dependabot-uv 0.365.0 → 0.367.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6240bab6f9752f6e33cac15a9334ee0af6e9dc6b0ab055970dd45dec7ecec3ce
-  data.tar.gz: dbb9a819d19fc1aae22864f589b90384bf76e2401ec7c07bc1961cb2094c6c62
+  metadata.gz: 00d7a1251bbd40a2dd5f3d8722884151356bb7410e2171cacc8c962798241b2c
+  data.tar.gz: 413a45f364671f58c8988af786dafcf8e8e635eb8e61d510547fe6f0652e500d
 SHA512:
-  metadata.gz: 33e3cb465420e534eb6137515ef2fa43a5fe2bbd370a99e39f24efe39bfdb81b0fc092ff8e26e2a94b6618fb5c0be99015d5a93f0c7225fc8db74885c0abfdbb
-  data.tar.gz: 1bc5d384e74eb79a58dc5a302ed8f004b36ffbb16adf2330aa50eacd7802cdbeebeeb5c2b0c00f2b9fe95ef262d4d39c3b82a4c57d214d4f8121e94ea9f5fda0
+  metadata.gz: 33c2808a0d88713ffb0b5cc5c9e49c18fbef881d7a4876e5cb01be62bf39d24957f1fc91029502428029725d811a37a180e0e700cabc6d48047f527c1e030d0d
+  data.tar.gz: 0bd0aaff8e4528123d63b50fc65e7a32e0adf2a4f62cd6478953a0bcceec6f033b40d1935ff703c48a753fedd533261604de50ee3cfcf29035c443e05769fc0f

data/lib/dependabot/uv/dependency_grapher.rb

@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/dependency_graphers"
 require "dependabot/dependency_graphers/base"
 require "dependabot/uv/file_parser"
+require "dependabot/uv/name_normaliser"
 require "toml-rb"
 
 module Dependabot
@@ -31,12 +32,10 @@ module Dependabot
 
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file
-        # This cannot realistically happen as the parser will throw a runtime error
-        # on init without a pyproject.toml file,
-        # but this will avoid surprises if anything changes.
-        raise DependabotError, "No pyproject.toml present in dependency files." unless pyproject_toml
+        return T.must(uv_lock) if uv_lock
+        return T.must(pyproject_toml) if pyproject_toml
 
-        T.must(pyproject_toml)
+        raise DependabotError, "No uv.lock or pyproject.toml present."
       end
 
       private
@@ -170,6 +169,13 @@ module Dependabot
         "pypi"
       end
 
+      # Strip extras (e.g. "[filecache]") from the dependency name for PURLs,
+      # since the PURL should reference the base package only.
+      sig { override.params(dependency: Dependabot::Dependency).returns(String) }
+      def purl_name_for(dependency)
+        NameNormaliser.normalise(dependency.name)
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pyproject_toml
         return @pyproject_toml if defined?(@pyproject_toml)

data/lib/dependabot/uv/file_updater/lock_file_error_handler.rb

@@ -64,6 +64,11 @@ module Dependabot
           /Failed to parse:?\s*`?(?<file>[^`\n]+\.toml)`?|TOML parse error/i,
           Regexp
         )
+        # uv prefixes errors with interpreter info that should be stripped
+        USING_CPYTHON_LINE_REGEX = T.let(
+          /\AUsing CPython \S+ interpreter at: [^\n]+\n?/,
+          Regexp
+        )
         PYPROJECT_SCHEMA_ERROR_REGEX = T.let(
           /missing field `project`|missing.*\[project\].*table|Field `project\.name` is required/i,
           Regexp
@@ -110,6 +115,7 @@ module Dependabot
           handle_python_version_errors(message)
           handle_resource_errors(message)
           handle_package_not_found_errors(message)
+          handle_uv_fallback_error(message)
 
           raise error
         end
@@ -293,6 +299,13 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, clean_error_message(message)
         end
 
+        sig { params(message: String).void }
+        def handle_uv_fallback_error(message)
+          return unless message.match?(USING_CPYTHON_LINE_REGEX)
+
+          raise Dependabot::DependencyFileNotResolvable, clean_error_message(message)
+        end
+
         sig { params(match: T.untyped).returns(T.nilable(String)) }
         def extract_match_string(match)
           return nil unless match
@@ -311,6 +324,7 @@ module Dependabot
         sig { params(message: String).returns(String) }
         def clean_error_message(message)
           message
+            .sub(USING_CPYTHON_LINE_REGEX, "")
             .gsub(/#{Regexp.escape(Utils::BUMP_TMP_DIR_PATH)}[^\s]*/o, "")
             .lines
             .reject { |line| line.strip.empty? }

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -460,8 +460,22 @@ module Dependabot
 
         sig { params(name: T.any(String, Symbol)).returns(String) }
         def escape_package_name(name)
-          # Per PEP 503, Python package names normalize -, _, and . to the same character
-          Regexp.escape(name).gsub(/\\[-_.]/, "[-_.]")
+          name_str = name.to_s
+          match = name_str.match(/\A([^\[]+)\[([^\]]+)\]\z/)
+
+          # Handle extras: "pkg[extra1,extra2]" needs flexible matching for
+          # whitespace around commas and any ordering of extras in source file
+          if match
+            base = Regexp.escape(T.must(match[1])).gsub(/\\[-_.]/, "[-_.]")
+            extras = T.must(match[2]).split(",").map(&:strip)
+            extras_patterns = extras.map { |e| Regexp.escape(e).gsub(/\\[-_.]/, "[-_.]") }
+            # Use lookaheads so extras match in any order
+            lookaheads = extras_patterns.map { |e| "(?=[^\\]]*#{e})" }.join
+            "#{base}\\[#{lookaheads}[^\\]]+\\]"
+          else
+            # Per PEP 503, Python package names normalize -, _, and . to the same character
+            Regexp.escape(name_str).gsub(/\\[-_.]/, "[-_.]")
+          end
         end
 
         sig { params(file: T.nilable(DependencyFile)).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.365.0
+  version: 0.367.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.367.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.367.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.367.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.367.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -300,7 +300,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.365.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.367.0
 rdoc_options: []
 require_paths:
 - lib