dependabot-uv 0.354.0 → 0.356.0

data/lib/dependabot/uv/update_checker.rb

@@ -10,14 +10,19 @@ require "dependabot/errors"
 require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirement_parser"
 require "dependabot/uv/requirement"
+require "dependabot/uv/version"
 require "dependabot/registry_client"
 require "dependabot/requirements_update_strategy"
 require "dependabot/update_checkers"
-require "dependabot/update_checkers/base"
+require "dependabot/python/update_checker"
 
 module Dependabot
   module Uv
-    class UpdateChecker < Dependabot::UpdateCheckers::Base
+    # UV UpdateChecker extends Python's UpdateChecker since both ecosystems
+    # share PyPI registry interaction and core version resolution logic.
+    # UV overrides only the resolver selection and UV-specific features
+    # (uv.lock support, no Pipenv/Poetry support).
+    class UpdateChecker < Dependabot::Python::UpdateChecker
       extend T::Sig
 
       require_relative "update_checker/pip_compile_version_resolver"
@@ -26,65 +31,6 @@ module Dependabot
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/lock_file_resolver"
 
-      MAIN_PYPI_INDEXES = %w(
-        https://pypi.python.org/simple/
-        https://pypi.org/simple/
-      ).freeze
-      VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
-
-      sig { override.returns(T.nilable(Gem::Version)) }
-      def latest_version
-        @latest_version ||= T.let(
-          fetch_latest_version,
-          T.nilable(Gem::Version)
-        )
-      end
-
-      sig { override.returns(T.nilable(Gem::Version)) }
-      def latest_resolvable_version
-        @latest_resolvable_version ||= T.let(
-          if resolver_type == :requirements
-            resolver.latest_resolvable_version
-          elsif resolver_type == :pip_compile && resolver.resolvable?(version: latest_version)
-            latest_version
-          else
-            resolver.latest_resolvable_version(
-              requirement: unlocked_requirement_string
-            )
-          end,
-          T.nilable(Gem::Version)
-        )
-      end
-
-      sig { override.returns(T.nilable(Gem::Version)) }
-      def latest_resolvable_version_with_no_unlock
-        @latest_resolvable_version_with_no_unlock ||= T.let(
-          if resolver_type == :requirements
-            resolver.latest_resolvable_version_with_no_unlock
-          else
-            resolver.latest_resolvable_version(
-              requirement: current_requirement_string
-            )
-          end,
-          T.nilable(Gem::Version)
-        )
-      end
-
-      sig { override.returns(T.nilable(Gem::Version)) }
-      def lowest_security_fix_version
-        latest_version_finder.lowest_security_fix_version
-      end
-
-      sig { override.returns(T.nilable(Gem::Version)) }
-      def lowest_resolvable_security_fix_version
-        raise "Dependency not vulnerable!" unless vulnerable?
-
-        @lowest_resolvable_security_fix_version ||= T.let(
-          fetch_lowest_resolvable_security_fix_version,
-          T.nilable(Gem::Version)
-        )
-      end
-
       sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
@@ -95,34 +41,9 @@ module Dependabot
         ).updated_requirements
       end
 
-      sig { override.returns(T::Boolean) }
-      def requirements_unlocked_or_can_be?
-        !requirements_update_strategy.lockfile_only?
-      end
-
-      sig { override.returns(Dependabot::RequirementsUpdateStrategy) }
-      def requirements_update_strategy
-        # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy if @requirements_update_strategy
-
-        # Otherwise, check if this is a library or not
-        library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersions
-      end
-
       private
 
-      sig { override.returns(T::Boolean) }
-      def latest_version_resolvable_with_full_unlock?
-        # Full unlock checks aren't implemented for Python (yet)
-        false
-      end
-
-      sig { override.returns(T::Array[Dependabot::Dependency]) }
-      def updated_dependencies_after_full_unlock
-        raise NotImplementedError
-      end
-
-      sig { returns(T.nilable(Gem::Version)) }
+      sig { override.returns(T.nilable(Gem::Version)) }
       def fetch_lowest_resolvable_security_fix_version
         fix_version = lowest_security_fix_version
         return latest_resolvable_version if fix_version.nil?
@@ -137,7 +58,7 @@ module Dependabot
         resolver.resolvable?(version: fix_version) ? fix_version : nil
       end
 
-      sig { returns(T.untyped) }
+      sig { override.returns(T.untyped) }
       def resolver
         case resolver_type
         when :pip_compile then pip_compile_version_resolver
@@ -147,13 +68,12 @@ module Dependabot
         end
       end
 
-      sig { returns(Symbol) }
+      sig { override.returns(Symbol) }
       def resolver_type
         reqs = requirements
 
         # If there are no requirements then this is a sub-dependency.
-        # It must come from one of Pipenv, Poetry or pip-tools,
-        # and can't come from the first two unless they have a lockfile.
+        # It must come from pip-tools or uv.lock.
         return subdependency_resolver if reqs.none?
 
         # Otherwise, this is a top-level dependency, and we can figure out
@@ -169,7 +89,7 @@ module Dependabot
         end
       end
 
-      sig { returns(Symbol) }
+      sig { override.returns(Symbol) }
       def subdependency_resolver
         return :pip_compile if pip_compile_files.any?
         return :lock_file if uv_lock.any?
@@ -177,7 +97,7 @@ module Dependabot
         raise "Claimed to be a sub-dependency, but no lockfile exists!"
       end
 
-      sig { params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
+      sig { override.params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
       def exact_requirement?(reqs)
         reqs = reqs.map { |r| r.fetch(:requirement) }
         reqs = reqs.compact
@@ -185,7 +105,7 @@ module Dependabot
         reqs.any? { |r| Uv::Requirement.new(r).exact? }
       end
 
-      sig { returns(PipCompileVersionResolver) }
+      sig { override.returns(Object) }
       def pip_compile_version_resolver
         @pip_compile_version_resolver ||= T.let(
           PipCompileVersionResolver.new(
@@ -198,7 +118,7 @@ module Dependabot
         )
       end
 
-      sig { returns(PipVersionResolver) }
+      sig { override.returns(PipVersionResolver) }
       def pip_version_resolver
         @pip_version_resolver ||= T.let(
           PipVersionResolver.new(
@@ -229,17 +149,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
-      def resolver_args
-        {
-          dependency: dependency,
-          dependency_files: dependency_files,
-          credentials: credentials,
-          repo_contents_path: repo_contents_path
-        }
-      end
-
-      sig { returns(T.nilable(String)) }
+      sig { override.returns(T.nilable(String)) }
       def current_requirement_string
         reqs = requirements
         return if reqs.none?
@@ -253,7 +163,7 @@ module Dependabot
         requirement&.fetch(:requirement)
       end
 
-      sig { returns(String) }
+      sig { override.returns(String) }
       def unlocked_requirement_string
         lower_bound_req = updated_version_req_lower_bound
 
@@ -270,7 +180,7 @@ module Dependabot
         lower_bound_req + ",<=#{latest_version}"
       end
 
-      sig { returns(String) }
+      sig { override.returns(String) }
       def updated_version_req_lower_bound
         return ">=#{dependency.version}" if dependency.version
 
@@ -285,12 +195,7 @@ module Dependabot
         ">=#{version_for_requirement || 0}"
       end
 
-      sig { returns(T.nilable(Gem::Version)) }
-      def fetch_latest_version
-        latest_version_finder.latest_version
-      end
-
-      sig { returns(LatestVersionFinder) }
+      sig { override.returns(LatestVersionFinder) }
       def latest_version_finder
         @latest_version_finder ||= T.let(
           LatestVersionFinder.new(
@@ -306,7 +211,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Boolean) }
+      sig { override.returns(T::Boolean) }
       def library?
         return false unless updating_pyproject?
         return false unless library_details
@@ -329,16 +234,6 @@ module Dependabot
         false
       end
 
-      sig { returns(T::Boolean) }
-      def updating_pyproject?
-        requirement_files.any?("pyproject.toml")
-      end
-
-      sig { returns(T::Boolean) }
-      def updating_in_file?
-        requirement_files.any? { |f| f.end_with?(".in") }
-      end
-
       sig { returns(T::Boolean) }
       def updating_uv_lock?
         requirement_files.any?("uv.lock")
@@ -349,32 +244,7 @@ module Dependabot
         requirement_files.any? { |f| f.end_with?("requirements.txt") }
       end
 
-      sig { returns(T::Boolean) }
-      def updating_requirements_file?
-        requirement_files.any? { |f| f =~ /\.txt$|\.in$/ }
-      end
-
-      sig { returns(T::Array[String]) }
-      def requirement_files
-        requirements.map { |r| r.fetch(:file) }
-      end
-
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
-      def requirements
-        dependency.requirements
-      end
-
-      sig { params(name: String).returns(String) }
-      def normalised_name(name)
-        NameNormaliser.normalise(name)
-      end
-
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def pyproject
-        dependency_files.find { |f| f.name == "pyproject.toml" }
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { override.returns(T.nilable(T::Hash[String, T.untyped])) }
       def library_details
         @library_details ||= T.let(
           standard_details || build_system_details,
@@ -382,35 +252,6 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def standard_details
-        @standard_details ||= T.let(
-          toml_content["project"],
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def build_system_details
-        @build_system_details ||= T.let(
-          toml_content["build-system"],
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T::Hash[String, T.untyped]) }
-      def toml_content
-        @toml_content ||= T.let(
-          TomlRB.parse(T.must(pyproject).content),
-          T.nilable(T::Hash[String, T.untyped])
-        )
-      end
-
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      def pip_compile_files
-        dependency_files.select { |f| f.name.end_with?(".in") }
-      end
-
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def uv_lock
         dependency_files.select { |f| f.name == "uv.lock" }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.354.0
+  version: 0.356.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.354.0
+        version: 0.356.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.354.0
+        version: 0.356.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.354.0
+        version: 0.356.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.354.0
+        version: 0.356.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -297,7 +297,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.354.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.356.0
 rdoc_options: []
 require_paths:
 - lib