dependabot-python 0.98.29 → 0.98.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1faaf65a49ef231340e38940b2009aca36fb70042283d342de4fd7616c10ea3
-  data.tar.gz: 3cb6606393b643655707d062db6e8de0fb4f22a22550bfef4570424dff6536d5
+  metadata.gz: de12aa5fff8598a55962c37fd73ad95554f9322f0c780d77ea7563c145ac4db8
+  data.tar.gz: 0b942489fd3b4e6d6f7c92657d66cf26cecea1b9d16078f3082e8e0df31d8073
 SHA512:
-  metadata.gz: 670c8a922a5a621752aafffe97cf4e991bdb1479016bc9c2ab2eb797b9aeb51c8bebaa2b3c8d72e7a84ef7b3ad3d096c73e498f1091d6c7aaa0d8a9f09753bd2
-  data.tar.gz: 9af09e0a3aac11788bdb4723e343ca2a53fe1b65878d5fab8ea52d6532425ff4d8a7f6adbd03a72c67bd5ebae0f749e19fc848d942350ed146831463ac78ecea
+  metadata.gz: 48592d3c0b731410126e49e3f2ed35b05b0a3e0c710034b43e267db38435891d52981fe9a7d1ce27885f04068ecdd6beade6bbb5362f16650e25713401dfdf3e
+  data.tar.gz: c3ec892d6f85db912d4fe1e81602f06e022acb46f1879099e35a2fcb5edb2f0587a1b98ffdf20ea859fcddb2f3029ae089c931396a27ada7462202833550f308

data/lib/dependabot/python/file_parser.rb

@@ -73,9 +73,9 @@ module Dependabot
           # and *aren't* a straight lockfile for the Pipfile
           next if included_in_pipenv_deps?(normalised_name(dep["name"]))
 
-          # If a requirement has a `<` or `<=` marker then updating it is
+          # If a requirement has a `<`, `<=` or '==' marker then updating it is
           # probably blocked. Ignore it.
-          next if dep["markers"].include?("<")
+          next if blocking_marker?(dep)
 
           requirements =
             if lockfile_for_pip_compile_file?(dep["file"]) then []
@@ -105,6 +105,14 @@ module Dependabot
         pipenv_dependencies.dependencies.map(&:name).include?(dep_name)
       end
 
+      def blocking_marker?(dep)
+        return false if dep["markers"].include?(">")
+        return true if dep["markers"].include?("<")
+        return true if dep["markers"].include?("==")
+
+        false
+      end
+
       def setup_file_dependencies
         @setup_file_dependencies ||=
           SetupFileParser.

data/lib/dependabot/python/file_updater.rb

@@ -46,25 +46,23 @@ module Dependabot
 
       def resolver_type
         reqs = dependencies.flat_map(&:requirements)
-        req_files = reqs.map { |r| r.fetch(:file) }
+        changed_reqs = reqs.zip(dependencies.flat_map(&:previous_requirements)).
+                       reject { |(new_req, old_req)| new_req == old_req }.
+                       map(&:first)
+        changed_req_files = changed_reqs.map { |r| r.fetch(:file) }
 
         # If there are no requirements then this is a sub-dependency. It
         # must come from one of Pipenv, Poetry or pip-tools, and can't come
         # from the first two unless they have a lockfile.
-        return subdependency_resolver if reqs.none?
+        return subdependency_resolver if changed_reqs.none?
 
         # Otherwise, this is a top-level dependency, and we can figure out
         # which resolver to use based on the filename of its requirements
-        return :pipfile if req_files.any? { |f| f == "Pipfile" }
-        return :poetry if req_files.any? { |f| f == "pyproject.toml" }
-        return :pip_compile if req_files.any? { |f| f.end_with?(".in") }
-
-        # Finally, we should only ever be updating a requirements.txt file if
-        # some requirements have changed. Otherwise, this must be a case where
-        # we have a requirements.txt *and* some other resolver of which the
-        # dependency is a sub-dependency.
-        changed_reqs = reqs - dependencies.flat_map(&:previous_requirements)
-        changed_reqs.none? ? subdependency_resolver : :requirements
+        return :pipfile if changed_req_files.any? { |f| f == "Pipfile" }
+        return :poetry if changed_req_files.any? { |f| f == "pyproject.toml" }
+        return :pip_compile if changed_req_files.any? { |f| f.end_with?(".in") }
+
+        :requirements
       end
 
       def subdependency_resolver

data/lib/dependabot/python/requirement_parser.rb

@@ -17,7 +17,7 @@ module Dependabot
       INSTALL_REQ_WITH_REQUIREMENT =
         /\s*\\?\s*(?<name>#{NAME})
           \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-          \s*\\?\s*(?<requirements>#{REQUIREMENTS})
+          \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})\)?
           \s*\\?\s*(?<hashes>#{HASHES})?
           \s*#*\s*(?<comment>.+)?
         /x.freeze
@@ -32,7 +32,7 @@ module Dependabot
       VALID_REQ_TXT_REQUIREMENT =
         /^\s*\\?\s*(?<name>#{NAME})
           \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-          \s*\\?\s*(?<requirements>#{REQUIREMENTS})?
+          \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})?\)?
           \s*\\?\s*(?<hashes>#{HASHES})?
           \s*(\#+\s*(?<comment>.*))?$
         /x.freeze

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.98.29
+  version: 0.98.30
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.29
+        version: 0.98.30
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.29
+        version: 0.98.30
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement