dependabot-python 0.401.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87da07cdeb8ed8eb7e4cd60c9ac7bb7ae6eefd114a16671b89e2a0063ae44990
-  data.tar.gz: b08192e8bc0a5b8c0125266571bd034029ed17e2c0f77a9d01350b7a9d30fca6
+  metadata.gz: eae7152a290937aaf3118091bf2d2befbeaeb54cf625498312167ea0cc88d867
+  data.tar.gz: d612db59f7e6ac54053c7a1a2f27a2fd591312a5292bfabd088d05a402acb453
 SHA512:
-  metadata.gz: 707368d0c61e05a337dab12cce1655ee25092c8563592ed00e90b8dbbd27e640558d681366e231f1370338c75a6b68b69e7064aacce4211237e5343a79d29629
-  data.tar.gz: 932c74e3ca269747bcbd005fa0ac624d38a26bc60269953b7a8af99c03abf157b999b1d6ec5e30a64b7791a3c970aca267f964bb62dab880a083fb4021a8cbc9
+  metadata.gz: 52df615381fec79610648a6e131cbe10f25ecccacb23a0b1b4ae54e1557eda648ae784181b110e609f670762a536768110ca71ee7602c3889734b295bf560994
+  data.tar.gz: 73aad5f18f8cdf0293d65dd57a1f71aa5d6da1afab438258c091c25dd09d1f0949535b1da729643deebb80dcd89ea4bc0785a20344421d975d2b782c4085895d

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -85,8 +85,8 @@ module Dependabot
         def unique_requirement_changes
           previous_reqs = dependency.previous_requirements || []
 
-          changes = dependency.requirements.filter_map do |new_req|
-            old_req = previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
+          changes = dependency.requirements.each_with_index.filter_map do |new_req, index|
+            old_req = matching_previous_requirement(new_req, previous_reqs, index)
             next if new_req == old_req
 
             T.let([new_req, old_req], RequirementChange)
@@ -99,6 +99,27 @@ module Dependabot
           end
         end
 
+        # Requirements and previous requirements are built in the same order, so
+        # pair them by position. The same package can be declared more than once
+        # in one file and group (e.g. with different environment markers), so
+        # matching on file and groups alone can pick the wrong declaration.
+        sig do
+          params(
+            new_req: Dependabot::DependencyRequirement,
+            previous_reqs: T::Array[Dependabot::DependencyRequirement],
+            index: Integer
+          ).returns(T.nilable(Dependabot::DependencyRequirement))
+        end
+        def matching_previous_requirement(new_req, previous_reqs, index)
+          positional = previous_reqs[index]
+          if previous_reqs.length == dependency.requirements.length &&
+             positional&.file == new_req.file && positional&.groups == new_req.groups
+            return positional
+          end
+
+          previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
+        end
+
         sig do
           params(
             content: String,

data/lib/dependabot/python/language.rb

@@ -16,8 +16,8 @@ module Dependabot
       # e.g. ARG PY_3_13=3.13.x
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.14.7
-        3.13.13
+        3.14.9
+        3.13.17
         3.12.13
         3.11.15
         3.10.20

data/lib/dependabot/python/update_checker.rb

@@ -420,6 +420,8 @@ module Dependabot
         local_description = metadata.description
         has_library_metadata = !local_description.nil?
 
+        return has_library_metadata if credentials.any? { |c| c["type"] == "python_index" && c.replaces_base? }
+
         begin
           response = Dependabot::RegistryClient.get(
             url: "https://pypi.org/pypi/#{normalised_name(name)}/json/"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -331,7 +331,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib