dependabot-uv 0.342.2 → 0.343.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f00e468643c8c51934dc5c318a4a3729643ed340f47e2ce81595ffe20d9d8cd
-  data.tar.gz: 252775b2e8fa74fb0843e197d988dd70da43a04104192d75e83922a441c81dff
+  metadata.gz: cc8dc04b7bdb8db182aa0adb99be92a1c3459c50bcd6c775ae3e335eb4837298
+  data.tar.gz: 4fd4431aa08154b567b3b51b40672d02e703c4d062d5b078464035337352a042
 SHA512:
-  metadata.gz: e34b9a8c30e3cc1eced9089f294c5fb65235d33b024f0d23917d0966be1f5ec460dab777c25bf8a44d9b4fa585bdf8546f230e8f1c0e0811eba137b685629b92
-  data.tar.gz: 3c3207318f77f1747f6b6f019f3b8f579ac0bede2845fb55bc5ea5e3ab81fd9579482d2ac0b5e55063b0e2b086869bf0610a24bd4d1a5821fd57560ed5428d04
+  metadata.gz: 79f1be392f297dc717cb4b13166d8e2ea041ca8c87c62f5de3efde8ed8e2da4e687c777ad5974f34598a6a2e6b43910f253ea9554566b56d36613d8031038018
+  data.tar.gz: 6341336703ad5a8c1779fc9371cc4c51992f5ea0acb7d3d4413467a801752c2fa8ad14e4c1bb0029b0a08b6020c36ace349ae72c272451bf1399caf2b38ca0c8

data/lib/dependabot/uv/file_fetcher.rb

@@ -32,6 +32,9 @@ module Dependabot
         T::Hash[Symbol, T::Array[String]]
       )
 
+      # Projects that use README files for metadata may use any of these common names
+      README_FILENAMES = T.let(%w(README.md README.rst README.txt README).freeze, T::Array[String])
+
       MAX_FILE_SIZE = 500_000
 
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
@@ -83,6 +86,8 @@ module Dependabot
         fetched_files = []
 
         fetched_files += pyproject_files
+        # Fetch README support files if referenced in pyproject metadata
+        fetched_files += readme_files
 
         fetched_files += requirements_in_files
         fetched_files += requirement_files if requirements_txt_files.any?
@@ -113,6 +118,41 @@ module Dependabot
         [pyproject].compact
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def readme_files
+        return [] unless pyproject
+
+        # Attempt to read the readme declaration from the pyproject. Accept both simplified
+        # string form and table form ( { file = "..." } ).
+        readme_decl = nil
+        begin
+          readme_decl = parsed_pyproject.dig("project", "readme")
+        rescue TomlRB::ParseError
+          # If the pyproject is unparseable fail later in parsed_pyproject.
+        end
+
+        candidate_names =
+          case readme_decl
+          when String then [readme_decl]
+          when Hash
+            if readme_decl["file"].is_a?(String)
+              [T.cast(readme_decl["file"], String)]
+            else
+              README_FILENAMES
+            end
+          else
+            README_FILENAMES
+          end
+
+        candidate_names.filter_map do |filename|
+          file = fetch_file_if_present(filename)
+          file.support_file = true if file
+          file
+        rescue Dependabot::DependencyFileNotFound
+          nil
+        end
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def requirement_files
         [

data/lib/dependabot/uv/language.rb

@@ -16,11 +16,12 @@ module Dependabot
       # ARG PY_3_13=3.13.2
       # When updating this list, also update python/lib/dependabot/python/language.rb
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.13.5
-        3.12.11
-        3.11.13
-        3.10.18
-        3.9.23
+        3.14.0
+        3.13.9
+        3.12.12
+        3.11.14
+        3.10.19
+        3.9.24
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.342.2
+  version: 0.343.1
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.342.2
+        version: 0.343.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.342.2
+        version: 0.343.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -284,7 +284,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.342.2
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.343.1
 rdoc_options: []
 require_paths:
 - lib