dependabot-python 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 242cdbd71bb6b0424ba7c88daf21d1839db3eb9d3f0beb2ad9e070f3d624cf77
-  data.tar.gz: 40a2faa1353d5fd82480211fee5ac28840996cf483fdf3c884fb558702396f08
+  metadata.gz: 0d1b1deb24d07d3b15f0c1cb2a434bc4014459ff9e52173a6b1aa1608bed9bef
+  data.tar.gz: c2a82f5e34e3f06ecfd16ad0516aa925d7cea4d564b9436befaf50ea5eaeb05f
 SHA512:
-  metadata.gz: 9a75d27db29ca5df37ea4e4962da3cbbfa0c05627044fd340d9b0b6f657108d44ff78bc40c206b2d0ac3a6d8387f3f0f30cd7dfeacafee122fd92b3e2d981954
-  data.tar.gz: 7651c73fdab13d9f091cada4a7d7531842e90042825ef0052c67882e90958870a26fd3936ac213bcd69362d9ac3b9d64d422a34ea4f9646344468851c6969b7c
+  metadata.gz: c6f557bb606f5cdd0105035e2569dfb80410716ae0b6eb514c46d92837f4677107e2f22c309dd90fcd983c0b4a0d23a8ef596036f242560670de569b90a01b43
+  data.tar.gz: 7426a6a6748ef14ed637e82fa5757e5a11fc2c56fadb9e549b559a35e0bd831985978be092f6908068ae5cdd787d330ff95bc7e9b54dc0add588523a4a194d6d

data/helpers/requirements.txt

@@ -1,4 +1,4 @@
-pip==26.1.2
+pip==26.2.1
 pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
@@ -10,4 +10,4 @@ pytest==9.1.1
 tomli==2.4.1
 
 # Some dependencies will only install if Cython is present
-Cython==3.2.9
+Cython==3.3.0

data/lib/dependabot/python/file_parser/pep_dependency.rb

@@ -0,0 +1,53 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PepDependency < T::ImmutableStruct
+        extend T::Sig
+
+        const :name, String
+        const :version, T.nilable(String), default: nil
+        const :markers, T.nilable(String), default: nil
+        const :file, String
+        const :requirement, T.nilable(String), default: nil
+        const :source_requirement, T.nilable(String), default: nil
+        const :extras, T::Array[String]
+        const :requirement_type, T.nilable(String), default: nil
+
+        sig { params(result: Object).returns(T::Array[PepDependency]) }
+        def self.from_helper_result(result)
+          PyprojectValueParser.array(result, "PEP dependency result").map do |value|
+            from_object(value)
+          end
+        end
+
+        sig { params(value: Object).returns(PepDependency) }
+        def self.from_object(value)
+          hash = PyprojectValueParser.object_hash(value, "PEP dependency")
+          new(
+            name: PyprojectValueParser.string(hash["name"], "PEP dependency name"),
+            version: PyprojectValueParser.optional_string(hash["version"], "PEP dependency version"),
+            markers: PyprojectValueParser.optional_string(hash["markers"], "PEP dependency markers"),
+            file: PyprojectValueParser.string(hash["file"], "PEP dependency file"),
+            requirement: PyprojectValueParser.optional_string(hash["requirement"], "PEP dependency requirement"),
+            source_requirement: PyprojectValueParser.optional_string(
+              hash["source_requirement"],
+              "PEP dependency source_requirement"
+            ),
+            extras: PyprojectValueParser.string_array(hash["extras"], "PEP dependency extras"),
+            requirement_type: PyprojectValueParser.optional_string(
+              hash["requirement_type"],
+              "PEP dependency requirement_type"
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/poetry_lock.rb

@@ -0,0 +1,95 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      class PoetryLock
+        extend T::Sig
+
+        class Package < T::ImmutableStruct
+          extend T::Sig
+
+          const :name, String
+          const :version, String
+          const :source_type, T.nilable(String), default: nil
+
+          sig { params(value: Object).returns(Package) }
+          def self.from_object(value)
+            hash = PyprojectValueParser.object_hash(value, "Poetry lock package")
+            source = hash["source"]
+            source_hash =
+              if source.nil?
+                nil
+              else
+                PyprojectValueParser.object_hash(source, "Poetry lock package source")
+              end
+
+            new(
+              name: PyprojectValueParser.string(hash["name"], "Poetry lock package name"),
+              version: PyprojectValueParser.string(hash["version"], "Poetry lock package version"),
+              source_type: PyprojectValueParser.optional_string(
+                source_hash&.[]("type"),
+                "Poetry lock package source type"
+              )
+            )
+          end
+
+          sig { returns(T::Hash[Symbol, T.nilable(String)]) }
+          def to_h
+            {
+              name: name,
+              version: version,
+              source_type: source_type
+            }
+          end
+        end
+
+        sig { returns(T::Array[Package]) }
+        attr_reader :packages
+
+        sig { params(packages: T::Array[Package]).void }
+        def initialize(packages)
+          @packages = packages
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PoetryLock) }
+        def self.from_file(file)
+          parsed = T.cast(TomlRB.parse(T.must(file.content)), Object)
+          document = PyprojectValueParser.object_hash(parsed, "poetry.lock")
+          value = document["package"]
+          packages =
+            if value.nil?
+              []
+            else
+              PyprojectValueParser.array(value, "poetry.lock package").map do |package|
+                Package.from_object(package)
+              end
+            end
+          new(packages)
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig do
+          params(
+            name: String,
+            _normalizer: T.proc.params(name: String).returns(String)
+          )
+            .returns(T.nilable(String))
+        end
+        def version_for(name, &_normalizer)
+          normalized_name = yield(name)
+          packages.find { |package| yield(package.name) == normalized_name }&.version
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_document.rb

@@ -0,0 +1,242 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "toml-rb"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/python/file_parser"
+
+module Dependabot
+  module Python
+    class FileParser < Dependabot::FileParsers::Base
+      module PyprojectValueParser
+        extend T::Sig
+
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+        PoetryRequirement = T.type_alias { T.any(String, ObjectHash) }
+        PoetryDependencyMap = T.type_alias { T::Hash[String, T::Array[PoetryRequirement]] }
+
+        sig { params(value: Object, context: String).returns(ObjectHash) }
+        def self.object_hash(value, context)
+          raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[Object]) }
+        def self.array(value, context)
+          raise TypeError, "#{context} must be an array" unless value.is_a?(Array)
+
+          value.map { |item| T.cast(item, Object) }
+        end
+
+        sig { params(value: Object, context: String).returns(String) }
+        def self.string(value, context)
+          return value if value.is_a?(String)
+
+          raise TypeError, "#{context} must be a string"
+        end
+
+        sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+        def self.optional_string(value, context)
+          return if value.nil?
+
+          string(value, context)
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[String]) }
+        def self.string_array(value, context)
+          array(value, context).map do |item|
+            raise TypeError, "#{context} must contain only strings" unless item.is_a?(String)
+
+            item
+          end
+        end
+
+        sig { params(value: Object, name: String).returns(T::Array[PoetryRequirement]) }
+        def self.poetry_requirements(value, name)
+          flattened = value.is_a?(Array) ? value.flatten : [value]
+          flattened.compact.map do |item|
+            item = T.cast(item, Object)
+            case item
+            when String
+              item
+            when Hash
+              object_hash(item, "Poetry dependency #{name}")
+            else
+              raise TypeError, "Poetry dependency #{name} must be a string, object, or array"
+            end
+          end
+        end
+
+        sig { params(value: Object, context: String).returns(PoetryDependencyMap) }
+        def self.poetry_dependency_map(value, context)
+          object_hash(value, context).to_h do |name, requirement|
+            [name, poetry_requirements(requirement, name)]
+          end
+        end
+      end
+      private_constant :PyprojectValueParser
+
+      class PyprojectDocument
+        extend T::Sig
+
+        PoetryRequirement = T.type_alias { PyprojectValueParser::PoetryRequirement }
+        PoetryDependencyMap = T.type_alias { PyprojectValueParser::PoetryDependencyMap }
+
+        class PoetrySource < T::ImmutableStruct
+          const :name, String
+          const :url, T.nilable(String), default: nil
+        end
+
+        sig { params(data: PyprojectValueParser::ObjectHash).void }
+        def initialize(data)
+          @data = data
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(PyprojectDocument) }
+        def self.from_file(file)
+          content = T.must(file.content)
+          parsed = T.cast(TomlRB.parse(content), Object)
+          new(PyprojectValueParser.object_hash(parsed, "pyproject.toml"))
+        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+          raise Dependabot::DependencyFileNotParseable, file.path
+        end
+
+        sig { returns(T::Boolean) }
+        def poetry?
+          !poetry_root.nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def pep621?
+          project = section(@data, "project", "project")
+          build_system = section(@data, "build-system", "build-system")
+
+          !project&.[]("dependencies").nil? ||
+            !project&.[]("optional-dependencies").nil? ||
+            !build_system&.[]("requires").nil?
+        end
+
+        sig { returns(T::Boolean) }
+        def pep735?
+          @data.key?("dependency-groups")
+        end
+
+        sig { params(type: String).returns(PoetryDependencyMap) }
+        def poetry_dependencies(type)
+          root = poetry_root
+          return {} unless root
+
+          value = root[type]
+          return {} if value.nil?
+
+          PyprojectValueParser.poetry_dependency_map(value, "tool.poetry.#{type}")
+        end
+
+        sig { returns(T::Hash[String, PoetryDependencyMap]) }
+        def poetry_groups
+          root = poetry_root
+          return {} unless root
+
+          raw_groups = root["group"]
+          return {} if raw_groups.nil?
+
+          parsed_groups = PyprojectValueParser.object_hash(raw_groups, "tool.poetry.group")
+          parsed_groups.each_with_object({}) do |(name, value), groups|
+            group = PyprojectValueParser.object_hash(value, "tool.poetry.group.#{name}")
+            dependencies = group["dependencies"]
+            next if dependencies.nil?
+
+            groups[name] = PyprojectValueParser.poetry_dependency_map(
+              dependencies,
+              "tool.poetry.group.#{name}.dependencies"
+            )
+          end
+        end
+
+        sig { returns(T::Array[String]) }
+        def dynamic_fields
+          project = section(@data, "project", "project")
+          value = project&.[]("dynamic")
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "project.dynamic")
+        end
+
+        sig { params(name: String).returns(T::Boolean) }
+        def optional_dependency_group?(name)
+          project = section(@data, "project", "project")
+          value = project&.[]("optional-dependencies")
+          return false if value.nil?
+
+          PyprojectValueParser.object_hash(value, "project.optional-dependencies").key?(name)
+        end
+
+        sig { params(name: String).returns(T.nilable(PoetrySource)) }
+        def poetry_source(name)
+          poetry_sources.find { |source| source.name == name }
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          tool = section(@data, "tool", "tool")
+          uv = tool && section(tool, "uv", "tool.uv")
+          workspace = uv && section(uv, "workspace", "tool.uv.workspace")
+          value = workspace&.[](key)
+          return [] if value.nil?
+
+          PyprojectValueParser.string_array(value, "tool.uv.workspace.#{key}")
+        end
+
+        private
+
+        sig { returns(T.nilable(PyprojectValueParser::ObjectHash)) }
+        def poetry_root
+          tool = section(@data, "tool", "tool")
+          tool && section(tool, "poetry", "tool.poetry")
+        end
+
+        sig { returns(T::Array[PoetrySource]) }
+        def poetry_sources
+          root = poetry_root
+          return [] unless root
+
+          value = root["source"]
+          return [] if value.nil?
+
+          PyprojectValueParser.array(value, "tool.poetry.source").map do |source|
+            source = PyprojectValueParser.object_hash(source, "tool.poetry.source entry")
+            PoetrySource.new(
+              name: PyprojectValueParser.string(source["name"], "Poetry source name"),
+              url: PyprojectValueParser.optional_string(source["url"], "Poetry source url")
+            )
+          end
+        end
+
+        sig do
+          params(
+            hash: PyprojectValueParser::ObjectHash,
+            key: String,
+            context: String
+          ).returns(T.nilable(PyprojectValueParser::ObjectHash))
+        end
+        def section(hash, key, context)
+          value = hash[key]
+          return if value.nil?
+
+          PyprojectValueParser.object_hash(value, context)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_parser/pyproject_files_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -25,7 +25,8 @@ module Dependabot
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
-          @dynamic_fields = T.let(nil, T.nilable(T::Array[String]))
+          @pyproject_document = T.let(nil, T.nilable(PyprojectDocument))
+          @poetry_lock_document = T.let(nil, T.nilable(PoetryLock))
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -63,16 +64,11 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           POETRY_DEPENDENCY_TYPES.each do |type|
-            deps_hash = T.must(poetry_root)[type] || {}
-            dependencies += parse_poetry_dependency_group(type, deps_hash)
+            dependencies += parse_poetry_dependency_group(type, pyproject_document.poetry_dependencies(type))
           end
 
-          groups = T.must(poetry_root)["group"] || {}
-          groups.each do |group, group_spec|
-            deps = group_spec["dependencies"]
-            next unless deps
-
-            dependencies += parse_poetry_dependency_group(group, deps)
+          pyproject_document.poetry_groups.each do |group, dependencies_by_name|
+            dependencies += parse_poetry_dependency_group(group, dependencies_by_name)
           end
           dependencies
         end
@@ -92,17 +88,17 @@ module Dependabot
 
             dependencies <<
               Dependency.new(
-                name: normalise(dep["name"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
+                name: normalise(dep.name),
+                version: dep.version&.include?("*") ? nil : dep.version,
                 requirements: [{
-                  requirement: dep["requirement"],
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
+                  requirement: dep.requirement,
+                  file: Pathname.new(dep.file).cleanpath.to_path,
                   source: nil,
-                  groups: [dep["requirement_type"]].compact
+                  groups: [dep.requirement_type].compact
                 }],
                 package_manager: "pip",
-                metadata: extras_metadata(dep["extras"]).merge(
-                  source_requirement: dep["source_requirement"]
+                metadata: extras_metadata(dep.extras).merge(
+                  source_requirement: dep.source_requirement
                 ).compact
               )
           end
@@ -113,17 +109,16 @@ module Dependabot
         sig do
           params(
             type: String,
-            deps_hash: T.nilable(T::Hash[String, T.untyped])
+            deps_hash: PyprojectDocument::PoetryDependencyMap
           ).returns(Dependabot::FileParsers::Base::DependencySet)
         end
         def parse_poetry_dependency_group(type, deps_hash)
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
-          return dependencies if deps_hash.nil?
 
-          deps_hash.each do |name, req|
+          deps_hash.each do |name, requirements_data|
             next if normalise(name) == "python"
 
-            requirements = parse_requirements_from(req, type)
+            requirements = parse_requirements_from(requirements_data, type)
             next if requirements.empty?
 
             dependencies << Dependency.new(
@@ -151,102 +146,108 @@ module Dependabot
           { extras: extras.join(",") }
         end
 
-        # @param req can be an Array, Hash or String that represents the constraints for a dependency
-        sig { params(req: T.untyped, type: String).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
-        # rubocop:disable Metrics/PerceivedComplexity
-        def parse_requirements_from(req, type)
-          [req].flatten.compact.filter_map do |requirement|
-            # Skip unsupported dependency types (path, url), but allow git
-            next if requirement.is_a?(Hash) && UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
-            # Skip git dependencies without tags (e.g., with branch, rev)
-            next if requirement.is_a?(Hash) && requirement["git"] && !requirement["tag"]
-
-            # Handle git dependencies with tags
-            if requirement.is_a?(Hash) && requirement["git"] && requirement["tag"]
-              {
-                requirement: nil,
-                file: T.must(pyproject).name,
-                source: {
-                  type: "git",
-                  url: requirement["git"],
-                  ref: requirement["tag"],
-                  branch: nil
-                },
-                groups: [type]
-              }
-            elsif requirement.is_a?(String)
-              check_requirements(requirement)
-              {
-                requirement: requirement,
-                file: T.must(pyproject).name,
-                source: nil,
-                groups: [type]
-              }
-            else
-              check_requirements(requirement)
-              # String sources are registry name references (e.g., "custom") that reference
-              # [[tool.poetry.source]] definitions. Resolve them to proper hashes.
-              source_value = requirement.fetch("source", nil)
-              source = resolve_source(source_value)
-              {
-                requirement: requirement["version"],
-                file: T.must(pyproject).name,
-                source: source,
-                groups: [type]
-              }
-            end
+        sig do
+          params(
+            requirements_data: T::Array[PyprojectDocument::PoetryRequirement],
+            type: String
+          ).returns(T::Array[Dependabot::Dependency::RequirementInput])
+        end
+        def parse_requirements_from(requirements_data, type)
+          requirements_data.filter_map { |requirement| poetry_requirement(requirement, type) }
+        end
+
+        sig do
+          params(
+            requirement: PyprojectDocument::PoetryRequirement,
+            type: String
+          ).returns(T.nilable(Dependabot::Dependency::RequirementInput))
+        end
+        def poetry_requirement(requirement, type)
+          if requirement.is_a?(String)
+            check_requirements(requirement)
+            return {
+              requirement: requirement,
+              file: T.must(pyproject).name,
+              source: nil,
+              groups: [type]
+            }
           end
+
+          return if UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
+
+          git = requirement_string(requirement, "git")
+          tag = requirement_string(requirement, "tag")
+          return if git && !tag
+
+          return git_requirement(git, tag, type) if git && tag
+
+          check_requirements(requirement)
+          {
+            requirement: requirement_string(requirement, "version"),
+            file: T.must(pyproject).name,
+            source: resolve_source(requirement["source"]),
+            groups: [type]
+          }
+        end
+
+        sig { params(git: String, tag: String, type: String).returns(Dependabot::Dependency::RequirementInput) }
+        def git_requirement(git, tag, type)
+          {
+            requirement: nil,
+            file: T.must(pyproject).name,
+            source: {
+              type: "git",
+              url: git,
+              ref: tag,
+              branch: nil
+            },
+            groups: [type]
+          }
         end
-        # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { returns(T.nilable(T::Boolean)) }
+        sig { returns(T::Boolean) }
         def using_poetry?
-          !poetry_root.nil?
+          pyproject_document.poetry?
         end
 
         sig { returns(T::Boolean) }
         def using_pep621?
-          !parsed_pyproject.dig("project", "dependencies").nil? ||
-            !parsed_pyproject.dig("project", "optional-dependencies").nil? ||
-            !parsed_pyproject.dig("build-system", "requires").nil?
+          pyproject_document.pep621?
         end
 
         sig { returns(T::Boolean) }
         def using_pep735?
-          parsed_pyproject.key?("dependency-groups")
-        end
-
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-        def poetry_root
-          parsed_pyproject.dig("tool", "poetry")
+          pyproject_document.pep735?
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Boolean) }
         def using_pdm?
-          using_pep621? && pdm_lock
+          using_pep621? && !pdm_lock.nil?
         end
 
         sig { returns(T::Array[String]) }
         def dynamic_fields
-          @dynamic_fields ||= parsed_pyproject.dig("project", "dynamic") || []
+          pyproject_document.dynamic_fields
         end
 
-        sig { params(dep: T::Hash[String, T.untyped]).returns(T::Boolean) }
+        sig { params(dep: PepDependency).returns(T::Boolean) }
         def skip_pep621_dep?(dep)
           # If a requirement has a `<` or `<=` marker then updating it is
           # probably blocked. Ignore it.
-          return true if dep["markers"]&.include?("<")
+          return true if dep.markers&.include?("<")
 
           # If no requirement, don't add it
-          return true if dep["requirement"].empty?
+          requirement = dep.requirement
+          raise TypeError, "Python PEP dependency requirement must be a string" unless requirement
+          return true if requirement.empty?
 
           # Skip build-system.requires dependencies when using Poetry
           # Poetry manages its own build system dependencies
-          return true if using_poetry? && dep["requirement_type"] == "build-system.requires"
+          return true if using_poetry? && dep.requirement_type == "build-system.requires"
 
           # When dependencies or optional-dependencies are listed in project.dynamic,
           # they are managed by the build backend (e.g. Poetry) — skip the PEP 621 path
-          dynamic_pep621_dep?(dep["requirement_type"])
+          dynamic_pep621_dep?(dep.requirement_type)
         end
 
         sig { params(requirement_type: T.nilable(String)).returns(T::Boolean) }
@@ -256,7 +257,7 @@ module Dependabot
 
           if requirement_type == "dependencies"
             dynamic_fields.include?("dependencies")
-          elsif parsed_pyproject.dig("project", "optional-dependencies")&.key?(requirement_type)
+          elsif pyproject_document.optional_dependency_group?(requirement_type)
             dynamic_fields.include?("optional-dependencies")
           else
             false
@@ -271,15 +272,15 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           source_types = %w(directory git url)
-          parsed_lockfile.fetch("package", []).each do |details|
-            next if source_types.include?(details.dig("source", "type"))
+          poetry_lock_document.packages.each do |package|
+            next if source_types.include?(package.source_type)
 
-            name = normalise(details.fetch("name"))
+            name = normalise(package.name)
 
             dependencies <<
               Dependency.new(
                 name: name,
-                version: details.fetch("version"),
+                version: package.version,
                 requirements: [],
                 package_manager: "pip",
                 subdependency_metadata: [{
@@ -302,8 +303,10 @@ module Dependabot
         sig { returns(T::Array[T.nilable(String)]) }
         def parse_production_dependency_names
           SharedHelpers.in_a_temporary_directory do
-            File.write(T.must(pyproject).name, T.must(pyproject).content)
-            File.write(lockfile.name, lockfile.content)
+            pyproject_file = T.must(pyproject)
+            lockfile_file = T.must(lockfile)
+            File.write(pyproject_file.name, pyproject_file.content)
+            File.write(lockfile_file.name, lockfile_file.content)
 
             begin
               output = SharedHelpers.run_shell_command("pyenv exec poetry show --only main")
@@ -322,18 +325,19 @@ module Dependabot
           end
         end
 
-        sig { params(dep_name: String).returns(T.untyped) }
+        sig { params(dep_name: String).returns(T.nilable(String)) }
         def version_from_lockfile(dep_name)
-          return unless parsed_lockfile
+          return unless poetry_lock
 
-          parsed_lockfile.fetch("package", [])
-                         .find { |p| normalise(p.fetch("name")) == normalise(dep_name) }
-                         &.fetch("version", nil)
+          poetry_lock_document.version_for(dep_name) { |name| normalise(name) }
         end
 
-        sig { params(req: T.untyped).returns(T::Array[Dependabot::Python::Requirement]) }
+        sig do
+          params(req: PyprojectDocument::PoetryRequirement)
+            .returns(T::Array[Dependabot::Python::Requirement])
+        end
         def check_requirements(req)
-          requirement = req.is_a?(String) ? req : req["version"]
+          requirement = req.is_a?(String) ? req : requirement_string(req, "version")
           Python::Requirement.requirements_array(requirement)
         rescue Gem::Requirement::BadRequirementError => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message
@@ -344,21 +348,23 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        sig { params(source_value: T.untyped).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig do
+          params(source_value: T.nilable(Object))
+            .returns(T.nilable(Dependabot::DependencyRequirement::Source))
+        end
         def resolve_source(source_value)
           # Return nil if no source specified
           return nil if source_value.nil?
 
           # If already a hash, return as-is (handles git sources)
-          return source_value if source_value.is_a?(Hash)
+          return PyprojectValueParser.object_hash(source_value, "Poetry dependency source") if source_value.is_a?(Hash)
 
           # String sources are references to [[tool.poetry.source]] definitions
           # Look up the source definition and create a hash
           return nil unless source_value.is_a?(String)
 
           source_name = source_value
-          poetry_sources = parsed_pyproject.dig("tool", "poetry", "source") || []
-          source_def = poetry_sources.find { |s| s["name"] == source_name }
+          source_def = pyproject_document.poetry_source(source_name)
 
           # If source definition not found, return nil
           return nil unless source_def
@@ -367,26 +373,19 @@ module Dependabot
           # Use "registry" as the type since these are package index sources
           {
             type: "registry",
-            url: source_def["url"],
+            url: source_def.url,
             name: source_name
           }
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pyproject
-          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.nilable(T::Hash[String, T.untyped]))
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
+        sig { returns(PyprojectDocument) }
+        def pyproject_document
+          @pyproject_document ||= PyprojectDocument.from_file(T.must(pyproject))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_poetry_lock
-          @parsed_poetry_lock ||= T.let(
-            TomlRB.parse(T.must(poetry_lock).content),
-            T.nilable(T::Hash[String, T.untyped])
-          )
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(poetry_lock).path
+        sig { returns(PoetryLock) }
+        def poetry_lock_document
+          @poetry_lock_document ||= PoetryLock.from_file(T.must(poetry_lock))
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -397,20 +396,22 @@ module Dependabot
           )
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           poetry_lock
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Array[PepDependency]) }
         def parse_pep621_pep735_dependencies
           SharedHelpers.in_a_temporary_directory do
             write_temporary_pyproject
 
-            SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_pep621_pep735_dependencies",
-              args: [T.must(pyproject).name]
+            PepDependency.from_helper_result(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "parse_pep621_pep735_dependencies",
+                args: [T.must(pyproject).name]
+              )
             )
           end
         end
@@ -422,11 +423,6 @@ module Dependabot
           File.write(path, T.must(pyproject).content)
         end
 
-        sig { returns(T.untyped) }
-        def parsed_lockfile
-          parsed_poetry_lock if poetry_lock
-        end
-
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def poetry_lock
           @poetry_lock ||= T.let(
@@ -435,6 +431,16 @@ module Dependabot
           )
         end
 
+        sig do
+          params(
+            requirement: PyprojectValueParser::ObjectHash,
+            key: String
+          ).returns(T.nilable(String))
+        end
+        def requirement_string(requirement, key)
+          PyprojectValueParser.optional_string(requirement[key], "Poetry dependency #{key}")
+        end
+
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pdm_lock
           @pdm_lock ||= T.let(

data/lib/dependabot/python/file_parser.rb

@@ -21,6 +21,9 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
+      require_relative "file_parser/pyproject_document"
+      require_relative "file_parser/poetry_lock"
+      require_relative "file_parser/pep_dependency"
       require_relative "file_parser/pipfile_files_parser"
       require_relative "file_parser/pyproject_files_parser"
       require_relative "file_parser/setup_file_parser"

data/lib/dependabot/python/package/package_details_fetcher.rb

@@ -12,6 +12,7 @@ require "dependabot/python/name_normaliser"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
 require "dependabot/python/package/package_registry_finder"
+require "dependabot/python/package/simple_api_parser"
 
 # Stores metadata for a package, including all its available versions
 module Dependabot
@@ -21,6 +22,7 @@ module Dependabot
       CREDENTIALS_PASSWORD = "password"
 
       APPLICATION_JSON = "application/json"
+      APPLICATION_PYPI_SIMPLE_JSON = "application/vnd.pypi.simple.v1+json"
       APPLICATION_TEXT = "text/html"
       CPYTHON = "cpython"
       PYTHON = "python"
@@ -42,11 +44,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential]
           ).void
         end
-        def initialize(
-          dependency:,
-          dependency_files:,
-          credentials:
-        )
+        def initialize(dependency:, dependency_files:, credentials:)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
@@ -70,7 +68,7 @@ module Dependabot
                              .flat_map do |index_url|
             fetch_from_registry(index_url) || [] # Ensure it always returns an array
           rescue Excon::Error::Timeout, Excon::Error::Socket
-            raise if MAIN_PYPI_INDEXES.include?(index_url)
+            raise if main_pypi_index?(index_url)
 
             raise PrivateSourceTimedOut, sanitized_url(index_url)
           rescue URI::InvalidURIError
@@ -90,15 +88,46 @@ module Dependabot
             .returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
         def fetch_from_registry(index_url)
-          metadata = fetch_from_json_registry(index_url)
+          return fetch_from_simple_registry(index_url) unless main_pypi_index?(index_url)
 
-          return metadata if metadata&.any?
+          begin
+            metadata = fetch_from_json_registry(index_url)
+
+            return metadata if metadata&.any?
 
-          Dependabot.logger.warn("No valid versions found via JSON API. Falling back to HTML.")
-          fetch_from_html_registry(index_url)
-        rescue StandardError => e
-          Dependabot.logger.warn("Unexpected error in JSON fetch: #{e.message}. Falling back to HTML.")
-          fetch_from_html_registry(index_url)
+            Dependabot.logger.warn("No valid versions found via JSON API. Falling back to HTML.")
+            fetch_from_html_registry(index_url)
+          rescue Dependabot::DependencyFileNotResolvable
+            raise
+          rescue StandardError => e
+            Dependabot.logger.warn("Unexpected error in JSON fetch: #{e.message}. Falling back to HTML.")
+            fetch_from_html_registry(index_url)
+          end
+        end
+
+        sig { params(index_url: String).returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def fetch_from_simple_registry(index_url)
+          Dependabot.logger.info(
+            "Fetching release information from simple registry at #{sanitized_url(index_url)} for #{dependency.name}"
+          )
+          response = registry_response_for_dependency(index_url, accept: simple_api_accept)
+          project_url = response.path ? Excon::Utils.request_uri(response.data) : index_url + normalised_name + "/"
+          check_authentication_response(response, index_url)
+
+          version_releases = if simple_json_response?(response)
+                               SimpleApiParser.new(
+                                 dependency: dependency,
+                                 project_url: project_url
+                               ).parse(response.body)
+                             else
+                               extract_release_details_json_from_html(response.body)
+                             end
+
+          format_version_releases(version_releases, preserve_distributions: simple_json_response?(response))
+            .sort_by(&:version).reverse
+        rescue JSON::ParserError
+          Dependabot.logger.warn("JSON parsing error for #{sanitized_url(index_url)}.")
+          []
         end
 
         # Example JSON Response Format:
@@ -203,14 +232,8 @@ module Dependabot
           Dependabot.logger.info(
             "Fetching release information from html registry at #{sanitized_url(index_url)} for #{dependency.name}"
           )
-          index_response = registry_response_for_dependency(index_url)
-          if index_response.status == 401 || index_response.status == 403
-            registry_index_response = registry_index_response(index_url)
-
-            if registry_index_response.status == 401 || registry_index_response.status == 403
-              raise PrivateSourceAuthenticationFailure, sanitized_url(index_url)
-            end
-          end
+          index_response = registry_response_for_dependency(index_url, accept: APPLICATION_TEXT)
+          check_authentication_response(index_response, index_url)
 
           version_releases = extract_release_details_json_from_html(index_response.body)
           releases = format_version_releases(version_releases)
@@ -218,6 +241,27 @@ module Dependabot
           releases.sort_by(&:version).reverse
         end
 
+        sig { params(response: Excon::Response).returns(T::Boolean) }
+        def simple_json_response?(response)
+          response.headers["Content-Type"].to_s.split(";", 2).first.to_s.strip.downcase == APPLICATION_PYPI_SIMPLE_JSON
+        end
+
+        sig { returns(String) }
+        def simple_api_accept
+          "application/vnd.pypi.simple.v1+json, " \
+            "application/vnd.pypi.simple.v1+html;q=0.2, text/html;q=0.01"
+        end
+
+        sig { params(response: Excon::Response, index_url: String).void }
+        def check_authentication_response(response, index_url)
+          return unless [401, 403].include?(response.status)
+
+          index_response = registry_index_response(index_url)
+          return unless [401, 403].include?(index_response.status)
+
+          raise PrivateSourceAuthenticationFailure, sanitized_url(index_url)
+        end
+
         sig do
           params(html_body: String)
             .returns(T::Hash[String, T::Array[T::Hash[String, T.untyped]]]) # Returns JSON-like format
@@ -266,23 +310,17 @@ module Dependabot
 
         sig do
           params(
-            releases_json: T.nilable(T::Hash[String, T::Array[T::Hash[String, T.untyped]]])
+            releases_json: T.nilable(T::Hash[String, T::Array[T::Hash[String, T.untyped]]]),
+            preserve_distributions: T::Boolean
           )
             .returns(T::Array[Dependabot::Package::PackageRelease])
         end
-        def format_version_releases(releases_json)
+        def format_version_releases(releases_json, preserve_distributions: false)
           return [] unless releases_json
 
           releases_json.each_with_object([]) do |(version, release_data_array), versions|
-            release_data = release_data_array.last
-
-            next unless release_data
-
-            release = format_version_release(version, release_data)
-
-            next unless release
-
-            versions << release
+            release_data_array = [release_data_array.last].compact unless preserve_distributions
+            versions.concat(release_data_array.filter_map { |data| format_version_release(version, data) })
           end
         end
 
@@ -397,11 +435,11 @@ module Dependabot
           )
         end
 
-        sig { params(index_url: String).returns(Excon::Response) }
-        def registry_response_for_dependency(index_url)
+        sig { params(index_url: String, accept: String).returns(Excon::Response) }
+        def registry_response_for_dependency(index_url, accept:)
           Dependabot::RegistryClient.get(
             url: index_url + normalised_name + "/",
-            headers: { "Accept" => APPLICATION_TEXT }
+            headers: { "Accept" => accept }
           )
         end
 
@@ -487,6 +525,14 @@ module Dependabot
           index_url.sub(%r{//([^/@]+)@}, "//redacted@")
         end
 
+        sig { params(index_url: String).returns(T::Boolean) }
+        def main_pypi_index?(index_url)
+          uri = URI.parse(index_url)
+          T.must(uri.scheme.to_s.casecmp("https")).zero? && uri.port == 443 &&
+            uri.path.to_s.split("/").reject(&:empty?) == ["simple"] &&
+            %w(pypi.org pypi.python.org).include?(uri.host.to_s.downcase)
+        end
+
         sig { params(dep_name: String).returns(String) }
         def remove_optional(dep_name)
           # Remove any optional dependencies postfix, e.g., "pyvista[io] "

data/lib/dependabot/python/package/package_registry_finder.rb

@@ -193,7 +193,7 @@ module Dependabot
 
         sig { params(url: String).returns(String) }
         def clean_check_and_remove_environment_variables(url)
-          url = url.strip.sub(%r{/+$}, "") + "/"
+          url = with_single_trailing_slash(url.strip)
 
           return authed_base_url(url) unless url.match?(ENVIRONMENT_VARIABLE_REGEX)
 
@@ -203,7 +203,7 @@ module Dependabot
               *config_variable_index_urls[:extra]
             ]
             .compact
-            .map { |u| u.strip.gsub(%r{/*$}, "") + "/" }
+            .map { |u| with_single_trailing_slash(u.strip) }
 
           regexp = url
                    .sub(%r{(?<=://).+@}, "")
@@ -226,7 +226,7 @@ module Dependabot
           cred = credential_for(base_url)
           return base_url unless cred
 
-          AuthedUrlBuilder.authed_url(credential: cred).gsub(%r{/*$}, "") + "/"
+          with_single_trailing_slash(AuthedUrlBuilder.authed_url(credential: cred))
         end
 
         sig { params(url: String).returns(T.nilable(Dependabot::Credential)) }
@@ -234,11 +234,18 @@ module Dependabot
           credentials
             .select { |c| c["type"] == "python_index" }
             .find do |c|
-              cred_url = c.fetch("index-url").gsub(%r{/*$}, "") + "/"
+              cred_url = with_single_trailing_slash(c.fetch("index-url"))
               cred_url.include?(url)
             end
         end
 
+        sig { params(url: String).returns(String) }
+        def with_single_trailing_slash(url)
+          normalized_url = url.dup
+          normalized_url.chop! while normalized_url.end_with?("/")
+          normalized_url + "/"
+        end
+
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pip_conf
           dependency_files.find { |f| f.name == "pip.conf" }

data/lib/dependabot/python/package/simple_api_parser.rb

@@ -0,0 +1,91 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+require "sorbet-runtime"
+require "dependabot/errors"
+require "dependabot/python/name_normaliser"
+
+module Dependabot
+  module Python
+    module Package
+      class SimpleApiParser
+        extend T::Sig
+
+        ReleaseDetail = T.type_alias { T::Hash[String, T.nilable(T.any(String, T::Boolean))] }
+
+        sig { params(dependency: Dependabot::Dependency, project_url: String).void }
+        def initialize(dependency:, project_url:)
+          @dependency = dependency
+          @project_url = project_url
+        end
+
+        sig do
+          params(json_body: String)
+            .returns(T::Hash[String, T::Array[ReleaseDetail]])
+        end
+        def parse(json_body)
+          data = JSON.parse(json_body)
+          validate_api_version!(data.dig("meta", "api-version").to_s)
+
+          data.fetch("files", []).each_with_object({}) do |file, releases|
+            filename = file["filename"]
+            next unless filename&.match?(name_regex)
+
+            version = version_from_filename(filename)
+            next unless dependency.version_class.correct?(version)
+
+            yanked = file["yanked"] || false
+            details = {
+              "version" => version,
+              "requires_python" => file["requires-python"],
+              "yanked" => yanked != false,
+              "yanked_reason" => yanked.is_a?(String) ? yanked : nil,
+              "upload_time" => file["upload-time"],
+              "url" => resolve_url(file["url"])
+            }
+            releases[version] ||= []
+            releases[version] << details
+          end
+        end
+
+        private
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(String) }
+        attr_reader :project_url
+
+        sig { params(url: T.nilable(String)).returns(T.nilable(String)) }
+        def resolve_url(url)
+          return unless url
+
+          resolved_url = URI.join(project_url, url)
+          resolved_url.user = nil
+          resolved_url.password = nil
+          resolved_url.to_s
+        end
+
+        sig { params(api_version: String).void }
+        def validate_api_version!(api_version)
+          return unless api_version.split(".").first.to_i > 1
+
+          raise Dependabot::DependencyFileNotResolvable, "Unsupported PEP 691 API version: #{api_version}"
+        end
+
+        sig { returns(Regexp) }
+        def name_regex
+          parts = NameNormaliser.normalise(dependency.name).split(/[\s_.-]/).map { |name| Regexp.quote(name) }
+          /#{parts.join("[\s_.-]")}/i
+        end
+
+        sig { params(filename: String).returns(T.nilable(String)) }
+        def version_from_filename(filename)
+          filename.strip.gsub(/#{name_regex}-/i, "").split(/-|\.tar\.|\.zip|\.whl/).first
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/python/shared_file_fetcher.rb

@@ -249,8 +249,7 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
-          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+          if !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
             raise Dependabot::DependencyFileNotEvaluatable,
                   "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
                   "Please either remove the reference from '#{file.name}' " \

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -42,6 +42,22 @@ module Dependabot
             cooldown.semver_minor_days.to_i.positive? ||
             cooldown.semver_patch_days.to_i.positive?
         end
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+        def eligible_releases(language_version: nil)
+          releases = available_versions
+          return unless releases
+
+          releases = filter_yanked_versions(releases)
+          releases = filter_by_cooldown(releases)
+          releases = filter_unsupported_versions(releases, language_version)
+          releases = filter_prerelease_versions(releases)
+          releases = filter_ignored_versions(releases)
+          apply_post_fetch_latest_versions_filter(releases)
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -280,7 +280,10 @@ files:
 - lib/dependabot/python/dependency_grapher/requirements_layers.rb
 - lib/dependabot/python/file_fetcher.rb
 - lib/dependabot/python/file_parser.rb
+- lib/dependabot/python/file_parser/pep_dependency.rb
 - lib/dependabot/python/file_parser/pipfile_files_parser.rb
+- lib/dependabot/python/file_parser/poetry_lock.rb
+- lib/dependabot/python/file_parser/pyproject_document.rb
 - lib/dependabot/python/file_parser/pyproject_files_parser.rb
 - lib/dependabot/python/file_parser/python_requirement_parser.rb
 - lib/dependabot/python/file_parser/setup_file_parser.rb
@@ -302,6 +305,7 @@ files:
 - lib/dependabot/python/native_helpers.rb
 - lib/dependabot/python/package/package_details_fetcher.rb
 - lib/dependabot/python/package/package_registry_finder.rb
+- lib/dependabot/python/package/simple_api_parser.rb
 - lib/dependabot/python/package_manager.rb
 - lib/dependabot/python/pip_compile_file_matcher.rb
 - lib/dependabot/python/pipenv_runner.rb
@@ -323,7 +327,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib