dependabot-python 0.276.0 → 0.277.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0c0ebe17176ecc264d11ac2b7e4a4b569f89d9caef5d82855c804045c23c2f2
-  data.tar.gz: caa6f4908c81929629fa4df74457c3ef18d67533eec81b0863f0b5b5d366ea52
+  metadata.gz: 4da06b9469d330346925302b154afcdd9fc86b56bebf83cdfdd507e5c0c5d49d
+  data.tar.gz: e19f02eb10fd9a05c18173efcf0ea1731af7a2bb90a9e984b5dadf39f39b5040
 SHA512:
-  metadata.gz: 0237ca31de163f73dc570289e2f103d4d1400fd6ca65adadd2ea9e8bb648d10a25500969513236cfc9c3047339ced25f5188101b15128ce584c95991f458957b
-  data.tar.gz: 677869a2cda25d91e93c3cf7dd6a6174e1c471c0f4234ece66e5231ac52864c283a1c740d2d5b4b2c40589a77440c2868e47ce38969cf277059431a4731e4550
+  metadata.gz: f5a8f5476bb1b546f0eb7914e3736e714f6411efada1e5937328733829e7ebeeb698f221177aca327608d6f4c44b6dd9b4469fda1bfab7b2a6b005ef23235678
+  data.tar.gz: 14f76ec80065edbe87d2443825ec7ae9eaca97d94d6ee387e112242b407b60b96dd30ae105f4095196b7557e986225fed2a2a9429a662595f00f028d55da43d5

data/helpers/requirements.txt

@@ -2,7 +2,7 @@ pip==24.0
 pip-tools==7.4.1
 flake8==7.1.0
 hashin==1.0.1
-pipenv==2023.12.1
+pipenv==2024.0.2
 plette==2.1.0
 poetry==1.8.3
 # TODO: Replace 3p package `toml` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -133,6 +133,8 @@ module Dependabot
           content = updated_pipfile_content
           content = add_private_sources(content)
           content = update_python_requirement(content)
+          content = update_ssl_requirement(content, updated_pipfile_content)
+
           content
         end
 
@@ -142,6 +144,12 @@ module Dependabot
             .update_python_requirement(language_version_manager.python_major_minor)
         end
 
+        def update_ssl_requirement(pipfile_content, parsed_file)
+          Python::FileUpdater::PipfilePreparer
+            .new(pipfile_content: pipfile_content)
+            .update_ssl_requirement(parsed_file)
+        end
+
         def add_private_sources(pipfile_content)
           PipfilePreparer
             .new(pipfile_content: pipfile_content)

data/lib/dependabot/python/file_updater/pipfile_preparer.rb

@@ -39,6 +39,21 @@ module Dependabot
           TomlRB.dump(pipfile_object)
         end
 
+        def update_ssl_requirement(parsed_file)
+          pipfile_object = TomlRB.parse(pipfile_content)
+          parsed_object = TomlRB.parse(parsed_file)
+
+          # we parse the verify_ssl value from manifest if it exists
+          verify_ssl = parsed_object["source"].map { |x| x["verify_ssl"] }.first
+
+          # provide a default "true" value to file generator in case no value is provided in manifest file
+          pipfile_object["source"].each do |key|
+            key["verify_ssl"] = verify_ssl.nil? ? true : verify_ssl
+          end
+
+          TomlRB.dump(pipfile_object)
+        end
+
         private
 
         attr_reader :pipfile_content

data/lib/dependabot/python/update_checker/pipenv_version_resolver.rb

@@ -30,7 +30,7 @@ module Dependabot
         PIPENV_INSTALLATION_ERROR_REGEX =
           /[\s\S]*Collecting\s(?<name>.+)\s\(from\s-r.+\)[\s\S]*(#{PIPENV_INSTALLATION_ERROR})/
 
-        PIPENV_RANGE_WARNING = /Warning:\sPython\s[<>].* was not found/
+        PIPENV_RANGE_WARNING = /Python version range specifier '(?<ver>.*)' is not supported/
 
         attr_reader :dependency
         attr_reader :dependency_files
@@ -284,6 +284,8 @@ module Dependabot
           content = pipfile.content
           content = add_private_sources(content)
           content = update_python_requirement(content)
+          content = update_ssl_requirement(content, pipfile.content)
+
           content
         end
 
@@ -293,6 +295,12 @@ module Dependabot
             .update_python_requirement(language_version_manager.python_major_minor)
         end
 
+        def update_ssl_requirement(pipfile_content, parsed_file)
+          Python::FileUpdater::PipfilePreparer
+            .new(pipfile_content: pipfile_content)
+            .update_ssl_requirement(parsed_file)
+        end
+
         def add_private_sources(pipfile_content)
           Python::FileUpdater::PipfilePreparer
             .new(pipfile_content: pipfile_content)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.276.0
+  version: 0.277.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-19 00:00:00.000000000 Z
+date: 2024-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.276.0
+        version: 0.277.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.276.0
+        version: 0.277.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -288,7 +288,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.276.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.277.0
 post_install_message: 
 rdoc_options: []
 require_paths: