dependabot-python 0.345.0 → 0.346.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61b27b82c1df809a8209cd6734efe64d1aa9aa3ddcd19097dfa63bddb2145464
-  data.tar.gz: 46b4b38e77efaa6d42c1fbac24356ebac46bfcf76eb4a606221754c9b50bd399
+  metadata.gz: 319ad8d9688dde480391efca28d4419d8bf38fd4ef31d1f8adc9612843f1c2be
+  data.tar.gz: e8f43fdea9eef21a1e35fa0d954331e57430ae4d901011e7745ffcbf0625a96a
 SHA512:
-  metadata.gz: a2a50e30f207cf15d6b1a9ab86929dd913be786ac9531c0257ce14dfaf6a9e2037f8c3683563a6786f1bc23604b43ac06d8c551d050a3c174a1331f12cebe0c3
-  data.tar.gz: 36a85412bb3ddb9eaebad92e5d29a91201f53f29c123e410b5ae6f9ab40db1b6203c0a78d4b3462e3f06a6dc030aa33f60fd735ae9356c6d0428b8267379b515
+  metadata.gz: 968b89aea534fbeceb292c46662da291358fb12c4d9fd388429e55ed3178932e365bf15c83ce2c21fb66e614f6d4abe1ded5fe106495ff16c3faf7dd1f06b0f2
+  data.tar.gz: 1f6478d8f06fb0009ea89b13671f37ecbc0a3aff08d7d252493f764dc86f7580587564729a49b3afe59fa0608dd1851e3f70d54bfc69d966ee4cae7b9781628d

data/helpers/lib/hasher.py

@@ -1,7 +1,9 @@
 import hashin
 import json
 import plette
+import ssl
 import traceback
+from urllib.error import URLError
 from poetry.factory import Factory
 
 
@@ -21,6 +23,17 @@ def get_dependency_hash(dependency_name, dependency_version, algorithm,
             "error_class:": e.__class__.__name__,
             "trace:": ''.join(traceback.format_stack())
         })
+    except (URLError, ssl.SSLError) as e:
+        # Handle SSL certificate verification errors
+        error_msg = str(e)
+        if "CERTIFICATE_VERIFY_FAILED" in error_msg:
+            return json.dumps({
+                "error": "CERTIFICATE_VERIFY_FAILED: " + error_msg,
+                "error_class:": e.__class__.__name__,
+                "trace:": ''.join(traceback.format_stack())
+            })
+        # Re-raise if it's not a certificate verification error
+        raise
 
 
 def get_pipfile_hash(directory):

data/helpers/lib/parser.py

@@ -32,7 +32,7 @@ def parse_pep621_pep735_dependencies(pyproject_path):
                 next(iter(specifier_set)).operator in {"==", "==="}):
             return next(iter(specifier_set)).version
 
-    def parse_requirement(entry, pyproject_path):
+    def parse_requirement(entry, pyproject_path, requirement_type=None):
         try:
             req = Requirement(entry)
         except InvalidRequirement as e:
@@ -46,14 +46,19 @@ def parse_pep621_pep735_dependencies(pyproject_path):
                 "file": pyproject_path,
                 "requirement": str(req.specifier),
                 "extras": sorted(list(req.extras)),
+                "requirement_type": requirement_type,
             }
             return data
 
-    def parse_toml_section_pep621_dependencies(pyproject_path, dependencies):
+    def parse_toml_section_pep621_dependencies(
+        pyproject_path, dependencies, requirement_type=None
+    ):
         requirement_packages = []
 
         for dependency in dependencies:
-            parsed_dependency = parse_requirement(dependency, pyproject_path)
+            parsed_dependency = parse_requirement(
+                dependency, pyproject_path, requirement_type
+            )
             requirement_packages.append(parsed_dependency)
 
         return requirement_packages
@@ -75,7 +80,9 @@ def parse_pep621_pep735_dependencies(pyproject_path):
         for entry in dependencies:
             # Handle direct requirement
             if isinstance(entry, str):
-                parsed_dependency = parse_requirement(entry, pyproject_path)
+                parsed_dependency = parse_requirement(
+                    entry, pyproject_path, group_name
+                )
                 requirement_packages.append(parsed_dependency)
             # Handle include-group directive
             elif isinstance(entry, dict) and "include-group" in entry:
@@ -100,7 +107,8 @@ def parse_pep621_pep735_dependencies(pyproject_path):
             dependencies_toml = project_section['dependencies']
             runtime_dependencies = parse_toml_section_pep621_dependencies(
                 pyproject_path,
-                dependencies_toml
+                dependencies_toml,
+                "dependencies"
             )
             dependencies.extend(runtime_dependencies)
 
@@ -111,7 +119,8 @@ def parse_pep621_pep735_dependencies(pyproject_path):
             for group in optional_dependencies_toml:
                 group_dependencies = parse_toml_section_pep621_dependencies(
                     pyproject_path,
-                    optional_dependencies_toml[group]
+                    optional_dependencies_toml[group],
+                    group
                 )
                 dependencies.extend(group_dependencies)
 
@@ -128,7 +137,8 @@ def parse_pep621_pep735_dependencies(pyproject_path):
         if 'requires' in build_system_section:
             build_system_dependencies = parse_toml_section_pep621_dependencies(
                 pyproject_path,
-                build_system_section['requires']
+                build_system_section['requires'],
+                "build-system.requires"
             )
             dependencies.extend(build_system_dependencies)
 

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -43,11 +43,16 @@ module Dependabot
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def pyproject_dependencies
-          if using_poetry?
-            poetry_dependencies
-          else
-            pep621_pep735_dependencies
-          end
+          dependencies = Dependabot::FileParsers::Base::DependencySet.new
+
+          # Parse Poetry dependencies if [tool.poetry] section exists
+          dependencies += poetry_dependencies if using_poetry?
+
+          # Parse PEP 621/735 dependencies if those sections exist
+          # This handles hybrid projects that have both Poetry and PEP 621 sections
+          dependencies += pep621_pep735_dependencies if using_pep621? || using_pep735?
+
+          dependencies
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -84,11 +89,15 @@ module Dependabot
           parse_pep621_pep735_dependencies.each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
-            next if dep["markers"].include?("<")
+            next if dep["markers"]&.include?("<")
 
             # If no requirement, don't add it
             next if dep["requirement"].empty?
 
+            # Skip build-system.requires dependencies when using Poetry
+            # Poetry manages its own build system dependencies
+            next if using_poetry? && dep["requirement_type"] == "build-system.requires"
+
             dependencies <<
               Dependency.new(
                 name: normalised_name(dep["name"], dep["extras"]),

data/lib/dependabot/python/package/package_details_fetcher.rb

@@ -294,6 +294,12 @@ module Dependabot
             .returns(T.nilable(Dependabot::Package::PackageRelease))
         end
         def format_version_release(version, release_data)
+          # Skip versions that don't conform to PEP 440
+          unless Dependabot::Python::Version.correct?(version)
+            Dependabot.logger.warn("Skipping invalid version #{version}: does not match PEP 440")
+            return nil
+          end
+
           upload_time = release_data["upload_time"]
           released_at = Time.parse(upload_time) if upload_time
           yanked = release_data["yanked"] || false
@@ -306,7 +312,7 @@ module Dependabot
             requires_python: release_data["requires_python"]
           )
 
-          release = Dependabot::Package::PackageRelease.new(
+          Dependabot::Package::PackageRelease.new(
             version: Dependabot::Python::Version.new(version),
             released_at: released_at,
             yanked: yanked,
@@ -316,7 +322,6 @@ module Dependabot
             package_type: package_type,
             language: language
           )
-          release
         end
 
         sig do

data/lib/dependabot/python/update_checker.rb

@@ -181,7 +181,10 @@ module Dependabot
 
       sig { returns(Symbol) }
       def pyproject_resolver
-        return :poetry if poetry_based?
+        # For hybrid projects with both [tool.poetry] and [project] sections but no lockfile,
+        # use the requirements resolver to handle PEP 621 dependencies
+        # For pure Poetry projects, use Poetry resolver even without lockfile
+        return :poetry if poetry_based? && (poetry_lock || !standard_details)
 
         :requirements
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.345.0
+  version: 0.346.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.345.0
+        version: 0.346.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.345.0
+        version: 0.346.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.345.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.346.0
 rdoc_options: []
 require_paths:
 - lib