dependabot-python 0.98.25 → 0.98.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1aaab07a4e5df91bccc505b908fc7f37702b8edbb79737e541b757e6e34f1bc7
-  data.tar.gz: 990d6385f400beb22a15d24d9e61831422d0eb13d801aa2f3425c6d87b933c30
+  metadata.gz: 934137f3ab2d41d222a9e1cefdb665a2569f8211b581e0e63a03bbd40e2cc3d7
+  data.tar.gz: 6072356a5ff1737059fa1f431b45bac17d06375f7832cfe4a3491b6302d07882
 SHA512:
-  metadata.gz: 3cd9b354906ec58fd77380a1bb5f6ffb450aa01eab2c38396e7708ba23174e0696350fab6c5633a932981aa0d190789746a63c4337866d5272979e174ba47562
-  data.tar.gz: 065ce3c0dd5afa5f01df0af0e15d6c187a89e0fa491c48bb783fe3d519736527f07e1c942d77bbe1959a3d6283edb3a935c14ead1d964f7acab6d9ad254e7bc1
+  metadata.gz: c56db43000d52695cddefb024874a46d6ecfa3f5f35d1ed42449e4baecc7139480ee32fb1476a9488c01259ad4e2c8bc9ee24dc3f6f35e42c35a6241232c7fe8
+  data.tar.gz: 3ad6b8e5f829f41724e6399b16a93b7f6621915cf9a1c578572bd2dada09c190ee8137869e03c35a7c205e71a063bdb9060fa27bfe5c2c71b19b1ac66bf419a2

data/lib/dependabot/python/file_updater/pipfile_manifest_updater.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "toml-rb"
 require "dependabot/python/file_updater"
 
 module Dependabot
@@ -16,19 +15,12 @@ module Dependabot
           dependencies.
             select { |dep| requirement_changed?(dep) }.
             reduce(manifest.content.dup) do |content, dep|
-              updated_requirement =
-                dep.requirements.find { |r| r[:file] == manifest.name }.
-                fetch(:requirement)
+              updated_content = content
 
-              old_req =
-                dep.previous_requirements.
-                find { |r| r[:file] == manifest.name }.
-                fetch(:requirement)
-
-              updated_content =
-                content.gsub(declaration_regex(dep)) do |line|
-                  line.gsub(old_req, updated_requirement)
-                end
+              updated_content = update_requirements(
+                content: updated_content,
+                dependency: dep
+              )
 
               raise "Content did not change!" if content == updated_content
 
@@ -40,11 +32,67 @@ module Dependabot
 
         attr_reader :dependencies, :manifest
 
+        def update_requirements(content:, dependency:)
+          updated_content = content.dup
+
+          # The UpdateChecker ensures the order of requirements is preserved
+          # when updating, so we can zip them together in new/old pairs.
+          reqs = dependency.requirements.
+                 zip(dependency.previous_requirements).
+                 reject { |new_req, old_req| new_req == old_req }
+
+          # Loop through each changed requirement
+          reqs.each do |new_req, old_req|
+            raise "Bad req match" unless new_req[:file] == old_req[:file]
+            next if new_req[:requirement] == old_req[:requirement]
+            next unless new_req[:file] == manifest.name
+
+            updated_content = update_manifest_req(
+              content: updated_content,
+              dep: dependency,
+              old_req: old_req.fetch(:requirement),
+              new_req: new_req.fetch(:requirement)
+            )
+          end
+
+          updated_content
+        end
+
+        def update_manifest_req(content:, dep:, old_req:, new_req:)
+          simple_declaration = content.scan(declaration_regex(dep)).
+                               find { |m| m.include?(old_req) }
+
+          if simple_declaration
+            simple_declaration_regex =
+              /(?:^|["'])#{Regexp.escape(simple_declaration)}/
+            content.gsub(simple_declaration_regex) do |line|
+              line.gsub(old_req, new_req)
+            end
+          elsif content.match?(table_declaration_version_regex(dep))
+            content.gsub(table_declaration_version_regex(dep)) do |part|
+              line = content.match(table_declaration_version_regex(dep)).
+                     named_captures.fetch("version_declaration")
+              new_line = line.gsub(old_req, new_req)
+              part.gsub(line, new_line)
+            end
+          else
+            content
+          end
+        end
+
         def declaration_regex(dep)
           escaped_name = Regexp.escape(dep.name).gsub("\\-", "[-_.]")
           /(?:^|["'])#{escaped_name}["']?\s*=.*$/i
         end
 
+        def table_declaration_version_regex(dep)
+          /
+            packages\.#{Regexp.quote(dep.name)}\]
+            (?:(?!^\[).)+
+            (?<version_declaration>version\s*=[^\[]*)$
+          /mx
+        end
+
         def requirement_changed?(dependency)
           changed_requirements =
             dependency.requirements - dependency.previous_requirements

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.98.25
+  version: 0.98.26
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.25
+        version: 0.98.26
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.25
+        version: 0.98.26
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement