dependabot-python 0.380.0 → 0.381.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05b66da58a53be405a84e1d0690f1e469dbe7f629a30a969e23eaded26de4f33
-  data.tar.gz: d42a62ba72dacd9e0368aa66c3b19b9791a9896f231cf5d43da258204dfe19d4
+  metadata.gz: f0477e6159f9fcd2dfd744b603b9bd23ba2df5ad50c3bf3a8fc51fbcd00e6306
+  data.tar.gz: 1271ebda6e197461e2721a7aa0f69d917dc8c506813465931ba01ae143f3c34a
 SHA512:
-  metadata.gz: 7953f17b6c1f70e7675228f17902850a0931b17aa2d25035d46348cfcd91db9cc6247b266cf84fdf927d3f6e9f86629a5ed41b1fd5e85933dfdbd22b09d8f63d
-  data.tar.gz: 33ecc6ad4b78e6327fa28224f1b5fe7fec57da1ff1a3106cb06b97e69bf30ab7e91040a7c5f1b2622d1b522a6889f5bb9cd81207a50822ddd9fd6ec024c97238
+  metadata.gz: ca638414b000ecf033fa4470316f3858a1f57e9ca496db678b9779da39a292aaaaf66908b037e6b6f0c02ad528c9142cd42a687149a75887b053dc5001dd5ff8
+  data.tar.gz: 34164a7fcbc0eb80ee3cdfe995cd891560fe9b2feaab98ec3be721699117897855be5a6f76bb76cea581b2cf18b60cc378df2a1128042197582894154abb308f

data/lib/dependabot/python/dependency_grapher/lockfile_generator.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/python/file_fetcher.rb

@@ -37,6 +37,7 @@ module Dependabot
         files << setup_file if setup_file
         files << setup_cfg_file if setup_cfg_file
         files << pip_conf if pip_conf
+        files << pip_tools_config if pip_tools_config
         files
       end
 
@@ -121,6 +122,14 @@ module Dependabot
         )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def pip_tools_config
+        @pip_tools_config ||= T.let(
+          fetch_support_file(".pip-tools.toml"),
+          T.nilable(Dependabot::DependencyFile)
+        )
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pipfile
         @pipfile ||= T.let(

data/lib/dependabot/python/file_parser/pipfile_files_parser.rb

@@ -94,9 +94,10 @@ module Dependabot
           return dependencies unless pipfile_lock
 
           DEPENDENCY_GROUP_KEYS.map { |h| h.fetch(:lockfile) }.each do |key|
-            next unless parsed_pipfile_lock[key]
+            section_data = parsed_pipfile_lock_section(key)
+            next unless section_data
 
-            parsed_pipfile_lock[key].each do |dep_name, details|
+            section_data.each do |dep_name, details|
               version = case details
                         when String then details
                         when Hash then details["version"]
@@ -129,8 +130,7 @@ module Dependabot
           req = version_from_hash_or_string(requirement)
 
           if pipfile_lock
-            details = parsed_pipfile_lock
-                      .dig(group, normalised_name(dep_name))
+            details = parsed_pipfile_lock_section(group)&.[](normalised_name(dep_name))
 
             version = version_from_hash_or_string(details)
             version&.gsub(/^===?/, "")
@@ -185,6 +185,14 @@ module Dependabot
           raise Dependabot::DependencyFileNotParseable, T.must(pipfile_lock).path
         end
 
+        sig { params(section: String).returns(T.nilable(T::Hash[String, T.untyped])) }
+        def parsed_pipfile_lock_section(section)
+          section_data = parsed_pipfile_lock[section]
+          return section_data if section_data.is_a?(Hash)
+
+          nil
+        end
+
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pipfile
           @pipfile ||= T.let(dependency_files.find { |f| f.name == "Pipfile" }, T.nilable(Dependabot::DependencyFile))

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -55,7 +55,7 @@ module Dependabot
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def poetry_dependencies
-          @poetry_dependencies ||= T.let(parse_poetry_dependencies, T.untyped)
+          @poetry_dependencies ||= T.let(parse_poetry_dependencies, T.nilable(Dependabot::FileParsers::Base::DependencySet))
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -372,16 +372,19 @@ module Dependabot
           }
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_pyproject
-          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.untyped)
+          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.nilable(T::Hash[String, T.untyped]))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_poetry_lock
-          @parsed_poetry_lock ||= T.let(TomlRB.parse(T.must(poetry_lock).content), T.untyped)
+          @parsed_poetry_lock ||= T.let(
+            TomlRB.parse(T.must(poetry_lock).content),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           raise Dependabot::DependencyFileNotParseable, T.must(poetry_lock).path
         end

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -21,7 +21,7 @@ module Dependabot
         TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m
         EXTRAS_REQUIRE_REGEX = /extras_require\s*=\s*\{/m
 
-        CLOSING_BRACKET = T.let({ "[" => "]", "{" => "}" }.freeze, T.any(T.untyped, T.untyped))
+        CLOSING_BRACKET = T.let({ "[" => "]", "{" => "}" }.freeze, T::Hash[String, String])
 
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)

data/lib/dependabot/python/file_parser.rb

@@ -539,7 +539,7 @@ module Dependabot
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pip_compile_files
-        @pip_compile_files ||= T.let(dependency_files.select { |f| f.name.end_with?(".in") }, T.untyped)
+        @pip_compile_files ||= T.let(dependency_files.select { |f| f.name.end_with?(".in") }, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
 
       sig { returns(Dependabot::Python::PipCompileFileMatcher) }

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require "toml-rb"
 require "dependabot/dependency"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_fetcher"
@@ -36,6 +37,7 @@ module Dependabot
         WARNINGS = T.let(/\s*# WARNING:.*\Z/m, Regexp)
         UNSAFE_NOTE = T.let(/\s*# The following packages are considered to be unsafe.*\Z/m, Regexp)
         RESOLVER_REGEX = T.let(/(?<=--resolver=)(\w+)/, Regexp)
+        UNSAFE_PACKAGE_OPTION_REGEX = T.let(/--unsafe-package(?:=|\s+)(?<name>[^\s\\]+)/, Regexp)
         NATIVE_COMPILATION_ERROR = T.let(
           "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
           String
@@ -206,13 +208,20 @@ module Dependabot
           files = dependency_files
                   .reject { |file| updated_filenames.include?(file.name) }
 
-          args = dependency.to_h
-          args = args.keys.to_h { |k| [k.to_sym, args[k]] }
-          args[:requirements] = new_reqs
-          args[:previous_requirements] = old_reqs
+          dep = T.must(dependency)
 
           RequirementFileUpdater.new(
-            dependencies: [Dependency.new(**T.unsafe(args))],
+            dependencies: [Dependency.new(
+              name: dep.name,
+              version: dep.version,
+              requirements: new_reqs,
+              package_manager: dep.package_manager,
+              previous_version: dep.previous_version,
+              previous_requirements: old_reqs,
+              directory: dep.directory,
+              subdependency_metadata: dep.subdependency_metadata,
+              removed: dep.removed?
+            )],
             dependency_files: files,
             credentials: credentials
           ).updated_dependency_files
@@ -533,37 +542,38 @@ module Dependabot
           # Use the explicit output file if provided, otherwise fall back to finding one
           requirements_file = output_file || compiled_file_for_filename(filename)
           options += pip_compile_options_from_compiled_file(requirements_file) if requirements_file
+          options = merge_pip_tools_config_options(options)
 
           options.join(" ")
         end
 
-        # rubocop:disable Metrics/AbcSize
         sig { params(requirements_file: T.nilable(Dependabot::DependencyFile)).returns(T::Array[String]) }
         def pip_compile_options_from_compiled_file(requirements_file)
+          content = T.must(T.must(requirements_file).content)
           options = ["--output-file=#{T.must(requirements_file).name}"]
 
-          options << "--no-emit-index-url" unless T.must(T.must(requirements_file).content).include?("index-url http")
+          options << "--no-emit-index-url" unless content.include?("index-url http")
 
-          options << "--generate-hashes" if T.must(T.must(requirements_file).content).include?("--hash=sha")
+          options << "--generate-hashes" if content.include?("--hash=sha")
 
-          options << "--allow-unsafe" if includes_unsafe_packages?(T.must(T.must(requirements_file).content))
+          options << "--allow-unsafe" if includes_unsafe_packages?(content)
+          options.concat(unsafe_package_options_from_compiled_file(content))
 
-          options << "--no-annotate" unless T.must(T.must(requirements_file).content).include?("# via ")
+          options << "--no-annotate" unless content.include?("# via ")
 
-          options << "--no-header" unless T.must(T.must(requirements_file).content).include?("autogenerated by pip-c")
+          options << "--no-header" unless content.include?("autogenerated by pip-c")
 
-          options << "--pre" if T.must(T.must(requirements_file).content).include?("--pre")
+          options << "--pre" if content.include?("--pre")
 
-          options << "--strip-extras" if T.must(T.must(requirements_file).content).include?("--strip-extras")
+          options << "--strip-extras" if content.include?("--strip-extras")
 
-          if (resolver = RESOLVER_REGEX.match(T.must(requirements_file).content))
+          if (resolver = RESOLVER_REGEX.match(content))
             options << "--resolver=#{resolver}"
           end
 
           options
         end
 
-        # rubocop:enable Metrics/AbcSize
         sig { returns(T::Array[String]) }
         def pip_compile_index_options
           credentials
@@ -584,6 +594,87 @@ module Dependabot
           UNSAFE_PACKAGES.any? { |n| content.match?(/^#{Regexp.quote(n)}==/) }
         end
 
+        sig { params(content: String).returns(T::Array[String]) }
+        def unsafe_package_options_from_compiled_file(content)
+          header = content.lines.take_while { |line| line.start_with?("#") }.join(" ")
+          header
+            .scan(UNSAFE_PACKAGE_OPTION_REGEX)
+            .flatten
+            .uniq
+            .map { |name| "--unsafe-package=#{name}" }
+        end
+
+        sig { params(options: T::Array[String]).returns(T::Array[String]) }
+        def merge_pip_tools_config_options(options)
+          merged_options = options.dup
+          pip_tools_config_options.each do |option|
+            next if option_already_present?(merged_options, option)
+
+            merged_options << option
+          end
+
+          merged_options
+        end
+
+        sig { returns(T::Array[String]) }
+        def pip_tools_config_options
+          return [] unless pip_tools_config_file&.content
+
+          config = parse_pip_tools_config
+          return [] unless config
+
+          options = []
+          options << "--allow-unsafe" if config["allow-unsafe"] == true
+          options << "--strip-extras" if config["strip-extras"] == true
+
+          options.concat(resolver_option_from_config(config))
+          options.concat(unsafe_package_options_from_config(config))
+
+          options
+        end
+
+        sig { params(existing_options: T::Array[String], option: String).returns(T::Boolean) }
+        def option_already_present?(existing_options, option)
+          return existing_options.include?("--allow-unsafe") if option == "--allow-unsafe"
+          return existing_options.include?("--strip-extras") if option == "--strip-extras"
+          return existing_options.any? { |opt| opt.start_with?("--resolver=") } if option.start_with?("--resolver=")
+          return existing_options.include?(option) if option.start_with?("--unsafe-package=")
+
+          false
+        end
+
+        sig { params(config: T::Hash[String, T.untyped]).returns(T::Array[String]) }
+        def resolver_option_from_config(config)
+          resolver = config["resolver"]
+          return [] unless resolver.is_a?(String)
+          return [] if resolver.empty?
+
+          ["--resolver=#{resolver}"]
+        end
+
+        sig { params(config: T::Hash[String, T.untyped]).returns(T::Array[String]) }
+        def unsafe_package_options_from_config(config)
+          Array(config["unsafe-package"])
+            .select { |package_name| package_name.is_a?(String) && !package_name.empty? }
+            .map { |package_name| "--unsafe-package=#{package_name}" }
+        end
+
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        def parse_pip_tools_config
+          parsed = T.let(TomlRB.parse(T.must(pip_tools_config_file).content), T::Hash[String, T.untyped])
+          pip_tools_config = parsed["pip-tools"]
+          return unless pip_tools_config.is_a?(Hash)
+
+          pip_tools_config
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          nil
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def pip_tools_config_file
+          dependency_files.find { |file| file.name.end_with?(".pip-tools.toml") }
+        end
+
         sig { returns(T::Array[String]) }
         def filenames_to_compile
           files_from_reqs =

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -14,6 +14,7 @@ require "dependabot/python/file_updater"
 require "dependabot/python/native_helpers"
 require "dependabot/python/name_normaliser"
 require "dependabot/python/poetry_plugin_installer"
+require "dependabot/package/release_cooldown_options"
 
 module Dependabot
   module Python
@@ -36,13 +37,15 @@ module Dependabot
           params(
             dependencies: T::Array[Dependabot::Dependency],
             dependency_files: T::Array[Dependabot::DependencyFile],
-            credentials: T::Array[Dependabot::Credential]
+            credentials: T::Array[Dependabot::Credential],
+            cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
-        def initialize(dependencies:, dependency_files:, credentials:)
+        def initialize(dependencies:, dependency_files:, credentials:, cooldown: nil)
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
+          @cooldown = T.let(cooldown, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
           @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @prepared_pyproject = T.let(nil, T.nilable(String))
           @pyproject = T.let(nil, T.nilable(Dependabot::DependencyFile))
@@ -252,29 +255,49 @@ module Dependabot
                            .update_python_requirement(language_version_manager.python_version)
         end
 
-        sig { params(poetry_object: T::Hash[String, T.untyped], dep: Dependabot::Dependency).returns(T::Array[String]) }
+        sig { params(poetry_object: T::Hash[String, T.untyped], dep: Dependabot::Dependency).void }
         def lock_declaration_to_new_version!(poetry_object, dep)
-          Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES.each do |type|
-            names = poetry_object[type]&.keys || []
-            pkg_name = names.find { |nm| normalise(nm) == dep.name }
-            next unless pkg_name
+          pinned_version = exact_poetry_requirement(dep.version)
+          return unless pinned_version
 
-            if poetry_object[type][pkg_name].is_a?(Hash)
-              next unless poetry_object[type][pkg_name].key?("version") # skip enrichment-only entries
+          poetry_dependency_tables(poetry_object).each do |deps_hash|
+            pkg_name = deps_hash.keys.find { |nm| normalise(nm) == dep.name }
+            next unless pkg_name
 
-              poetry_object[type][pkg_name]["version"] = dep.version
+            entry = deps_hash[pkg_name]
+            if entry.is_a?(Hash)
+              entry["version"] = pinned_version if entry.key?("version") # skip enrichment-only entries
             else
-              poetry_object[type][pkg_name] = dep.version
+              deps_hash[pkg_name] = pinned_version
             end
           end
         end
 
         sig { params(poetry_object: T::Hash[String, T.untyped], dep: Dependabot::Dependency).void }
         def create_declaration_at_new_version!(poetry_object, dep)
-          subdep_type = dep.production? ? "dependencies" : "dev-dependencies"
+          pinned_version = exact_poetry_requirement(dep.version)
+          return unless pinned_version
 
+          subdep_type = dep.production? ? "dependencies" : "dev-dependencies"
           poetry_object[subdep_type] ||= {}
-          poetry_object[subdep_type][dep.name] = dep.version
+          poetry_object[subdep_type][dep.name] = pinned_version
+        end
+
+        sig { params(version: T.nilable(String)).returns(T.nilable(String)) }
+        def exact_poetry_requirement(version)
+          return nil unless version
+
+          # Pin with ==version only when cooldown is set so Poetry can't pick a newer excluded release.
+          @cooldown ? "==#{version}" : version
+        end
+
+        sig { params(poetry_object: T::Hash[String, T.untyped]).returns(T::Array[T::Hash[String, T.untyped]]) }
+        def poetry_dependency_tables(poetry_object)
+          types = Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES
+          groups = poetry_object["group"].is_a?(Hash) ? poetry_object["group"].values : []
+          candidates = types.map { |type| poetry_object[type] } +
+                       groups.map { |group_spec| group_spec["dependencies"] if group_spec.is_a?(Hash) }
+          candidates.grep(Hash)
         end
 
         sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }

data/lib/dependabot/python/file_updater.rb

@@ -93,7 +93,8 @@ module Dependabot
         PoetryFileUpdater.new(
           dependencies: dependencies,
           dependency_files: dependency_files,
-          credentials: credentials
+          credentials: credentials,
+          cooldown: options[:update_cooldown]
         ).updated_dependency_files
       end
 

data/lib/dependabot/python/language_version_manager.rb

@@ -34,9 +34,12 @@ module Dependabot
         T.must(version)
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(String) }
       def python_major_minor
-        @python_major_minor ||= T.let(T.must(Python::Version.new(python_version).segments[0..1]).join("."), T.untyped)
+        @python_major_minor ||= T.let(
+          T.must(Python::Version.new(python_version).segments[0..1]).join("."),
+          T.nilable(String)
+        )
       end
 
       sig { returns(String) }

data/lib/dependabot/python/pipenv_runner.rb

@@ -117,9 +117,10 @@ module Dependabot
         return nil unless lockfile_content
 
         parsed_lockfile = JSON.parse(lockfile_content)
-        section = lockfile_section
-        dependency_data = parsed_lockfile.dig(section, dependency_name)
+        section_data = parsed_lockfile_section(parsed_lockfile, lockfile_section)
+        return nil unless section_data
 
+        dependency_data = section_data[dependency_name]
         return nil unless dependency_data
 
         dependency_data["extras"]
@@ -127,10 +128,11 @@ module Dependabot
 
       sig { params(updated_lockfile: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
       def fetch_version_from_parsed_lockfile(updated_lockfile)
-        deps = updated_lockfile[lockfile_section] || {}
+        section_data = parsed_lockfile_section(updated_lockfile, lockfile_section)
+        return nil unless section_data
 
-        deps.dig(dependency_name, "version")
-            &.gsub(/^==/, "")
+        section_data.dig(dependency_name, "version")
+                    &.gsub(/^==/, "")
       end
 
       sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
@@ -138,18 +140,39 @@ module Dependabot
         SharedHelpers.run_shell_command(command, env: pipenv_env_variables, fingerprint: fingerprint)
       end
 
-      sig { returns(String) }
+      sig { returns(T.nilable(String)) }
       def lockfile_section
         if current_dependency.requirements.any?
           T.must(current_dependency.requirements.first)[:groups].first
         else
+          parsed_lockfile = JSON.parse(T.must(T.must(lockfile).content))
           Python::FileParser::DEPENDENCY_GROUP_KEYS.each do |keys|
             section = keys.fetch(:lockfile)
-            return section if JSON.parse(T.must(T.must(lockfile).content))[section].keys.any?(dependency_name)
+            section_data = parsed_lockfile_section(parsed_lockfile, section)
+            next unless section_data
+
+            return section if section_data.key?(dependency_name)
           end
+
+          nil
         end
       end
 
+      sig do
+        params(
+          parsed_lockfile: T::Hash[String, T.untyped],
+          section: T.nilable(String)
+        ).returns(T.nilable(T::Hash[String, T.untyped]))
+      end
+      def parsed_lockfile_section(parsed_lockfile, section)
+        return nil unless section
+
+        section_data = parsed_lockfile[section]
+        return section_data if section_data.is_a?(Hash)
+
+        nil
+      end
+
       sig { returns(String) }
       def dependency_name
         current_dependency.metadata[:original_name] || current_dependency.name

data/lib/dependabot/python/shared_file_fetcher.rb

@@ -48,7 +48,7 @@ module Dependabot
           languages: {
             python: {
               "raw" => language_version_manager.user_specified_python_version || "unknown",
-              "max" => language_version_manager.python_major_minor || "unknown"
+              "max" => language_version_manager.python_major_minor
             }
           }
         }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.380.0
+  version: 0.381.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -323,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
 rdoc_options: []
 require_paths:
 - lib