dependabot-uv 0.390.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8321e87aabcd72cae64306b506846ed940e8b1209ccacd81b01053f8e8fa60eb
-  data.tar.gz: 3c4321de425ebb554694d0fc3636383978a79f9b8c8a4fdda0d29f6d174ca672
+  metadata.gz: b1c6b85902cc78b5c3624f68a39a32e05a4d5206081bac206d54e8afa732489f
+  data.tar.gz: 401140b860009a2650a5b96fde815fc50f3813ad60104516d5d50c8f9635799c
 SHA512:
-  metadata.gz: e42ae4dad39bee817e1036b3b0eb43d390acb1be78882b4fc691ff13f7508ad0587c83b1ccda1579db016bc3095221bce548c9ac8b377bcd41dde4670d058753
-  data.tar.gz: 3f2d360fd9efb8afd3d23a3d41977763e04e5e193e210f04be6d0f863358a36b4dc824d03b41f1cfa32d86c55b328808fa9f20307b907e2dc65d8f73f779a61c
+  metadata.gz: 399a2740238ae91547e49246a5fd309bfe228d2efbf05f9d8c9699201960158e92e115dd625b940a7a49a7664f683777957a371d9e5326af74823d883947a6f2
+  data.tar.gz: 7a2307ab70008dcbb760977f20c226e3b659df68cc4adf867f237e8196db5fc7462f18a10ef5cfe5ba008d04641cc009e40b8def58596c70b1bc5346e0bae253

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.2.1
 poetry==2.3.4
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.11.8
+uv==0.12.1
 
 # Some dependencies will only install if Cython is present
 Cython==3.2.4

data/lib/dependabot/uv/dependency_grapher.rb

@@ -12,8 +12,8 @@ require "toml-rb"
 module Dependabot
   module Uv
     class DependencyGrapher < Dependabot::DependencyGraphers::Base
-      RUNTIME_GROUP = T.let("dependencies", String)
-      DEV_GROUP = T.let("dev-dependencies", String)
+      RUNTIME_GROUP = "dependencies"
+      DEV_GROUP = "dev-dependencies"
 
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file

data/lib/dependabot/uv/file_fetcher/workspace_fetcher.rb

@@ -12,7 +12,7 @@ module Dependabot
       class WorkspaceFetcher
         extend T::Sig
 
-        README_FILENAMES = T.let(%w(README.md README.rst README.txt README).freeze, T::Array[String])
+        README_FILENAMES = %w(README.md README.rst README.txt README).freeze
 
         sig do
           params(

data/lib/dependabot/uv/file_fetcher.rb

@@ -16,7 +16,7 @@ module Dependabot
     class FileFetcher < Dependabot::Python::SharedFileFetcher
       extend T::Sig
 
-      ECOSYSTEM_SPECIFIC_FILES = T.let(%w(uv.lock).freeze, T::Array[String])
+      ECOSYSTEM_SPECIFIC_FILES = %w(uv.lock).freeze
 
       REQUIREMENT_FILE_PATTERNS = T.let(
         {
@@ -27,7 +27,7 @@ module Dependabot
       )
 
       # Projects that use README files for metadata may use any of these common names
-      README_FILENAMES = T.let(%w(README.md README.rst README.txt README).freeze, T::Array[String])
+      README_FILENAMES = %w(README.md README.rst README.txt README).freeze
 
       # Type alias for path dependency hashes
       PathDependency = T.type_alias { T::Hash[Symbol, String] }

data/lib/dependabot/uv/file_parser/python_requirement_parser.rb

@@ -92,7 +92,7 @@ module Dependabot
           end.reject(&:empty?)
 
           file_version = content_lines.first
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version
@@ -104,7 +104,7 @@ module Dependabot
 
           file_version = T.must(T.must(runtime_file).content)
                           .match(/(?<=python-).*/)&.to_s&.strip
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -26,19 +26,14 @@ module Dependabot
         require_relative "requirement_file_updater"
         require_relative "lock_file_error_handler"
 
-        UNSAFE_PACKAGES = T.let(%w(setuptools distribute pip).freeze, T::Array[String])
-        INCOMPATIBLE_VERSIONS_REGEX = T.let(
-          /There are incompatible versions in the resolved dependencies:.*\z/m,
-          Regexp
-        )
-        WARNINGS = T.let(/\s*# WARNING:.*\Z/m, Regexp)
-        UNSAFE_NOTE = T.let(/\s*# The following packages are considered to be unsafe.*\Z/m, Regexp)
-        RESOLVER_REGEX = T.let(/(?<=--resolver=)(\w+)/, Regexp)
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
-        )
-        PYTHON_VERSION_REGEX = T.let(/--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/, Regexp)
+        UNSAFE_PACKAGES = %w(setuptools distribute pip).freeze
+        INCOMPATIBLE_VERSIONS_REGEX = /There are incompatible versions in the resolved dependencies:.*\z/m
+        WARNINGS = /\s*# WARNING:.*\Z/m
+        UNSAFE_NOTE = /\s*# The following packages are considered to be unsafe.*\Z/m
+        RESOLVER_REGEX = /(?<=--resolver=)(\w+)/
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
+        PYTHON_VERSION_REGEX = /--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/
 
         sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
@@ -58,10 +53,10 @@ module Dependabot
           ).void
         end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @index_urls = index_urls
           @build_isolation = T.let(true, T::Boolean)
         end
 
@@ -183,9 +178,9 @@ module Dependabot
         def update_uncompiled_files(updated_files)
           updated_filenames = updated_files.map(&:name)
           all_old_reqs = T.must(dependency).previous_requirements
-          old_reqs = T.must(all_old_reqs).reject { |r| updated_filenames.include?(r[:file]) }
+          old_reqs = T.must(all_old_reqs).reject { |r| updated_filenames.include?(r.file) }
           all_new_reqs = T.must(dependency).requirements
-          new_reqs = all_new_reqs.reject { |r| updated_filenames.include?(r[:file]) }
+          new_reqs = all_new_reqs.reject { |r| updated_filenames.include?(r.file) }
 
           return [] if new_reqs.none?
 
@@ -288,15 +283,15 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(dependency).previous_requirements
-          old_req = old_req&.find { |r| r[:file] == file.name }
+          old_req = old_req&.find { |r| r.file == file.name }
 
           return file.content unless old_req
-          return file.content if old_req == "==#{T.must(dependency).version}"
+          return file.content if old_req.requirement_string == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
+            old_requirement: old_req.requirement_string,
             new_requirement: "==#{T.must(dependency).version}",
             index_urls: @index_urls
           ).updated_content
@@ -307,17 +302,17 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(dependency).previous_requirements
-          old_req = old_req&.find { |r| r[:file] == file.name }
+          old_req = old_req&.find { |r| r.file == file.name }
           new_req = T.must(dependency).requirements
-          new_req = new_req.find { |r| r[:file] == file.name }
-          return file.content unless old_req&.fetch(:requirement)
+          new_req = new_req.find { |r| r.file == file.name }
+          return file.content unless old_req&.requirement_string
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
-            new_requirement: T.must(new_req)[:requirement],
+            old_requirement: old_req.requirement_string,
+            new_requirement: T.must(T.must(new_req).requirement_string),
             index_urls: @index_urls
           ).updated_content
         end
@@ -552,7 +547,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             T.must(dependency).requirements
-             .map { |r| r[:file] }
+             .filter_map(&:file)
              .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/uv/file_updater/lock_file_error_handler.rb

@@ -11,35 +11,17 @@ module Dependabot
       class LockFileErrorHandler
         extend T::Sig
 
-        UV_UNRESOLVABLE_REGEX = T.let(/× No solution found when resolving dependencies.*[\s\S]*$/, Regexp)
-        UV_BUILD_FAILED_REGEX = T.let(/× Failed to build.*[\s\S]*$/, Regexp)
-        RESOLUTION_IMPOSSIBLE_ERROR = T.let("ResolutionImpossible", String)
-
-        GIT_DEPENDENCY_UNREACHABLE_REGEX = T.let(%r{git clone.*(?<url>https?://[^\s]+)}, Regexp)
-        GIT_REFERENCE_NOT_FOUND_REGEX = T.let(
-          /Did not find branch or tag '(?<tag>[^\n"']+)'/m,
-          Regexp
-        )
-        GIT_CREDENTIALS_ERROR_REGEX = T.let(
-          /could not read Username for '(?<url>[^']+)'/,
-          Regexp
-        )
-        GIT_DEPENDENCY_URL_FROM_UV_REGEX = T.let(
-          %r{git\+(?<url>https?://[^\s@#]+)},
-          Regexp
-        )
-        PYTHON_VERSION_ERROR_REGEX = T.let(
-          /Requires-Python|requires-python|python_requires|Python version/i,
-          Regexp
-        )
-        AUTH_ERROR_REGEX = T.let(
-          /authentication|unauthorized|forbidden|HTTP status code: 40[13]/i,
-          Regexp
-        )
-        TIMEOUT_ERROR_REGEX = T.let(
-          /timed?\s*out|connection.*reset|read timeout|connect timeout/i,
-          Regexp
-        )
+        UV_UNRESOLVABLE_REGEX = /× No solution found when resolving dependencies.*[\s\S]*$/
+        UV_BUILD_FAILED_REGEX = /× Failed to build.*[\s\S]*$/
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+
+        GIT_DEPENDENCY_UNREACHABLE_REGEX = %r{git clone.*(?<url>https?://[^\s]+)}
+        GIT_REFERENCE_NOT_FOUND_REGEX = /Did not find branch or tag '(?<tag>[^\n"']+)'/m
+        GIT_CREDENTIALS_ERROR_REGEX = /could not read Username for '(?<url>[^']+)'/
+        GIT_DEPENDENCY_URL_FROM_UV_REGEX = %r{git\+(?<url>https?://[^\s@#]+)}
+        PYTHON_VERSION_ERROR_REGEX = /Requires-Python|requires-python|python_requires|Python version/i
+        AUTH_ERROR_REGEX = /authentication|unauthorized|forbidden|HTTP status code: 40[13]/i
+        TIMEOUT_ERROR_REGEX = /timed?\s*out|connection.*reset|read timeout|connect timeout/i
         NETWORK_ERROR_REGEX = T.let(
           Regexp.union(
             /ConnectionError/i,
@@ -52,39 +34,17 @@ module Dependabot
           ),
           Regexp
         )
-        PACKAGE_NOT_FOUND_REGEX = T.let(
-          /No matching distribution found|package.*not found|No versions found/i,
-          Regexp
-        )
-        UV_REQUIRED_VERSION_REGEX = T.let(
-          /Required uv version `(?<required>[^`]+)` does not match the running version `(?<running>[^`]+)`/,
-          Regexp
-        )
-        TOML_PARSE_ERROR_REGEX = T.let(
-          /Failed to parse:?\s*`?(?<file>[^`\n]+\.toml)`?|TOML parse error/i,
-          Regexp
-        )
+        PACKAGE_NOT_FOUND_REGEX = /No matching distribution found|package.*not found|No versions found/i
+        UV_REQUIRED_VERSION_REGEX =
+          /Required uv version `(?<required>[^`]+)` does not match the running version `(?<running>[^`]+)`/
+        TOML_PARSE_ERROR_REGEX = /Failed to parse:?\s*`?(?<file>[^`\n]+\.toml)`?|TOML parse error/i
         # uv prefixes errors with interpreter info that should be stripped
-        USING_CPYTHON_LINE_REGEX = T.let(
-          /\AUsing CPython \S+ interpreter at: [^\n]+\n?/,
-          Regexp
-        )
-        PYPROJECT_SCHEMA_ERROR_REGEX = T.let(
-          /missing field `project`|missing.*\[project\].*table|Field `project\.name` is required/i,
-          Regexp
-        )
-        WORKSPACE_MEMBER_ERROR_REGEX = T.let(
-          /Failed to find workspace member|No `pyproject\.toml` found in workspace member/i,
-          Regexp
-        )
-        PATH_DEPENDENCY_ERROR_REGEX = T.let(
-          /Failed to read `(?<path>[^`]+)`|failed to read from file `(?<path>[^`]+)`/i,
-          Regexp
-        )
-        HTTP_STATUS_ERROR_REGEX = T.let(
-          /HTTP status code: (?<code>\d{3})/i,
-          Regexp
-        )
+        USING_CPYTHON_LINE_REGEX = /\AUsing CPython \S+ interpreter at: [^\n]+\n?/
+        PYPROJECT_SCHEMA_ERROR_REGEX =
+          /missing field `project`|missing.*\[project\].*table|Field `project\.name` is required/i
+        WORKSPACE_MEMBER_ERROR_REGEX = /Failed to find workspace member|No `pyproject\.toml` found in workspace member/i
+        PATH_DEPENDENCY_ERROR_REGEX = /Failed to read `(?<path>[^`]+)`|failed to read from file `(?<path>[^`]+)`/i
+        HTTP_STATUS_ERROR_REGEX = /HTTP status code: (?<code>\d{3})/i
         UV_MISCONFIGURED_REGEX = T.let(
           Regexp.union(
             /unknown field `[^`]+`, expected one of/i,
@@ -100,7 +60,7 @@ module Dependabot
         # This limit ensures error messages remain readable while providing enough
         # context for debugging. Most uv error messages convey the key information
         # within the first few lines.
-        MAX_ERROR_LINES = T.let(10, Integer)
+        MAX_ERROR_LINES = 10
 
         sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
         def handle_uv_error(error)

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -3,6 +3,7 @@
 
 require "toml-rb"
 require "open3"
+require "uri"
 require "dependabot/dependency"
 require "dependabot/shared_helpers"
 require "dependabot/uv/language_version_manager"
@@ -83,7 +84,7 @@ module Dependabot
         def build_system_only_dependency?
           return false unless dependency
 
-          groups = T.must(dependency).requirements.flat_map { |req| req[:groups] || [] }.compact.uniq
+          groups = T.must(dependency).requirements.flat_map { |req| req.groups || [] }.compact.uniq
           return false if groups.empty?
 
           groups.all?("build-system")
@@ -132,7 +133,7 @@ module Dependabot
           updated_content = content.dup
 
           T.must(dependency).requirements.zip(T.must(T.must(dependency).previous_requirements)).each do |new_r, old_r|
-            next unless new_r[:file] == file.name && T.must(old_r)[:file] == file.name
+            next unless new_r.file == file.name && T.must(old_r).file == file.name
 
             updated_content = replace_dep(T.must(dependency), updated_content, new_r, T.must(old_r))
           end
@@ -146,13 +147,13 @@ module Dependabot
           params(
             dep: Dependabot::Dependency,
             content: String,
-            new_r: T::Hash[Symbol, T.untyped],
-            old_r: T::Hash[Symbol, T.untyped]
+            new_r: Dependabot::DependencyRequirement,
+            old_r: Dependabot::DependencyRequirement
           ).returns(String)
         end
         def replace_dep(dep, content, new_r, old_r)
-          new_req = new_r[:requirement]
-          old_req = old_r[:requirement]
+          new_req = new_r.requirement_string
+          old_req = old_r.requirement_string
           escaped_name = escape_package_name(dep.name)
 
           regex = /(["']#{escaped_name})([^"']+)(["'])/x
@@ -399,9 +400,12 @@ module Dependabot
             .reject { |cred| skip_lock_index_credential?(cred) }
         end
 
+        # Skip credentials whose index is already declared in pyproject.toml; those are
+        # authenticated via UV_INDEX_<NAME>_* env vars (see #pyproject_index_env_vars) so uv
+        # uses the pyproject.toml index entry directly, avoiding a duplicate --index flag.
         sig { params(credential: Dependabot::Credential).returns(T::Boolean) }
         def skip_lock_index_credential?(credential)
-          credential.replaces_base? ? defined_in_pyproject?(credential) : explicit_index?(credential)
+          defined_in_pyproject?(credential)
         end
 
         sig do
@@ -504,16 +508,6 @@ module Dependabot
           []
         end
 
-        sig { params(credential: Dependabot::Credential).returns(T::Boolean) }
-        def explicit_index?(credential)
-          return false if credential.replaces_base?
-
-          cred_url = normalize_index_url(credential["index-url"].to_s)
-          uv_indices.any? do |_name, config|
-            config["explicit"] == true && normalize_index_url(config["url"].to_s) == cred_url
-          end
-        end
-
         # Checks if a credential's index URL matches any index defined in pyproject.toml.
         # When true, authentication is provided via env vars so uv uses the pyproject.toml URL,
         # preserving URL format alignment between pyproject.toml and uv.lock.
@@ -522,8 +516,15 @@ module Dependabot
           !find_index_name_for_credential(credential).nil?
         end
 
+        # Strips trailing slashes and any embedded userinfo so a pyproject.toml URL like
+        # https://oauth2accesstoken@host/path matches a credential URL like https://host/path.
         sig { params(url: String).returns(String) }
         def normalize_index_url(url)
+          uri = URI.parse(url.chomp("/"))
+          uri.user = nil
+          uri.password = nil
+          uri.to_s
+        rescue URI::InvalidURIError
           url.chomp("/")
         end
 
@@ -545,8 +546,7 @@ module Dependabot
             next unless name
 
             result[name] = {
-              "url" => index["url"],
-              "explicit" => index["explicit"] == true
+              "url" => index["url"]
             }
           end
         rescue TomlRB::ParseError
@@ -634,7 +634,7 @@ module Dependabot
           return false unless file
 
           dependencies.any? do |dep|
-            dep.requirements.any? { |r| r[:file] == file.name } &&
+            dep.requirements.any? { |r| r.file == file.name } &&
               requirement_changed?(file, dep)
           end
         end
@@ -647,7 +647,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == T.must(file).name }
+          changed_requirements.any? { |f| f.file == T.must(file).name }
         end
 
         sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }
@@ -719,7 +719,7 @@ module Dependabot
         def create_or_update_lock_file?
           return true if lockfile && T.must(dependency).requirements.empty?
 
-          T.must(dependency).requirements.select { _1[:file].end_with?(*REQUIRED_FILES) }.any?
+          T.must(dependency).requirements.any? { |req| req.file&.end_with?(*REQUIRED_FILES) }
         end
 
         sig { returns(T::Hash[String, String]) }

data/lib/dependabot/uv/requirement_suffix_helper.rb

@@ -8,13 +8,10 @@ module Dependabot
     module RequirementSuffixHelper
       extend T::Sig
 
-      REQUIREMENT_SUFFIX_REGEX = T.let(
-        Regexp.new(
-          "\\A(?<requirement>.*?)(?<suffix>\\s*(?:;|#).*)?\\z",
-          Regexp::MULTILINE
-        ).freeze,
-        Regexp
-      )
+      REQUIREMENT_SUFFIX_REGEX = Regexp.new(
+        "\\A(?<requirement>.*?)(?<suffix>\\s*(?:;|#).*)?\\z",
+        Regexp::MULTILINE
+      ).freeze
 
       sig { params(segment: String).returns(T::Array[String]) }
       def self.split(segment)

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -28,26 +28,18 @@ module Dependabot
       class PipCompileVersionResolver
         extend T::Sig
 
-        GIT_DEPENDENCY_UNREACHABLE_REGEX = T.let(/git clone --filter=blob:none --quiet (?<url>[^\s]+).* /, Regexp)
-        GIT_REFERENCE_NOT_FOUND_REGEX = T.let(/Did not find branch or tag '(?<tag>[^\n"]+)'/m, Regexp)
-        GIT_CREDENTIALS_ERROR_REGEX = T.let(
-          /could not read Username for '(?<url>[^']+)'/,
-          Regexp
-        )
-        GIT_DEPENDENCY_URL_FROM_UV_REGEX = T.let(
-          %r{git\+(?<url>https?://[^\s@#]+)},
-          Regexp
-        )
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
-        )
+        GIT_DEPENDENCY_UNREACHABLE_REGEX = /git clone --filter=blob:none --quiet (?<url>[^\s]+).* /
+        GIT_REFERENCE_NOT_FOUND_REGEX = /Did not find branch or tag '(?<tag>[^\n"]+)'/m
+        GIT_CREDENTIALS_ERROR_REGEX = /could not read Username for '(?<url>[^']+)'/
+        GIT_DEPENDENCY_URL_FROM_UV_REGEX = %r{git\+(?<url>https?://[^\s@#]+)}
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
         # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#configuring-metadata
-        PYTHON_PACKAGE_NAME_REGEX = T.let(/[A-Za-z0-9_\-]+/, Regexp)
-        RESOLUTION_IMPOSSIBLE_ERROR = T.let("ResolutionImpossible", String)
-        ERROR_REGEX = T.let(/(?<=ERROR\:\W).*$/, Regexp)
-        UV_UNRESOLVABLE_REGEX = T.let(/ × No solution found when resolving dependencies:[\s\S]*$/, Regexp)
-        PYTHON_VERSION_REGEX = T.let(/--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/, Regexp)
+        PYTHON_PACKAGE_NAME_REGEX = /[A-Za-z0-9_\-]+/
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+        ERROR_REGEX = /(?<=ERROR\:\W).*$/
+        UV_UNRESOLVABLE_REGEX = / × No solution found when resolving dependencies:[\s\S]*$/
+        PYTHON_VERSION_REGEX = /--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
@@ -73,10 +65,10 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency               = T.let(dependency, Dependabot::Dependency)
-          @dependency_files         = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials              = T.let(credentials, T::Array[Dependabot::Credential])
-          @repo_contents_path       = T.let(repo_contents_path, T.nilable(String))
+          @dependency               = dependency
+          @dependency_files         = dependency_files
+          @credentials              = credentials
+          @repo_contents_path       = repo_contents_path
           @build_isolation = T.let(true, T::Boolean)
           @error_handler = T.let(PipCompileErrorHandler.new, PipCompileErrorHandler)
         end
@@ -417,14 +409,14 @@ module Dependabot
         def update_req_file(file, updated_req)
           return T.must(file.content) unless file.name.end_with?(".in")
 
-          req = dependency.requirements.find { |r| r[:file] == file.name }
+          req = dependency.requirements.find { |r| r.file == file.name }
 
-          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.fetch(:requirement)
+          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.requirement_string
 
           Uv::FileUpdater::RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: dependency.name,
-            old_requirement: req[:requirement],
+            old_requirement: req.requirement_string,
             new_requirement: updated_req
           ).updated_content
         end
@@ -462,7 +454,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             dependency.requirements
-                      .map { |r| r[:file] }
+                      .filter_map(&:file)
                       .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =
@@ -609,13 +601,13 @@ module Dependabot
     class PipCompileErrorHandler
       extend T::Sig
 
-      SUBPROCESS_ERROR = T.let(/subprocess-exited-with-error/, Regexp)
+      SUBPROCESS_ERROR = /subprocess-exited-with-error/
 
-      INSTALLATION_ERROR = T.let(/InstallationError/, Regexp)
+      INSTALLATION_ERROR = /InstallationError/
 
-      INSTALLATION_SUBPROCESS_ERROR = T.let(/InstallationSubprocessError/, Regexp)
+      INSTALLATION_SUBPROCESS_ERROR = /InstallationSubprocessError/
 
-      HASH_MISMATCH = T.let(/HashMismatch/, Regexp)
+      HASH_MISMATCH = /HashMismatch/
 
       sig { params(error: String).void }
       def handle_pipcompile_error(error)

data/lib/dependabot/uv/update_checker.rb

@@ -98,10 +98,9 @@ module Dependabot
         raise "Claimed to be a sub-dependency, but no lockfile exists!"
       end
 
-      sig { override.params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
+      sig { override.params(reqs: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def exact_requirement?(reqs)
-        reqs = reqs.map { |r| r.fetch(:requirement) }
-        reqs = reqs.compact
+        reqs = reqs.filter_map(&:requirement_string)
         reqs = reqs.flat_map { |r| r.split(",").map(&:strip) }
         reqs.any? { |r| Uv::Requirement.new(r).exact? }
       end
@@ -157,12 +156,13 @@ module Dependabot
         return if reqs.none?
 
         requirement = reqs.find do |r|
-          file = r[:file]
+          file = r.file
+          next false unless file
 
           file == "uv.lock" || file.end_with?("pyproject.toml") || file.end_with?(".in") || file.end_with?(".txt")
         end
 
-        requirement&.fetch(:requirement)
+        requirement&.requirement_string
       end
 
       sig { override.returns(String) }
@@ -187,7 +187,7 @@ module Dependabot
         return ">=#{dependency.version}" if dependency.version
 
         version_for_requirement =
-          requirements.filter_map { |r| r[:requirement] }
+          requirements.filter_map(&:requirement_string)
                       .reject { |req_string| req_string.start_with?("<") }
                       .select { |req_string| req_string.match?(VERSION_REGEX) }
                       .map { |req_string| req_string.match(VERSION_REGEX).to_s }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib