dependabot-uv 0.387.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e349c3717f1c1313ae8c8ffdda0c47958424c03c79d5c02a54940233bce875f
-  data.tar.gz: a7762b490962b760db62ee1134ccd0134c3f0b2351d49755e437f5f243cc975e
+  metadata.gz: fda1b90d861ae8ba886593936b74d7c6172d90067b1f134148a703ca6a75a517
+  data.tar.gz: 3c4321de425ebb554694d0fc3636383978a79f9b8c8a4fdda0d29f6d174ca672
 SHA512:
-  metadata.gz: 29defe68539a011531569503d466773eb1ef0c62c8af5252f86707d51337d0c2034706b2fbf31adeb87b9c3cb4384054645bf53d593b306db3229a06c9da83f1
-  data.tar.gz: dcc79395354cf217097e8e158cd5ae57f104d9e635359fb6bc9d192d8bc3d962531eac7f9fd95b9abc14dce523e3f6f8892adb2c26ababf541cd1f38f80cbc73
+  metadata.gz: 6bd4784e6ff2ab8c9a18c8824a5dce8d344b55f4b0c924452d441be9d48fdf995c5733cf35a46724da061d78255b0c8ea476eaa09de36002d35883bc4136135d
+  data.tar.gz: 3f2d360fd9efb8afd3d23a3d41977763e04e5e193e210f04be6d0f863358a36b4dc824d03b41f1cfa32d86c55b328808fa9f20307b907e2dc65d8f73f779a61c

data/lib/dependabot/uv/dependency_grapher.rb

@@ -22,14 +22,35 @@ module Dependabot
 
       # uv.lock is guaranteed to be present when graphing runs - the
       # dependabot-api EcosystemFileDetector only routes UV jobs when it sees
-      # a uv.lock in the repo. We override prepare! to parse uv.lock directly
-      # rather than delegating to FileParser, so the graph reflects only what
-      # uv actually resolved (no requirements.txt / pyproject.toml inputs).
+      # a uv.lock in the repo. We parse uv.lock directly rather than
+      # delegating to FileParser, so the graph reflects only what uv resolved.
       sig { override.void }
       def prepare!
         raise DependabotError, "No uv.lock present; uv graphing requires a lockfile." unless uv_lock
 
-        parsed = TomlRB.parse(T.must(T.must(uv_lock).content))
+        prepare_from_lockfile!
+      end
+
+      private
+
+      sig { override.params(dependency: Dependabot::Dependency).returns(T::Array[String]) }
+      def fetch_subdependencies(dependency)
+        dependency_names = @dependencies.map(&:name)
+        package_relationships.fetch(dependency.name, []).select { |child| dependency_names.include?(child) }
+      end
+
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      def package_relationships
+        @package_relationships ||= T.let(
+          package_relationships_from_lockfile(T.must(T.must(uv_lock).content)),
+          T.nilable(T::Hash[String, T::Array[String]])
+        )
+      end
+
+      sig { void }
+      def prepare_from_lockfile!
+        lockfile = T.must(uv_lock)
+        parsed = TomlRB.parse(lockfile.content)
         packages = T.cast(parsed.fetch("package", []), T::Array[T.untyped])
         manifest = parsed.fetch("manifest", {})
 
@@ -40,8 +61,6 @@ module Dependabot
           build_dependency(pkg, root_names, direct_runtime, direct_dev)
         end
         @prepared = true
-      rescue DependabotError
-        raise
       rescue StandardError => e
         # If uv.lock is unparseable we can't build a graph at all, but we still
         # want the rest of the submission flow to continue (matching the prior
@@ -54,22 +73,6 @@ module Dependabot
         @prepared = true
       end
 
-      private
-
-      sig { override.params(dependency: Dependabot::Dependency).returns(T::Array[String]) }
-      def fetch_subdependencies(dependency)
-        dependency_names = @dependencies.map(&:name)
-        package_relationships.fetch(dependency.name, []).select { |child| dependency_names.include?(child) }
-      end
-
-      sig { returns(T::Hash[String, T::Array[String]]) }
-      def package_relationships
-        @package_relationships ||= T.let(
-          package_relationships_from_lockfile(T.must(T.must(uv_lock).content)),
-          T.nilable(T::Hash[String, T::Array[String]])
-        )
-      end
-
       sig { params(lockfile_content: String).returns(T::Hash[String, T::Array[String]]) }
       def package_relationships_from_lockfile(lockfile_content)
         lockfile_packages(lockfile_content).each_with_object({}) do |package_data, rels|
@@ -269,7 +272,8 @@ module Dependabot
         return @uv_lock if defined?(@uv_lock)
 
         @uv_lock = T.let(
-          dependency_files.find { |f| f.name == "uv.lock" },
+          dependency_files.find { |f| f.name == "uv.lock" } ||
+            dependency_files.find { |f| f.name.end_with?("/uv.lock") },
           T.nilable(Dependabot::DependencyFile)
         )
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.387.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib