dependabot-python 0.332.0 → 0.333.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14beb61431b04fa613bbfa5d424c63c7c1d88557cf3983d48d310cd16aca4d32
-  data.tar.gz: e9fadba2ea95a977b2f40dac856e04ba8ae7eaeb31942b78ffb6b66bba42c8a9
+  metadata.gz: eb861b2b496cfd6879573eee03425670d74ec6fad92a93721b76f2d98392d8c9
+  data.tar.gz: ba2b3dbcbedb42506cbb78884340ee0f7a38a39d67f9093f27c8b45d84ffae9b
 SHA512:
-  metadata.gz: '0687eb3d178a073d2578660c521eece4372f649d94a2e386b8ead4c3ce46cf3aa31f0b980bc7df6ff2de6396e3bec6981632f2a05e0745686615951419662353'
-  data.tar.gz: cd72b9690629928818f0355e0e0492861f94788d1d7005167cf484b3401ecf667e08f62325bd79c114cf595d19ea07c4b17ee11b9034eaeaf9a7036b1eb6ccc8
+  metadata.gz: 9048dbfa79c5754a2ddb7fe88b72974d414155c7206fa25d1b4db274802ef10de60dd04bb9ad40fab7e5337c70becfffbff99d2487f2425524d3e26b0d4f4792
+  data.tar.gz: b039ecae109ea713a2ef2669b3841ea8cb97a9e4854d1bf69ed93c993eb2240b89af5d9993d8dac92540da348dcb6e461d3e6f492df4e6fe081f3458f6fd8998

data/lib/dependabot/python/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -12,9 +12,11 @@ require "dependabot/python/requirement_parser"
 require "dependabot/python/file_parser/pyproject_files_parser"
 require "dependabot/python/file_parser/python_requirement_parser"
 require "dependabot/errors"
+require "dependabot/file_filtering"
 
 module Dependabot
   module Python
+    # rubocop:disable Metrics/ClassLength
     class FileFetcher < Dependabot::FileFetchers::Base
       extend T::Sig
       extend T::Helpers
@@ -23,6 +25,7 @@ module Dependabot
       CONSTRAINT_REGEX = /^-c\s?(?<path>.*\.(?:txt|in))/
       DEPENDENCY_TYPES = %w(packages dev-packages).freeze
 
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         return true if filenames.any? { |name| name.end_with?(".txt", ".in") }
 
@@ -40,11 +43,13 @@ module Dependabot
         filenames.include?("setup.cfg")
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a requirements.txt, setup.py, setup.cfg, pyproject.toml, " \
           "or a Pipfile."
       end
 
+      sig { override.returns(T::Hash[Symbol, T::Hash[Symbol, T::Hash[String, String]]]) }
       def ecosystem_versions
         # Hmm... it's weird that this calls file parser methods, but here we are in the file fetcher... for all
         # ecosystems our goal is to extract the user specified versions, so we'll need to do file parsing... so should
@@ -84,25 +89,34 @@ module Dependabot
         fetched_files << pip_conf if pip_conf
         fetched_files << python_version_file if python_version_file
 
-        uniq_files(fetched_files)
+        uniques = uniq_files(fetched_files)
+        filtered_files = uniques.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files
       end
 
       private
 
+      sig { params(fetched_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile]) }
       def uniq_files(fetched_files)
         uniq_files = fetched_files.reject(&:support_file?).uniq
         uniq_files += fetched_files
                       .reject { |f| uniq_files.map(&:name).include?(f.name) }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pipenv_files
         [pipfile, pipfile_lock].compact
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pyproject_files
         [pyproject, poetry_lock, pdm_lock].compact
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def requirement_files
         [
           *requirements_txt_files,
@@ -111,114 +125,141 @@ module Dependabot
         ]
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def setup_file
-        return @setup_file if defined?(@setup_file)
-
-        @setup_file = fetch_file_if_present("setup.py")
+        @setup_file ||= T.let(
+          fetch_file_if_present("setup.py"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def setup_cfg_file
-        return @setup_cfg_file if defined?(@setup_cfg_file)
-
-        @setup_cfg_file = fetch_file_if_present("setup.cfg")
+        @setup_cfg_file ||= T.let(
+          fetch_file_if_present("setup.cfg"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pip_conf
-        return @pip_conf if defined?(@pip_conf)
-
-        @pip_conf = fetch_support_file("pip.conf")
+        @pip_conf ||= T.let(
+          fetch_support_file("pip.conf"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def python_version_file
-        return @python_version_file if defined?(@python_version_file)
-
-        @python_version_file = fetch_support_file(".python-version")
-
-        return @python_version_file if @python_version_file
-        return if [".", "/"].include?(directory)
+        @python_version_file ||= T.let(begin
+          file = fetch_support_file(".python-version")
+          return file if file
+          return if [".", "/"].include?(directory)
 
-        # Check the top-level for a .python-version file, too
-        reverse_path = Pathname.new(directory[0]).relative_path_from(directory)
-        @python_version_file =
+          # Check the top-level for a .python-version file, too
+          reverse_path = Pathname.new(directory[0]).relative_path_from(directory)
           fetch_support_file(File.join(reverse_path, ".python-version"))
-          &.tap { |f| f.name = ".python-version" }
+            &.tap { |f| f.name = ".python-version" }
+        end, T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pipfile
-        return @pipfile if defined?(@pipfile)
-
-        @pipfile = fetch_file_if_present("Pipfile")
+        @pipfile ||= T.let(
+          fetch_file_if_present("Pipfile"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pipfile_lock
-        return @pipfile_lock if defined?(@pipfile_lock)
-
-        @pipfile_lock = fetch_file_if_present("Pipfile.lock")
+        @pipfile_lock ||= T.let(
+          fetch_file_if_present("Pipfile.lock"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pyproject
-        return @pyproject if defined?(@pyproject)
-
-        @pyproject = fetch_file_if_present("pyproject.toml")
+        @pyproject ||= T.let(
+          fetch_file_if_present("pyproject.toml"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def poetry_lock
-        return @poetry_lock if defined?(@poetry_lock)
-
-        @poetry_lock = fetch_file_if_present("poetry.lock")
+        @poetry_lock ||= T.let(
+          fetch_file_if_present("poetry.lock"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pdm_lock
-        return @pdm_lock if defined?(@pdm_lock)
-
-        @pdm_lock = fetch_file_if_present("pdm.lock")
+        @pdm_lock ||= T.let(
+          fetch_file_if_present("pdm.lock"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def requirements_txt_files
         req_txt_and_in_files.select { |f| f.name.end_with?(".txt") }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def requirements_in_files
         req_txt_and_in_files.select { |f| f.name.end_with?(".in") } +
           child_requirement_in_files
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def parsed_pipfile
         raise "No Pipfile" unless pipfile
 
-        @parsed_pipfile ||= TomlRB.parse(pipfile.content)
+        @parsed_pipfile ||= T.let(
+          TomlRB.parse(T.must(pipfile).content),
+          T.nilable(T::Hash[String, T.untyped])
+        )
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-        raise Dependabot::DependencyFileNotParseable, pipfile.path
+        raise Dependabot::DependencyFileNotParseable, T.must(pipfile).path
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def parsed_pyproject
         raise "No pyproject.toml" unless pyproject
 
-        @parsed_pyproject ||= TomlRB.parse(pyproject.content)
+        @parsed_pyproject ||= T.let(
+          TomlRB.parse(T.must(pyproject).content),
+          T.nilable(T::Hash[String, T.untyped])
+        )
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-        raise Dependabot::DependencyFileNotParseable, pyproject.path
+        raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def req_txt_and_in_files
-        return @req_txt_and_in_files if @req_txt_and_in_files
+        @req_txt_and_in_files ||= T.let(begin
+          files = T.let([], T::Array[Dependabot::DependencyFile])
 
-        @req_txt_and_in_files = []
+          repo_contents
+            .select { |f| f.type == "file" }
+            .select { |f| f.name.end_with?(".txt", ".in") }
+            .reject { |f| f.size > 500_000 }
+            .map { |f| fetch_file_from_host(f.name) }
+            .select { |f| requirements_file?(f) }
+            .each { |f| files << f }
 
-        repo_contents
-          .select { |f| f.type == "file" }
-          .select { |f| f.name.end_with?(".txt", ".in") }
-          .reject { |f| f.size > 500_000 }
-          .map { |f| fetch_file_from_host(f.name) }
-          .select { |f| requirements_file?(f) }
-          .each { |f| @req_txt_and_in_files << f }
+          repo_contents
+            .select { |f| f.type == "dir" }
+            .each { |f| files.concat(req_files_for_dir(f)) }
 
-        repo_contents
-          .select { |f| f.type == "dir" }
-          .each { |f| @req_txt_and_in_files += req_files_for_dir(f) }
-
-        @req_txt_and_in_files
+          files
+        end, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
 
+      sig { params(requirements_dir: T.untyped).returns(T::Array[Dependabot::DependencyFile]) }
       def req_files_for_dir(requirements_dir)
         dir = directory.gsub(%r{(^/|/$)}, "")
         relative_reqs_dir =
@@ -232,32 +273,41 @@ module Dependabot
           .select { |f| requirements_file?(f) }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def child_requirement_txt_files
         child_requirement_files.select { |f| f.name.end_with?(".txt") }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def child_requirement_in_files
         child_requirement_files.select { |f| f.name.end_with?(".in") }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def child_requirement_files
-        @child_requirement_files ||=
-          begin
-            fetched_files = req_txt_and_in_files.dup
-            req_txt_and_in_files.flat_map do |requirement_file|
-              child_files = fetch_child_requirement_files(
-                file: requirement_file,
-                previously_fetched_files: fetched_files
-              )
-
-              fetched_files += child_files
-              child_files
-            end
+        @child_requirement_files ||= T.let(begin
+          fetched_files = req_txt_and_in_files.dup
+          req_txt_and_in_files.flat_map do |requirement_file|
+            child_files = fetch_child_requirement_files(
+              file: requirement_file,
+              previously_fetched_files: fetched_files
+            )
+
+            fetched_files += child_files
+            child_files
           end
+        end, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
 
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          previously_fetched_files: T::Array[Dependabot::DependencyFile]
+        )
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
       def fetch_child_requirement_files(file:, previously_fetched_files:)
-        paths = file.content.scan(CHILD_REQUIREMENT_REGEX).flatten
+        paths = T.must(file.content).scan(CHILD_REQUIREMENT_REGEX).flatten
         current_dir = File.dirname(file.name)
 
         paths.flat_map do |path|
@@ -267,6 +317,14 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
+          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
+             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+            raise Dependabot::DependencyFileNotEvaluatable,
+                  "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
+                  "Please either remove the reference from '#{file.name}' " \
+                  "or update your exclude_paths configuration."
+          end
+
           fetched_file = fetch_file_from_host(path)
           grandchild_requirement_files = fetch_child_requirement_files(
             file: fetched_file,
@@ -276,13 +334,14 @@ module Dependabot
         end.compact
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def constraints_files
         all_requirement_files = requirements_txt_files +
                                 child_requirement_txt_files
 
         constraints_paths = all_requirement_files.map do |req_file|
           current_dir = File.dirname(req_file.name)
-          paths = req_file.content.scan(CONSTRAINT_REGEX).flatten
+          paths = T.must(req_file.content).scan(CONSTRAINT_REGEX).flatten
 
           paths.map do |path|
             path = File.join(current_dir, path) unless current_dir == "."
@@ -293,15 +352,16 @@ module Dependabot
         constraints_paths.map { |path| fetch_file_from_host(path) }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def project_files
         project_files = T.let([], T::Array[Dependabot::DependencyFile])
         unfetchable_deps = []
 
         path_dependencies.each do |dep|
-          path = dep[:path]
+          path = T.must(dep[:path])
           project_files += fetch_project_file(path)
         rescue Dependabot::DependencyFileNotFound => e
-          unfetchable_deps << if sdist_or_wheel?(path)
+          unfetchable_deps << if sdist_or_wheel?(T.must(path))
                                 e.file_path&.gsub(%r{^/}, "")
                               else
                                 "\"#{dep[:name]}\" at #{cleanpath(File.join(directory, dep[:file]))}"
@@ -319,6 +379,7 @@ module Dependabot
         project_files
       end
 
+      sig { params(path: String).returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_project_file(path)
         project_files = []
 
@@ -346,10 +407,12 @@ module Dependabot
         project_files + cfg_files_for_setup_py(path)
       end
 
+      sig { params(path: String).returns(T::Boolean) }
       def sdist_or_wheel?(path)
         path.end_with?(".tar.gz", ".whl", ".zip")
       end
 
+      sig { params(path: String).returns(T::Array[Dependabot::DependencyFile]) }
       def cfg_files_for_setup_py(path)
         cfg_path = path.gsub(/\.py$/, ".cfg")
 
@@ -364,11 +427,12 @@ module Dependabot
         end
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
       def requirements_file?(file)
-        return false unless file.content.valid_encoding?
+        return false unless T.must(file.content).valid_encoding?
         return true if file.name.match?(/requirements/x)
 
-        file.content.lines.all? do |line|
+        T.must(file.content).lines.all? do |line|
           next true if line.strip.empty?
           next true if line.strip.start_with?("#", "-r ", "-c ", "-e ", "--")
 
@@ -376,45 +440,54 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
       def path_dependencies
         requirement_txt_path_dependencies +
           requirement_in_path_dependencies +
           pipfile_path_dependencies
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
       def requirement_txt_path_dependencies
         (requirements_txt_files + child_requirement_txt_files)
           .map { |req_file| parse_requirement_path_dependencies(req_file) }
           .flatten.uniq { |dep| dep[:path] }
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
       def requirement_in_path_dependencies
         requirements_in_files
           .map { |req_file| parse_requirement_path_dependencies(req_file) }
           .flatten.uniq { |dep| dep[:path] }
       end
 
+      sig { params(req_file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, String]]) }
       def parse_requirement_path_dependencies(req_file)
         # If this is a pip-compile lockfile, rely on whatever path dependencies we found in the main manifest
         return [] if pip_compile_file_matcher.lockfile_for_pip_compile_file?(req_file)
 
         uneditable_reqs =
-          req_file.content
-                  .scan(/(?<name>^['"]?(?:file:)?(?<path>\..*?)(?=\[|#|'|"|$))/)
-                  .filter_map do |n, p|
-                    { name: n.strip, path: p.strip, file: req_file.name } unless p.include?("://")
-                  end
+          T.must(req_file.content)
+           .scan(/(?<name>^['"]?(?:file:)?(?<path>\..*?)(?=\[|#|'|"|$))/)
+           .filter_map do |match_array|
+            n, p = match_array
+            { name: n.to_s.strip, path: p.to_s.strip, file: req_file.name } unless p.to_s.include?("://")
+          end
 
         editable_reqs =
-          req_file.content
-                  .scan(/(?<name>^(?:-e)\s+['"]?(?:file:)?(?<path>.*?)(?=\[|#|'|"|$))/)
-                  .filter_map do |n, p|
-                    { name: n.strip, path: p.strip, file: req_file.name } unless p.include?("://") || p.include?("git@")
-                  end
+          T.must(req_file.content)
+           .scan(/(?<name>^(?:-e)\s+['"]?(?:file:)?(?<path>.*?)(?=\[|#|'|"|$))/)
+           .filter_map do |match_array|
+            n, p = match_array
+            unless p.to_s.include?("://") || p.to_s.include?("git@")
+              { name: n.to_s.strip, path: p.to_s.strip, file: req_file.name }
+            end
+          end
 
         uneditable_reqs + editable_reqs
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
       def pipfile_path_dependencies
         return [] unless pipfile
 
@@ -425,13 +498,14 @@ module Dependabot
           parsed_pipfile[dep_type].each do |_, req|
             next unless req.is_a?(Hash) && req["path"]
 
-            deps << { name: req["path"], path: req["path"], file: pipfile.name }
+            deps << { name: req["path"], path: req["path"], file: T.must(pipfile).name }
           end
         end
 
         deps
       end
 
+      sig { returns(T::Array[String]) }
       def poetry_path_dependencies
         return [] unless pyproject
 
@@ -449,14 +523,20 @@ module Dependabot
         paths
       end
 
+      sig { params(path: String).returns(String) }
       def cleanpath(path)
         Pathname.new(path).cleanpath.to_path
       end
 
+      sig { returns(Dependabot::Python::PipCompileFileMatcher) }
       def pip_compile_file_matcher
-        @pip_compile_file_matcher ||= PipCompileFileMatcher.new(requirements_in_files)
+        @pip_compile_file_matcher ||= T.let(
+          PipCompileFileMatcher.new(requirements_in_files),
+          T.nilable(Dependabot::Python::PipCompileFileMatcher)
+        )
       end
     end
+    # rubocop:enable Metrics/ClassLength
   end
 end
 

data/lib/dependabot/python/file_parser/pipfile_files_parser.rb

@@ -14,6 +14,7 @@ module Dependabot
     class FileParser
       class PipfileFilesParser
         extend T::Sig
+
         DEPENDENCY_GROUP_KEYS = T.let([
           {
             pipfile: "packages",
@@ -73,8 +74,7 @@ module Dependabot
                     groups: [group]
                   }],
                   package_manager: "pip",
-                  metadata: { original_name: dep_name },
-                  origin_files: [T.must(pipfile).name]
+                  metadata: { original_name: dep_name }
                 )
             end
           end
@@ -107,8 +107,7 @@ module Dependabot
                   version: version&.gsub(/^===?/, ""),
                   requirements: [],
                   package_manager: "pip",
-                  subdependency_metadata: [{ production: key != "develop" }],
-                  origin_files: [T.must(pipfile_lock).name]
+                  subdependency_metadata: [{ production: key != "develop" }]
                 )
             end
           end

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -15,6 +15,7 @@ module Dependabot
     class FileParser
       class PyprojectFilesParser
         extend T::Sig
+
         POETRY_DEPENDENCY_TYPES = %w(dependencies dev-dependencies).freeze
 
         # https://python-poetry.org/docs/dependency-specification/
@@ -98,8 +99,7 @@ module Dependabot
                   source: nil,
                   groups: [dep["requirement_type"]].compact
                 }],
-                package_manager: "pip",
-                origin_files: [Pathname.new(dep["file"]).cleanpath.to_path]
+                package_manager: "pip"
               )
           end
 
@@ -124,8 +124,7 @@ module Dependabot
               name: normalise(name),
               version: version_from_lockfile(name),
               requirements: requirements,
-              package_manager: "pip",
-              origin_files: [T.must(pyproject).name]
+              package_manager: "pip"
             )
           end
           dependencies
@@ -210,8 +209,7 @@ module Dependabot
                 package_manager: "pip",
                 subdependency_metadata: [{
                   production: production_dependency_names.include?(name)
-                }],
-                origin_files: [lockfile.name]
+                }]
               )
           end
 

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -15,6 +15,7 @@ module Dependabot
     class FileParser
       class SetupFileParser
         extend T::Sig
+
         INSTALL_REQUIRES_REGEX = /install_requires\s*=\s*\[/m
         SETUP_REQUIRES_REGEX = /setup_requires\s*=\s*\[/m
         TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m
@@ -50,8 +51,7 @@ module Dependabot
                   source: nil,
                   groups: [dep["requirement_type"]]
                 }],
-                package_manager: "pip",
-                origin_files: [Pathname.new(dep["file"]).cleanpath.to_path]
+                package_manager: "pip"
               )
           end
           dependencies

data/lib/dependabot/python/file_parser.rb

@@ -19,6 +19,7 @@ module Dependabot
   module Python
     class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
+
       require_relative "file_parser/pipfile_files_parser"
       require_relative "file_parser/pyproject_files_parser"
       require_relative "file_parser/setup_file_parser"
@@ -281,8 +282,7 @@ module Dependabot
               name: normalised_name(name, dep["extras"]),
               version: version&.include?("*") ? nil : version,
               requirements: requirements,
-              package_manager: "pip",
-              origin_files: [Pathname.new(file).cleanpath.to_path]
+              package_manager: "pip"
             )
         end
         dependencies

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -19,6 +19,7 @@ module Dependabot
       # rubocop:disable Metrics/ClassLength
       class PipCompileFileUpdater
         extend T::Sig
+
         require_relative "requirement_replacer"
         require_relative "requirement_file_updater"
         require_relative "setup_file_sanitizer"

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -17,6 +17,7 @@ module Dependabot
     class FileUpdater
       class PipfileFileUpdater
         extend T::Sig
+
         require_relative "pipfile_preparer"
         require_relative "pipfile_manifest_updater"
         require_relative "setup_file_sanitizer"

data/lib/dependabot/python/file_updater/pipfile_preparer.rb

@@ -57,7 +57,7 @@ module Dependabot
 
           # provide a default "true" value to file generator in case no value is provided in manifest file
           pipfile_object["source"].each do |key|
-            key["verify_ssl"] = verify_ssl.nil? ? true : verify_ssl
+            key["verify_ssl"] = verify_ssl.nil? || verify_ssl
           end
 
           TomlRB.dump(pipfile_object)

data/lib/dependabot/python/language.rb

@@ -11,6 +11,7 @@ module Dependabot
 
     class Language < Dependabot::Ecosystem::VersionManager
       extend T::Sig
+
       # This list must match the versions specified at the top of `python/Dockerfile`
       # ARG PY_3_13=3.13.2
       # When updating this list, also update uv/lib/dependabot/uv/language.rb

data/lib/dependabot/python/metadata_finder.rb

@@ -14,6 +14,7 @@ module Dependabot
   module Python
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
+
       MAIN_PYPI_URL = "https://pypi.org/pypi"
 
       sig do
@@ -196,7 +197,9 @@ module Dependabot
           .map { |c| AuthedUrlBuilder.authed_url(credential: c) }
 
         (credential_urls + [MAIN_PYPI_URL]).map do |base_url|
-          base_url.gsub(%r{/$}, "") + "/#{normalised_dependency_name}/json"
+          # Convert /simple/ endpoints to /pypi/ for JSON API access
+          json_base_url = base_url.sub(%r{/simple/?$}i, "/pypi")
+          json_base_url.gsub(%r{/$}, "") + "/#{normalised_dependency_name}/json"
         end
       end
 

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -389,7 +389,7 @@ module Dependabot
           elsif req_string.strip.start_with?("~=", "==")
             version.segments.count - 2
           elsif req_string.strip.start_with?("~")
-            req_string.split(".").count == 1 ? 0 : 1
+            req_string.split(".").one? ? 0 : 1
           else
             raise "Don't know how to convert #{req_string} to range"
           end

data/lib/dependabot/python/update_checker.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "toml-rb"
+require "sorbet-runtime"
 
 require "dependabot/dependency"
 require "dependabot/errors"
@@ -17,6 +18,8 @@ require "dependabot/update_checkers/base"
 module Dependabot
   module Python
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/poetry_version_resolver"
       require_relative "update_checker/pipenv_version_resolver"
       require_relative "update_checker/pip_compile_version_resolver"
@@ -30,12 +33,17 @@ module Dependabot
       ).freeze
       VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def latest_version
-        @latest_version ||= fetch_latest_version
+        @latest_version ||= T.let(
+          fetch_latest_version,
+          T.nilable(Gem::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def latest_resolvable_version
-        @latest_resolvable_version ||=
+        @latest_resolvable_version ||= T.let(
           if resolver_type == :requirements
             resolver.latest_resolvable_version
           elsif resolver_type == :pip_compile && resolver.resolvable?(version: latest_version)
@@ -44,33 +52,41 @@ module Dependabot
             resolver.latest_resolvable_version(
               requirement: unlocked_requirement_string
             )
-          end
+          end,
+          T.nilable(Gem::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def latest_resolvable_version_with_no_unlock
-        @latest_resolvable_version_with_no_unlock ||=
+        @latest_resolvable_version_with_no_unlock ||= T.let(
           if resolver_type == :requirements
             resolver.latest_resolvable_version_with_no_unlock
           else
             resolver.latest_resolvable_version(
               requirement: current_requirement_string
             )
-          end
+          end,
+          T.nilable(Gem::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
-
-        @lowest_resolvable_security_fix_version =
-          fetch_lowest_resolvable_security_fix_version
+        @lowest_resolvable_security_fix_version ||= T.let(
+          fetch_lowest_resolvable_security_fix_version,
+          T.nilable(Gem::Version)
+        )
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
           requirements: requirements,
@@ -80,10 +96,12 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { override.returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         !requirements_update_strategy.lockfile_only?
       end
 
+      sig { override.returns(Dependabot::RequirementsUpdateStrategy) }
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
@@ -94,15 +112,18 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Python (yet)
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
+      sig { returns(T.nilable(Gem::Version)) }
       def fetch_lowest_resolvable_security_fix_version
         fix_version = lowest_security_fix_version
         return latest_resolvable_version if fix_version.nil?
@@ -112,6 +133,7 @@ module Dependabot
         resolver.resolvable?(version: fix_version) ? fix_version : nil
       end
 
+      sig { returns(T.untyped) }
       def resolver
         if Dependabot::Experiments.enabled?(:enable_file_parser_python_local)
           Dependabot.logger.info("Python package resolver : #{resolver_type}")
@@ -126,6 +148,7 @@ module Dependabot
         end
       end
 
+      sig { returns(Symbol) }
       def resolver_type
         reqs = requirements
 
@@ -147,6 +170,7 @@ module Dependabot
         end
       end
 
+      sig { returns(Symbol) }
       def subdependency_resolver
         return :pipenv if pipfile_lock
         return :poetry if poetry_lock
@@ -155,12 +179,14 @@ module Dependabot
         raise "Claimed to be a sub-dependency, but no lockfile exists!"
       end
 
+      sig { returns(Symbol) }
       def pyproject_resolver
         return :poetry if poetry_based?
 
         :requirements
       end
 
+      sig { params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
       def exact_requirement?(reqs)
         reqs = reqs.map { |r| r.fetch(:requirement) }
         reqs = reqs.compact
@@ -168,31 +194,62 @@ module Dependabot
         reqs.any? { |r| Python::Requirement.new(r).exact? }
       end
 
+      sig { returns(PipenvVersionResolver) }
       def pipenv_version_resolver
-        @pipenv_version_resolver ||= PipenvVersionResolver.new(**resolver_args)
+        @pipenv_version_resolver ||= T.let(
+          PipenvVersionResolver.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            repo_contents_path: repo_contents_path
+          ),
+          T.nilable(PipenvVersionResolver)
+        )
       end
 
+      sig { returns(PipCompileVersionResolver) }
       def pip_compile_version_resolver
-        @pip_compile_version_resolver ||=
-          PipCompileVersionResolver.new(**resolver_args)
+        @pip_compile_version_resolver ||= T.let(
+          PipCompileVersionResolver.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            repo_contents_path: repo_contents_path
+          ),
+          T.nilable(PipCompileVersionResolver)
+        )
       end
 
+      sig { returns(PoetryVersionResolver) }
       def poetry_version_resolver
-        @poetry_version_resolver ||= PoetryVersionResolver.new(**resolver_args)
+        @poetry_version_resolver ||= T.let(
+          PoetryVersionResolver.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            repo_contents_path: repo_contents_path
+          ),
+          T.nilable(PoetryVersionResolver)
+        )
       end
 
+      sig { returns(PipVersionResolver) }
       def pip_version_resolver
-        @pip_version_resolver ||= PipVersionResolver.new(
-          dependency: dependency,
-          dependency_files: dependency_files,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          update_cooldown: @update_cooldown,
-          raise_on_ignored: @raise_on_ignored,
-          security_advisories: security_advisories
+        @pip_version_resolver ||= T.let(
+          PipVersionResolver.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            update_cooldown: @update_cooldown,
+            raise_on_ignored: @raise_on_ignored,
+            security_advisories: security_advisories
+          ),
+          T.nilable(PipVersionResolver)
         )
       end
 
+      sig { returns(T::Hash[Symbol, T.untyped]) }
       def resolver_args
         {
           dependency: dependency,
@@ -202,6 +259,7 @@ module Dependabot
         }
       end
 
+      sig { returns(T.nilable(String)) }
       def current_requirement_string
         reqs = requirements
         return if reqs.none?
@@ -215,6 +273,7 @@ module Dependabot
         requirement&.fetch(:requirement)
       end
 
+      sig { returns(String) }
       def unlocked_requirement_string
         lower_bound_req = updated_version_req_lower_bound
 
@@ -231,6 +290,7 @@ module Dependabot
         lower_bound_req + ",<=#{latest_version}"
       end
 
+      sig { returns(String) }
       def updated_version_req_lower_bound
         return ">=#{dependency.version}" if dependency.version
 
@@ -245,111 +305,151 @@ module Dependabot
         ">=#{version_for_requirement || 0}"
       end
 
+      sig { returns(T.nilable(Gem::Version)) }
       def fetch_latest_version
         latest_version_finder.latest_version
       end
 
+      sig { returns(LatestVersionFinder) }
       def latest_version_finder
-        @latest_version_finder ||= LatestVersionFinder.new(
-          dependency: dependency,
-          dependency_files: dependency_files,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          raise_on_ignored: @raise_on_ignored,
-          cooldown_options: @update_cooldown,
-          security_advisories: security_advisories
+        @latest_version_finder ||= T.let(
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: @raise_on_ignored,
+            cooldown_options: @update_cooldown,
+            security_advisories: security_advisories
+          ),
+          T.nilable(LatestVersionFinder)
         )
       end
 
+      sig { returns(T::Boolean) }
       def poetry_based?
         updating_pyproject? && !poetry_details.nil?
       end
 
+      sig { returns(T::Boolean) }
       def library?
         return false unless updating_pyproject?
+        return false unless library_details
 
-        return false if library_details["name"].nil?
+        return false if T.must(library_details)["name"].nil?
 
         # Hit PyPi and check whether there are details for a library with a
         # matching name and description
         index_response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(library_details['name'])}/json/"
+          url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
         )
 
         return false unless index_response.status == 200
 
         pypi_info = JSON.parse(index_response.body)["info"] || {}
-        pypi_info["summary"] == library_details["description"]
+        pypi_info["summary"] == T.must(library_details)["description"]
       rescue Excon::Error::Timeout, Excon::Error::Socket
         false
       rescue URI::InvalidURIError
         false
       end
 
+      sig { returns(T::Boolean) }
       def updating_pipfile?
         requirement_files.any?("Pipfile")
       end
 
+      sig { returns(T::Boolean) }
       def updating_pyproject?
         requirement_files.any?("pyproject.toml")
       end
 
+      sig { returns(T::Boolean) }
       def updating_in_file?
         requirement_files.any? { |f| f.end_with?(".in") }
       end
 
+      sig { returns(T::Boolean) }
       def updating_requirements_file?
         requirement_files.any? { |f| f =~ /\.txt$|\.in$/ }
       end
 
+      sig { returns(T::Array[String]) }
       def requirement_files
         requirements.map { |r| r.fetch(:file) }
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def requirements
         dependency.requirements
       end
 
+      sig { params(name: String).returns(String) }
       def normalised_name(name)
         NameNormaliser.normalise(name)
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pipfile
         dependency_files.find { |f| f.name == "Pipfile" }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pipfile_lock
         dependency_files.find { |f| f.name == "Pipfile.lock" }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pyproject
         dependency_files.find { |f| f.name == "pyproject.toml" }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def poetry_lock
         dependency_files.find { |f| f.name == "poetry.lock" }
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def library_details
-        @library_details ||= poetry_details || standard_details || build_system_details
+        @library_details ||= T.let(
+          poetry_details || standard_details || build_system_details,
+          T.nilable(T::Hash[String, T.untyped])
+        )
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def poetry_details
-        @poetry_details ||= toml_content.dig("tool", "poetry")
+        @poetry_details ||= T.let(
+          toml_content.dig("tool", "poetry"),
+          T.nilable(T::Hash[String, T.untyped])
+        )
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def standard_details
-        @standard_details ||= toml_content["project"]
+        @standard_details ||= T.let(
+          toml_content["project"],
+          T.nilable(T::Hash[String, T.untyped])
+        )
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def build_system_details
-        @build_system_details ||= toml_content["build-system"]
+        @build_system_details ||= T.let(
+          toml_content["build-system"],
+          T.nilable(T::Hash[String, T.untyped])
+        )
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def toml_content
-        @toml_content ||= TomlRB.parse(pyproject.content)
+        @toml_content ||= T.let(
+          TomlRB.parse(T.must(pyproject).content),
+          T.nilable(T::Hash[String, T.untyped])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pip_compile_files
         dependency_files.select { |f| f.name.end_with?(".in") }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.332.0
+  version: 0.333.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.332.0
+        version: 0.333.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.332.0
+        version: 0.333.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -211,14 +211,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.333.0
 rdoc_options: []
 require_paths:
 - lib