dependabot-python 0.377.0 → 0.378.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97fc5f469b022c35a988056752d5de194bb42712a22b0841437b64b95d1979d4
-  data.tar.gz: d294b949dda1e010b01caae6c285f979c7c9510f55e57a8f7ed48b06c141d9ba
+  metadata.gz: 61fc61302a50b0c01bb331b80e2ae2b02ad4a59734310cd621a4176fb86ccefb
+  data.tar.gz: d42a62ba72dacd9e0368aa66c3b19b9791a9896f231cf5d43da258204dfe19d4
 SHA512:
-  metadata.gz: 2437d172ed350ebcf53af1cbf4f6086d2229d97ab1ecb9ba4729750b0b1643f6eaf1088928443e1b9f465eacf0106e3df8aaf542a401113dd3ca4efc42e468d8
-  data.tar.gz: f923f746f74bdc91ba8a47f3a1366250a90ebc178b0ae1eb94a012cb43777fedc854b19cb427ffcad4232408cf1bfc2f60bf04aaef8e58aee28cc3d9d039e5fe
+  metadata.gz: cf7432b8dd7bc1d8338e11df066ca36be310215847b3508933abde9676b97cac4bc3bb724ec7b68acf137bb24b202d1de2c1117244228e36c2dc22a7cbfc86cb
+  data.tar.gz: 33ecc6ad4b78e6327fa28224f1b5fe7fec57da1ff1a3106cb06b97e69bf30ab7e91040a7c5f1b2622d1b522a6889f5bb9cd81207a50822ddd9fd6ec024c97238

data/helpers/build

@@ -15,6 +15,7 @@ cp -r \
   "$helpers_dir/lib" \
   "$helpers_dir/run.py" \
   "$helpers_dir/requirements.txt" \
+  "$helpers_dir/requirements-3.9.txt" \
   "$install_dir"
 
 if [ -d "$helpers_dir/test" ]; then
@@ -22,7 +23,17 @@ if [ -d "$helpers_dir/test" ]; then
 fi
 
 cd "$install_dir"
-PYENV_VERSION=$1 pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r "requirements.txt"
+
+python_version=$1
+# pip 26.x and several other packages require Python >=3.10.
+# Use 3.9-compatible versions for the deprecated Python 3.9 runtime.
+if [[ "$python_version" == 3.9.* ]]; then
+  req_file="requirements-3.9.txt"
+else
+  req_file="requirements.txt"
+fi
+
+PYENV_VERSION=$python_version pyenv exec pip3 --disable-pip-version-check install --use-pep517 -r "$req_file"
 
 # Remove the extra objects added during the previous install. Based on
 # https://github.com/docker-library/python/blob/master/Dockerfile-linux.template

data/helpers/requirements-3.9.txt

@@ -0,0 +1,15 @@
+# Python 3.9-compatible versions pinned to the last known working set before
+# packages dropped 3.9 support. Python 3.9 reached end-of-life on 2025-10-31.
+pip==24.2
+pip-tools==7.5.3
+flake8==7.3.0
+hashin==1.0.5
+pipenv==2024.4.1
+plette==2.1.0
+poetry==2.2.1
+pytest==8.3.5
+# tomli is required for Python <3.11 (stdlib tomllib was added in 3.11).
+tomli==2.2.1
+
+# Some dependencies will only install if Cython is present
+Cython==3.2.4

data/helpers/requirements.txt

@@ -1,13 +1,13 @@
-pip==24.2
+pip==26.1.1
 pip-tools==7.5.3
 flake8==7.3.0
 hashin==1.0.5
 pipenv==2024.4.1
-plette==2.1.0
-poetry==2.2.1
-pytest==8.3.5
+plette==2.2.1
+poetry==2.4.1
+pytest==9.0.3
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
-tomli==2.2.1
+tomli==2.4.1
 
 # Some dependencies will only install if Cython is present
 Cython==3.2.4

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -113,12 +113,12 @@ module Dependabot
         sig do
           params(
             type: String,
-            deps_hash: T::Hash[String,
-                               T.untyped]
+            deps_hash: T.nilable(T::Hash[String, T.untyped])
           ).returns(Dependabot::FileParsers::Base::DependencySet)
         end
         def parse_poetry_dependency_group(type, deps_hash)
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
+          return dependencies if deps_hash.nil?
 
           deps_hash.each do |name, req|
             next if normalise(name) == "python"

data/lib/dependabot/python/language.rb

@@ -13,15 +13,15 @@ module Dependabot
       extend T::Sig
 
       # This list must match the versions specified at the top of `python/Dockerfile`
-      # ARG PY_3_13=3.13.2
+      # e.g. ARG PY_3_13=3.13.x
       # Note: uv ecosystem aliases this class, so updates here apply to both ecosystems.
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.14.2
-        3.13.11
-        3.12.12
-        3.11.14
-        3.10.19
-        3.9.24
+        3.14.5
+        3.13.13
+        3.12.13
+        3.11.15
+        3.10.20
+        3.9.25
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(
@@ -47,7 +47,9 @@ module Dependabot
         T::Array[Dependabot::Python::Version]
       )
 
-      NON_SUPPORTED_HIGHEST_VERSION = "3.8"
+      # The highest Python version that is no longer fully supported.
+      # Deprecated now (warning); unsupported once removed from PRE_INSTALLED_PYTHON_VERSIONS_RAW.
+      NON_SUPPORTED_HIGHEST_VERSION = "3.9"
 
       DEPRECATED_VERSIONS = T.let([Version.new(NON_SUPPORTED_HIGHEST_VERSION)].freeze, T::Array[Dependabot::Version])
 

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -341,8 +341,10 @@ module Dependabot
           TomlRB.dump(pyproject_object)
         end
 
-        sig { params(toml_node: T::Hash[String, T.untyped], requirement: String).void }
+        sig { params(toml_node: T.nilable(T::Hash[String, T.untyped]), requirement: String).void }
         def update_dependency_requirement(toml_node, requirement)
+          return unless toml_node
+
           names = toml_node.keys
           pkg_name = names.find { |nm| normalise(nm) == dependency.name }
           return unless pkg_name

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.377.0
+  version: 0.378.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.378.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.378.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -245,6 +245,7 @@ files:
 - helpers/lib/__init__.py
 - helpers/lib/hasher.py
 - helpers/lib/parser.py
+- helpers/requirements-3.9.txt
 - helpers/requirements.txt
 - helpers/run.py
 - helpers/test/fixtures/no_dependencies.toml
@@ -322,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.378.0
 rdoc_options: []
 require_paths:
 - lib