dependabot-python 0.104.6 → 0.105.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86a22a74e2cfeb8d600f160d2078900565de559537249b34d6e8d31d3475f01f
-  data.tar.gz: 7a0b0874123f7decd66511a39b1ebe207c98fd8968e6194b0906ca5ef68e6d8a
+  metadata.gz: d065ba598a486126484abd062f9aef9318a5d66840259e2c92e494c361829b35
+  data.tar.gz: 652ffb3b9e08ab5f3592cb3b1468a478716b71ae7c159b505a138f202afebbb3
 SHA512:
-  metadata.gz: 30592c176e2ce1dadc2b1f4d689861fd57388377827af9d1a189cb9ae37aa790eba4ef9a727e325c6ef696b8364c93703a9116657c26840091e9de95bbfecc9e
-  data.tar.gz: cbc364db1c7a3de0b4c7643af272c424946e32b16e90742cc911d9e728eb42f97e850bd5d4c304e66fe27fa3b7fa322c4b2b25724a72134a2bb3377dfb068cb2
+  metadata.gz: a90ca099db2c454c926007e0991872b656fb12daab079a9229799053dc52432c96b1d340a8e182c15a3090de7c55da522831b27dc3d7d0924a78322de4fc127a
+  data.tar.gz: f60a63b2bb29ff09c94796ca683aa753dbc26822e888fc463e543c57bc4c2313f1aaec7867cf2a2766004edfc0194dc48719846c7a300e408f29560977095d56

data/lib/dependabot/python/update_checker.rb

@@ -6,6 +6,7 @@ require "toml-rb"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/shared_helpers"
+require "dependabot/errors"
 require "dependabot/python/requirement"
 require "dependabot/python/requirement_parser"
 
@@ -76,17 +77,12 @@ module Dependabot
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        @lowest_resolvable_security_fix_version ||=
-          case resolver_type
-          when :requirements
-            latest_version_finder.lowest_security_fix_version
-          when :pipenv, :poetry, :pip_compile
-            # TODO: Handle package managers with a resolvability concept
-            latest_resolvable_version
-          else raise "Unexpected resolver type #{resolver_type}"
-          end
+        if defined?(@lowest_resolvable_security_fix_version)
+          return @lowest_resolvable_security_fix_version
+        end
 
-        latest_version_finder.lowest_security_fix_version
+        @lowest_resolvable_security_fix_version =
+          fetch_lowest_resolvable_security_fix_version
       end
 
       def updated_requirements
@@ -122,6 +118,24 @@ module Dependabot
         raise NotImplementedError
       end
 
+      def fetch_lowest_resolvable_security_fix_version
+        fix_version = latest_version_finder.lowest_security_fix_version
+        return latest_resolvable_version if fix_version.nil?
+        return fix_version if resolver_type == :requirements
+
+        resolver =
+          case resolver_type
+          when :pip_compile then pip_compile_version_resolver
+          when :pipenv then pipenv_version_resolver
+          when :poetry then poetry_version_resolver
+          else raise "Unexpected resolver type #{resolver_type}"
+          end
+
+        resolver.latest_resolvable_version(requirement: "==#{fix_version}")
+      rescue DependabotError
+        latest_resolvable_version
+      end
+
       # rubocop:disable Metrics/PerceivedComplexity
       def resolver_type
         reqs = dependency.requirements

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -296,7 +296,11 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           req = dependency.requirements.find { |r| r[:file] == file.name }
-          return file.content unless req&.fetch(:requirement)
+          return file.content unless req
+
+          unless req.fetch(:requirement)
+            return file.content + "\n#{dependency.name} #{updated_req}"
+          end
 
           Python::FileUpdater::RequirementReplacer.new(
             content: file.content,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.104.6
+  version: 0.105.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.6
+        version: 0.105.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.6
+        version: 0.105.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement