dependabot-python 0.299.1 → 0.300.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: acceb8fa127937d9f47961a162388d23ff9bf1c5c0c5d0ebbbe07a65273762e7
-  data.tar.gz: 9b8f49f1c670ea8473b506fbbfff4dfe8fb570664c2ceb07fdf9b9ff5778977a
+  metadata.gz: c66f1ad421fbc53cea7f4eafddfb4e31c0acb69876af1b3291407176d968e2fe
+  data.tar.gz: f63f34f3be94781bce2e3471002b56df61b4fc8b04b0cf645f3e1d305749a302
 SHA512:
-  metadata.gz: 42bc5d2b34edc189d8f0eb9c58db001695abcae2607dfb17281c512c43822c863460298a8384498746e5c0c372df850ae608437c1dc6e38a152030e36b103aea
-  data.tar.gz: 05e37c59eeb041362d71b84e3cfe38c93a7e7ed90ef14a7bfa781dfa10795d7a778f4cf9c4a946817c3f6da5f6275505f09583eee5dceec2f0eebde3b72326a8
+  metadata.gz: 39ebf5bb262f04d910a81abbc28c48afefabd49731646289accccd9ac10d10686d180fc48ba7983ace19b06906f13eb9420202f906807d5c36a4c6caa75ea325
+  data.tar.gz: 1435af159a0c50873c1ddfca6d335520411a3ea8e04ecef83e0c430abe20200c3e7949182c8225d60011175d1ca5876c258a628af97ef479d85608297dbeed64

data/helpers/requirements.txt

@@ -2,9 +2,9 @@ pip==24.0
 pip-tools==7.4.1
 flake8==7.1.0
 hashin==1.0.3
-pipenv==2024.0.2
+pipenv==2024.4.1
 plette==2.1.0
-poetry==1.8.5
+poetry==2.1.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.0.1
 

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -190,7 +190,7 @@ module Dependabot
               language_version_manager.install_required_python
 
               # use system git instead of the pure Python dulwich
-              run_poetry_command("pyenv exec poetry config experimental.system-git-client true")
+              run_poetry_command("pyenv exec poetry config system-git-client true")
 
               run_poetry_update_command
 

data/lib/dependabot/python/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -13,8 +13,22 @@ require "dependabot/python/name_normaliser"
 module Dependabot
   module Python
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
       MAIN_PYPI_URL = "https://pypi.org/pypi"
 
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          credentials: T::Array[Dependabot::Credential]
+        )
+          .void
+      end
+      def initialize(dependency:, credentials:)
+        super
+        @pypi_listing = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+      end
+
+      sig { returns(T.nilable(String)) }
       def homepage_url
         pypi_listing.dig("info", "home_page") ||
           pypi_listing.dig("info", "project_urls", "Homepage") ||
@@ -24,6 +38,7 @@ module Dependabot
 
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         potential_source_urls = [
           pypi_listing.dig("info", "project_urls", "Source"),
@@ -44,6 +59,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { returns(T.nilable(String)) }
       def source_from_description
         potential_source_urls = []
         desc = pypi_listing.dig("info", "description")
@@ -64,7 +80,7 @@ module Dependabot
 
         # Failing that, look for a source where the full dependency name is
         # mentioned when the link is followed
-        @source_from_description ||=
+        @source_from_description ||= T.let(
           potential_source_urls.find do |url|
             full_url = Source.from_url(url)&.url
             next unless full_url
@@ -73,16 +89,19 @@ module Dependabot
             next unless response.status == 200
 
             response.body.include?(normalised_dependency_name)
-          end
+          end, T.nilable(String)
+        )
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { returns(T.nilable(String)) }
       def source_from_homepage
-        return unless homepage_body
+        homepage_body_local = homepage_body
+        return unless homepage_body_local
 
         potential_source_urls = []
-        homepage_body.scan(Source::SOURCE_REGEX) do
+        homepage_body_local.scan(Source::SOURCE_REGEX) do
           potential_source_urls << Regexp.last_match.to_s
         end
 
@@ -93,7 +112,7 @@ module Dependabot
 
         return match_url if match_url
 
-        @source_from_homepage ||=
+        @source_from_homepage ||= T.let(
           potential_source_urls.find do |url|
             full_url = Source.from_url(url)&.url
             next unless full_url
@@ -102,10 +121,12 @@ module Dependabot
             next unless response.status == 200
 
             response.body.include?(normalised_dependency_name)
-          end
+          end, T.nilable(String)
+        )
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
+      sig { returns(T.nilable(String)) }
       def homepage_body
         homepage_url = pypi_listing.dig("info", "home_page")
 
@@ -115,19 +136,21 @@ module Dependabot
           "pypi.python.org"
         ].include?(URI(homepage_url).host)
 
-        @homepage_response ||=
+        @homepage_response ||= T.let(
           begin
             Dependabot::RegistryClient.get(url: homepage_url)
           rescue Excon::Error::Timeout, Excon::Error::Socket,
                  Excon::Error::TooManyRedirects, ArgumentError
             nil
-          end
+          end, T.nilable(Excon::Response)
+        )
 
         return unless @homepage_response&.status == 200
 
-        @homepage_response.body
+        @homepage_response&.body
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def pypi_listing
         return @pypi_listing unless @pypi_listing.nil?
         return @pypi_listing = {} if dependency.version&.include?("+")
@@ -147,6 +170,7 @@ module Dependabot
         @pypi_listing = {} # No listing found
       end
 
+      sig { params(url: String).returns(Excon::Response) }
       def fetch_authed_url(url)
         if url.match(%r{(.*)://(.*?):(.*)@([^@]+)$}) &&
            Regexp.last_match&.captures&.[](1)&.include?("@")
@@ -164,6 +188,7 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Array[String]) }
       def possible_listing_urls
         credential_urls =
           credentials
@@ -176,6 +201,7 @@ module Dependabot
       end
 
       # Strip [extras] from name (dependency_name[extra_dep,other_extra])
+      sig { returns(String) }
       def normalised_dependency_name
         NameNormaliser.normalise(dependency.name)
       end

data/lib/dependabot/python/package/package_details_fetcher.rb

@@ -385,8 +385,9 @@ module Dependabot
 
         sig { params(json_url: String).returns(Excon::Response) }
         def registry_json_response_for_dependency(json_url)
+          url = "#{json_url.chomp('/')}/#{@dependency.name}/json"
           Dependabot::RegistryClient.get(
-            url: "#{json_url.chomp('/')}/#{@dependency.name}/json",
+            url: url,
             headers: { "Accept" => APPLICATION_JSON }
           )
         end

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -32,6 +32,11 @@ module Dependabot
             credentials: credentials
           ).fetch
         end
+
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_python)
+        end
       end
     end
   end

data/lib/dependabot/python/update_checker/pip_version_resolver.rb

@@ -11,12 +11,13 @@ module Dependabot
     class UpdateChecker
       class PipVersionResolver
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
+                       ignored_versions:, update_cooldown: nil, raise_on_ignored: false,
                        security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @update_cooldown = update_cooldown
           @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
         end
@@ -50,8 +51,10 @@ module Dependabot
             credentials: credentials,
             ignored_versions: ignored_versions,
             raise_on_ignored: @raise_on_ignored,
+            cooldown_options: @update_cooldown,
             security_advisories: security_advisories
           )
+          @latest_version_finder
         end
 
         def python_requirement_parser

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -97,7 +97,7 @@ module Dependabot
                 language_version_manager.install_required_python
 
                 # use system git instead of the pure Python dulwich
-                run_poetry_command("pyenv exec poetry config experimental.system-git-client true")
+                run_poetry_command("pyenv exec poetry config system-git-client true")
 
                 # Shell out to Poetry, which handles everything for us.
                 run_poetry_update_command

data/lib/dependabot/python/update_checker.rb

@@ -187,6 +187,7 @@ module Dependabot
           dependency_files: dependency_files,
           credentials: credentials,
           ignored_versions: ignored_versions,
+          update_cooldown: @update_cooldown,
           raise_on_ignored: @raise_on_ignored,
           security_advisories: security_advisories
         )
@@ -255,6 +256,7 @@ module Dependabot
           credentials: credentials,
           ignored_versions: ignored_versions,
           raise_on_ignored: @raise_on_ignored,
+          cooldown_options: @update_cooldown,
           security_advisories: security_advisories
         )
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.299.1
+  version: 0.300.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-28 00:00:00.000000000 Z
+date: 2025-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.299.1
+        version: 0.300.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.299.1
+        version: 0.300.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.299.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.300.0
 post_install_message:
 rdoc_options: []
 require_paths: