dependabot-python 0.401.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87da07cdeb8ed8eb7e4cd60c9ac7bb7ae6eefd114a16671b89e2a0063ae44990
-  data.tar.gz: b08192e8bc0a5b8c0125266571bd034029ed17e2c0f77a9d01350b7a9d30fca6
+  metadata.gz: a356ce1516395b575e6b2e0c814c8e8eaa53bd908b24d2b12dbf9bacc62d91a6
+  data.tar.gz: b28b4cb49fdda64b59b84597d47e2a60f393cc081948b9cfc31d5787975d4d8d
 SHA512:
-  metadata.gz: 707368d0c61e05a337dab12cce1655ee25092c8563592ed00e90b8dbbd27e640558d681366e231f1370338c75a6b68b69e7064aacce4211237e5343a79d29629
-  data.tar.gz: 932c74e3ca269747bcbd005fa0ac624d38a26bc60269953b7a8af99c03abf157b999b1d6ec5e30a64b7791a3c970aca267f964bb62dab880a083fb4021a8cbc9
+  metadata.gz: 918c03f9e57b1c853ab0448403cd6b797c2b199d1247bba325cfb8ab0b042d04a17f1bf67626e98048412e697201ec29033655b17737da193a041f7e7eae8be3
+  data.tar.gz: 31703938bf24482e8fc74fb8705d858072a5e190330b415b51e667da46941c3c6bac78bbd0b58a0ccd6646b24096c5b7026e24ba4aa14a404c4727845fa4b20a

data/helpers/requirements.txt

@@ -2,7 +2,9 @@ pip==26.2.1
 pip-tools==7.6.1
 flake8==7.4.1
 hashin==1.0.5
-pipenv==2024.4.1
+# pipenv 2024.4.1 fails to import on Python 3.15 (typing.no_type_check_decorator was removed)
+pipenv==2024.4.1; python_version < "3.15"
+pipenv==2025.1.1; python_version >= "3.15"
 plette==2.2.1
 poetry==2.5.1
 pytest==9.1.1

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -85,8 +85,8 @@ module Dependabot
         def unique_requirement_changes
           previous_reqs = dependency.previous_requirements || []
 
-          changes = dependency.requirements.filter_map do |new_req|
-            old_req = previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
+          changes = dependency.requirements.each_with_index.filter_map do |new_req, index|
+            old_req = matching_previous_requirement(new_req, previous_reqs, index)
             next if new_req == old_req
 
             T.let([new_req, old_req], RequirementChange)
@@ -99,6 +99,27 @@ module Dependabot
           end
         end
 
+        # Requirements and previous requirements are built in the same order, so
+        # pair them by position. The same package can be declared more than once
+        # in one file and group (e.g. with different environment markers), so
+        # matching on file and groups alone can pick the wrong declaration.
+        sig do
+          params(
+            new_req: Dependabot::DependencyRequirement,
+            previous_reqs: T::Array[Dependabot::DependencyRequirement],
+            index: Integer
+          ).returns(T.nilable(Dependabot::DependencyRequirement))
+        end
+        def matching_previous_requirement(new_req, previous_reqs, index)
+          positional = previous_reqs[index]
+          if previous_reqs.length == dependency.requirements.length &&
+             positional&.file == new_req.file && positional&.groups == new_req.groups
+            return positional
+          end
+
+          previous_reqs.find { |r| r.file == new_req.file && r.groups == new_req.groups }
+        end
+
         sig do
           params(
             content: String,

data/lib/dependabot/python/file_updater/requirement_replacer.rb

@@ -150,7 +150,10 @@ module Dependabot
           after_escaped = Regexp.escape(after_name_extras)
           # Match the dependency name with any extras (or none), followed by the requirement.
           # This ensures a single gsub handles all extras variants of the same dependency.
-          /(?<![\-\w\.\[])#{name_escaped}\s*\\?\s*(?:\[[^\]]*\])?\s*\\?\s*#{after_escaped}(?![\-\w\.])/
+          # The requirement must end where the declaration's own specifiers end: ">=2.7.0" is the start of
+          # ">=2.7.0,<3.0.0" and ">=2.7.0,!=2.9.0; sys_platform == 'win32'", which are other declarations.
+          /(?<![\-\w\.\[])#{name_escaped}\s*\\?\s*(?:\[[^\]]*\])?\s*\\?\s*
+           #{after_escaped}(?![\-\w\.]|\s*,\s*\\?\s*[<>=!~])/x
         end
 
         sig { params(requirement: T.nilable(String)).returns(T::Boolean) }

data/lib/dependabot/python/language.rb

@@ -16,8 +16,9 @@ module Dependabot
       # e.g. ARG PY_3_13=3.13.x
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.14.7
-        3.13.13
+        3.15.2
+        3.14.9
+        3.13.17
         3.12.13
         3.11.15
         3.10.20

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -421,6 +421,14 @@ module Dependabot
       # if .toml has incorrect version specification i.e. <0.2.0app
       INVALID_VERSION = /Could not parse version constraint: (?<ver>.*)/
 
+      # Poetry cannot read the poetry.lock: it has no lock-version (written by Poetry before 1.1), or its lock-version
+      # is newer than this Poetry reads. The warning for a merely newer lock-version says "might not be compatible".
+      LOCK_FILE_NOT_COMPATIBLE = /
+        The\slock\sfile\sis\snot\scompatible\swith\sthe\scurrent\sversion\sof\sPoetry\.\s+
+        (?:Upgrade\sPoetry\sto\sbe\sable\sto\sread\sthe\slock\sfile\sor,\salternatively,\sregenerate|Regenerate)
+        \sthe\slock\sfile\swith\sthe\s`poetry\slock`\scommand\.
+      /x
+
       # dependency source link not accessible
       INVALID_LINK = /No valid distribution links found for package: "(?<dep>.*)" version: "(?<ver>.*)"/
 
@@ -530,6 +538,7 @@ module Dependabot
           raise DependencyFileNotResolvable, msg
         end
 
+        handle_lock_file_not_compatible(error)
         handle_enrich_constraints(error)
 
         raise DependencyFileNotResolvable, error.message if error.message.match(PYTHON_RANGE_NOT_SATISFIED)
@@ -572,6 +581,13 @@ module Dependabot
 
       private
 
+      sig { params(error: Exception).void }
+      def handle_lock_file_not_compatible(error)
+        return unless (msg = error.message.match(LOCK_FILE_NOT_COMPATIBLE))
+
+        raise DependencyFileNotResolvable, msg[0].to_s.gsub(/\s+/, " ")
+      end
+
       sig { params(error: Exception).void }
       def handle_enrich_constraints(error)
         if (msg = error.message.match(INCOMPATIBLE_ENRICH_CONSTRAINTS))

data/lib/dependabot/python/update_checker.rb

@@ -420,6 +420,8 @@ module Dependabot
         local_description = metadata.description
         has_library_metadata = !local_description.nil?
 
+        return has_library_metadata if credentials.any? { |c| c["type"] == "python_index" && c.replaces_base? }
+
         begin
           response = Dependabot::RegistryClient.get(
             url: "https://pypi.org/pypi/#{normalised_name(name)}/json/"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.401.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -331,7 +331,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib