dependabot-uv 0.324.0 → 0.324.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92b0138b2a802482348f4d0486e9dd5f48dfa8762d32f9495e01c10bcd05cdb8
-  data.tar.gz: f60d953ad7ceb7fa06dc74d82677fd43cf7425dd763a567c8161097bb388c82d
+  metadata.gz: f5dcecc8cda1a971e30f9c77b0390147d531ef3dd21c447c70caf265ac9e1467
+  data.tar.gz: 7e69d3bf55fb153155d9bc5418a97e467ac019c58d34a678751ee3ed98c52e7b
 SHA512:
-  metadata.gz: 270b22a94e3a16d3d5885ace094935c668f6a3c9608d0c185f4eb030629863efb03f6158cfaf67840e07d7011f361a0f60d04cae9bdef82397436c723fa2677b
-  data.tar.gz: 4cbc5d87ac6919a05159aca0c396b5688abbef23eb156cbfbc0380407066087b87a7a0105ad02fc1338ce18173656932e154eaf800b4c6377e9827110ebd0157
+  metadata.gz: 2061f0460abf4edb6af49785d5726213608fae84317f9b8d27e3db9a0584b5812e69db0a06febbb11e3a49a6b88e9ff44d2d06266a323c9e55e61c3c4b1bc4df
+  data.tar.gz: ae31c936c367b29741d6ec04a3aa8ac400d51d56761eeb55d069f7e7463ee7f0c8d45ae74b7993a782cb8c6580ee745bc54eb910c1c5ee186017fd9fe1859bda

data/helpers/lib/parser.py

@@ -132,6 +132,28 @@ def parse_pep621_pep735_dependencies(pyproject_path):
             )
             dependencies.extend(build_system_dependencies)
 
+    # Parse UV sources for path dependencies
+    if (
+        'tool' in project_toml
+        and 'uv' in project_toml['tool']
+        and 'sources' in project_toml['tool']['uv']
+    ):
+        uv_sources = project_toml['tool']['uv']['sources']
+        for dep_name, source_config in uv_sources.items():
+            if isinstance(source_config, dict) and 'path' in source_config:
+                # Add path dependency info
+                # but don't parse as regular dependency
+                dependencies.append({
+                    "name": dep_name,
+                    "version": None,
+                    "markers": None,
+                    "file": pyproject_path,
+                    "requirement": None,
+                    "extras": [],
+                    "path_dependency": True,
+                    "path": source_config['path']
+                })
+
     return json.dumps({"result": dependencies})
 
 

data/lib/dependabot/uv/file_fetcher.rb

@@ -277,7 +277,8 @@ module Dependabot
       def path_dependencies
         [
           *requirement_txt_path_dependencies,
-          *requirement_in_path_dependencies
+          *requirement_in_path_dependencies,
+          *uv_sources_path_dependencies
         ]
       end
 
@@ -322,6 +323,23 @@ module Dependabot
         @requirements_in_file_matcher ||= RequiremenstFileMatcher.new(requirements_in_files)
       end
 
+      def uv_sources_path_dependencies
+        return [] unless pyproject
+
+        uv_sources = parsed_pyproject.dig("tool", "uv", "sources")
+        return [] unless uv_sources
+
+        uv_sources.filter_map do |name, source_config|
+          if source_config.is_a?(Hash) && source_config["path"]
+            {
+              name: name,
+              path: source_config["path"],
+              file: pyproject.name
+            }
+          end
+        end
+      end
+
       def fetch_requirement_files_from_path(path = nil)
         contents = path ? repo_contents(dir: path) : repo_contents
         filter_requirement_files(contents, base_path: path)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.324.0
+  version: 0.324.1
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.324.0
+        version: 0.324.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.324.0
+        version: 0.324.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -284,7 +284,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.324.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.324.1
 rdoc_options: []
 require_paths:
 - lib