dependabot-python 0.398.0 → 0.400.0

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -363,9 +363,19 @@ module Dependabot
           content = replace_header_with_original(updated_content, T.must(file.content))
           content = remove_new_warnings(content, T.must(file.content))
           content = update_hashes_if_required(content, T.must(file.content))
+          content = scrub_index_url_credentials(content)
           replace_absolute_file_paths(content, T.must(file.content))
         end
 
+        # Index URLs are passed to pip-compile with credentials embedded so the
+        # private index can be fetched, and pip-tools emits those URLs verbatim
+        # into the compiled file when index-url emission is active. Strip any
+        # userinfo so tokens are never written into the regenerated file.
+        sig { params(content: String).returns(String) }
+        def scrub_index_url_credentials(content)
+          content.gsub(%r{^(--(?:extra-)?index-url[= ]https?://)[^/\s]+@}, "\\1")
+        end
+
         sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_header_with_original(updated_content, original_content)
           original_header_lines =

data/lib/dependabot/python/package/distribution.rb

@@ -0,0 +1,180 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "uri"
+require "cgi/escape"
+require "nokogiri"
+require "sorbet-runtime"
+require "dependabot/errors"
+
+module Dependabot
+  module Python
+    module Package
+      class Distribution < T::ImmutableStruct
+        extend T::Sig
+
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+        const :version_string, String
+        const :released_at, T.nilable(Time), default: nil
+        const :requires_python, T.nilable(String), default: nil
+        const :python_version, T.nilable(String), default: nil
+        const :yanked, T::Boolean, default: false
+        const :yanked_reason, T.nilable(String), default: nil
+        const :downloads, Integer, default: -1
+        const :url, T.nilable(String), default: nil
+        const :package_type, T.nilable(String), default: nil
+
+        sig { params(value: Object, version_string: String, context: String).returns(Distribution) }
+        def self.from_pypi(value, version_string:, context:)
+          fields = object(value, context)
+          new(
+            version_string: version_string,
+            released_at: timestamp(fields["upload_time"], "#{context}.upload_time"),
+            requires_python: optional_string(fields["requires_python"], "#{context}.requires_python"),
+            python_version: optional_string(fields["python_version"], "#{context}.python_version"),
+            yanked: boolean(fields["yanked"], "#{context}.yanked"),
+            yanked_reason: optional_string(fields["yanked_reason"], "#{context}.yanked_reason"),
+            downloads: downloads(fields["downloads"], "#{context}.downloads"),
+            url: optional_string(fields["url"], "#{context}.url"),
+            package_type: optional_string(fields["packagetype"], "#{context}.packagetype")
+          )
+        end
+
+        sig do
+          params(value: Object, version_string: String, context: String, project_url: String).returns(Distribution)
+        end
+        def self.from_simple(value, version_string:, context:, project_url:)
+          fields = object(value, context)
+          withdrawn = fields["yanked"]
+          yanked = withdrawn.is_a?(String) || boolean(withdrawn, "#{context}.yanked")
+          new(
+            version_string: version_string,
+            released_at: timestamp(fields["upload-time"], "#{context}.upload-time"),
+            requires_python: optional_string(fields["requires-python"], "#{context}.requires-python"),
+            yanked: yanked,
+            yanked_reason: withdrawn.is_a?(String) ? withdrawn : nil,
+            url: resolve_url(optional_string(fields["url"], "#{context}.url"), project_url, "#{context}.url")
+          )
+        end
+
+        sig do
+          params(
+            link: Nokogiri::XML::Node, version_string: String, context: String, project_url: String
+          ).returns(Distribution)
+        end
+        def self.from_html(link, version_string:, context:, project_url:)
+          requirement = optional_string(T.cast(link["data-requires-python"], Object), "#{context}.data-requires-python")
+          reason = optional_string(T.cast(link["data-yanked"], Object), "#{context}.data-yanked")
+          withdrawn = !T.cast(link.attribute("data-yanked"), Object).nil?
+          new(
+            version_string: version_string,
+            requires_python: requirement ? CGI.unescapeHTML(requirement) : nil,
+            yanked: withdrawn,
+            yanked_reason: reason,
+            url: resolve_url(
+              optional_string(T.cast(link["href"], Object), "#{context}.href"),
+              project_url,
+              "#{context}.href"
+            )
+          )
+        end
+
+        sig { params(format: String, source_url: String).returns(String) }
+        def self.context(format, source_url)
+          uri = URI.parse(source_url)
+          uri.userinfo = nil
+          uri.query = nil
+          uri.fragment = nil
+          "#{format} registry #{String(uri)}"
+        rescue URI::InvalidURIError
+          invalid(format, "registry URL is invalid")
+        end
+
+        sig { params(content: String, context: String).returns(Object) }
+        def self.parse_json(content, context)
+          T.cast(JSON.parse(content), Object)
+        rescue JSON::ParserError
+          invalid(context, "must contain valid JSON")
+        end
+
+        sig { params(value: Object, context: String).returns(ObjectHash) }
+        def self.object(value, context)
+          invalid(context, "must be an object") unless value.is_a?(Hash)
+
+          value.to_h do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            invalid(context, "keys must be strings") unless key.is_a?(String)
+
+            [key, T.cast(raw_value, Object)]
+          end
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[Object]) }
+        def self.array(value, context)
+          invalid(context, "must be an array") unless value.is_a?(Array)
+
+          value.map { |entry| T.cast(entry, Object) }
+        end
+
+        sig { params(value: Object, context: String).returns(T.nilable(String)) }
+        def self.optional_string(value, context)
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          invalid(context, "must be a string or nil")
+        end
+
+        sig { params(context: String, message: String).returns(T.noreturn) }
+        def self.invalid(context, message)
+          raise DependencyFileNotResolvable.new("#{context} #{message}"), cause: nil
+        end
+
+        sig { params(value: Object, context: String).returns(T.nilable(Time)) }
+        def self.timestamp(value, context)
+          text = optional_string(value, context)
+          return if text.nil?
+
+          Time.parse(text)
+        rescue ArgumentError
+          invalid(context, "must be a valid timestamp")
+        end
+        private_class_method :timestamp
+
+        sig { params(value: Object, context: String).returns(T::Boolean) }
+        def self.boolean(value, context)
+          case value
+          when nil, false then false
+          when true then true
+          else invalid(context, "must be a boolean or nil")
+          end
+        end
+        private_class_method :boolean
+
+        sig { params(value: Object, context: String).returns(Integer) }
+        def self.downloads(value, context)
+          return -1 if value.nil?
+          return value if value.is_a?(Integer)
+
+          invalid(context, "must be an integer or nil")
+        end
+        private_class_method :downloads
+
+        sig { params(url: T.nilable(String), project_url: String, context: String).returns(T.nilable(String)) }
+        def self.resolve_url(url, project_url, context)
+          return if url.nil?
+
+          resolved = URI.join(project_url, url)
+          resolved.user = nil
+          resolved.password = nil
+          String(resolved)
+        rescue URI::InvalidURIError
+          invalid(context, "must be a valid URL")
+        end
+        private_class_method :resolve_url
+      end
+    end
+  end
+end

data/lib/dependabot/python/package/package_details_fetcher.rb

@@ -1,8 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "json"
-require "time"
 require "cgi/escape"
 require "excon"
 require "nokogiri"
@@ -13,6 +11,8 @@ require "dependabot/package/package_release"
 require "dependabot/package/package_details"
 require "dependabot/python/package/package_registry_finder"
 require "dependabot/python/package/simple_api_parser"
+require "dependabot/python/package/distribution"
+require "dependabot/python/package/pypi_json_parser"
 
 # Stores metadata for a package, including all its available versions
 module Dependabot
@@ -111,7 +111,7 @@ module Dependabot
             "Fetching release information from simple registry at #{sanitized_url(index_url)} for #{dependency.name}"
           )
           response = registry_response_for_dependency(index_url, accept: simple_api_accept)
-          project_url = response.path ? Excon::Utils.request_uri(response.data) : index_url + normalised_name + "/"
+          project_url = project_url_for(response, index_url)
           check_authentication_response(response, index_url)
 
           version_releases = if simple_json_response?(response)
@@ -120,14 +120,11 @@ module Dependabot
                                  project_url: project_url
                                ).parse(response.body)
                              else
-                               extract_release_details_json_from_html(response.body)
+                               distributions_from_html(response.body, project_url: project_url)
                              end
 
           format_version_releases(version_releases, preserve_distributions: simple_json_response?(response))
             .sort_by(&:version).reverse
-        rescue JSON::ParserError
-          Dependabot.logger.warn("JSON parsing error for #{sanitized_url(index_url)}.")
-          []
         end
 
         # Example JSON Response Format:
@@ -190,16 +187,13 @@ module Dependabot
           return nil unless response.status == 200
 
           begin
-            data = JSON.parse(response.body)
-
-            version_releases = data["releases"]
+            version_releases = PypiJsonParser.new(source_url: json_url).parse(response.body)
 
             releases = format_version_releases(version_releases)
 
             releases.sort_by(&:version).reverse
-          rescue JSON::ParserError
-            Dependabot.logger.warn("JSON parsing error for #{json_url}. Falling back to HTML.")
-            nil
+          rescue Dependabot::DependencyFileNotResolvable
+            raise
           rescue StandardError => e
             Dependabot.logger.warn("Unexpected error while fetching JSON data: #{e.message}.")
             nil
@@ -235,7 +229,9 @@ module Dependabot
           index_response = registry_response_for_dependency(index_url, accept: APPLICATION_TEXT)
           check_authentication_response(index_response, index_url)
 
-          version_releases = extract_release_details_json_from_html(index_response.body)
+          version_releases = distributions_from_html(
+            index_response.body, project_url: project_url_for(index_response, index_url)
+          )
           releases = format_version_releases(version_releases)
 
           releases.sort_by(&:version).reverse
@@ -262,102 +258,64 @@ module Dependabot
           raise PrivateSourceAuthenticationFailure, sanitized_url(index_url)
         end
 
-        sig do
-          params(html_body: String)
-            .returns(T::Hash[String, T::Array[T::Hash[String, T.untyped]]]) # Returns JSON-like format
+        sig { params(response: Excon::Response, index_url: String).returns(String) }
+        def project_url_for(response, index_url)
+          response.path ? Excon::Utils.request_uri(response.data) : index_url + normalised_name + "/"
         end
-        def extract_release_details_json_from_html(html_body)
-          doc = Nokogiri::HTML(html_body)
-
-          releases = {}
 
-          doc.css("a").each do |a_tag|
-            details = version_details_from_link(a_tag.to_s)
-            if details && details["version"]
-              releases[details["version"]] ||= []
-              releases[details["version"]] << details
-            end
+        sig { params(html_body: String, project_url: String).returns(T::Hash[String, T::Array[Distribution]]) }
+        def distributions_from_html(html_body, project_url:)
+          doc = Nokogiri::HTML(html_body)
+          context = Distribution.context("HTML index", project_url)
+          releases = T.let({}, T::Hash[String, T::Array[Distribution]])
+
+          doc.css("a").each_with_index do |link, index|
+            filename = link.content
+            url = link["href"]
+            next unless filename.match?(name_regex) || url&.match?(name_regex)
+
+            version = get_version_from_filename(filename)
+            next unless version && version_class.correct?(version)
+
+            distribution = Distribution.from_html(
+              link, version_string: version, context: "#{context}.links[#{index}]", project_url: project_url
+            )
+            releases[version] ||= []
+            T.must(releases[version]) << distribution
           end
 
           releases
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
-        sig do
-          params(link: T.nilable(String))
-            .returns(T.nilable(T::Hash[String, T.untyped]))
-        end
-        def version_details_from_link(link)
-          return unless link
-
-          doc = Nokogiri::XML(link)
-          filename = doc.at_css("a")&.content
-          url = doc.at_css("a")&.attributes&.fetch("href", nil)&.value
-
-          return unless filename&.match?(name_regex) || url&.match?(name_regex)
-
-          version = get_version_from_filename(filename)
-          return unless version_class.correct?(version)
-
-          {
-            "version" => version,
-            "requires_python" => requires_python_from_link(link),
-            "yanked" => link.include?("data-yanked"),
-            "url" => link
-          }
-        end
-        # rubocop:enable Metrics/PerceivedComplexity
-
         sig do
           params(
-            releases_json: T.nilable(T::Hash[String, T::Array[T::Hash[String, T.untyped]]]),
+            distributions: T::Hash[String, T::Array[Distribution]],
             preserve_distributions: T::Boolean
           )
             .returns(T::Array[Dependabot::Package::PackageRelease])
         end
-        def format_version_releases(releases_json, preserve_distributions: false)
-          return [] unless releases_json
-
-          releases_json.each_with_object([]) do |(version, release_data_array), versions|
-            release_data_array = [release_data_array.last].compact unless preserve_distributions
-            versions.concat(release_data_array.filter_map { |data| format_version_release(version, data) })
+        def format_version_releases(distributions, preserve_distributions: false)
+          distributions.each_value.flat_map do |files|
+            selected = preserve_distributions ? files : files.last(1)
+            selected.map { |distribution| format_version_release(distribution) }
           end
         end
 
-        sig do
-          params(
-            version: String,
-            release_data: T::Hash[String, T.untyped]
-          )
-            .returns(T.nilable(Dependabot::Package::PackageRelease))
-        end
-        def format_version_release(version, release_data)
-          # Skip versions that don't conform to PEP 440
-          unless Dependabot::Python::Version.correct?(version)
-            Dependabot.logger.warn("Skipping invalid version #{version}: does not match PEP 440")
-            return nil
-          end
-
-          upload_time = release_data["upload_time"]
-          released_at = Time.parse(upload_time) if upload_time
-          yanked = release_data["yanked"] || false
-          yanked_reason = release_data["yanked_reason"]
-          downloads = release_data["downloads"] || -1
-          url = release_data["url"]
-          package_type = release_data["packagetype"]
+        sig { params(distribution: Distribution).returns(Dependabot::Package::PackageRelease) }
+        def format_version_release(distribution)
           language = package_language(
-            python_version: release_data["python_version"],
-            requires_python: release_data["requires_python"]
+            python_version: distribution.python_version,
+            requires_python: distribution.requires_python
           )
 
           Dependabot::Package::PackageRelease.new(
-            version: Dependabot::Python::Version.new(version),
-            released_at: released_at,
-            yanked: yanked,
-            yanked_reason: yanked_reason,
-            downloads: downloads,
-            url: url,
-            package_type: package_type,
+            version: Dependabot::Python::Version.new(distribution.version_string),
+            released_at: distribution.released_at,
+            yanked: distribution.yanked,
+            yanked_reason: distribution.yanked_reason,
+            downloads: distribution.downloads,
+            url: distribution.url,
+            package_type: distribution.package_type,
             language: language
           )
         end
@@ -472,18 +430,6 @@ module Dependabot
           nil
         end
 
-        sig { params(link: String).returns(T.nilable(String)) }
-        def requires_python_from_link(link)
-          raw_value = Nokogiri::XML(link)
-                              .at_css("a")
-                              &.attribute("data-requires-python")
-                              &.content
-
-          return nil unless raw_value
-
-          CGI.unescapeHTML(raw_value) # Decodes HTML entities like &gt;=3 → >=3
-        end
-
         sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class

data/lib/dependabot/python/package/pypi_json_parser.rb

@@ -0,0 +1,48 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/python/version"
+require "dependabot/python/package/distribution"
+
+module Dependabot
+  module Python
+    module Package
+      class PypiJsonParser
+        extend T::Sig
+
+        sig { params(source_url: String).void }
+        def initialize(source_url:)
+          @context = T.let(Distribution.context("PyPI JSON", source_url), String)
+        end
+
+        sig { params(content: String).returns(T::Hash[String, T::Array[Distribution]]) }
+        def parse(content)
+          fields = Distribution.object(Distribution.parse_json(content, @context), @context)
+          raw_releases = fields["releases"]
+          return {} if raw_releases.nil?
+
+          releases = Distribution.object(raw_releases, "#{@context}.releases")
+          parsed = T.let({}, T::Hash[String, T::Array[Distribution]])
+          releases.each_with_index do |(version, value), release_index|
+            location = "#{@context}.releases[#{release_index}]"
+            entries = Distribution.array(value, location)
+            next if entries.empty?
+
+            unless Python::Version.correct?(version)
+              Dependabot.logger.warn("Skipping invalid version #{version}: does not match PEP 440")
+              next
+            end
+
+            parsed[version] = entries.each_with_index.map do |entry, index|
+              Distribution.from_pypi(
+                entry, version_string: version, context: "#{location}[#{index}]"
+              )
+            end
+          end
+          parsed
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/package/simple_api_parser.rb

@@ -1,11 +1,10 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "json"
-require "uri"
 require "sorbet-runtime"
 require "dependabot/errors"
 require "dependabot/python/name_normaliser"
+require "dependabot/python/package/distribution"
 
 module Dependabot
   module Python
@@ -13,8 +12,6 @@ module Dependabot
       class SimpleApiParser
         extend T::Sig
 
-        ReleaseDetail = T.type_alias { T::Hash[String, T.nilable(T.any(String, T::Boolean))] }
-
         sig { params(dependency: Dependabot::Dependency, project_url: String).void }
         def initialize(dependency:, project_url:)
           @dependency = dependency
@@ -23,31 +20,32 @@ module Dependabot
 
         sig do
           params(json_body: String)
-            .returns(T::Hash[String, T::Array[ReleaseDetail]])
+            .returns(T::Hash[String, T::Array[Distribution]])
         end
         def parse(json_body)
-          data = JSON.parse(json_body)
-          validate_api_version!(data.dig("meta", "api-version").to_s)
-
-          data.fetch("files", []).each_with_object({}) do |file, releases|
-            filename = file["filename"]
+          context = Distribution.context("Simple API JSON", project_url)
+          data = Distribution.object(Distribution.parse_json(json_body, context), context)
+          meta = data["meta"]
+          metadata = meta.nil? ? {} : Distribution.object(meta, "#{context}.meta")
+          validate_api_version!(metadata.fetch("api-version", "1.0"), context)
+
+          releases = T.let({}, T::Hash[String, T::Array[Distribution]])
+          Distribution.array(data.fetch("files", []), "#{context}.files").each_with_index do |entry, index|
+            location = "#{context}.files[#{index}]"
+            file = Distribution.object(entry, location)
+            filename = Distribution.optional_string(file["filename"], "#{location}.filename")
             next unless filename&.match?(name_regex)
 
             version = version_from_filename(filename)
-            next unless dependency.version_class.correct?(version)
+            next unless version && dependency.version_class.correct?(version)
 
-            yanked = file["yanked"] || false
-            details = {
-              "version" => version,
-              "requires_python" => file["requires-python"],
-              "yanked" => yanked != false,
-              "yanked_reason" => yanked.is_a?(String) ? yanked : nil,
-              "upload_time" => file["upload-time"],
-              "url" => resolve_url(file["url"])
-            }
+            distribution = Distribution.from_simple(
+              file, version_string: version, context: location, project_url: project_url
+            )
             releases[version] ||= []
-            releases[version] << details
+            T.must(releases[version]) << distribution
           end
+          releases
         end
 
         private
@@ -58,18 +56,11 @@ module Dependabot
         sig { returns(String) }
         attr_reader :project_url
 
-        sig { params(url: T.nilable(String)).returns(T.nilable(String)) }
-        def resolve_url(url)
-          return unless url
-
-          resolved_url = URI.join(project_url, url)
-          resolved_url.user = nil
-          resolved_url.password = nil
-          resolved_url.to_s
-        end
-
-        sig { params(api_version: String).void }
-        def validate_api_version!(api_version)
+        sig { params(api_version: Object, context: String).void }
+        def validate_api_version!(api_version, context)
+          unless api_version.is_a?(String) && api_version.match?(/\A[0-9]+\.[0-9]+\z/)
+            Distribution.invalid("#{context}.meta.api-version", "must be a Major.Minor string")
+          end
           return unless api_version.split(".").first.to_i > 1
 
           raise Dependabot::DependencyFileNotResolvable, "Unsupported PEP 691 API version: #{api_version}"

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -13,6 +13,7 @@ require "dependabot/python/package/package_registry_finder"
 require "dependabot/python/update_checker"
 require "dependabot/python/update_checker/latest_version_finder"
 require "dependabot/python/file_parser/python_requirement_parser"
+require "dependabot/python/file_parser/pyproject_document"
 
 module Dependabot
   module Python
@@ -62,7 +63,7 @@ module Dependabot
           @constraints_files = T.let(nil, T.nilable(T::Array[String]))
           @constraints_file_basenames = T.let(nil, T.nilable(T::Array[String]))
           @requirement_file_directories = T.let(nil, T.nilable(T::Array[String]))
-          @pyproject_content_cache = T.let({}, T::Hash[String, T::Hash[String, Object]])
+          @pyproject_document_cache = T.let({}, T::Hash[String, FileParser::PyprojectDocument])
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }
@@ -201,19 +202,8 @@ module Dependabot
 
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[[String, String]]) }
         def pinned_pyproject_dependencies_for(pyproject)
-          pyproject_content = pyproject_content_for(pyproject)
-          project_obj = pyproject_content["project"]
-          return [] unless project_obj.is_a?(Hash)
-
-          project_hash = project_obj
-          dependencies_obj = T.cast(project_hash["dependencies"], T.nilable(Object))
-          return [] unless dependencies_obj.is_a?(Array)
-
-          dependencies_obj.filter_map do |entry|
-            entry_obj = T.cast(entry, T.nilable(Object))
-            next unless entry_obj.is_a?(String)
-
-            requirement_string, marker = split_requirement_and_marker(entry_obj)
+          pyproject_document_for(pyproject).pip_dependencies.filter_map do |entry|
+            requirement_string, marker = split_requirement_and_marker(entry)
             next unless marker_satisfied_for_python?(marker)
             next if requirement_string.nil? || requirement_string.empty?
 
@@ -432,23 +422,8 @@ module Dependabot
 
         sig { params(pyproject: Dependabot::DependencyFile).returns(T::Array[String]) }
         def constraints_for_pyproject(pyproject)
-          pyproject_content = pyproject_content_for(pyproject)
-          tool_obj = pyproject_content["tool"]
-          return [] unless tool_obj.is_a?(Hash)
-
-          pip_obj = T.cast(tool_obj["pip"], T.nilable(Object))
-          return [] unless pip_obj.is_a?(Hash)
-
-          constraints_obj = T.cast(pip_obj["constraints"], T.nilable(Object))
-          case constraints_obj
-          when String
-            [resolve_constraint_path(path: constraints_obj, declaring_file: pyproject)]
-          when Array
-            constraints_obj.grep(String).map do |path|
-              resolve_constraint_path(path: path, declaring_file: pyproject)
-            end
-          else
-            []
+          pyproject_document_for(pyproject).pip_constraint_paths.map do |path|
+            resolve_constraint_path(path: path, declaring_file: pyproject)
           end
         end
 
@@ -556,23 +531,22 @@ module Dependabot
           marker_evaluator.marker_satisfied?(marker: marker, python_version: python_version)
         end
 
-        sig { params(pyproject: Dependabot::DependencyFile).returns(T::Hash[String, Object]) }
-        def pyproject_content_for(pyproject)
+        sig { params(pyproject: Dependabot::DependencyFile).returns(FileParser::PyprojectDocument) }
+        def pyproject_document_for(pyproject)
           cache_key = pyproject.name
-          return T.must(@pyproject_content_cache[cache_key]) if @pyproject_content_cache.key?(cache_key)
+          return T.must(@pyproject_document_cache[cache_key]) if @pyproject_document_cache.key?(cache_key)
 
-          content =
-            if pyproject.content
-              T.let(TomlRB.parse(pyproject.content), T::Hash[String, Object])
+          content = pyproject.content
+          document =
+            if content
+              FileParser::PyprojectDocument.from_content(content)
             else
-              T.let({}, T::Hash[String, Object])
+              FileParser::PyprojectDocument.new({})
             end
 
-          @pyproject_content_cache[cache_key] = content
-          content
+          @pyproject_document_cache[cache_key] = document
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          @pyproject_content_cache[pyproject.name] = {}
-          T.must(@pyproject_content_cache[pyproject.name])
+          @pyproject_document_cache[pyproject.name] = FileParser::PyprojectDocument.new({})
         end
       end
     end