dependabot-python 0.402.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eae7152a290937aaf3118091bf2d2befbeaeb54cf625498312167ea0cc88d867
-  data.tar.gz: d612db59f7e6ac54053c7a1a2f27a2fd591312a5292bfabd088d05a402acb453
+  metadata.gz: a356ce1516395b575e6b2e0c814c8e8eaa53bd908b24d2b12dbf9bacc62d91a6
+  data.tar.gz: b28b4cb49fdda64b59b84597d47e2a60f393cc081948b9cfc31d5787975d4d8d
 SHA512:
-  metadata.gz: 52df615381fec79610648a6e131cbe10f25ecccacb23a0b1b4ae54e1557eda648ae784181b110e609f670762a536768110ca71ee7602c3889734b295bf560994
-  data.tar.gz: 73aad5f18f8cdf0293d65dd57a1f71aa5d6da1afab438258c091c25dd09d1f0949535b1da729643deebb80dcd89ea4bc0785a20344421d975d2b782c4085895d
+  metadata.gz: 918c03f9e57b1c853ab0448403cd6b797c2b199d1247bba325cfb8ab0b042d04a17f1bf67626e98048412e697201ec29033655b17737da193a041f7e7eae8be3
+  data.tar.gz: 31703938bf24482e8fc74fb8705d858072a5e190330b415b51e667da46941c3c6bac78bbd0b58a0ccd6646b24096c5b7026e24ba4aa14a404c4727845fa4b20a

data/helpers/requirements.txt

@@ -2,7 +2,9 @@ pip==26.2.1
 pip-tools==7.6.1
 flake8==7.4.1
 hashin==1.0.5
-pipenv==2024.4.1
+# pipenv 2024.4.1 fails to import on Python 3.15 (typing.no_type_check_decorator was removed)
+pipenv==2024.4.1; python_version < "3.15"
+pipenv==2025.1.1; python_version >= "3.15"
 plette==2.2.1
 poetry==2.5.1
 pytest==9.1.1

data/lib/dependabot/python/file_updater/requirement_replacer.rb

@@ -150,7 +150,10 @@ module Dependabot
           after_escaped = Regexp.escape(after_name_extras)
           # Match the dependency name with any extras (or none), followed by the requirement.
           # This ensures a single gsub handles all extras variants of the same dependency.
-          /(?<![\-\w\.\[])#{name_escaped}\s*\\?\s*(?:\[[^\]]*\])?\s*\\?\s*#{after_escaped}(?![\-\w\.])/
+          # The requirement must end where the declaration's own specifiers end: ">=2.7.0" is the start of
+          # ">=2.7.0,<3.0.0" and ">=2.7.0,!=2.9.0; sys_platform == 'win32'", which are other declarations.
+          /(?<![\-\w\.\[])#{name_escaped}\s*\\?\s*(?:\[[^\]]*\])?\s*\\?\s*
+           #{after_escaped}(?![\-\w\.]|\s*,\s*\\?\s*[<>=!~])/x
         end
 
         sig { params(requirement: T.nilable(String)).returns(T::Boolean) }

data/lib/dependabot/python/language.rb

@@ -16,6 +16,7 @@ module Dependabot
       # e.g. ARG PY_3_13=3.13.x
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
+        3.15.2
         3.14.9
         3.13.17
         3.12.13

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -421,6 +421,14 @@ module Dependabot
       # if .toml has incorrect version specification i.e. <0.2.0app
       INVALID_VERSION = /Could not parse version constraint: (?<ver>.*)/
 
+      # Poetry cannot read the poetry.lock: it has no lock-version (written by Poetry before 1.1), or its lock-version
+      # is newer than this Poetry reads. The warning for a merely newer lock-version says "might not be compatible".
+      LOCK_FILE_NOT_COMPATIBLE = /
+        The\slock\sfile\sis\snot\scompatible\swith\sthe\scurrent\sversion\sof\sPoetry\.\s+
+        (?:Upgrade\sPoetry\sto\sbe\sable\sto\sread\sthe\slock\sfile\sor,\salternatively,\sregenerate|Regenerate)
+        \sthe\slock\sfile\swith\sthe\s`poetry\slock`\scommand\.
+      /x
+
       # dependency source link not accessible
       INVALID_LINK = /No valid distribution links found for package: "(?<dep>.*)" version: "(?<ver>.*)"/
 
@@ -530,6 +538,7 @@ module Dependabot
           raise DependencyFileNotResolvable, msg
         end
 
+        handle_lock_file_not_compatible(error)
         handle_enrich_constraints(error)
 
         raise DependencyFileNotResolvable, error.message if error.message.match(PYTHON_RANGE_NOT_SATISFIED)
@@ -572,6 +581,13 @@ module Dependabot
 
       private
 
+      sig { params(error: Exception).void }
+      def handle_lock_file_not_compatible(error)
+        return unless (msg = error.message.match(LOCK_FILE_NOT_COMPATIBLE))
+
+        raise DependencyFileNotResolvable, msg[0].to_s.gsub(/\s+/, " ")
+      end
+
       sig { params(error: Exception).void }
       def handle_enrich_constraints(error)
         if (msg = error.message.match(INCOMPATIBLE_ENRICH_CONSTRAINTS))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.402.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.402.0
+        version: 0.403.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -331,7 +331,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib