dependabot-python 0.398.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 994970816dfcd8b91b616aa7631a109f49eee0f9b4f0932de511dd98fec2b241
-  data.tar.gz: bf721b19a76ba1f476dc6ff6a0cc944930ba7c4719d7206b478db5f2a238d9b1
+  metadata.gz: ddc78c3d36f56fa3124806151a71bb16e46ccbd4fb002a814974c6d4b8fd2fad
+  data.tar.gz: b08192e8bc0a5b8c0125266571bd034029ed17e2c0f77a9d01350b7a9d30fca6
 SHA512:
-  metadata.gz: 9a394b52ded2188b362ba17aa4babe2827a9953139986fc2d5d020a63c226477d31684f992f2e1b9b73bdc70a02d7f3eb5b749864bd70c679a369957ef3bd943
-  data.tar.gz: a0a788f75f42d236527bdf9e78b8371bc434b231029b91c38650ac1b27818974d595c3eb01dfe149bf8a537a8b4edec3e4c8136cd9af18faae90edfd1ab114d0
+  metadata.gz: 5062ffec97c3b221246787027d1afb91fc0da8aeba188cbf7be0f834448ec3ddf0d8ed25a5c7e18803bf986c8c0f6fea96cd4164ae6ecd81215fb4ffb0f75628
+  data.tar.gz: 932c74e3ca269747bcbd005fa0ac624d38a26bc60269953b7a8af99c03abf157b999b1d6ec5e30a64b7791a3c970aca267f964bb62dab880a083fb4021a8cbc9

data/helpers/requirements.txt

@@ -1,10 +1,10 @@
 pip==26.2.1
 pip-tools==7.6.1
-flake8==7.3.0
+flake8==7.4.1
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.4.3
+poetry==2.5.1
 pytest==9.1.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1

data/lib/dependabot/python/dependency_grapher/requirements_layers.rb

@@ -129,7 +129,9 @@ module Dependabot
           end
 
           # When the primary is a compiled `.txt`, the `-r`/`-c` directives live in the paired `.in` files.
-          referenced = referenced_requirement_files([primary] + paired)
+          # Constraints files join every layer below, so they are seeded here too: a constraints file
+          # that references siblings needs those siblings on disk for the layer to parse.
+          referenced = referenced_requirement_files([primary] + paired + constraints_files)
 
           support = (paired + referenced + constraints_files).uniq.map do |f|
             as_support_file(f)

data/lib/dependabot/python/file_parser/pipfile_document.rb

@@ -0,0 +1,105 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PipfileDocument
+        extend T::Sig
+
+        class Entry
+          extend T::Sig
+
+          sig { params(name: String, value: Object, context: String).void }
+          def initialize(name:, value:, context:)
+            @name = name
+            @context = context
+            @value = T.let(
+              value.is_a?(String) ? value : PyprojectValueParser.object_hash(value, context),
+              T.any(String, PyprojectValueParser::ObjectHash)
+            )
+          end
+
+          sig { returns(String) }
+          attr_reader :name
+
+          sig { returns(T::Boolean) }
+          def specifies_version?
+            value = @value
+            return true if value.is_a?(String)
+
+            version = value["version"]
+            return false if version.nil? || version == false
+            return true if version.is_a?(String) || version == true
+
+            raise TypeError, "#{@context} version must be a string or boolean"
+          end
+
+          sig { returns(T::Boolean) }
+          def git_or_path?
+            value = @value
+            value.is_a?(Hash) && (value.key?("git") || value.key?("path"))
+          end
+
+          sig { returns(String) }
+          def requirement
+            value = @value
+            return value.empty? ? "*" : value if value.is_a?(String)
+
+            PyprojectValueParser.string(value["version"], "#{@context} version")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def lookup_version
+            value = @value
+            return value.strip if value.is_a?(String)
+
+            PyprojectValueParser.optional_string(value["version"], "#{@context} version")
+          end
+
+          sig { returns(T.nilable(String)) }
+          def lockfile_version
+            value = @value
+            version = value.is_a?(String) ? value : value["version"]
+            return unless version
+            return if git_or_path?
+
+            PyprojectValueParser.string(version, "#{@context} version")
+          end
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PipfileDocument) }
+        def self.from_file(file)
+          new(data: T.cast(TomlRB.parse(T.must(file.content)), Object), context: file.path)
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { params(data: Object, context: String).void }
+        def initialize(data:, context:)
+          @data = T.let(PyprojectValueParser.object_hash(data, context), PyprojectValueParser::ObjectHash)
+          @context = context
+        end
+
+        sig { params(group: String).returns(T::Array[Entry]) }
+        def entries(group)
+          value = @data[group]
+          return [] unless value
+          return [] if value.is_a?(Array) && value.empty?
+
+          context = "#{@context} #{group}"
+          PyprojectValueParser.object_hash(value, context).map do |name, requirement|
+            Entry.new(name: name, value: requirement, context: "#{context} entry")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pipfile_files_parser.rb

@@ -1,17 +1,14 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "toml-rb"
-
 require "dependabot/dependency"
 require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/python/file_parser"
-require "dependabot/errors"
 require "dependabot/python/name_normaliser"
 
 module Dependabot
   module Python
-    class FileParser
+    class FileParser < Dependabot::FileParsers::Base
       class PipfileFilesParser
         extend T::Sig
 
@@ -54,30 +51,24 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           DEPENDENCY_GROUP_KEYS.each do |keys|
-            next unless parsed_pipfile[T.must(keys[:pipfile])]
-
-            parsed_pipfile[T.must(keys[:pipfile])].map do |dep_name, req|
-              group = keys[:lockfile]
-              next unless specifies_version?(req)
-              next if git_or_path_requirement?(req)
-              next if pipfile_lock && !dependency_version(dep_name, req, T.must(group))
-
-              # Empty requirements are not allowed in Dependabot::Dependency and
-              # equivalent to "*" (latest available version)
-              req = "*" if req == ""
+            pipfile_document.entries(keys.fetch(:pipfile)).each do |entry|
+              group = keys.fetch(:lockfile)
+              next unless entry.specifies_version?
+              next if entry.git_or_path?
+              next if pipfile_lock && !dependency_version(entry, group)
 
               dependencies <<
                 Dependency.new(
-                  name: normalised_name(dep_name),
-                  version: dependency_version(dep_name, req, T.must(group)),
+                  name: normalised_name(entry.name),
+                  version: dependency_version(entry, group),
                   requirements: [{
-                    requirement: req.is_a?(String) ? req : req["version"],
+                    requirement: entry.requirement,
                     file: T.must(pipfile).name,
                     source: nil,
                     groups: [group]
                   }],
                   package_manager: "pip",
-                  metadata: { original_name: dep_name }
+                  metadata: { original_name: entry.name }
                 )
             end
           end
@@ -94,21 +85,14 @@ module Dependabot
           return dependencies unless pipfile_lock
 
           DEPENDENCY_GROUP_KEYS.map { |h| h.fetch(:lockfile) }.each do |key|
-            section_data = parsed_pipfile_lock_section(key)
-            next unless section_data
-
-            section_data.each do |dep_name, details|
-              version = case details
-                        when String then details
-                        when Hash then details["version"]
-                        end
+            pipfile_lock_document.entries(key).each do |entry|
+              version = entry.lockfile_version
               next unless version
-              next if git_or_path_requirement?(details)
 
               dependencies <<
                 Dependency.new(
-                  name: dep_name,
-                  version: version&.gsub(/^===?/, ""),
+                  name: entry.name,
+                  version: version.gsub(/^===?/, ""),
                   requirements: [],
                   package_manager: "pip",
                   subdependency_metadata: [{ production: key != "develop" }]
@@ -119,78 +103,34 @@ module Dependabot
           dependencies
         end
 
-        sig do
-          params(
-            dep_name: String,
-            requirement: T.any(String, T::Hash[String, T.untyped]),
-            group: String
-          ).returns(T.nilable(String))
-        end
-        def dependency_version(dep_name, requirement, group)
-          req = version_from_hash_or_string(requirement)
+        sig { params(entry: PipfileDocument::Entry, group: String).returns(T.nilable(String)) }
+        def dependency_version(entry, group)
+          req = entry.lookup_version
 
           if pipfile_lock
-            details = parsed_pipfile_lock_section(group)&.[](normalised_name(dep_name))
-
-            version = version_from_hash_or_string(details)
+            version = pipfile_lock_document.version_for(group, normalised_name(entry.name))
             version&.gsub(/^===?/, "")
           elsif T.must(req).start_with?("==") && !T.must(req).include?("*")
             T.must(req).strip.gsub(/^===?/, "")
           end
         end
 
-        sig do
-          params(obj: T.nilable(T.any(String, T::Array[String], T::Hash[String, T.untyped]))).returns(T.nilable(String))
-        end
-        def version_from_hash_or_string(obj)
-          case obj
-          when String then obj.strip
-          when Hash then obj["version"]
-          end
-        end
-
-        sig { params(req: T.any(String, T::Hash[String, T.untyped])).returns(T.nilable(T.any(T::Boolean, String))) }
-        def specifies_version?(req)
-          return true if req.is_a?(String)
-
-          req["version"]
-        end
-
-        sig { params(req: T.any(String, T::Hash[String, T.untyped])).returns(T::Boolean) }
-        def git_or_path_requirement?(req)
-          return false unless req.is_a?(Hash)
-
-          %w(git path).any? { |k| req.key?(k) }
-        end
-
         sig { params(name: String, extras: T::Array[String]).returns(String) }
         def normalised_name(name, extras = [])
           NameNormaliser.normalise_including_extras(name, extras)
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pipfile
-          @parsed_pipfile ||= T.let(TomlRB.parse(T.must(pipfile).content), T.nilable(T::Hash[String, T.untyped]))
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(pipfile).path
+        sig { returns(PipfileDocument) }
+        def pipfile_document
+          @pipfile_document ||= T.let(PipfileDocument.from_file(T.must(pipfile)), T.nilable(PipfileDocument))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pipfile_lock
-          @parsed_pipfile_lock ||= T.let(
-            JSON.parse(T.must(T.must(pipfile_lock).content)),
-            T.nilable(T::Hash[String, T.untyped])
+        sig { returns(PipfileLockDocument) }
+        def pipfile_lock_document
+          @pipfile_lock_document ||= T.let(
+            PipfileLockDocument.from_file(T.must(pipfile_lock)),
+            T.nilable(PipfileLockDocument)
           )
-        rescue JSON::ParserError
-          raise Dependabot::DependencyFileNotParseable, T.must(pipfile_lock).path
-        end
-
-        sig { params(section: String).returns(T.nilable(T::Hash[String, T.untyped])) }
-        def parsed_pipfile_lock_section(section)
-          section_data = parsed_pipfile_lock[section]
-          return section_data if section_data.is_a?(Hash)
-
-          nil
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/python/file_parser/pipfile_lock_document.rb

@@ -0,0 +1,67 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+require "dependabot/python/file_parser/pipfile_document"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PipfileLockDocument
+        extend T::Sig
+
+        sig { params(file: Dependabot::DependencyFile).returns(PipfileLockDocument) }
+        def self.from_file(file)
+          new(data: T.cast(JSON.parse(T.must(file.content)), Object), context: file.path)
+        rescue JSON::ParserError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { params(data: Object, context: String).void }
+        def initialize(data:, context:)
+          @data = T.let(PyprojectValueParser.object_hash(data, context), PyprojectValueParser::ObjectHash)
+          @context = context
+        end
+
+        sig { params(group: String).returns(T::Array[PipfileDocument::Entry]) }
+        def entries(group)
+          entries = section(group)
+          return [] unless entries
+
+          entries.filter_map do |name, value|
+            next unless value.is_a?(String) || value.is_a?(Hash)
+
+            PipfileDocument::Entry.new(name: name, value: value, context: "#{@context} #{group} entry")
+          end
+        end
+
+        sig { params(group: String, name: String).returns(T.nilable(String)) }
+        def version_for(group, name)
+          value = section(group)&.[](name)
+          return if value.nil? || value.is_a?(Array)
+
+          unless value.is_a?(String) || value.is_a?(Hash)
+            raise TypeError, "#{@context} #{group} entry must be a string, object, or array"
+          end
+
+          PipfileDocument::Entry.new(name: name, value: value, context: "#{@context} #{group} entry").lookup_version
+        end
+
+        private
+
+        sig { params(group: String).returns(T.nilable(PyprojectValueParser::ObjectHash)) }
+        def section(group)
+          value = @data[group]
+          return unless value.is_a?(Hash)
+
+          PyprojectValueParser.object_hash(value, "#{@context} #{group}")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -202,6 +202,34 @@ module Dependabot
           PyprojectValueParser.string_array(value, "project.dynamic")
         end
 
+        # Pip resolution ignores malformed containers and non-string entries in these fields.
+        sig { returns(T::Array[String]) }
+        def pip_dependencies
+          project = @data["project"]
+          return [] unless project.is_a?(Hash)
+
+          dependencies = T.cast(project["dependencies"], Object)
+          return [] unless dependencies.is_a?(Array)
+
+          dependencies.grep(String)
+        end
+
+        sig { returns(T::Array[String]) }
+        def pip_constraint_paths
+          tool = @data["tool"]
+          return [] unless tool.is_a?(Hash)
+
+          pip = T.cast(tool["pip"], Object)
+          return [] unless pip.is_a?(Hash)
+
+          constraints = T.cast(pip["constraints"], Object)
+          case constraints
+          when String then [constraints]
+          when Array then constraints.grep(String)
+          else []
+          end
+        end
+
         sig { params(name: String).returns(T::Boolean) }
         def optional_dependency_group?(name)
           project = section(@data, "project", "project")

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -12,10 +12,21 @@ require "sorbet-runtime"
 
 module Dependabot
   module Python
-    class FileParser
+    class FileParser < Dependabot::FileParsers::Base
       class SetupFileParser
         extend T::Sig
 
+        class SetupDependency < T::ImmutableStruct
+          const :name, String
+          const :version, T.nilable(String)
+          const :markers, T.nilable(String)
+          const :file, String
+          const :requirement, T.nilable(String)
+          const :requirement_type, String
+          const :extras, T::Array[String]
+        end
+        private_constant :SetupDependency
+
         INSTALL_REQUIRES_REGEX = /install_requires\s*=\s*\[/m
         SETUP_REQUIRES_REGEX = /setup_requires\s*=\s*\[/m
         TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m
@@ -35,24 +46,24 @@ module Dependabot
           parsed_setup_file.each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
-            next if dep["markers"].include?("<")
+            next if dep.markers&.include?("<")
 
             # If the requirement is our inserted version, ignore it
             # (we wouldn't be able to update it)
-            next if dep["version"] == "0.0.1+dependabot"
+            next if dep.version == "0.0.1+dependabot"
 
             dependencies <<
               Dependency.new(
-                name: normalise(dep["name"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
+                name: normalise(dep.name),
+                version: dep.version&.include?("*") ? nil : dep.version,
                 requirements: [{
-                  requirement: dep["requirement"],
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
+                  requirement: dep.requirement,
+                  file: Pathname.new(dep.file).cleanpath.to_path,
                   source: nil,
-                  groups: [dep["requirement_type"]]
+                  groups: [dep.requirement_type]
                 }],
                 package_manager: "pip",
-                metadata: extras_metadata(dep["extras"])
+                metadata: extras_metadata(dep.extras)
               )
           end
           dependencies
@@ -63,59 +74,26 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Array[SetupDependency]) }
         def parsed_setup_file
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
-
-            requirements = T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                function: "parse_setup",
-                args: [Dir.pwd]
-              ),
-              T.nilable(
-                T.any(
-                  T::Hash[String, T.untyped],
-                  String,
-                  T::Array[T::Hash[String, T.untyped]]
-                )
-              )
-            )
-
-            check_requirements(requirements)
-            requirements
+            run_setup_helper
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message if e.message.start_with?("InstallationError")
 
-          return [] unless setup_file
+          file = setup_file
+          return [] unless file
 
-          parsed_sanitized_setup_file
+          parsed_sanitized_setup_file(file)
         end
 
-        sig { returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]]))) }
-        def parsed_sanitized_setup_file
+        sig { params(file: Dependabot::DependencyFile).returns(T::Array[SetupDependency]) }
+        def parsed_sanitized_setup_file(file)
           SharedHelpers.in_a_temporary_directory do
-            write_sanitized_setup_file
-
-            requirements = T.cast(
-              SharedHelpers.run_helper_subprocess(
-                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                function: "parse_setup",
-                args: [Dir.pwd]
-              ),
-              T.nilable(
-                T.any(
-                  T::Hash[String, T.untyped],
-                  String,
-                  T::Array[T::Hash[String, T.untyped]]
-                )
-              )
-            )
-
-            check_requirements(requirements)
-            requirements
+            write_sanitized_setup_file(T.must(file.content))
+            run_setup_helper
           end
         rescue SharedHelpers::HelperSubprocessFailed
           # Assume there are no dependencies in setup.py files that fail to
@@ -125,15 +103,36 @@ module Dependabot
           []
         end
 
-        sig { params(requirements: T.untyped).returns(T.untyped) }
-        def check_requirements(requirements)
-          requirements&.each do |dep|
-            next unless dep["requirement"]
+        sig { returns(T::Array[SetupDependency]) }
+        def run_setup_helper
+          result = SharedHelpers.run_helper_subprocess(
+            command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+            function: "parse_setup",
+            args: [Dir.pwd]
+          )
+          parse_setup_result(result)
+        end
 
-            Python::Requirement.new(dep["requirement"].split(","))
-          rescue Gem::Requirement::BadRequirementError => e
-            raise Dependabot::DependencyFileNotEvaluatable, e.message
+        sig { params(result: Object).returns(T::Array[SetupDependency]) }
+        def parse_setup_result(result)
+          PyprojectValueParser.array(result, "parse_setup result").each_with_index.map do |value, index|
+            context = "parse_setup result[#{index}]"
+            fields = PyprojectValueParser.object_hash(value, context)
+            requirement = PyprojectValueParser.optional_string(fields["requirement"], "#{context}.requirement")
+            Python::Requirement.new(requirement.split(",")) unless requirement.nil?
+
+            SetupDependency.new(
+              name: PyprojectValueParser.string(fields["name"], "#{context}.name"),
+              version: PyprojectValueParser.optional_string(fields["version"], "#{context}.version"),
+              markers: PyprojectValueParser.optional_string(fields["markers"], "#{context}.markers"),
+              file: PyprojectValueParser.string(fields["file"], "#{context}.file"),
+              requirement: requirement,
+              requirement_type: PyprojectValueParser.string(fields["requirement_type"], "#{context}.requirement_type"),
+              extras: PyprojectValueParser.string_array(fields["extras"], "#{context}.extras")
+            )
           end
+        rescue TypeError, Gem::Requirement::BadRequirementError => e
+          raise Dependabot::DependencyFileNotEvaluatable, e.message
         end
 
         sig { void }
@@ -152,12 +151,12 @@ module Dependabot
         # This sanitization is far from perfect (it will fail if any of the
         # entries are dynamic), but it is an alternative approach to the one
         # used in parser.py which sometimes succeeds when that has failed.
-        sig { void }
-        def write_sanitized_setup_file
-          install_requires = get_regexed_req_array(INSTALL_REQUIRES_REGEX)
-          setup_requires = get_regexed_req_array(SETUP_REQUIRES_REGEX)
-          tests_require = get_regexed_req_array(TESTS_REQUIRE_REGEX)
-          extras_require = get_regexed_req_dict(EXTRAS_REQUIRE_REGEX)
+        sig { params(content: String).void }
+        def write_sanitized_setup_file(content)
+          install_requires = get_regexed_req_array(content, INSTALL_REQUIRES_REGEX)
+          setup_requires = get_regexed_req_array(content, SETUP_REQUIRES_REGEX)
+          tests_require = get_regexed_req_array(content, TESTS_REQUIRE_REGEX)
+          extras_require = get_regexed_req_dict(content, EXTRAS_REQUIRE_REGEX)
 
           tmp = "from setuptools import setup\n\n" \
                 "setup(name=\"sanitized-package\",version=\"0.0.1\","
@@ -171,16 +170,16 @@ module Dependabot
           File.write("setup.py", tmp)
         end
 
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_array(regex)
-          return unless (mch = setup_file.content.match(regex))
+        sig { params(content: String, regex: Regexp).returns(T.nilable(String)) }
+        def get_regexed_req_array(content, regex)
+          return unless (mch = content.match(regex))
 
           "[#{mch.post_match[0..closing_bracket_index(mch.post_match, '[')]}"
         end
 
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_dict(regex)
-          return unless (mch = setup_file.content.match(regex))
+        sig { params(content: String, regex: Regexp).returns(T.nilable(String)) }
+        def get_regexed_req_dict(content, regex)
+          return unless (mch = content.match(regex))
 
           "{#{mch.post_match[0..closing_bracket_index(mch.post_match, '{')]}"
         end
@@ -215,7 +214,7 @@ module Dependabot
           { extras: extras.join(",") }
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def setup_file
           dependency_files.find { |f| f.name == "setup.py" }
         end

data/lib/dependabot/python/file_parser.rb

@@ -24,6 +24,8 @@ module Dependabot
       require_relative "file_parser/pyproject_document"
       require_relative "file_parser/poetry_lock"
       require_relative "file_parser/pep_dependency"
+      require_relative "file_parser/pipfile_document"
+      require_relative "file_parser/pipfile_lock_document"
       require_relative "file_parser/pipfile_files_parser"
       require_relative "file_parser/pyproject_files_parser"
       require_relative "file_parser/setup_file_parser"