dependabot-python 0.98.18 → 0.98.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c61ae5290c443c45d469488041fc80248b6884352ad68974243936971019b9b
-  data.tar.gz: eb7cadd14ccbeda8fccbb434243ec08b6d214ad4c571621921d008c4915abda2
+  metadata.gz: f440844cfa09bb25c9d674290a4da8bbbadb4be1c83c3ed140047a6063eea533
+  data.tar.gz: 0e8c5b8173b67f5ea300a7dec1f8a1e4515498f71d985906b2bef44426c4ef36
 SHA512:
-  metadata.gz: ac4a20e6de1684ac451dc196626d1c84b4a93bb69d61da2ba7b5ade0083db2900223c57daa1331c612fbc53720d8f808bd193c5bb9abaa65ac8a6ed51cabcd3f
-  data.tar.gz: e5f4079c7a142199e56e47a5257de57bf0fefd80f5609b4654dd87775e4d95a7daee894d6874e519b6d26ac6e45698d36ea24e98cb6c3d6fdd7c90d7eed8ce7a
+  metadata.gz: 8961fa161070ff3d79c7a7e61588c2b73681c80aee91b1bd4fd16c5041068a3699b1f6114b5c311af2d296334d0aa3cd8b169559c57e1649e739de5413f7a82a
+  data.tar.gz: e8e8d69945370638ecd79d0e9acb552b8970fcd926d1b0e37c46ed2b618e975d0f6ef7de03660187bc4acb61426f1ed03116f6e9e5e727ed5967f06d6d8adc53

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -57,6 +57,8 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/MethodLength
+        # rubocop:disable Metrics/BlockLength
+        # rubocop:disable Metrics/AbcSize
         def compile_new_requirement_files
           SharedHelpers.in_a_temporary_directory do
             write_updated_dependency_files
@@ -80,6 +82,8 @@ module Dependabot
                 ["pyenv", "exec", "pip-compile", *pip_compile_options(filename),
                  filename].reject(&:empty?)
               )
+
+              unredact_git_credentials_in_compiled_file(filename)
             end
 
             # Remove any .python-version file before parsing the reqs
@@ -99,6 +103,8 @@ module Dependabot
           end
         end
         # rubocop:enable Metrics/MethodLength
+        # rubocop:enable Metrics/BlockLength
+        # rubocop:enable Metrics/AbcSize
 
         def update_manifest_files
           dependency_files.map do |file|
@@ -322,6 +328,40 @@ module Dependabot
           content
         end
 
+        # Pip redacts git credentials in the compiled pip-tools file. We don't
+        # want that, as it makes the compiled files unusable. (This is kind of
+        # a pip-tools bug.)
+        def unredact_git_credentials_in_compiled_file(filename)
+          compiled_name = filename.gsub(/\.in$/, ".txt")
+          original_content = dependency_files.
+                             find { |f| f.name == compiled_name }.
+                             content
+
+          updated_content = File.read(compiled_name)
+          new_content = updated_content
+
+          update_count = 0
+          original_content.lines.each do |original_line|
+            next unless original_line.match?(/^(-e )?git+/)
+            next unless original_line.match?(%r{(?<=:)[^/].*?(?=@)})
+            next update_count += 1 if updated_content.include?(original_line)
+
+            line_to_update =
+              updated_content.lines.
+              select { |l| l.match?(/^(-e )?git+/) && l.include?(":****@") }.
+              at(update_count)
+            raise "Mismatch in editable requirements!" unless line_to_update
+
+            auth = original_line.match(%r{(?<=:)[^/].*?(?=@)}).to_s
+            new_content =
+              new_content.
+              gsub(line_to_update, line_to_update.gsub(":****@", ":#{auth}@"))
+            update_count += 1
+          end
+
+          File.write(compiled_name, new_content)
+        end
+
         def update_hashes_if_required(updated_content, original_content)
           deps_to_update =
             deps_to_augment_hashes_for(updated_content, original_content)

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -155,8 +155,6 @@ module Dependabot
 
             if python_version && !pre_installed_python?(python_version)
               run_poetry_command(["pyenv", "install", "-s", python_version])
-              run_poetry_command(["pyenv", "exec", "pip", "install",
-                                  "--upgrade", "pip"])
               run_poetry_command(["pyenv", "exec", "pip", "install", "-r",
                                   NativeHelpers.python_requirements_path])
             end

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -68,6 +68,8 @@ module Dependabot
                     ["pyenv", "exec", "pip-compile", "--allow-unsafe",
                      "--build-isolation", filename]
                   )
+
+                  unredact_git_credentials_in_compiled_file(filename)
                 end
 
                 # Remove any .python-version file before parsing the reqs
@@ -115,6 +117,40 @@ module Dependabot
           raise
         end
 
+        # Pip redacts git credentials in the compiled pip-tools file. We don't
+        # want that, as it makes the compiled files unusable. (This is kind of
+        # a pip-tools bug.)
+        def unredact_git_credentials_in_compiled_file(filename)
+          compiled_name = filename.gsub(/\.in$/, ".txt")
+          original_content = dependency_files.
+                             find { |f| f.name == compiled_name }.
+                             content
+
+          updated_content = File.read(compiled_name)
+          new_content = updated_content
+
+          update_count = 0
+          original_content.lines.each do |original_line|
+            next unless original_line.match?(/^(-e )?git+/)
+            next unless original_line.match?(%r{(?<=:)[^/].*?(?=@)})
+            next update_count += 1 if updated_content.include?(original_line)
+
+            line_to_update =
+              updated_content.lines.
+              select { |l| l.match?(/^(-e )?git+/) && l.include?(":****@") }.
+              at(update_count)
+            raise "Mismatch in editable requirements!" unless line_to_update
+
+            auth = original_line.match(%r{(?<=:)[^/].*?(?=@)}).to_s
+            new_content =
+              new_content.
+              gsub(line_to_update, line_to_update.gsub(":****@", ":#{auth}@"))
+            update_count += 1
+          end
+
+          File.write(compiled_name, new_content)
+        end
+
         # Needed because pip-compile's resolver isn't perfect.
         # Note: We raise errors from this method, rather than returning a
         # boolean, so that all deps for this repo will raise identical

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.98.18
+  version: 0.98.19
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.18
+        version: 0.98.19
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.18
+        version: 0.98.19
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement