dependabot-python 0.106.10 → 0.106.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a23c37b5bf352ba9feae06ec60c51a32cd875482bbc3ec48338042814507202d
-  data.tar.gz: fc66b1e47bf55070f819969425938a5f9e1c3da8601c2abc4496c80b249a8f24
+  metadata.gz: 3a5271c81524fde4ca367b1e7f1f7643b494cfcf8cca9a8bdf7794a1f521926d
+  data.tar.gz: 70aa42b7863635e7f1493b35f940d44a4c7abd73674751d78311505dd910b7de
 SHA512:
-  metadata.gz: f8a2cd85269c061e05769dd89776c1080bcd3af14b66197e1139752eb0aa9d5dbaeb9e43113feb937b54b5971ecb828630423c1667fd1eeab81a24150f7aafb1
-  data.tar.gz: 7800184034ce4f338d5daab1c5849bc4dce6db316966efdcc3a48964d5dad050e8daed78285dcfd73241affc5e83331f54b63c336f75b33ca35a26440381591b
+  metadata.gz: aa9d21f885b05d54e550166f7381b386edd9c5daa98a5bca1ef89171936b03b5c8ca9ef2b883284ab1843c576ef791dffeee6335bca43da230cf0dbac267c747
+  data.tar.gz: 926655acc7af32cf0e44c1b03eeefb9767c123ffd5f6b8de7854a27ead7d47b61d3fe4654a22aac26a4b9bacfeaaed55b5471a15204f62e4ad3dbea8f5b03427

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -147,8 +147,9 @@ module Dependabot
             %w(packages dev-packages).each do |type|
               names = pipfile_object[type]&.keys || []
               pkg_name = names.find { |nm| normalise(nm) == dep.name }
-              next unless pkg_name
+              next unless pkg_name || subdep_type?(type)
 
+              pkg_name ||= dependency.name
               if pipfile_object[type][pkg_name].is_a?(Hash)
                 pipfile_object[type][pkg_name]["version"] =
                   "==#{dep.version}"
@@ -161,6 +162,18 @@ module Dependabot
           TomlRB.dump(pipfile_object)
         end
 
+        def subdep_type?(type)
+          return false if dependency.top_level?
+
+          lockfile_type = Python::FileParser::DEPENDENCY_GROUP_KEYS.
+                          find { |i| i.fetch(:pipfile) == type }.
+                          fetch(:lockfile)
+
+          JSON.parse(lockfile.content).
+            fetch(lockfile_type, {}).
+            keys.any? { |k| normalise(k) == dependency.name }
+        end
+
         def add_private_sources(pipfile_content)
           PipfilePreparer.
             new(pipfile_content: pipfile_content).

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -120,28 +120,50 @@ module Dependabot
           poetry_object = pyproject_object.fetch("tool").fetch("poetry")
 
           dependencies.each do |dep|
-            %w(dependencies dev-dependencies).each do |type|
-              names = poetry_object[type]&.keys || []
-              pkg_name = names.find { |nm| normalise(nm) == dep.name }
-              next unless pkg_name
-
-              if poetry_object[type][pkg_name].is_a?(Hash)
-                poetry_object[type][pkg_name]["version"] = dep.version
-              else
-                poetry_object[type][pkg_name] = dep.version
-              end
+            if dep.requirements.find { |r| r[:file] == pyproject.name }
+              lock_declaration_to_new_version!(poetry_object, dep)
+            else
+              create_declaration_at_new_version!(poetry_object, dep)
             end
           end
 
           TomlRB.dump(pyproject_object)
         end
 
+        def lock_declaration_to_new_version!(poetry_object, dep)
+          %w(dependencies dev-dependencies).each do |type|
+            names = poetry_object[type]&.keys || []
+            pkg_name = names.find { |nm| normalise(nm) == dep.name }
+            next unless pkg_name
+
+            if poetry_object[type][pkg_name].is_a?(Hash)
+              poetry_object[type][pkg_name]["version"] = dep.version
+            else
+              poetry_object[type][pkg_name] = dep.version
+            end
+          end
+        end
+
+        def create_declaration_at_new_version!(poetry_object, dep)
+          poetry_object[subdep_type] ||= {}
+          poetry_object[subdep_type][dependency.name] = dep.version
+        end
+
         def add_private_sources(pyproject_content)
           PyprojectPreparer.
             new(pyproject_content: pyproject_content).
             replace_sources(credentials)
         end
 
+        def subdep_type
+          category =
+            TomlRB.parse(lockfile.content).fetch("package", []).
+            find { |dets| normalise(dets.fetch("name")) == dependency.name }.
+            fetch("category")
+
+          category == "dev" ? "dev-dependencies" : "dependencies"
+        end
+
         def sanitize(pyproject_content)
           PyprojectPreparer.
             new(pyproject_content: pyproject_content).

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -339,8 +339,9 @@ module Dependabot
           %w(packages dev-packages).each do |type|
             names = pipfile_object[type]&.keys || []
             pkg_name = names.find { |nm| normalise(nm) == dependency.name }
-            next unless pkg_name
+            next unless pkg_name || subdep_type?(type)
 
+            pkg_name ||= dependency.name
             if pipfile_object.dig(type, pkg_name).is_a?(Hash)
               pipfile_object[type][pkg_name]["version"] = updated_requirement
             else
@@ -351,6 +352,18 @@ module Dependabot
           TomlRB.dump(pipfile_object)
         end
 
+        def subdep_type?(type)
+          return false if dependency.top_level?
+
+          lockfile_type = Python::FileParser::DEPENDENCY_GROUP_KEYS.
+                          find { |i| i.fetch(:pipfile) == type }.
+                          fetch(:lockfile)
+
+          JSON.parse(lockfile.content).
+            fetch(lockfile_type, {}).
+            keys.any? { |k| normalise(k) == dependency.name }
+        end
+
         def add_private_sources(pipfile_content)
           Python::FileUpdater::PipfilePreparer.
             new(pipfile_content: pipfile_content).

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -14,6 +14,7 @@ require "dependabot/python/native_helpers"
 require "dependabot/python/python_versions"
 require "dependabot/python/authed_url_builder"
 
+# rubocop:disable Metrics/ClassLength
 module Dependabot
   module Python
     class UpdateChecker
@@ -246,9 +247,24 @@ module Dependabot
             end
           end
 
+          # If this is a sub-dependency, add the new requirement
+          unless dependency.requirements.find { |r| r[:file] == pyproject.name }
+            poetry_object[subdep_type] ||= {}
+            poetry_object[subdep_type][dependency.name] = updated_requirement
+          end
+
           TomlRB.dump(pyproject_object)
         end
 
+        def subdep_type
+          category =
+            TomlRB.parse(lockfile.content).fetch("package", []).
+            find { |dets| normalise(dets.fetch("name")) == dependency.name }.
+            fetch("category")
+
+          category == "dev" ? "dev-dependencies" : "dependencies"
+        end
+
         def check_private_sources_are_reachable
           sources_to_check =
             pyproject_sources +
@@ -346,3 +362,4 @@ module Dependabot
     end
   end
 end
+# rubocop:enable Metrics/ClassLength

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.106.10
+  version: 0.106.11
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.10
+        version: 0.106.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.10
+        version: 0.106.11
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement