dependabot-python 0.403.0 → 0.404.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a356ce1516395b575e6b2e0c814c8e8eaa53bd908b24d2b12dbf9bacc62d91a6
-  data.tar.gz: b28b4cb49fdda64b59b84597d47e2a60f393cc081948b9cfc31d5787975d4d8d
+  metadata.gz: 658f2f5ddb3748a69e82dc4f8bf49d767a2c0dae9cbb8914a593d20ef5c07ea3
+  data.tar.gz: 68b2055158a4c722df9189946fbf1a187fcf30772d891c34656ee528d77f5301
 SHA512:
-  metadata.gz: 918c03f9e57b1c853ab0448403cd6b797c2b199d1247bba325cfb8ab0b042d04a17f1bf67626e98048412e697201ec29033655b17737da193a041f7e7eae8be3
-  data.tar.gz: 31703938bf24482e8fc74fb8705d858072a5e190330b415b51e667da46941c3c6bac78bbd0b58a0ccd6646b24096c5b7026e24ba4aa14a404c4727845fa4b20a
+  metadata.gz: 94b57c466aca413a45ac4cf7d467c3e6267e44e045a7d60d5c81d938f3ab272022b01cf678842350cc9ec22e6292b77698d562fc368061302581f3a60dd80eed
+  data.tar.gz: 804c699ef9572ecba46b5de36b11d25fdd06f869e514f411f3e82cf109ff829855a38ec333d523ee49d1dfa9e8e1270d8d50eb147f1839e86ad6dd54808be4c7

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -121,11 +121,24 @@ module Dependabot
           new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
         end
 
+        POETRY_BUILD_BACKEND_PREFIX = "poetry.core"
+
         sig { returns(T::Boolean) }
         def poetry?
           !poetry_root.nil?
         end
 
+        # Poetry 2.0+ allows projects to declare dependencies using only PEP 621's
+        # [project.dependencies], with no [tool.poetry] table at all. We detect these
+        # projects via their declared build backend so they're still treated as Poetry
+        # projects (e.g. for lockfile parsing and dependency updates).
+        sig { returns(T::Boolean) }
+        def poetry_build_backend?
+          build_system = section(@data, "build-system", "build-system")
+          backend = build_system&.[]("build-backend")
+          backend.is_a?(String) && backend.start_with?(POETRY_BUILD_BACKEND_PREFIX)
+        end
+
         sig { returns(T::Boolean) }
         def project?
           !section(@data, "project", "project").nil?
@@ -275,6 +288,32 @@ module Dependabot
           !(keys.include?("git") && keys.include?("tag"))
         end
 
+        # Keys come back as the author wrote them, which is what a caller has to match the file on.
+        sig { returns(T::Hash[String, T::Hash[Symbol, String]]) }
+        def uv_git_tag_sources
+          tool = section(@data, "tool", "tool")
+          uv = tool && section(tool, "uv", "tool.uv")
+          sources = uv && section(uv, "sources", "tool.uv.sources")
+          return {} unless sources
+
+          result = T.let({}, T::Hash[String, T::Hash[Symbol, String]])
+          sources.each do |name, config|
+            next unless config.is_a?(Hash)
+
+            entry = PyprojectValueParser.object_hash(config, "tool.uv.sources.#{name}")
+            url = entry["git"]
+            ref = entry["tag"]
+            next unless url.is_a?(String) && ref.is_a?(String)
+
+            result[name] = { url: url, ref: ref }
+          end
+          result
+        rescue TypeError
+          # A malformed table is not this method's business either: it runs for every PEP 621
+          # manifest, so raising would stop every dependency in the repository being updated.
+          {}
+        end
+
         sig { params(key: String).returns(T::Array[String]) }
         def workspace_globs(key)
           tool = section(@data, "tool", "tool")

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -207,7 +207,19 @@ module Dependabot
 
         sig { returns(T::Boolean) }
         def using_poetry?
-          pyproject_document.poetry?
+          pyproject_document.poetry? || locked_poetry_build_backend?
+        end
+
+        # A declared Poetry build backend alone isn't proof the project is actively Poetry-managed;
+        # require a committed lockfile as evidence it's really locked by Poetry.
+        sig { returns(T::Boolean) }
+        def locked_poetry_build_backend?
+          pyproject_document.poetry_build_backend? && !lockfile.nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def locked_pep621_only_poetry?
+          !pyproject_document.poetry? && locked_poetry_build_backend?
         end
 
         sig { returns(T::Boolean) }
@@ -233,8 +245,9 @@ module Dependabot
         sig { params(dep: PepDependency).returns(T::Boolean) }
         def skip_pep621_dep?(dep)
           # If a requirement has a `<` or `<=` marker then updating it is
-          # probably blocked. Ignore it.
-          return true if dep.markers&.include?("<")
+          # probably blocked. Ignore it, unless Poetry has locked it: skipping would
+          # re-surface it from the lockfile as a requirement-less sub-dependency.
+          return true if dep.markers&.include?("<") && !locked_pep621_only_poetry?
 
           # If no requirement, don't add it
           requirement = dep.requirement

data/lib/dependabot/python/file_parser.rb

@@ -15,6 +15,7 @@ require "dependabot/python/name_normaliser"
 require "dependabot/python/pip_compile_file_matcher"
 require "dependabot/python/language_version_manager"
 require "dependabot/python/package_manager"
+require "dependabot/python/marker_evaluator"
 
 module Dependabot
   module Python
@@ -351,8 +352,8 @@ module Dependabot
 
         version = python_raw_version
 
-        if marker.include?("python_version")
-          !marker_satisfied?(marker, version)
+        if marker.match?(/\bpython(?:_full)?_version\b/)
+          !marker_evaluator.marker_satisfied?(marker: marker, python_version: version)
         else
           return true if marker.include?("<")
           return false if marker.include?(">")
@@ -361,52 +362,9 @@ module Dependabot
         end
       end
 
-      sig { params(marker: String, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean) }
-      def marker_satisfied?(marker, python_version)
-        conditions = marker.split(/\s+(and|or)\s+/)
-
-        # Explicitly define the type of result as T::Boolean
-        result = T.let(evaluate_condition(T.must(conditions.shift), python_version), T::Boolean)
-
-        until conditions.empty?
-          operator = conditions.shift
-          next_condition = T.must(conditions.shift)
-          next_result = evaluate_condition(next_condition, python_version)
-
-          result = if operator == "and"
-                     result && next_result
-                   else
-                     result || next_result
-                   end
-        end
-
-        result
-      end
-
-      sig do
-        params(
-          condition: String,
-          python_version: T.any(String, Integer, Gem::Version)
-        ).returns(T::Boolean)
-      end
-      def evaluate_condition(condition, python_version)
-        operator, version = condition.match(/([<>=!]=?)\s*"?([\d.]+)"?/)&.captures
-        return false unless version
-
-        case operator
-        when "<"
-          Dependabot::Python::Version.new(python_version) < Dependabot::Python::Version.new(version)
-        when "<="
-          Dependabot::Python::Version.new(python_version) <= Dependabot::Python::Version.new(version)
-        when ">"
-          Dependabot::Python::Version.new(python_version) > Dependabot::Python::Version.new(version)
-        when ">="
-          Dependabot::Python::Version.new(python_version) >= Dependabot::Python::Version.new(version)
-        when "=="
-          Dependabot::Python::Version.new(python_version) == Dependabot::Python::Version.new(version)
-        else
-          false
-        end
+      sig { returns(MarkerEvaluator) }
+      def marker_evaluator
+        @marker_evaluator ||= T.let(MarkerEvaluator.new, T.nilable(MarkerEvaluator))
       end
 
       sig { returns(DependencySet) }

data/lib/dependabot/python/file_updater/poetry_file_updater/pep621_updater.rb

@@ -101,10 +101,9 @@ module Dependabot
             ).returns(T.nilable(String))
           end
           def replace_with_source_requirement(content, source_req, new_r, old_r)
-            match = content.match(declaration_regex(source_req))
-            return unless match
+            declaration = find_declaration(content, declaration_regex(source_req))
+            return unless declaration
 
-            declaration = T.must(match[:declaration])
             new_req_str = rewrite_pep508_requirement(
               source_req,
               T.must(old_r.requirement_string),
@@ -128,23 +127,44 @@ module Dependabot
             old_req = T.must(old_r.requirement_string)
             new_req = T.must(new_r.requirement_string)
 
-            match = content.match(normalized_declaration_regex(old_req))
-            return unless match
-
-            declaration = T.must(match[:declaration])
-            return unless declaration.include?(old_req)
+            declaration = find_declaration(content, normalized_declaration_regex(old_req))
+            return unless declaration&.include?(old_req)
 
             content.sub(declaration, declaration.sub(old_req, new_req))
           end
 
+          # The regexes stop after the requirement. The closing quote and any environment marker are
+          # checked here, since matching an unbounded marker in the regex itself can backtrack badly.
+          sig { params(content: String, prefix_regex: Regexp).returns(T.nilable(String)) }
+          def find_declaration(content, prefix_regex)
+            position = 0
+            while (match = content.match(prefix_regex, position))
+              finish = declaration_end(content, match.end(0))
+              return content[match.begin(0)...finish] if finish
+
+              position = match.begin(0) + 1
+            end
+          end
+
+          sig { params(content: String, start: Integer).returns(T.nilable(Integer)) }
+          def declaration_end(content, start)
+            tail = content[start..].to_s
+            quote = tail.index(/["']/)
+            return unless quote
+
+            trailing = tail[0, quote].to_s
+            start + quote + 1 if trailing.empty? || trailing.lstrip.start_with?(";")
+          end
+
           sig { params(old_req: String).returns(Regexp) }
           def declaration_regex(old_req)
-            /(?<declaration>["']#{escape}\s*#{extras_pattern}\s*#{Regexp.escape(old_req)}["'])/mi
+            spacing = extras_pattern.empty? ? "\\s*" : "\\s*#{extras_pattern}\\s*"
+            /["']#{escape}#{spacing}#{Regexp.escape(old_req)}/mi
           end
 
           sig { params(old_req: String).returns(Regexp) }
           def normalized_declaration_regex(old_req)
-            /(?<declaration>["']#{escape}#{extras_pattern}#{Regexp.escape(old_req)}["'])/mi
+            /["']#{escape}#{extras_pattern}#{Regexp.escape(old_req)}/mi
           end
 
           sig { returns(String) }

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -11,9 +11,11 @@ require "dependabot/python/version"
 require "dependabot/python/requirement"
 require "dependabot/python/file_parser/python_requirement_parser"
 require "dependabot/python/file_updater"
+require "dependabot/python/file_parser/pyproject_document"
 require "dependabot/python/native_helpers"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/poetry_plugin_installer"
+require "dependabot/python/poetry_subdependency_pin"
 require "dependabot/package/release_cooldown_options"
 
 module Dependabot
@@ -29,6 +31,7 @@ module Dependabot
     end
 
     class FileUpdater
+      # rubocop:disable-next Metrics/ClassLength
       class PoetryFileUpdater
         require_relative "pyproject_preparer"
         require_relative "poetry_file_updater/pep621_updater"
@@ -249,6 +252,8 @@ module Dependabot
                 create_declaration_at_new_version!(poetry_object, dep)
               end
             end
+          elsif FileParser::PyprojectDocument.from_content(pyproject_content).poetry_build_backend?
+            pin_pep621_subdependencies!(pyproject_object)
           end
 
           # Freeze PEP 621 project.dependencies and project.optional-dependencies
@@ -259,6 +264,21 @@ module Dependabot
           TomlRB.dump(pyproject_object)
         end
 
+        # freeze_pep621_deps! skips dependency groups and a sub-dependency has no declaration, so without
+        # this Poetry could lock either to a newer release than the one selected.
+        sig { params(pyproject_object: T::Hash[String, T.untyped]).void }
+        def pin_pep621_subdependencies!(pyproject_object)
+          dependencies.each do |dep|
+            next if git_dependency_being_updated?(dep)
+            next unless dep.version
+
+            PoetrySubdependencyPin.new(lockfile, dep.name).set_requirement!(pyproject_object, "==#{dep.version}")
+          rescue PoetrySubdependencyPin::ScopeNotReproducible
+            # The update checker declines these; skipping keeps a direct run from promoting the package.
+            next
+          end
+        end
+
         sig { params(pyproject_content: String).returns(String) }
         def update_python_requirement(pyproject_content)
           PyprojectPreparer.new(pyproject_content: pyproject_content)

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -8,6 +8,7 @@ require "dependabot/python/file_parser"
 require "dependabot/python/file_updater"
 require "dependabot/python/authed_url_builder"
 require "dependabot/python/name_normaliser"
+require "dependabot/python/requirement"
 require "securerandom"
 
 module Dependabot
@@ -122,8 +123,8 @@ module Dependabot
           pyproject_object = TomlRB.parse(@pyproject_content)
 
           if (python_specification = pyproject_object.dig("tool", "poetry", "dependencies", "python"))
-            python_req = Python::Requirement.new(python_specification)
-            unless python_req.satisfied_by?(requirement)
+            python_requirements = Python::Requirement.requirements_array(python_specification)
+            unless python_requirements.empty? || python_requirements.any? { |req| req.satisfied_by?(requirement) }
               pyproject_object["tool"]["poetry"]["dependencies"]["python"] = "~#{requirement}"
             end
           end
@@ -148,8 +149,9 @@ module Dependabot
           pyproject_object = TomlRB.parse(pyproject_content)
           poetry_object = pyproject_object.dig("tool", "poetry")
 
-          return pyproject_content unless poetry_object
+          return pyproject_content unless poetry_object || locked_poetry_build_backend?
 
+          poetry_object ||= {}
           excluded_names = dependencies.map(&:name) + ["python"]
 
           Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES.each do |key|
@@ -176,6 +178,11 @@ module Dependabot
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :lockfile
 
+        sig { returns(T::Boolean) }
+        def locked_poetry_build_backend?
+          !lockfile.nil? && FileParser::PyprojectDocument.from_content(pyproject_content).poetry_build_backend?
+        end
+
         sig { params(deps_hash: T::Hash[String, T.untyped], dep_name: String).void }
         def freeze_poetry_dep!(deps_hash, dep_name)
           details = locked_details(dep_name)
@@ -230,6 +237,9 @@ module Dependabot
             dep_name = normalise(T.must(match[1]))
             next if excluded_names.include?(dep_name)
 
+            # One pin can't suit every Python branch of a package locked at several versions.
+            next if locked_entry_count(dep_name) > 1
+
             locked_details = locked_details(dep_name)
             next unless (locked_version = locked_details&.fetch("version"))
 
@@ -243,6 +253,11 @@ module Dependabot
                          .find { |d| d["name"] == normalise(dep_name) }
         end
 
+        sig { params(dep_name: String).returns(Integer) }
+        def locked_entry_count(dep_name)
+          parsed_lockfile.fetch("package").count { |d| d["name"] == normalise(dep_name) }
+        end
+
         sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)

data/lib/dependabot/python/file_updater.rb

@@ -5,6 +5,7 @@ require "toml-rb"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "dependabot/python/file_parser/pyproject_document"
 require "sorbet-runtime"
 
 module Dependabot
@@ -154,8 +155,7 @@ module Dependabot
 
         return false unless poetry_lock
 
-        build_backend = parsed_pyproject.dig("build-system", "build-backend")
-        !build_backend.nil? && build_backend.start_with?("poetry.core")
+        FileParser::PyprojectDocument.from_content(T.must(pyproject&.content)).poetry_build_backend?
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/python/language.rb

@@ -17,11 +17,11 @@ module Dependabot
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
         3.15.2
-        3.14.9
-        3.13.17
-        3.12.13
-        3.11.15
-        3.10.20
+        3.14.10
+        3.13.18
+        3.12.16
+        3.11.18
+        3.10.22
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(

data/lib/dependabot/python/marker_evaluator.rb

@@ -0,0 +1,237 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/python/version"
+
+module Dependabot
+  module Python
+    class MarkerEvaluator
+      extend T::Sig
+
+      sig { params(requirement_string: String).returns([T.nilable(String), T.nilable(String)]) }
+      def split_requirement_and_marker(requirement_string)
+        separator_index = T.let(nil, T.nilable(Integer))
+        in_single_quote = T.let(false, T::Boolean)
+        in_double_quote = T.let(false, T::Boolean)
+
+        requirement_string.each_char.with_index do |char, index|
+          in_single_quote, in_double_quote, quote_toggled =
+            toggle_quote_state(char, in_single_quote, in_double_quote)
+          next if quote_toggled
+          next if in_single_quote || in_double_quote
+          next unless char == ";"
+
+          separator_index = index
+          break
+        end
+
+        return [requirement_string.strip, nil] if separator_index.nil?
+
+        requirement_part = requirement_string[0...separator_index]
+        marker_part = requirement_string[(separator_index + 1)..]
+
+        [requirement_part&.strip, marker_part&.strip]
+      end
+
+      sig { params(marker: String, python_version: String).returns(T::Boolean) }
+      def marker_satisfied?(marker:, python_version:)
+        evaluate_marker_expression(marker, python_version)
+      rescue ArgumentError
+        # If we cannot safely parse a python marker, treat it as applicable.
+        # This avoids silently skipping transitive constraints that may break installs.
+        true
+      end
+
+      private
+
+      sig { params(expression: String, python_version: String).returns(T::Boolean) }
+      def evaluate_marker_expression(expression, python_version)
+        expr = strip_wrapping_parentheses(expression.strip)
+
+        or_parts = split_top_level(expr, "or")
+        return or_parts.any? { |part| evaluate_marker_expression(part, python_version) } if or_parts.length > 1
+
+        and_parts = split_top_level(expr, "and")
+        if and_parts.length > 1
+          return and_parts.all? do |part|
+            evaluate_marker_expression(part, python_version) || !python_marker?(part)
+          end
+        end
+
+        not_expression = strip_top_level_not(expr)
+        if not_expression
+          return false unless python_marker?(not_expression)
+
+          return !evaluate_marker_expression(not_expression, python_version)
+        end
+
+        evaluate_python_version_condition(expr, python_version, default: python_marker?(expr))
+      end
+
+      sig { params(expression: String).returns(T.nilable(String)) }
+      def strip_top_level_not(expression)
+        return nil unless expression.start_with?("not")
+        return nil unless word_at?(expression, 0, "not")
+
+        remaining = expression[3..]&.strip
+        return nil if remaining.nil? || remaining.empty?
+
+        remaining
+      end
+
+      sig { params(expression: String).returns(T::Boolean) }
+      def python_marker?(expression)
+        expression.match?(/\bpython(?:_full)?_version\b/)
+      end
+
+      sig { params(expression: String).returns(String) }
+      def strip_wrapping_parentheses(expression)
+        expr = expression
+        while expr.start_with?("(") && expr.end_with?(")")
+          inner = expr[1...-1].to_s.strip
+          break unless balanced_parentheses?(inner)
+
+          expr = inner
+        end
+
+        expr
+      end
+
+      sig { params(expression: String).returns(T::Boolean) }
+      def balanced_parentheses?(expression)
+        depth = T.let(0, Integer)
+        in_single_quote = T.let(false, T::Boolean)
+        in_double_quote = T.let(false, T::Boolean)
+
+        expression.each_char do |char|
+          in_single_quote, in_double_quote, quote_toggled =
+            toggle_quote_state(char, in_single_quote, in_double_quote)
+          next if quote_toggled
+          next if in_single_quote || in_double_quote
+
+          depth += 1 if char == "("
+          depth -= 1 if char == ")"
+          return false if depth.negative?
+        end
+
+        depth.zero? && !in_single_quote && !in_double_quote
+      end
+
+      sig do
+        params(
+          char: String,
+          in_single_quote: T::Boolean,
+          in_double_quote: T::Boolean
+        ).returns([T::Boolean, T::Boolean, T::Boolean])
+      end
+      def toggle_quote_state(char, in_single_quote, in_double_quote)
+        return [!in_single_quote, in_double_quote, true] if char == "'" && !in_double_quote
+
+        return [in_single_quote, !in_double_quote, true] if char == '"' && !in_single_quote
+
+        [in_single_quote, in_double_quote, false]
+      end
+
+      sig { params(expression: String, operator: String).returns(T::Array[String]) }
+      def split_top_level(expression, operator)
+        parts = T.let([], T::Array[String])
+        token = T.let(+"", String)
+        depth = T.let(0, Integer)
+        in_single_quote = T.let(false, T::Boolean)
+        in_double_quote = T.let(false, T::Boolean)
+        i = T.let(0, Integer)
+
+        while i < expression.length
+          char = T.must(expression[i])
+
+          in_single_quote, in_double_quote, quote_toggled =
+            toggle_quote_state(char, in_single_quote, in_double_quote)
+          if quote_toggled
+            token << char
+            i += 1
+            next
+          end
+
+          depth = update_depth_for_unquoted_char(char, depth, in_single_quote, in_double_quote)
+
+          if depth.zero? && !in_single_quote && !in_double_quote && word_at?(expression, i, operator)
+            parts << token.strip
+            token = +""
+            i += operator.length
+            next
+          end
+
+          token << char
+          i += 1
+        end
+
+        parts << token.strip
+        parts
+      end
+
+      sig do
+        params(
+          char: String,
+          depth: Integer,
+          in_single_quote: T::Boolean,
+          in_double_quote: T::Boolean
+        ).returns(Integer)
+      end
+      def update_depth_for_unquoted_char(char, depth, in_single_quote, in_double_quote)
+        return depth if in_single_quote || in_double_quote
+
+        depth += 1 if char == "("
+        depth -= 1 if char == ")"
+        depth
+      end
+
+      sig { params(expression: String, index: Integer, word: String).returns(T::Boolean) }
+      def word_at?(expression, index, word)
+        return false unless expression[index, word.length] == word
+
+        before = index.zero? ? " " : T.must(expression[index - 1])
+        after_index = index + word.length
+        after = after_index >= expression.length ? " " : T.must(expression[after_index])
+
+        word_boundary?(before) && word_boundary?(after)
+      end
+
+      sig { params(char: String).returns(T::Boolean) }
+      def word_boundary?(char)
+        !!(char =~ /[^A-Za-z0-9_]/)
+      end
+
+      sig do
+        params(
+          condition: T.nilable(String),
+          python_version: String,
+          default: T::Boolean
+        ).returns(T::Boolean)
+      end
+      def evaluate_python_version_condition(condition, python_version, default:)
+        return default if condition.nil?
+
+        candidate = strip_wrapping_parentheses(condition.strip)
+        match = candidate.match(/\Apython(?:_full)?_version\s*(<=|>=|<|>|==|!=)\s*['\"]([^'\"]+)['\"]\z/)
+        return default unless match
+
+        operator = T.must(match[1])
+        version = T.must(match[2])
+        lhs = Dependabot::Python::Version.new(python_version)
+        rhs = Dependabot::Python::Version.new(version)
+
+        case operator
+        when "<" then lhs < rhs
+        when "<=" then lhs <= rhs
+        when ">" then lhs > rhs
+        when ">=" then lhs >= rhs
+        when "==" then lhs == rhs
+        when "!=" then lhs != rhs
+        else false
+        end
+      rescue ArgumentError
+        true
+      end
+    end
+  end
+end

data/lib/dependabot/python/poetry_subdependency_pin.rb

@@ -0,0 +1,198 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "toml-rb"
+require "dependabot/dependency_file"
+require "dependabot/python/name_normaliser"
+require "dependabot/python/file_updater/pyproject_preparer"
+
+module Dependabot
+  module Python
+    # Pins a sub-dependency of a PEP 621-only project in a scratch manifest. The pin keeps
+    # the package's locked markers, so Poetry records the same install conditions; an unconditional pin
+    # would promote an extra-only or platform-specific package into every install.
+    #
+    # A package locked at several versions (one per Python branch) is declined: a single pin can't
+    # satisfy every branch.
+    class PoetrySubdependencyPin
+      extend T::Sig
+
+      EXTRA_NAME = /extra\s*==\s*"([^"]+)"/
+      private_constant :EXTRA_NAME
+
+      # Raised when a pin can't reproduce the package's install conditions, so the update is declined
+      # rather than risk locking a version outside its intended scope.
+      class ScopeNotReproducible < StandardError; end
+
+      # A string, or a table such as PEP 735's `{ include-group = "..." }`.
+      DeclarationEntry = T.type_alias { T.any(String, T::Hash[String, String]) }
+      private_constant :DeclarationEntry
+
+      class LockedEntry < T::Struct
+        const :optional, T::Boolean
+        const :groups, T::Array[String]
+        const :markers, T::Hash[String, T::Array[String]]
+
+        extend T::Sig
+
+        sig { params(group: String).returns(T::Array[String]) }
+        def markers_for(group)
+          markers.fetch(group, [])
+        end
+      end
+      private_constant :LockedEntry
+
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile), name: String).void }
+      def initialize(lockfile, name)
+        @lockfile = lockfile
+        @name = name
+      end
+
+      # Updates every declaration of the dependency in place; a sub-dependency isn't declared anywhere,
+      # so it is pinned instead to force Poetry's solver to consider the target version.
+      # rubocop:disable-next Sorbet/ForbidTUntyped
+      sig { params(pyproject_object: T::Hash[String, T.untyped], requirement: String).void }
+      def set_requirement!(pyproject_object, requirement)
+        project_object = pyproject_object["project"]
+        return unless project_object
+
+        ensure_single_version!
+        return if declaration_arrays(pyproject_object).map { |arr| update_declarations!(arr, requirement) }.any?
+
+        pin!(pyproject_object, "#{@name}#{requirement}")
+      end
+
+      # A package locked at several versions has per-marker scopes that one target version can't reproduce.
+      sig { void }
+      def ensure_single_version!
+        raise ScopeNotReproducible, "#{@name} is locked at several versions" if entries.size > 1
+      end
+
+      # Adds a pin per place the package is locked (main, extras, other groups), each keeping its locked
+      # markers. Raises ScopeNotReproducible for a package locked at several versions, or an optional
+      # package with no extras in its markers.
+      # rubocop:disable-next Sorbet/ForbidTUntyped
+      sig { params(pyproject_object: T::Hash[String, T.untyped], pin: String).void }
+      def pin!(pyproject_object, pin)
+        project_object = pyproject_object["project"]
+        return unless project_object
+
+        main_pin, extra_pins, group_pins = pins_for(pin)
+
+        (project_object["dependencies"] ||= []) << main_pin if main_pin
+        append_pins!(project_object["optional-dependencies"] ||= {}, extra_pins)
+        append_pins!(pyproject_object["dependency-groups"] ||= {}, group_pins) if group_pins.any?
+      end
+
+      private
+
+      sig { params(table: T::Hash[String, T::Array[DeclarationEntry]], pins: T::Hash[String, String]).void }
+      def append_pins!(table, pins)
+        pins.each { |key, pin| (table[declared_key(table, key)] ||= []) << pin }
+      end
+
+      # Returns [main_pin, extra_pins, group_pins]. Raises ScopeNotReproducible for a package locked at
+      # several versions, or an optional package with no extras in its markers (legacy lockfile format):
+      # pinning it unconditionally would promote it into the main install.
+      sig { params(pin: String).returns([T.nilable(String), T::Hash[String, String], T::Hash[String, String]]) }
+      def pins_for(pin)
+        ensure_single_version!
+
+        entry = entries.first
+        return [pin, {}, {}] unless entry
+
+        group_pins = (entry.groups - ["main"]).to_h { |group| [group, scoped_pin(pin, entry, group)] }
+        return [nil, {}, group_pins] unless entry.groups.include?("main")
+        return [scoped_pin(pin, entry, "main"), {}, group_pins] unless entry.optional
+
+        [nil, extra_pins(pin, entry), group_pins]
+      end
+
+      sig { params(pin: String, entry: LockedEntry, group: String).returns(String) }
+      def scoped_pin(pin, entry, group)
+        marker = entry.markers_for(group).first
+        marker ? "#{pin}; #{marker}" : pin
+      end
+
+      # The lock holds normalised extra and group names, which may differ from how the project spells them.
+      sig { params(table: T::Hash[String, T::Array[DeclarationEntry]], name: String).returns(String) }
+      def declared_key(table, name)
+        table.keys.find { |key| normalise_key(key) == normalise_key(name) } || name
+      end
+
+      sig { params(name: String).returns(String) }
+      def normalise_key(name)
+        name.downcase.gsub(/[-_.]+/, "-")
+      end
+
+      # rubocop:disable-next Sorbet/ForbidTUntyped
+      sig { params(pyproject_object: T::Hash[String, T.untyped]).returns(T::Array[T::Array[DeclarationEntry]]) }
+      def declaration_arrays(pyproject_object)
+        project = pyproject_object.fetch("project", {})
+        tables = [project["optional-dependencies"], pyproject_object["dependency-groups"]].compact
+        [project["dependencies"], *tables.flat_map(&:values)].grep(Array)
+      end
+
+      sig { params(declarations: T::Array[DeclarationEntry], requirement: String).returns(T::Boolean) }
+      def update_declarations!(declarations, requirement)
+        updated = T.let(false, T::Boolean)
+
+        declarations.each_with_index do |entry, index|
+          next unless entry.is_a?(String)
+
+          match = entry.match(Python::FileUpdater::PyprojectPreparer::PEP508_PREFIX)
+          next unless match && NameNormaliser.normalise(T.must(match[:name])) == @name
+
+          prefix = T.must(match[:prefix])
+          head, separator, tail = entry[prefix.length..].to_s.partition(";")
+          marker = separator.empty? ? "" : "#{head[head.rstrip.length..]};#{tail}"
+          declarations[index] = "#{prefix}#{requirement}#{marker}"
+          updated = true
+        end
+
+        updated
+      end
+
+      sig { returns(T::Array[LockedEntry]) }
+      def entries
+        @entries ||= T.let(locked_entries, T.nilable(T::Array[LockedEntry]))
+      end
+
+      sig { returns(T::Array[LockedEntry]) }
+      def locked_entries
+        return [] unless @lockfile
+
+        TomlRB.parse(T.must(@lockfile.content)).fetch("package", []).filter_map do |entry|
+          next unless entry["name"] && NameNormaliser.normalise(entry["name"]) == @name
+
+          # Legacy lockfiles record no groups; those entries are treated as main.
+          groups = Array(entry["groups"])
+          groups = ["main"] if groups.empty?
+          LockedEntry.new(optional: entry["optional"] == true, groups: groups, markers: locked_markers(entry, groups))
+        end
+      end
+
+      # Markers are a single string, or a table keyed by group.
+      # rubocop:disable-next Sorbet/ForbidTUntyped
+      sig do
+        params(entry: T::Hash[String, T.untyped], groups: T::Array[String]).returns(T::Hash[String, T::Array[String]])
+      end
+      def locked_markers(entry, groups)
+        markers = entry["markers"]
+        return markers.transform_values { |marker| ["(#{marker})"] } if markers.is_a?(Hash)
+
+        groups.to_h { |group| [group, markers ? ["(#{markers})"] : []] }
+      end
+
+      sig { params(pin: String, entry: LockedEntry).returns(T::Hash[String, String]) }
+      def extra_pins(pin, entry)
+        marker = entry.markers_for("main").first.to_s
+        extras = marker.scan(EXTRA_NAME).flatten.uniq
+        raise ScopeNotReproducible, "#{@name} is optional but has no recorded extras" if extras.empty?
+
+        extras.to_h { |extra| [extra, "#{pin}; #{marker}"] }
+      end
+    end
+  end
+end

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -14,6 +14,7 @@ require "dependabot/python/update_checker"
 require "dependabot/python/update_checker/latest_version_finder"
 require "dependabot/python/file_parser/python_requirement_parser"
 require "dependabot/python/file_parser/pyproject_document"
+require "dependabot/python/marker_evaluator"
 
 module Dependabot
   module Python
@@ -24,8 +25,6 @@ module Dependabot
       class PipVersionResolver
         extend T::Sig
 
-        require_relative "pip_version_resolver/marker_evaluator"
-
         sig do
           params(
             dependency: Dependabot::Dependency,
@@ -56,7 +55,7 @@ module Dependabot
           @latest_version_finder = T.let(nil, T.nilable(LatestVersionFinder))
           @python_requirement_parser = T.let(nil, T.nilable(FileParser::PythonRequirementParser))
           @language_version_manager = T.let(nil, T.nilable(LanguageVersionManager))
-          @marker_evaluator = T.let(nil, T.nilable(MarkerEvaluator))
+          @marker_evaluator = T.let(nil, T.nilable(Dependabot::Python::MarkerEvaluator))
           @registry_json_urls = T.let(nil, T.nilable(T::Array[String]))
           @transitive_requirements_cache = T.let({}, T::Hash[String, T::Array[String]])
           @transitive_requirement_available_cache = T.let({}, T::Hash[String, T::Boolean])
@@ -138,9 +137,9 @@ module Dependabot
             )
         end
 
-        sig { returns(MarkerEvaluator) }
+        sig { returns(Dependabot::Python::MarkerEvaluator) }
         def marker_evaluator
-          @marker_evaluator ||= MarkerEvaluator.new
+          @marker_evaluator ||= Dependabot::Python::MarkerEvaluator.new
         end
 
         sig { params(candidate: Dependabot::Version).returns(T::Boolean) }

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -19,6 +19,7 @@ require "dependabot/python/native_helpers"
 require "dependabot/python/authed_url_builder"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/poetry_plugin_installer"
+require "dependabot/python/poetry_subdependency_pin"
 
 module Dependabot
   module Python
@@ -144,6 +145,8 @@ module Dependabot
                 updated_lockfile = TomlRB.parse(updated_lockfile)
 
                 fetch_version_from_parsed_lockfile(updated_lockfile)
+              rescue PoetrySubdependencyPin::ScopeNotReproducible
+                nil
               rescue SharedHelpers::HelperSubprocessFailed => e
                 handle_poetry_errors(e)
               end
@@ -315,11 +318,33 @@ module Dependabot
 
         sig { params(pyproject_content: String, updated_requirement: T.nilable(String)).returns(String) }
         def set_target_dependency_req(pyproject_content, updated_requirement)
-          return pyproject_content unless updated_requirement
+          unless updated_requirement
+            # Poetry's lock result for a package locked at several versions can't be read back as one version.
+            if pep621_only_poetry_project?(pyproject_content)
+              PoetrySubdependencyPin.new(poetry_lock, dependency.name).ensure_single_version!
+            end
+            return pyproject_content
+          end
 
           pyproject_object = TomlRB.parse(pyproject_content)
           poetry_object = pyproject_object.dig("tool", "poetry")
 
+          if poetry_object
+            set_poetry_target_dependency_req(poetry_object, updated_requirement)
+          elsif pep621_only_poetry_project?(pyproject_content)
+            set_pep621_target_dependency_req(pyproject_object, updated_requirement)
+          end
+
+          TomlRB.dump(pyproject_object)
+        end
+
+        sig { params(pyproject_content: String).returns(T::Boolean) }
+        def pep621_only_poetry_project?(pyproject_content)
+          !poetry_lock.nil? && FileParser::PyprojectDocument.from_content(pyproject_content).poetry_build_backend?
+        end
+
+        sig { params(poetry_object: T::Hash[String, T.untyped], updated_requirement: String).void }
+        def set_poetry_target_dependency_req(poetry_object, updated_requirement)
           Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES.each do |type|
             dependencies = poetry_object[type]
             next unless dependencies
@@ -333,12 +358,18 @@ module Dependabot
           end
 
           # If this is a sub-dependency, add the new requirement
-          unless dependency.requirements.find { |r| r.file == T.must(pyproject).name }
-            poetry_object[subdep_type] ||= {}
-            poetry_object[subdep_type][dependency.name] = updated_requirement
-          end
+          return if dependency.requirements.find { |r| r.file == T.must(pyproject).name }
 
-          TomlRB.dump(pyproject_object)
+          poetry_object[subdep_type] ||= {}
+          poetry_object[subdep_type][dependency.name] = updated_requirement
+        end
+
+        # PEP 621 projects have no [tool.poetry] table to pin dependencies in. This file is only ever used
+        # as scratch input to run `poetry lock`, so it never reaches the real manifest.
+        sig { params(pyproject_object: T::Hash[String, T.untyped], updated_requirement: String).void }
+        def set_pep621_target_dependency_req(pyproject_object, updated_requirement)
+          PoetrySubdependencyPin.new(poetry_lock, dependency.name)
+                                .set_requirement!(pyproject_object, updated_requirement)
         end
 
         sig { params(toml_node: T.nilable(T::Hash[String, T.untyped]), requirement: String).void }

data/lib/dependabot/python/update_checker.rb

@@ -73,6 +73,8 @@ module Dependabot
         @latest_resolvable_version_with_no_unlock ||= T.let(
           if resolver_type == :requirements
             resolver.latest_resolvable_version_with_no_unlock
+          elsif resolver_type == :poetry
+            resolver.latest_resolvable_version(requirement: nil)
           else
             resolver.latest_resolvable_version(
               requirement: current_requirement_string
@@ -84,6 +86,12 @@ module Dependabot
 
       sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_security_fix_version
+        # A git dependency's version is whatever the lockfile records for that package, not a commit
+        # sha, so `existing_version_is_sha?` does not exclude it from security updates the way it does
+        # elsewhere. Its index has no bearing on the pinned ref: answering with a version from there
+        # would title the pull request with a fix the diff does not apply.
+        return nil if git_dependency?
+
         latest_version_finder.lowest_security_fix_version
       end
 
@@ -398,7 +406,12 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def poetry_based?
-        updating_pyproject? && pyproject_document.poetry?
+        updating_pyproject? && (pyproject_document.poetry? || locked_poetry_build_backend?)
+      end
+
+      sig { returns(T::Boolean) }
+      def locked_poetry_build_backend?
+        !poetry_lock.nil? && pyproject_document.poetry_build_backend?
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.403.0
+  version: 0.404.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.403.0
+        version: 0.404.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -302,6 +302,7 @@ files:
 - lib/dependabot/python/file_updater/setup_file_sanitizer.rb
 - lib/dependabot/python/language.rb
 - lib/dependabot/python/language_version_manager.rb
+- lib/dependabot/python/marker_evaluator.rb
 - lib/dependabot/python/metadata_finder.rb
 - lib/dependabot/python/name_normaliser.rb
 - lib/dependabot/python/native_helpers.rb
@@ -314,6 +315,7 @@ files:
 - lib/dependabot/python/pip_compile_file_matcher.rb
 - lib/dependabot/python/pipenv_runner.rb
 - lib/dependabot/python/poetry_plugin_installer.rb
+- lib/dependabot/python/poetry_subdependency_pin.rb
 - lib/dependabot/python/requirement.rb
 - lib/dependabot/python/requirement_parser.rb
 - lib/dependabot/python/shared_file_fetcher.rb
@@ -321,7 +323,6 @@ files:
 - lib/dependabot/python/update_checker/latest_version_finder.rb
 - lib/dependabot/python/update_checker/pip_compile_version_resolver.rb
 - lib/dependabot/python/update_checker/pip_version_resolver.rb
-- lib/dependabot/python/update_checker/pip_version_resolver/marker_evaluator.rb
 - lib/dependabot/python/update_checker/pipenv_version_resolver.rb
 - lib/dependabot/python/update_checker/poetry_version_resolver.rb
 - lib/dependabot/python/update_checker/requirements_updater.rb
@@ -331,7 +332,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.404.0
 rdoc_options: []
 require_paths:
 - lib

data/lib/dependabot/python/update_checker/pip_version_resolver/marker_evaluator.rb

@@ -1,241 +0,0 @@
-# typed: strong
-# frozen_string_literal: true
-
-require "dependabot/python/update_checker/pip_version_resolver"
-
-module Dependabot
-  module Python
-    class UpdateChecker
-      class PipVersionResolver
-        class MarkerEvaluator
-          extend T::Sig
-
-          sig { params(requirement_string: String).returns([T.nilable(String), T.nilable(String)]) }
-          def split_requirement_and_marker(requirement_string)
-            separator_index = T.let(nil, T.nilable(Integer))
-            in_single_quote = T.let(false, T::Boolean)
-            in_double_quote = T.let(false, T::Boolean)
-
-            requirement_string.each_char.with_index do |char, index|
-              in_single_quote, in_double_quote, quote_toggled =
-                toggle_quote_state(char, in_single_quote, in_double_quote)
-              next if quote_toggled
-              next if in_single_quote || in_double_quote
-              next unless char == ";"
-
-              separator_index = index
-              break
-            end
-
-            return [requirement_string.strip, nil] if separator_index.nil?
-
-            requirement_part = requirement_string[0...separator_index]
-            marker_part = requirement_string[(separator_index + 1)..]
-
-            [requirement_part&.strip, marker_part&.strip]
-          end
-
-          sig { params(marker: String, python_version: String).returns(T::Boolean) }
-          def marker_satisfied?(marker:, python_version:)
-            evaluate_marker_expression(marker, python_version)
-          rescue ArgumentError
-            # If we cannot safely parse a python marker, treat it as applicable.
-            # This avoids silently skipping transitive constraints that may break installs.
-            true
-          end
-
-          private
-
-          sig { params(expression: String, python_version: String).returns(T::Boolean) }
-          def evaluate_marker_expression(expression, python_version)
-            expr = strip_wrapping_parentheses(expression.strip)
-
-            or_parts = split_top_level(expr, "or")
-            return or_parts.any? { |part| evaluate_marker_expression(part, python_version) } if or_parts.length > 1
-
-            and_parts = split_top_level(expr, "and")
-            if and_parts.length > 1
-              return and_parts.all? do |part|
-                evaluate_marker_expression(part, python_version) || !python_marker?(part)
-              end
-            end
-
-            not_expression = strip_top_level_not(expr)
-            if not_expression
-              return false unless python_marker?(not_expression)
-
-              return !evaluate_marker_expression(not_expression, python_version)
-            end
-
-            evaluate_python_version_condition(expr, python_version, default: python_marker?(expr))
-          end
-
-          sig { params(expression: String).returns(T.nilable(String)) }
-          def strip_top_level_not(expression)
-            return nil unless expression.start_with?("not")
-            return nil unless word_at?(expression, 0, "not")
-
-            remaining = expression[3..]&.strip
-            return nil if remaining.nil? || remaining.empty?
-
-            remaining
-          end
-
-          sig { params(expression: String).returns(T::Boolean) }
-          def python_marker?(expression)
-            expression.match?(/\bpython(?:_full)?_version\b/)
-          end
-
-          sig { params(expression: String).returns(String) }
-          def strip_wrapping_parentheses(expression)
-            expr = expression
-            while expr.start_with?("(") && expr.end_with?(")")
-              inner = expr[1...-1].to_s.strip
-              break unless balanced_parentheses?(inner)
-
-              expr = inner
-            end
-
-            expr
-          end
-
-          sig { params(expression: String).returns(T::Boolean) }
-          def balanced_parentheses?(expression)
-            depth = T.let(0, Integer)
-            in_single_quote = T.let(false, T::Boolean)
-            in_double_quote = T.let(false, T::Boolean)
-
-            expression.each_char do |char|
-              in_single_quote, in_double_quote, quote_toggled =
-                toggle_quote_state(char, in_single_quote, in_double_quote)
-              next if quote_toggled
-              next if in_single_quote || in_double_quote
-
-              depth += 1 if char == "("
-              depth -= 1 if char == ")"
-              return false if depth.negative?
-            end
-
-            depth.zero? && !in_single_quote && !in_double_quote
-          end
-
-          sig do
-            params(
-              char: String,
-              in_single_quote: T::Boolean,
-              in_double_quote: T::Boolean
-            ).returns([T::Boolean, T::Boolean, T::Boolean])
-          end
-          def toggle_quote_state(char, in_single_quote, in_double_quote)
-            return [!in_single_quote, in_double_quote, true] if char == "'" && !in_double_quote
-
-            return [in_single_quote, !in_double_quote, true] if char == '"' && !in_single_quote
-
-            [in_single_quote, in_double_quote, false]
-          end
-
-          sig { params(expression: String, operator: String).returns(T::Array[String]) }
-          def split_top_level(expression, operator)
-            parts = T.let([], T::Array[String])
-            token = T.let(+"", String)
-            depth = T.let(0, Integer)
-            in_single_quote = T.let(false, T::Boolean)
-            in_double_quote = T.let(false, T::Boolean)
-            i = T.let(0, Integer)
-
-            while i < expression.length
-              char = T.must(expression[i])
-
-              in_single_quote, in_double_quote, quote_toggled =
-                toggle_quote_state(char, in_single_quote, in_double_quote)
-              if quote_toggled
-                token << char
-                i += 1
-                next
-              end
-
-              depth = update_depth_for_unquoted_char(char, depth, in_single_quote, in_double_quote)
-
-              if depth.zero? && !in_single_quote && !in_double_quote && word_at?(expression, i, operator)
-                parts << token.strip
-                token = +""
-                i += operator.length
-                next
-              end
-
-              token << char
-              i += 1
-            end
-
-            parts << token.strip
-            parts
-          end
-
-          sig do
-            params(
-              char: String,
-              depth: Integer,
-              in_single_quote: T::Boolean,
-              in_double_quote: T::Boolean
-            ).returns(Integer)
-          end
-          def update_depth_for_unquoted_char(char, depth, in_single_quote, in_double_quote)
-            return depth if in_single_quote || in_double_quote
-
-            depth += 1 if char == "("
-            depth -= 1 if char == ")"
-            depth
-          end
-
-          sig { params(expression: String, index: Integer, word: String).returns(T::Boolean) }
-          def word_at?(expression, index, word)
-            return false unless expression[index, word.length] == word
-
-            before = index.zero? ? " " : T.must(expression[index - 1])
-            after_index = index + word.length
-            after = after_index >= expression.length ? " " : T.must(expression[after_index])
-
-            word_boundary?(before) && word_boundary?(after)
-          end
-
-          sig { params(char: String).returns(T::Boolean) }
-          def word_boundary?(char)
-            !!(char =~ /[^A-Za-z0-9_]/)
-          end
-
-          sig do
-            params(
-              condition: T.nilable(String),
-              python_version: String,
-              default: T::Boolean
-            ).returns(T::Boolean)
-          end
-          def evaluate_python_version_condition(condition, python_version, default:)
-            return default if condition.nil?
-
-            candidate = strip_wrapping_parentheses(condition.strip)
-            match = candidate.match(/\Apython(?:_full)?_version\s*(<=|>=|<|>|==|!=)\s*['\"]([^'\"]+)['\"]\z/)
-            return default unless match
-
-            operator = T.must(match[1])
-            version = T.must(match[2])
-            lhs = Dependabot::Python::Version.new(python_version)
-            rhs = Dependabot::Python::Version.new(version)
-
-            case operator
-            when "<" then lhs < rhs
-            when "<=" then lhs <= rhs
-            when ">" then lhs > rhs
-            when ">=" then lhs >= rhs
-            when "==" then lhs == rhs
-            when "!=" then lhs != rhs
-            else false
-            end
-          rescue ArgumentError
-            true
-          end
-        end
-      end
-    end
-  end
-end