(T::Array[String]))
           @requirement_file_directories = T.let(nil, T.nilable(T::Array[String]))
-          @pyproject_content_cache = T.let({}, T::Hash[String, T::Hash[String, Object]])
+          @pyproject_document_cache = T.let({}, T::Hash[String, FileParser::PyprojectDocument])
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }
@@ -201,19 +202,8 @@ module Dependabot
 
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[[String, String]]) }
         def pinned_pyproject_dependencies_for(pyproject)
-          pyproject_content = pyproject_content_for(pyproject)
-          project_obj = pyproject_content["project"]
-          return [] unless project_obj.is_a?(Hash)
-
-          project_hash = project_obj
-          dependencies_obj = T.cast(project_hash["dependencies"], T.nilable(Object))
-          return [] unless dependencies_obj.is_a?(Array)
-
-          dependencies_obj.filter_map do |entry|
-            entry_obj = T.cast(entry, T.nilable(Object))
-            next unless entry_obj.is_a?(String)
-
-            requirement_string, marker = split_requirement_and_marker(entry_obj)
+          pyproject_document_for(pyproject).pip_dependencies.filter_map do |entry|
+            requirement_string, marker = split_requirement_and_marker(entry)
             next unless marker_satisfied_for_python?(marker)
             next if requirement_string.nil? || requirement_string.empty?
 
@@ -432,23 +422,8 @@ module Dependabot
 
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[String]) }
         def constraints_for_pyproject(pyproject)
-          pyproject_content = pyproject_content_for(pyproject)
-          tool_obj = pyproject_content["tool"]
-          return [] unless tool_obj.is_a?(Hash)
-
-          pip_obj = T.cast(tool_obj["pip"], T.nilable(Object))
-          return [] unless pip_obj.is_a?(Hash)
-
-          constraints_obj = T.cast(pip_obj["constraints"], T.nilable(Object))
-          case constraints_obj
-          when String
-            [resolve_constraint_path(path: constraints_obj, declaring_file: pyproject)]
-          when Array
-            constraints_obj.grep(String).map do |path|
-              resolve_constraint_path(path: path, declaring_file: pyproject)
-            end
-          else
-            []
+          pyproject_document_for(pyproject).pip_constraint_paths.map do |path|
+            resolve_constraint_path(path: path, declaring_file: pyproject)
           end
         end
 
@@ -556,23 +531,22 @@ module Dependabot
           marker_evaluator.marker_satisfied?(marker: marker, python_version: python_version)
         end
 
-        sig { params(pyproject: Dependabot::DependencyFile).returns(T::Hash[String, Object]) }
-        def pyproject_content_for(pyproject)
+        sig { params(pyproject: Dependabot::DependencyFile).returns(FileParser::PyprojectDocument) }
+        def pyproject_document_for(pyproject)
           cache_key = pyproject.name
-          return T.must(@pyproject_content_cache[cache_key]) if @pyproject_content_cache.key?(cache_key)
+          return T.must(@pyproject_document_cache[cache_key]) if @pyproject_document_cache.key?(cache_key)
 
-          content =
-            if pyproject.content
-              T.let(TomlRB.parse(pyproject.content), T::Hash[String, Object])
+          content = pyproject.content
+          document =
+            if content
+              FileParser::PyprojectDocument.from_content(content)
             else
-              T.let({}, T::Hash[String, Object])
+              FileParser::PyprojectDocument.new({})
             end
 
-          @pyproject_content_cache[cache_key] = content
-          content
+          @pyproject_document_cache[cache_key] = document
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          @pyproject_content_cache[pyproject.name] = {}
-          T.must(@pyproject_content_cache[pyproject.name])
+          @pyproject_document_cache[pyproject.name] = FileParser::PyprojectDocument.new({})
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -281,7 +281,9 @@ files:
 - lib/dependabot/python/file_fetcher.rb
 - lib/dependabot/python/file_parser.rb
 - lib/dependabot/python/file_parser/pep_dependency.rb
+- lib/dependabot/python/file_parser/pipfile_document.rb
 - lib/dependabot/python/file_parser/pipfile_files_parser.rb
+- lib/dependabot/python/file_parser/pipfile_lock_document.rb
 - lib/dependabot/python/file_parser/poetry_lock.rb
 - lib/dependabot/python/file_parser/pyproject_document.rb
 - lib/dependabot/python/file_parser/pyproject_files_parser.rb
@@ -327,7 +329,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib