dependabot-python 0.98.20 → 0.98.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f82010c9278c24bfcfa894e2eb3c95c030b68bcdd844eaf5edd0b3e39a4349b6
-  data.tar.gz: 64a9ee89068002ded0cd6182386058bf3cf31044296f7a80012be58c1112b134
+  metadata.gz: 13e1990a53a8a437ac23ce95e0d59f3400a209da64ab5f82d6f2a432e620d721
+  data.tar.gz: 6284e7cb3cd180d467cab29670eca9ac804079c9bdd717ecfec29e3ff7795a94
 SHA512:
-  metadata.gz: 18b5d0196e453fe5181381761b36a757c92bbf124ca90ad8e41dd6c3a7a418534162dcfcd8f5a4d7fdf8b1ca3aeeba9e306002831cf8822c8a55c4c8acea402e
-  data.tar.gz: 788d1b0684eff52abd1a7c7c92355e4bd4e30571440369ceb29f59617655eaae4f11f84a5c486b4d17ce1ceb05e0f729a5b3da857b508413ff037b93350dc359
+  metadata.gz: 3bf815b588d9380809c4d9655da94608215e58ca286c5682f956e44070db5df492efd13e0f88bf97c7c1388513518341a240d618952bbb253fe03c6e530a7fdf
+  data.tar.gz: acd750d8963927eebeb48e67acd3184d4607fb9dbc8ce2fab7402cfeee0953c3d748ef7c7e27a1adaa287fcd00835efd69b906cfd5463af1919681fc6676905b

data/lib/dependabot/python/file_parser.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "toml-rb"
-require "shellwords"
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
@@ -125,10 +124,8 @@ module Dependabot
         SharedHelpers.in_a_temporary_directory do
           write_temporary_dependency_files
 
-          command_parts = ["pyenv", "exec", "python",
-                           NativeHelpers.python_helper_path]
           requirements = SharedHelpers.run_helper_subprocess(
-            command: Shellwords.join(command_parts),
+            command: "pyenv exec python #{NativeHelpers.python_helper_path}",
             function: "parse_requirements",
             args: [Dir.pwd]
           )

data/lib/dependabot/python/file_parser/setup_file_parser.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "shellwords"
 require "dependabot/dependency"
 require "dependabot/errors"
 require "dependabot/file_parsers/base/dependency_set"
@@ -58,10 +57,8 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_temporary_dependency_files
 
-            command_parts = ["pyenv", "exec", "python",
-                             NativeHelpers.python_helper_path]
             requirements = SharedHelpers.run_helper_subprocess(
-              command: Shellwords.join(command_parts),
+              command: "pyenv exec python #{NativeHelpers.python_helper_path}",
               function: "parse_setup",
               args: [Dir.pwd]
             )
@@ -81,10 +78,8 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             write_sanitized_setup_file
 
-            command_parts = ["pyenv", "exec", "python",
-                             NativeHelpers.python_helper_path]
             requirements = SharedHelpers.run_helper_subprocess(
-              command: Shellwords.join(command_parts),
+              command: "pyenv exec python #{NativeHelpers.python_helper_path}",
               function: "parse_setup",
               args: [Dir.pwd]
             )

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "open3"
-require "shellwords"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_fetcher"
 require "dependabot/python/file_updater"
@@ -9,10 +8,10 @@ require "dependabot/shared_helpers"
 require "dependabot/python/native_helpers"
 require "dependabot/python/python_versions"
 
-# rubocop:disable Metrics/ClassLength
 module Dependabot
   module Python
     class FileUpdater
+      # rubocop:disable Metrics/ClassLength
       class PipCompileFileUpdater
         require_relative "requirement_replacer"
         require_relative "requirement_file_updater"
@@ -58,7 +57,6 @@ module Dependabot
 
         # rubocop:disable Metrics/MethodLength
         # rubocop:disable Metrics/BlockLength
-        # rubocop:disable Metrics/AbcSize
         def compile_new_requirement_files
           SharedHelpers.in_a_temporary_directory do
             write_updated_dependency_files
@@ -67,20 +65,21 @@ module Dependabot
             filenames_to_compile.each do |filename|
               # Shell out to pip-compile, generate a new set of requirements.
               # This is slow, as pip-compile needs to do installs.
-              cmd_dep_name = Shellwords.join([
-                "pyenv", "exec", "pip-compile",
-                *pip_compile_options(filename),
-                "-P", dependency.name
-              ].reject(&:empty?))
-              cmd_dep_version = Shellwords.join([dependency.version, filename])
+              name_part = "pyenv exec pip-compile "\
+                          "#{pip_compile_options(filename)} -P "\
+                          "#{dependency.name}"
+              version_part = "#{dependency.version} #{filename}"
               # Don't escape pyenv `dep-name==version` syntax
-              run_pip_compile_command(["#{cmd_dep_name}==#{cmd_dep_version}"],
-                                      escape: false)
+              run_pip_compile_command(
+                "#{SharedHelpers.escape_command(name_part)}=="\
+                "#{SharedHelpers.escape_command(version_part)}",
+                escape_command_str: false
+              )
               # Run pip-compile a second time, without an update argument, to
               # ensure it resets the right comments.
               run_pip_compile_command(
-                ["pyenv", "exec", "pip-compile", *pip_compile_options(filename),
-                 filename].reject(&:empty?)
+                "pyenv exec pip-compile #{pip_compile_options(filename)} "\
+                "#{filename}"
               )
 
               unredact_git_credentials_in_compiled_file(filename)
@@ -104,7 +103,6 @@ module Dependabot
         end
         # rubocop:enable Metrics/MethodLength
         # rubocop:enable Metrics/BlockLength
-        # rubocop:enable Metrics/AbcSize
 
         def update_manifest_files
           dependency_files.map do |file|
@@ -143,9 +141,9 @@ module Dependabot
           ).updated_dependency_files
         end
 
-        def run_command(cmd_parts, env: python_env, escape: true)
+        def run_command(cmd, env: python_env, escape_command_str: true)
           start = Time.now
-          command = escape ? Shellwords.join(cmd_parts) : cmd_parts.join(" ")
+          command = escape_command_str ? SharedHelpers.escape_command(cmd) : cmd
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
 
@@ -161,9 +159,9 @@ module Dependabot
           )
         end
 
-        def run_pip_compile_command(command_parts, escape: true)
-          run_command(["pyenv", "local", python_version])
-          run_command(command_parts, escape: escape)
+        def run_pip_compile_command(command, escape_command_str: true)
+          run_command("pyenv local #{python_version}")
+          run_command(command, escape_command_str: escape_command_str)
         rescue SharedHelpers::HelperSubprocessFailed => error
           original_error ||= error
           msg = error.message
@@ -229,13 +227,13 @@ module Dependabot
         end
 
         def install_required_python
-          if run_command(%w(pyenv versions)).include?("#{python_version}\n")
+          if run_command("pyenv versions").include?("#{python_version}\n")
             return
           end
 
-          run_command(["pyenv", "install", "-s", python_version])
-          run_command(["pyenv", "exec", "pip", "install", "-r",
-                       NativeHelpers.python_requirements_path])
+          run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install -r "\
+                      "#{NativeHelpers.python_requirements_path}")
         end
 
         def sanitized_setup_file_content(file)
@@ -414,10 +412,8 @@ module Dependabot
         end
 
         def package_hashes_for(name:, version:, algorithm:)
-          command_parts = ["pyenv", "exec", "python",
-                           NativeHelpers.python_helper_path]
           SharedHelpers.run_helper_subprocess(
-            command: Shellwords.join(command_parts),
+            command: "pyenv exec python #{NativeHelpers.python_helper_path}",
             function: "get_dependency_hash",
             args: [name, version, algorithm]
           ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }
@@ -468,7 +464,7 @@ module Dependabot
             options << "--no-header"
           end
 
-          options
+          options.join(" ")
         end
 
         def includes_unsafe_packages?(content)
@@ -562,7 +558,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_command("pyenv install --list")
         end
 
         def pre_installed_python?(version)
@@ -585,7 +581,7 @@ module Dependabot
           dependency_files.find { |f| f.name == ".python-version" }
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -2,16 +2,14 @@
 
 require "toml-rb"
 require "open3"
-require "shellwords"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_updater"
 require "dependabot/shared_helpers"
 require "dependabot/python/native_helpers"
-
-# rubocop:disable Metrics/ClassLength
 module Dependabot
   module Python
     class FileUpdater
+      # rubocop:disable Metrics/ClassLength
       class PipfileFileUpdater
         require_relative "pipfile_preparer"
         require_relative "setup_file_sanitizer"
@@ -191,11 +189,11 @@ module Dependabot
                 install_required_python
 
                 # Initialize a git repo to appease pip-tools
-                command = Shellwords.join(%w(git init))
+                command = SharedHelpers.escape_command("git init")
                 IO.popen(command, err: %i(child out)) if setup_files.any?
 
                 run_pipenv_command(
-                  %w(pyenv exec pipenv lock)
+                  "pyenv exec pipenv lock"
                 )
 
                 result = { lockfile: File.read("Pipfile.lock") }
@@ -232,19 +230,19 @@ module Dependabot
 
         def generate_updated_requirements_files
           req_content = run_pipenv_command(
-            ["pyenv", "exec", "pipenv", "lock", "-r"]
+            "pyenv exec pipenv lock -r"
           )
           File.write("req.txt", req_content)
 
           dev_req_content = run_pipenv_command(
-            ["pyenv", "exec", "pipenv", "lock", "-r", "-d"]
+            "pyenv exec pipenv lock -r -d"
           )
           File.write("dev-req.txt", dev_req_content)
         end
 
-        def run_command(command_parts, env: {})
+        def run_command(command, env: {})
           start = Time.now
-          command = Shellwords.join(command_parts)
+          command = SharedHelpers.escape_command(command)
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
 
@@ -262,9 +260,9 @@ module Dependabot
           )
         end
 
-        def run_pipenv_command(command_parts, env: pipenv_env_variables)
-          run_command(["pyenv", "local", python_version])
-          run_command(command_parts, env: env)
+        def run_pipenv_command(command, env: pipenv_env_variables)
+          run_command("pyenv local #{python_version}")
+          run_command(command, env: env)
         rescue SharedHelpers::HelperSubprocessFailed => error
           original_error ||= error
           msg = error.message
@@ -278,8 +276,8 @@ module Dependabot
           raise relevant_error if python_version.start_with?("2")
 
           # Clear the existing virtualenv, so that we use the new Python version
-          run_command(["pyenv", "local", python_version])
-          run_command(["pyenv", "exec", "pipenv", "--rm"])
+          run_command("pyenv local #{python_version}")
+          run_command("pyenv exec pipenv --rm")
 
           @python_version = "2.7.16"
           retry
@@ -323,19 +321,18 @@ module Dependabot
         def install_required_python
           # Initialize a git repo to appease pip-tools
           begin
-            run_command(%w(git init)) if setup_files.any?
+            run_command("git init") if setup_files.any?
           rescue Dependabot::SharedHelpers::HelperSubprocessFailed
             nil
           end
 
-          if run_command(%w(pyenv versions)).include?("#{python_version}\n")
+          if run_command("pyenv versions").include?("#{python_version}\n")
             return
           end
 
           requirements_path = NativeHelpers.python_requirements_path
-          run_command(["pyenv", "install", "-s", python_version])
-          run_command(["pyenv", "exec", "pip", "install", "-r",
-                       requirements_path])
+          run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install -r #{requirements_path}")
         end
 
         def sanitized_setup_file_content(file)
@@ -406,7 +403,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_command("pyenv install --list")
         end
 
         def pipfile_python_requirement
@@ -425,10 +422,8 @@ module Dependabot
         def pipfile_hash_for(pipfile_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             File.write(File.join(dir, "Pipfile"), pipfile_content)
-            command_parts = ["pyenv", "exec", "python",
-                             NativeHelpers.python_helper_path]
             SharedHelpers.run_helper_subprocess(
-              command: Shellwords.join(command_parts),
+              command: "pyenv exec python #{NativeHelpers.python_helper_path}",
               function: "get_pipfile_hash",
               args: [dir]
             )
@@ -500,7 +495,7 @@ module Dependabot
           }
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -2,7 +2,6 @@
 
 require "toml-rb"
 require "open3"
-require "shellwords"
 require "dependabot/shared_helpers"
 require "dependabot/python/version"
 require "dependabot/python/requirement"
@@ -154,13 +153,13 @@ module Dependabot
             write_temporary_dependency_files(pyproject_content)
 
             if python_version && !pre_installed_python?(python_version)
-              run_poetry_command(["pyenv", "install", "-s", python_version])
-              run_poetry_command(["pyenv", "exec", "pip", "install", "-r",
-                                  NativeHelpers.python_requirements_path])
+              run_poetry_command("pyenv install -s #{python_version}")
+              run_poetry_command("pyenv exec pip install -r"\
+                                 "#{NativeHelpers.python_requirements_path}")
             end
 
             run_poetry_command(
-              ["pyenv", "exec", "poetry", "update", dependency.name, "--lock"]
+              "pyenv exec poetry update #{dependency.name} --lock"
             )
 
             return File.read("poetry.lock") if File.exist?("poetry.lock")
@@ -169,9 +168,9 @@ module Dependabot
           end
         end
 
-        def run_poetry_command(command_parts)
+        def run_poetry_command(command)
           start = Time.now
-          command = Shellwords.join(command_parts)
+          command = SharedHelpers.escape_command(command)
           stdout, process = Open3.capture2e(command)
           time_taken = Time.now - start
 
@@ -232,7 +231,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_poetry_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_poetry_command("pyenv install --list")
         end
 
         def pre_installed_python?(version)
@@ -242,10 +241,8 @@ module Dependabot
         def pyproject_hash_for(pyproject_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             File.write(File.join(dir, "pyproject.toml"), pyproject_content)
-            command_parts = ["pyenv", "exec", "python",
-                             NativeHelpers.python_helper_path]
             SharedHelpers.run_helper_subprocess(
-              command: Shellwords.join(command_parts),
+              command: "pyenv exec python #{NativeHelpers.python_helper_path}",
               function: "get_pyproject_hash",
               args: [dir]
             )

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "shellwords"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_updater"
 require "dependabot/shared_helpers"
@@ -140,10 +139,8 @@ module Dependabot
         end
 
         def package_hashes_for(name:, version:, algorithm:)
-          command_parts = ["pyenv", "exec", "python",
-                           NativeHelpers.python_helper_path]
           SharedHelpers.run_helper_subprocess(
-            command: Shellwords.join(command_parts),
+            command: "pyenv exec python #{NativeHelpers.python_helper_path}",
             function: "get_dependency_hash",
             args: [name, version, algorithm]
           ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "open3"
-require "shellwords"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_fetcher"
 require "dependabot/python/file_parser"
@@ -12,6 +11,7 @@ require "dependabot/python/version"
 require "dependabot/shared_helpers"
 require "dependabot/python/native_helpers"
 require "dependabot/python/python_versions"
+
 module Dependabot
   module Python
     class UpdateChecker
@@ -59,14 +59,14 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    ["pyenv", "exec", "pip-compile", "--allow-unsafe",
-                     "--build-isolation", "-P", dependency.name, filename]
+                    "pyenv exec pip-compile --allow-unsafe "\
+                     "--build-isolation -P #{dependency.name} #{filename}"
                   )
                   # Run pip-compile a second time, without an update argument,
                   # to ensure it handles markers correctly
                   run_pip_compile_command(
-                    ["pyenv", "exec", "pip-compile", "--allow-unsafe",
-                     "--build-isolation", filename]
+                    "pyenv exec pip-compile --allow-unsafe "\
+                     "--build-isolation #{filename}"
                   )
 
                   unredact_git_credentials_in_compiled_file(filename)
@@ -162,8 +162,7 @@ module Dependabot
               write_temporary_dependency_files(unlock_requirement: false)
 
               filenames_to_compile.each do |filename|
-                run_command(["pyenv", "exec", "pip-compile", "--allow-unsafe",
-                             filename])
+                run_command("pyenv exec pip-compile --allow-unsafe #{filename}")
               end
 
               true
@@ -181,9 +180,9 @@ module Dependabot
           end
         end
 
-        def run_command(command_parts, env: python_env)
+        def run_command(command, env: python_env)
           start = Time.now
-          command = Shellwords.join(command_parts)
+          command = SharedHelpers.escape_command(command)
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
 
@@ -199,9 +198,9 @@ module Dependabot
           )
         end
 
-        def run_pip_compile_command(command_parts)
-          run_command(["pyenv", "local", python_version])
-          run_command(command_parts)
+        def run_pip_compile_command(command)
+          run_command("pyenv local #{python_version}")
+          run_command(command)
         rescue SharedHelpers::HelperSubprocessFailed => error
           original_error ||= error
           msg = error.message
@@ -271,13 +270,13 @@ module Dependabot
         end
 
         def install_required_python
-          if run_command(%w(pyenv versions)).include?("#{python_version}\n")
+          if run_command("pyenv versions").include?("#{python_version}\n")
             return
           end
 
-          run_command(["pyenv", "install", "-s", python_version])
-          run_command(["pyenv", "exec", "pip", "install", "-r",
-                       NativeHelpers.python_requirements_path])
+          run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install -r"\
+                      "#{NativeHelpers.python_requirements_path}")
         end
 
         def sanitized_setup_file_content(file)
@@ -463,7 +462,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_command("pyenv install --list")
         end
 
         def pre_installed_python?(version)

data/lib/dependabot/python/update_checker/pipfile_version_resolver.rb

@@ -3,7 +3,6 @@
 require "excon"
 require "toml-rb"
 require "open3"
-require "shellwords"
 require "dependabot/errors"
 require "dependabot/shared_helpers"
 require "dependabot/python/file_parser"
@@ -78,9 +77,7 @@ module Dependabot
                 # Whilst calling `lock` avoids doing an install as part of the
                 # pipenv flow, an install is still done by pip-tools in order
                 # to resolve the dependencies. That means this is slow.
-                run_pipenv_command(
-                  %w(pyenv exec pipenv lock)
-                )
+                run_pipenv_command("pyenv exec pipenv lock")
 
                 updated_lockfile = JSON.parse(File.read("Pipfile.lock"))
 
@@ -195,9 +192,7 @@ module Dependabot
             SharedHelpers.with_git_configured(credentials: credentials) do
               write_temporary_dependency_files(update_pipfile: false)
 
-              run_pipenv_command(
-                %w(pyenv exec pipenv lock)
-              )
+              run_pipenv_command("pyenv exec pipenv lock")
 
               true
             rescue SharedHelpers::HelperSubprocessFailed => error
@@ -288,19 +283,19 @@ module Dependabot
         def install_required_python
           # Initialize a git repo to appease pip-tools
           begin
-            run_command(%w(git init)) if setup_files.any?
+            run_command("git init") if setup_files.any?
           rescue Dependabot::SharedHelpers::HelperSubprocessFailed
             nil
           end
 
-          if run_command(%w(pyenv versions)).include?("#{python_version}\n")
+          if run_command("pyenv versions").include?("#{python_version}\n")
             return
           end
 
           requirements_path = NativeHelpers.python_requirements_path
-          run_command(["pyenv", "install", "-s", python_version])
-          run_command(["pyenv", "exec", "pip", "install", "-r",
-                       requirements_path])
+          run_command("pyenv install -s #{python_version}")
+          run_command("pyenv exec pip install -r "\
+                      "#{requirements_path}")
         end
 
         def sanitized_setup_file_content(file)
@@ -414,7 +409,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_command("pyenv install --list")
         end
 
         def pipfile_python_requirement
@@ -487,9 +482,9 @@ module Dependabot
           end
         end
 
-        def run_command(command_parts, env: {})
+        def run_command(command, env: {})
           start = Time.now
-          command = Shellwords.join(command_parts)
+          command = SharedHelpers.escape_command(command)
           stdout, process = Open3.capture2e(env, command)
           time_taken = Time.now - start
 
@@ -505,9 +500,9 @@ module Dependabot
           )
         end
 
-        def run_pipenv_command(command_parts, env: pipenv_env_variables)
-          run_command(["pyenv", "local", python_version])
-          run_command(command_parts, env: env)
+        def run_pipenv_command(command, env: pipenv_env_variables)
+          run_command("pyenv local #{python_version}")
+          run_command(command, env: env)
         rescue SharedHelpers::HelperSubprocessFailed => error
           original_error ||= error
           msg = error.message
@@ -521,8 +516,8 @@ module Dependabot
           raise relevant_error if python_version.start_with?("2")
 
           # Clear the existing virtualenv, so that we use the new Python version
-          run_command(["pyenv", "local", python_version])
-          run_command(["pyenv", "exec", "pipenv", "--rm"])
+          run_command("pyenv local #{python_version}")
+          run_command("pyenv exec pipenv --rm")
 
           @python_version = "2.7.16"
           retry

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -3,7 +3,6 @@
 require "excon"
 require "toml-rb"
 require "open3"
-require "shellwords"
 require "dependabot/errors"
 require "dependabot/shared_helpers"
 require "dependabot/python/file_parser"
@@ -56,15 +55,15 @@ module Dependabot
               write_temporary_dependency_files
 
               if python_version && !pre_installed_python?(python_version)
-                run_poetry_command(["pyenv", "install", "-s", python_version])
-                run_poetry_command(["pyenv", "exec", "pip", "install", "-r",
-                                    NativeHelpers.python_requirements_path])
+                run_poetry_command("pyenv install -s #{python_version}")
+                run_poetry_command("pyenv exec pip install -r "\
+                                   "#{NativeHelpers.python_requirements_path}")
               end
 
               # Shell out to Poetry, which handles everything for us.
               # Using `--lock` avoids doing an install.
               run_poetry_command(
-                ["pyenv", "exec", "poetry", "update", dependency.name, "--lock"]
+                "pyenv exec poetry update #{dependency.name} --lock"
               )
 
               updated_lockfile =
@@ -106,7 +105,7 @@ module Dependabot
             write_temporary_dependency_files(update_pyproject: false)
 
             run_poetry_command(
-              ["pyenv", "exec", "poetry", "update", dependency.name, "--lock"]
+              "pyenv exec poetry update #{dependency.name} --lock"
             )
 
             true
@@ -176,7 +175,7 @@ module Dependabot
         end
 
         def pyenv_versions
-          @pyenv_versions ||= run_poetry_command(["pyenv", "install", "--list"])
+          @pyenv_versions ||= run_poetry_command("pyenv install --list")
         end
 
         def pre_installed_python?(version)
@@ -312,9 +311,9 @@ module Dependabot
           dependency_files.find { |f| f.name == ".python-version" }
         end
 
-        def run_poetry_command(command_parts)
+        def run_poetry_command(command)
           start = Time.now
-          command = Shellwords.join(command_parts)
+          command = SharedHelpers.escape_command(command)
           stdout, process = Open3.capture2e(command)
           time_taken = Time.now - start
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.98.20
+  version: 0.98.21
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.20
+        version: 0.98.21
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.20
+        version: 0.98.21
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement