dependabot-python 0.346.0 → 0.347.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 319ad8d9688dde480391efca28d4419d8bf38fd4ef31d1f8adc9612843f1c2be
-  data.tar.gz: e8f43fdea9eef21a1e35fa0d954331e57430ae4d901011e7745ffcbf0625a96a
+  metadata.gz: 3318bd6183c48be4d1747cb8918393cd51a68db3c282d94fdd6a22359b187ecc
+  data.tar.gz: 9e9eac099f7b9dede87c73159720df01d4459aac2e93c4f5f31477384c5fcdc7
 SHA512:
-  metadata.gz: 968b89aea534fbeceb292c46662da291358fb12c4d9fd388429e55ed3178932e365bf15c83ce2c21fb66e614f6d4abe1ded5fe106495ff16c3faf7dd1f06b0f2
-  data.tar.gz: 1f6478d8f06fb0009ea89b13671f37ecbc0a3aff08d7d252493f764dc86f7580587564729a49b3afe59fa0608dd1851e3f70d54bfc69d966ee4cae7b9781628d
+  metadata.gz: eededd5aa20a1b07409cb8712af2f6caf8ee3f53cd7f8bbdb229fd041f346c24bc714bcb8c4f48192930098a6403c3a61a2a96d5ab59907273313384809e12cb
+  data.tar.gz: '099b7724f914246e3c95557b633feb6015466f3fe6e156cdb53237763c6ac3c68e35476d8fbe130b7a4d061d3df24e0728d687bbf8121581db694bf27fa20183'

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -458,6 +458,8 @@ module Dependabot
           hashes = []
 
           index_urls.each do |index_url|
+            index_url = "https://pypi.org" if index_url && !index_url.start_with?("http://", "https://")
+
             args = [name, version, algorithm]
             args << index_url if index_url
 

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -123,15 +123,30 @@ module Dependabot
           if declaration_match
             declaration = declaration_match[:declaration]
             new_declaration = T.must(declaration).sub(old_req, new_req)
-            content.sub(T.must(declaration), new_declaration)
-          else
-            content.gsub(table_declaration_regex(dep, new_r)) do |match|
+            return content.sub(T.must(declaration), new_declaration)
+          end
+
+          # Try Poetry table format
+          table_match = content.match(table_declaration_regex(dep, new_r))
+          if table_match
+            return content.gsub(table_declaration_regex(dep, new_r)) do |match|
               match.gsub(
                 /(\s*version\s*=\s*["'])#{Regexp.escape(old_req)}/,
                 '\1' + new_req
               )
             end
           end
+
+          # Try PEP 621 array format (e.g., dependencies = ["django==5.0.0"])
+          pep621_regex = pep621_declaration_regex(dep, old_req)
+          pep621_match = content.match(pep621_regex)
+          if pep621_match
+            declaration = pep621_match[:declaration]
+            new_declaration = T.must(declaration).sub(old_req, new_req)
+            return content.sub(T.must(declaration), new_declaration)
+          end
+
+          content
         end
 
         sig { returns(String) }
@@ -177,13 +192,16 @@ module Dependabot
         sig { params(pyproject_content: String).returns(String) }
         def freeze_dependencies_being_updated(pyproject_content)
           pyproject_object = TomlRB.parse(pyproject_content)
-          poetry_object = pyproject_object.fetch("tool").fetch("poetry")
 
-          dependencies.each do |dep|
-            if dep.requirements.find { |r| r[:file] == pyproject&.name }
-              lock_declaration_to_new_version!(poetry_object, dep)
-            else
-              create_declaration_at_new_version!(poetry_object, dep)
+          poetry_object = pyproject_object.dig("tool", "poetry")
+
+          if poetry_object
+            dependencies.each do |dep|
+              if dep.requirements.find { |r| r[:file] == pyproject&.name }
+                lock_declaration_to_new_version!(poetry_object, dep)
+              else
+                create_declaration_at_new_version!(poetry_object, dep)
+              end
             end
           end
 
@@ -321,6 +339,11 @@ module Dependabot
           /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\]\n.*?\s*version\s* =.*?\n/m
         end
 
+        sig { params(dep: Dependabot::Dependency, old_req: String).returns(Regexp) }
+        def pep621_declaration_regex(dep, old_req)
+          /(?<declaration>["']#{escape(dep)}#{Regexp.escape(old_req)}["'])/mi
+        end
+
         sig { params(dep: Dependency).returns(String) }
         def escape(dep)
           Regexp.escape(dep.name).gsub("\\-", "[-_.]")

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -45,12 +45,14 @@ module Dependabot
         sig { params(requirement: String).returns(String) }
         def update_python_requirement(requirement)
           pyproject_object = TomlRB.parse(@pyproject_content)
+
           if (python_specification = pyproject_object.dig("tool", "poetry", "dependencies", "python"))
             python_req = Python::Requirement.new(python_specification)
             unless python_req.satisfied_by?(requirement)
               pyproject_object["tool"]["poetry"]["dependencies"]["python"] = "~#{requirement}"
             end
           end
+
           TomlRB.dump(pyproject_object)
         end
 
@@ -69,7 +71,10 @@ module Dependabot
           return pyproject_content unless lockfile
 
           pyproject_object = TomlRB.parse(pyproject_content)
-          poetry_object = pyproject_object["tool"]["poetry"]
+          poetry_object = pyproject_object.dig("tool", "poetry")
+
+          return pyproject_content unless poetry_object
+
           excluded_names = dependencies.map(&:name) + ["python"]
 
           Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES.each do |key|

data/lib/dependabot/python/file_updater.rb

@@ -147,7 +147,14 @@ module Dependabot
       def poetry_based?
         return false unless pyproject
 
-        !TomlRB.parse(pyproject&.content).dig("tool", "poetry").nil?
+        parsed_pyproject = TomlRB.parse(pyproject&.content)
+
+        return true unless parsed_pyproject.dig("tool", "poetry").nil?
+
+        return false unless poetry_lock
+
+        build_backend = parsed_pyproject.dig("build-system", "build-backend")
+        !build_backend.nil? && build_backend.start_with?("poetry.core")
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -84,8 +84,11 @@ module Dependabot
           new_requirement =
             if req_strings.any? { |r| requirement_class.new(r).exact? }
               find_and_update_equality_match(req_strings)
-            elsif req_strings.any? { |r| r.start_with?("~=", "==") }
-              tw_req = req_strings.find { |r| r.start_with?("~=", "==") }
+            elsif req_strings.any? { |r| r.start_with?("~=") }
+              tw_req = req_strings.find { |r| r.start_with?("~=") }
+              bump_version(tw_req, latest_resolvable_version.to_s)
+            elsif req_strings.any? { |r| r.start_with?("==") }
+              tw_req = req_strings.find { |r| r.start_with?("==") }
               convert_to_range(tw_req, T.must(latest_resolvable_version))
             else
               update_requirements_range(req_strings)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.346.0
+  version: 0.347.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.346.0
+        version: 0.347.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.346.0
+        version: 0.347.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.346.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.347.0
 rdoc_options: []
 require_paths:
 - lib