dependabot-uv 0.366.0 → 0.367.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a921263a8493134f2d7e6670d06844e9f4f232f2e5afc2c76908bab64df9101
-  data.tar.gz: 8fa028c9a8b1184935ed65002de04664dbdccc85249abee4e1e8477b59fac9ee
+  metadata.gz: 00d7a1251bbd40a2dd5f3d8722884151356bb7410e2171cacc8c962798241b2c
+  data.tar.gz: 413a45f364671f58c8988af786dafcf8e8e635eb8e61d510547fe6f0652e500d
 SHA512:
-  metadata.gz: d42c942af66f282f399afff0125dda633772d2283932b900f4ac2521fbcd018b78de4b3d0ef41c6cf829572ca3eab0d17c09da9394b91620fb6cea7352468f95
-  data.tar.gz: b5d1fd02a5c9bfbdfeac365d307482719514464de17e1519dede2283da2b3e3fd9179b54dcf216ca823a7de810fe60818cae398a93ca7d36ae22b75daab4d3c5
+  metadata.gz: 33c2808a0d88713ffb0b5cc5c9e49c18fbef881d7a4876e5cb01be62bf39d24957f1fc91029502428029725d811a37a180e0e700cabc6d48047f527c1e030d0d
+  data.tar.gz: 0bd0aaff8e4528123d63b50fc65e7a32e0adf2a4f62cd6478953a0bcceec6f033b40d1935ff703c48a753fedd533261604de50ee3cfcf29035c443e05769fc0f

data/lib/dependabot/uv/dependency_grapher.rb

@@ -32,12 +32,10 @@ module Dependabot
 
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file
-        # This cannot realistically happen as the parser will throw a runtime error
-        # on init without a pyproject.toml file,
-        # but this will avoid surprises if anything changes.
-        raise DependabotError, "No pyproject.toml present in dependency files." unless pyproject_toml
+        return T.must(uv_lock) if uv_lock
+        return T.must(pyproject_toml) if pyproject_toml
 
-        T.must(pyproject_toml)
+        raise DependabotError, "No uv.lock or pyproject.toml present."
       end
 
       private

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -460,8 +460,22 @@ module Dependabot
 
         sig { params(name: T.any(String, Symbol)).returns(String) }
         def escape_package_name(name)
-          # Per PEP 503, Python package names normalize -, _, and . to the same character
-          Regexp.escape(name).gsub(/\\[-_.]/, "[-_.]")
+          name_str = name.to_s
+          match = name_str.match(/\A([^\[]+)\[([^\]]+)\]\z/)
+
+          # Handle extras: "pkg[extra1,extra2]" needs flexible matching for
+          # whitespace around commas and any ordering of extras in source file
+          if match
+            base = Regexp.escape(T.must(match[1])).gsub(/\\[-_.]/, "[-_.]")
+            extras = T.must(match[2]).split(",").map(&:strip)
+            extras_patterns = extras.map { |e| Regexp.escape(e).gsub(/\\[-_.]/, "[-_.]") }
+            # Use lookaheads so extras match in any order
+            lookaheads = extras_patterns.map { |e| "(?=[^\\]]*#{e})" }.join
+            "#{base}\\[#{lookaheads}[^\\]]+\\]"
+          else
+            # Per PEP 503, Python package names normalize -, _, and . to the same character
+            Regexp.escape(name_str).gsub(/\\[-_.]/, "[-_.]")
+          end
         end
 
         sig { params(file: T.nilable(DependencyFile)).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.366.0
+  version: 0.367.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -300,7 +300,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.367.0
 rdoc_options: []
 require_paths:
 - lib