dependabot-uv 0.380.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3b4c4b6a4b3763d4433341d1701c472a991315fb9cb30d6cdbc1b1401fc9232
-  data.tar.gz: 73d2e249b54aa9c849dd4c7cf88bf1586af43122b020cc2e4f2d27ce60225356
+  metadata.gz: 4f8d39e39ce8e18f7c946928ed3a7b5cd780ce3ae7d8808dad8c96c3b8248e6b
+  data.tar.gz: 2747bc7341934590fb3c0d1b0af95f788e055ff7845570dc10918179c0a9a26b
 SHA512:
-  metadata.gz: 7fb68d3a6c4668894905f961b7b02a9ba8e5ae26bca1d23e245cc5bd77da2e48bb3e004bfb1a3d233d5cc459f7c338ec2cf568d8f3a4019e62fde896c282e7d2
-  data.tar.gz: 35d5bfefbcaaa09a71798e6fda30c2e26beb23c3c5e62090ed0fcc8a45b126a0f2537b56206e3565fe2e43fe31cc9e8dfc9c5ce0c372f6f392f9e47c881c34f2
+  metadata.gz: 4f6677be24fdf402b476d7018f98ca323491fb6c4ea7ba5eeb4634d0e48b097e98dde9c679b9c1229dcc6343d38600e17d83a2fb931ca3a6918742d8bc88f777
+  data.tar.gz: f56c52f7b7d3b38d894bfa5452a6c4d68a61cf0ea995f2a26ec75a7d68c4bc4abb7a41a495ba0e699c85597bb8d74b9ddc5ee2413ba009db260102807f716d5c

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -53,7 +53,7 @@ module Dependabot
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def poetry_dependencies
-          @poetry_dependencies ||= T.let(parse_poetry_dependencies, T.untyped)
+          @poetry_dependencies ||= T.let(parse_poetry_dependencies, T.nilable(Dependabot::FileParsers::Base::DependencySet))
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -288,16 +288,19 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_pyproject
-          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.untyped)
+          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.nilable(T::Hash[String, T.untyped]))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_poetry_lock
-          @parsed_poetry_lock ||= T.let(TomlRB.parse(T.must(poetry_lock).content), T.untyped)
+          @parsed_poetry_lock ||= T.let(
+            TomlRB.parse(T.must(poetry_lock).content),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           raise Dependabot::DependencyFileNotParseable, T.must(poetry_lock).path
         end

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -177,7 +177,6 @@ module Dependabot
           end
         end
 
-        # rubocop:disable Metrics/AbcSize
         sig do
           params(updated_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile])
         end
@@ -193,19 +192,24 @@ module Dependabot
           files = dependency_files
                   .reject { |file| updated_filenames.include?(file.name) }
 
-          args = T.must(dependency).to_h
-          args = args.keys.to_h { |k| [k.to_sym, args[k]] }
-          args[:requirements] = new_reqs
-          args[:previous_requirements] = old_reqs
+          dep = T.must(dependency)
 
           RequirementFileUpdater.new(
-            dependencies: [Dependency.new(**T.unsafe(args))],
+            dependencies: [Dependency.new(
+              name: dep.name,
+              version: dep.version,
+              requirements: new_reqs,
+              package_manager: dep.package_manager,
+              previous_version: dep.previous_version,
+              previous_requirements: old_reqs,
+              directory: dep.directory,
+              subdependency_metadata: dep.subdependency_metadata,
+              removed: dep.removed?
+            )],
             dependency_files: files,
             credentials: credentials
           ).updated_dependency_files
         end
-        # rubocop:enable Metrics/AbcSize
-
         sig do
           params(
             cmd: String,

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -482,27 +482,34 @@ module Dependabot
         # themselves and for dry-run.
         sig { returns(T::Hash[String, String]) }
         def pyproject_index_env_vars
-          env_vars = {}
+          python_index_creds = credentials.select { |cred| cred["type"] == "python_index" }
+          python_index_creds.each_with_object(T.let({}, T::Hash[String, String])) do |cred, env_vars|
+            env_vars.merge!(index_auth_env_vars_for(cred))
+          end
+        end
+
+        sig { params(cred: Dependabot::Credential).returns(T::Hash[String, String]) }
+        def index_auth_env_vars_for(cred)
+          env_vars = T.let({}, T::Hash[String, String])
+          index_name = find_index_name_for_credential(cred)
 
-          matched_credentials = credentials
-                                .select { |cred| cred["type"] == "python_index" }
-                                .filter_map do |cred|
-                                  index_name = find_index_name_for_credential(cred)
-                                  [cred, index_name] if index_name
-                                end
+          unless index_name
+            Dependabot.logger.debug(
+              "python_index credential did not match a [[tool.uv.index]] entry; skipping UV_INDEX_* env vars"
+            )
+            return env_vars
+          end
 
-          matched_credentials.each do |cred, index_name|
-            env_name = index_name.upcase.gsub(/[^A-Z0-9]/, "_")
+          env_name = index_name.upcase.gsub(/[^A-Z0-9]/, "_")
+          username = cred["username"]
+          password = cred["password"] || cred["token"]
 
-            env_vars["UV_INDEX_#{env_name}_USERNAME"] = cred["username"] if cred["username"]
+          env_vars["UV_INDEX_#{env_name}_USERNAME"] = username if username
+          env_vars["UV_INDEX_#{env_name}_PASSWORD"] = password if password
 
-            if cred["password"]
-              env_vars["UV_INDEX_#{env_name}_PASSWORD"] = cred["password"]
-            elsif cred["token"]
-              env_vars["UV_INDEX_#{env_name}_PASSWORD"] = cred["token"]
-            end
-          end
+          return env_vars unless username || password
 
+          Dependabot.logger.debug("Configured uv auth env vars for a matched [[tool.uv.index]] entry")
           env_vars
         end
 

data/lib/dependabot/uv/file_updater/pyproject_preparer.rb

@@ -17,12 +17,9 @@ module Dependabot
       class PyprojectPreparer
         extend T::Sig
 
-        Credentials = T.type_alias { T::Array[T::Hash[String, String]] }
-
-        sig { params(pyproject_content: String, lockfile: T.nilable(Dependabot::DependencyFile)).void }
-        def initialize(pyproject_content:, lockfile: nil)
+        sig { params(pyproject_content: String).void }
+        def initialize(pyproject_content:)
           @pyproject_content = pyproject_content
-          @lockfile = lockfile
           @lines = T.let(pyproject_content.split("\n"), T::Array[String])
         end
 
@@ -44,41 +41,11 @@ module Dependabot
           @pyproject_content = updated_lines.join("\n")
         end
 
-        sig { params(credentials: T.nilable(Credentials)).returns(T.nilable(Credentials)) }
-        def add_auth_env_vars(credentials)
-          return unless credentials
-
-          credentials.each do |credential|
-            next unless credential["type"] == "python_index"
-
-            token = credential["token"]
-            index_url = credential["index-url"]
-
-            next unless token && index_url
-
-            # Set environment variables for uv auth
-            ENV["UV_INDEX_URL_TOKEN_#{sanitize_env_name(index_url)}"] = token
-
-            # Also set pip-style credentials for compatibility
-            ENV["PIP_INDEX_URL"] ||= "https://#{token}@#{index_url.gsub(%r{^https?://}, '')}"
-          end
-        end
-
         sig { returns(String) }
         def sanitize
           # No special sanitization needed for UV files at this point
           @pyproject_content
         end
-
-        private
-
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        attr_reader :lockfile
-
-        sig { params(url: String).returns(String) }
-        def sanitize_env_name(url)
-          url.gsub(%r{^https?://}, "").gsub(/[^a-zA-Z0-9]/, "_").upcase
-        end
       end
     end
   end

data/lib/dependabot/uv/update_checker.rb

@@ -31,14 +31,16 @@ module Dependabot
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/lock_file_resolver"
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        RequirementsUpdater.new(
-          requirements: requirements,
-          latest_resolvable_version: preferred_resolvable_version&.to_s,
-          update_strategy: requirements_update_strategy,
-          has_lockfile: requirements_text_file?
-        ).updated_requirements
+        wrap_requirements(
+          RequirementsUpdater.new(
+            requirements: requirements,
+            latest_resolvable_version: preferred_resolvable_version&.to_s,
+            update_strategy: requirements_update_strategy,
+            has_lockfile: requirements_text_file?
+          ).updated_requirements
+        )
       end
 
       private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.380.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -302,7 +302,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib