dependabot-uv 0.301.1 → 0.302.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26af709186ad20b222961b28c19395f53edfcab51c9fdc0e92734cd06aa2d296
-  data.tar.gz: c26d70a21a979a655c952c940c0f32a10f89e58cb1d1588238b64c252bf96c48
+  metadata.gz: 13de7d80edd84c1e0f706821592cd4f756a2cbc418f16b33f3af2eb58be41942
+  data.tar.gz: 5e0e922260aaa77e3041abb3103501c86be7a24b57d6f1fa25a5e782ec7b5a92
 SHA512:
-  metadata.gz: d0c2ac20cafd314d293a7a903947cd7fef9df95c5a85fae9f46e41d78920ae856949357cb4e6419c1804e95c19ba625c2a8fbd8bef43d9154d912c6aa31adb43
-  data.tar.gz: e1cb4fe17761e4f1433f9a55ae619a9271ec49359a3de0198c807f9393748633d9bfddb85002c01d782eadfc40f0a6598488fde5d9a7044e1c4e844198a26dd5
+  metadata.gz: 03fac6d585a7f26b470dda56264b85f3e078b29c561e37a5df3c118298ff2c8a2fe0eb7751efc2a9c127bd6029eed0697a9f2b7dedf0a0f45fb23e597209f346
+  data.tar.gz: 2c1419e9e906e4b7b198f95ae55f032a05ee2fab815672d0c8d80e99edc1923aecbfe02506c73892b058277664bdfaa23c92c77580c2278b6cdd1bc76cda001d

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.1.0
 poetry==1.8.5
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.0.1
-uv==0.6.2
+uv==0.6.8
 
 # Some dependencies will only install if Cython is present
 Cython==3.0.10

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -104,48 +104,36 @@ module Dependabot
               original_requires_python = original_content
                                          .match(/requires-python\s*=\s*["']([^"']+)["']/)&.captures&.first
 
-              # Use the original Python version requirement for the update if one exists
-              with_original_python_version(original_requires_python) do
-                new_lockfile = updated_lockfile_content_for(prepared_pyproject)
-
-                # Use direct string replacement to preserve the exact format
-                # Match the dependency section and update only the version
-                dependency_section_pattern = /
-                  (\[\[package\]\]\s*\n
-                   .*?name\s*=\s*["']#{Regexp.escape(dependency.name)}["']\s*\n
-                   .*?)
-                  (version\s*=\s*["'][^"']+["'])
-                  (.*?)
-                  (\[\[package\]\]|\z)
-                /xm
-
-                result = original_content.sub(dependency_section_pattern) do
-                  section_start = Regexp.last_match(1)
-                  version_line = "version = \"#{dependency.version}\""
-                  section_end = Regexp.last_match(3)
-                  next_section_or_end = Regexp.last_match(4)
-
-                  "#{section_start}#{version_line}#{section_end}#{next_section_or_end}"
-                end
-
-                # If the content didn't change and we expect it to, something went wrong
-                if result == original_content
-                  Dependabot.logger.warn("Package section not found for #{dependency.name}, falling back to raw update")
-                  result = new_lockfile
-                end
-
-                # Restore the original requires-python if it exists
-                if original_requires_python
-                  result = result.gsub(/requires-python\s*=\s*["'][^"']+["']/,
-                                       "requires-python = \"#{original_requires_python}\"")
-                end
-
-                result
+              # Store the original Python version requirement for later use
+              @original_python_version = original_requires_python
+
+              new_lockfile = updated_lockfile_content_for(prepared_pyproject)
+
+              # Normalize line endings to ensure proper comparison
+              new_lockfile = normalize_line_endings(new_lockfile, original_content)
+
+              result = new_lockfile
+
+              # Restore the original requires-python if it exists
+              if original_requires_python
+                result = result.gsub(/requires-python\s*=\s*["'][^"']+["']/,
+                                     "requires-python = \"#{original_requires_python}\"")
               end
+
+              result
             end
         end
 
-        # Helper method to temporarily override Python version during operations
+        # Helper method to normalize line endings between two strings
+        def normalize_line_endings(content, reference)
+          # Check if reference has escaped newlines like "\n" +
+          if reference.include?("\\n")
+            content.gsub("\n", "\\n")
+          else
+            content
+          end
+        end
+
         def with_original_python_version(original_requires_python)
           if original_requires_python
             original_python_version = @original_python_version
@@ -164,7 +152,6 @@ module Dependabot
               content = updated_pyproject_content
               content = sanitize(content)
               content = freeze_other_dependencies(content)
-              content = update_python_requirement(content)
               content
             end
         end
@@ -175,12 +162,6 @@ module Dependabot
             .freeze_top_level_dependencies_except(dependencies)
         end
 
-        def update_python_requirement(pyproject_content)
-          PyprojectPreparer
-            .new(pyproject_content: pyproject_content)
-            .update_python_requirement(language_version_manager.python_version)
-        end
-
         def sanitize(pyproject_content)
           PyprojectPreparer
             .new(pyproject_content: pyproject_content)
@@ -192,14 +173,8 @@ module Dependabot
             SharedHelpers.with_git_configured(credentials: credentials) do
               write_temporary_dependency_files(pyproject_content)
 
-              # Install Python before writing .python-version to make sure we use a version that's available
-              language_version_manager.install_required_python
-
-              # Determine the Python version to use after installation
-              python_version = determine_python_version
-
-              # Now write the .python-version file with a version we know is installed
-              File.write(".python-version", python_version)
+              # Set up Python environment using LanguageVersionManager
+              setup_python_environment
 
               run_update_command
 
@@ -209,8 +184,9 @@ module Dependabot
         end
 
         def run_update_command
-          command = "pyenv exec uv lock --upgrade-package #{dependency.name}"
-          fingerprint = "pyenv exec uv lock --upgrade-package <dependency_name>"
+          # Use pyenv exec to ensure we're using the correct Python environment
+          command = "pyenv exec python -m uv lock --upgrade-package #{dependency.name}"
+          fingerprint = "pyenv exec python -m uv lock --upgrade-package <dependency_name>"
 
           run_command(command, fingerprint:)
         end
@@ -226,82 +202,28 @@ module Dependabot
             File.write(path, file.content)
           end
 
-          # Only write the .python-version file after the language version manager has
-          # installed the required Python version to ensure it's available
           # Overwrite the pyproject with updated content
           File.write("pyproject.toml", pyproject_content)
         end
 
-        def determine_python_version
-          # Check available Python versions through pyenv
-          available_versions = nil
-          begin
-            available_versions = SharedHelpers.run_shell_command("pyenv versions --bare")
-                                              .split("\n")
-                                              .map(&:strip)
-                                              .reject(&:empty?)
-          rescue StandardError => e
-            Dependabot.logger.warn("Error checking available Python versions: #{e}")
-          end
-
-          # Try to find the closest match for our priority order
-          preferred_version = find_preferred_version(available_versions)
+        def setup_python_environment
+          # Use LanguageVersionManager to determine and install the appropriate Python version
+          Dependabot.logger.info("Setting up Python environment using LanguageVersionManager")
 
-          if preferred_version
-            # Just return the major.minor version string
-            preferred_version.match(/^(\d+\.\d+)/)[1]
-          else
-            # If all else fails, use "system" which should work with whatever Python is available
-            "system"
-          end
-        end
-
-        def find_preferred_version(available_versions)
-          return nil unless available_versions&.any?
-
-          # Try each strategy in order of preference
-          try_version_from_file(available_versions) ||
-            try_version_from_requires_python(available_versions) ||
-            try_highest_python3_version(available_versions)
-        end
-
-        def try_version_from_file(available_versions)
-          python_version_file = dependency_files.find { |f| f.name == ".python-version" }
-          return nil unless python_version_file && !python_version_file.content.strip.empty?
-
-          requested_version = python_version_file.content.strip
-          return requested_version if version_available?(available_versions, requested_version)
-
-          Dependabot.logger.info("Python version #{requested_version} from .python-version not available")
-          nil
-        end
-
-        def try_version_from_requires_python(available_versions)
-          return nil unless @original_python_version
-
-          version_match = @original_python_version.match(/(\d+\.\d+)/)
-          return nil unless version_match
-
-          requested_version = version_match[1]
-          return requested_version if version_available?(available_versions, requested_version)
-
-          Dependabot.logger.info("Python version #{requested_version} from requires-python not available")
-          nil
-        end
-
-        def try_highest_python3_version(available_versions)
-          python3_versions = available_versions
-                             .select { |v| v.match(/^3\.\d+/) }
-                             .sort_by { |v| Gem::Version.new(v.match(/^(\d+\.\d+)/)[1]) }
-                             .reverse
+          begin
+            # Install the required Python version
+            language_version_manager.install_required_python
 
-          python3_versions.first # returns nil if array is empty
-        end
+            # Set the local Python version
+            python_version = language_version_manager.python_version
+            Dependabot.logger.info("Setting Python version to #{python_version}")
+            SharedHelpers.run_shell_command("pyenv local #{language_version_manager.python_major_minor}")
 
-        def version_available?(available_versions, requested_version)
-          # Check if the exact version or a version with the same major.minor is available
-          available_versions.any? do |v|
-            v == requested_version || v.start_with?("#{requested_version}.")
+            # We don't need to install uv as it should be available in the Docker environment
+            Dependabot.logger.info("Using pre-installed uv package")
+          rescue StandardError => e
+            Dependabot.logger.warn("Error setting up Python environment: #{e.message}")
+            Dependabot.logger.info("Falling back to system Python")
           end
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.301.1
+  version: 0.302.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-14 00:00:00.000000000 Z
+date: 2025-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -285,7 +285,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.301.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0
 post_install_message:
 rdoc_options: []
 require_paths: