dependabot-uv 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8aae027d8e4328d4979db8067b5fc2a0c277a257e3bcf2394620a175f1b34273
-  data.tar.gz: 6defb5dddfbdcf1e698061faa33c0ad8e62fc92d6784ec3202c0bfbb7b2be708
+  metadata.gz: b0b2c86fecd6361c11d682fd96da7135b08179f251f7a524d045824341ccbe9e
+  data.tar.gz: df43361f2dd0a76a17da2a6ea510086da7adadbe859d1d91975be7ebe84a61bc
 SHA512:
-  metadata.gz: 83215549f85c5492a144f50e6ed0c3588ba6aa64cf023aa749f629197319e1b5b8fdd001cf07874ba108d20ed107c579dcb753c1edfc8205f2a2b6cc274b9375
-  data.tar.gz: e84514279e143ae6125742d75d11b6b4d24262d2e7b423972be2e1132a8f82d77560e067bd1d1dff2aceecd7de892afc6428cefde84e32665f59ca7ab889e0cb
+  metadata.gz: 3117ccb8929d12b1caff2b31607e8b459fbb61008495f3f9c5b195e7d4b888cabd0d2b47de2535d130660db0b4fe51fc2aede86b856bcd237d5f3e2eb20da37b
+  data.tar.gz: 162286da713782ed33c25c4fcea096c4365edcf219ad4da6bb93812fd64792a569e92e86b3c20d4f8814f10f141b1bf010ba0c3cf44a3c6e553c814e1006aad2

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.2.1
 poetry==2.3.4
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.11.31
+uv==0.12.1
 
 # Some dependencies will only install if Cython is present
 Cython==3.2.4

data/lib/dependabot/uv/file_fetcher/workspace_fetcher.rb

@@ -277,8 +277,8 @@ module Dependabot
           normalized_directory = directory.gsub(%r{(^/|/$)}, "")
 
           repo_contents(dir: base_dir, raise_errors: false)
-            .select { |file| T.unsafe(file).type == "dir" }
-            .map { |f| T.unsafe(f).path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
+            .select { |file| file.type == "dir" }
+            .map { |file| file.path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
         end
 
         sig { params(paths: T::Array[String], pattern: String).returns(T::Array[String]) }

data/lib/dependabot/uv/file_fetcher.rb

@@ -276,7 +276,7 @@ module Dependabot
       def req_files_for_dir(requirements_dir)
         dir = directory.gsub(%r{(^/|/$)}, "")
         relative_reqs_dir =
-          requirements_dir.path&.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
+          requirements_dir.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
 
         fetch_requirement_files_from_path(relative_reqs_dir)
       end
@@ -321,7 +321,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_requirement_files_from_dirs
         repo_contents
-          .select { |f| T.unsafe(f).type == "dir" }
+          .select { |f| f.type == "dir" }
           .flat_map { |dir| req_files_for_dir(dir) }
       end
 
@@ -333,10 +333,10 @@ module Dependabot
       end
       def filter_requirement_files(contents, base_path: nil)
         contents
-          .select { |f| T.unsafe(f).type == "file" }
-          .select { |f| file_matches_requirement_pattern?(T.unsafe(f).name) }
-          .reject { |f| T.unsafe(f).size > MAX_FILE_SIZE }
-          .map { |f| fetch_file_with_path(T.unsafe(f).name, base_path) }
+          .select { |f| f.type == "file" }
+          .select { |f| file_matches_requirement_pattern?(f.name) }
+          .reject { |f| f.size > MAX_FILE_SIZE }
+          .map { |f| fetch_file_with_path(f.name, base_path) }
           .select { |f| T.must(REQUIREMENT_FILE_PATTERNS[:filenames]).include?(f.name) || requirements_file?(f) }
       end
 

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -109,7 +109,53 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         def workspace_member_pyproject_files
-          dependency_files.select { |file| file.support_file? && file.name.end_with?("pyproject.toml") }
+          return [] if workspace_member_patterns.empty?
+
+          dependency_files.select do |file|
+            next false unless file.support_file? && file.name.end_with?("pyproject.toml")
+
+            workspace_member_file?(file)
+          end
+        end
+
+        # Only pyprojects declared under `[tool.uv.workspace].members` in the root
+        # manifest are true workspace members whose requirements should be updated.
+        # Editable `[tool.uv.sources]` path dependencies are separate packages that
+        # are fetched as support files for resolution but must not be modified.
+        sig { returns(T::Array[String]) }
+        def workspace_member_patterns
+          workspace_globs("members")
+        end
+
+        # uv removes paths matching `[tool.uv.workspace].exclude` after expanding
+        # `members`, so an excluded directory is not a workspace member even when it
+        # matches a `members` glob.
+        sig { returns(T::Array[String]) }
+        def workspace_exclude_patterns
+          workspace_globs("exclude")
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          return [] unless pyproject
+
+          globs = parsed_pyproject.dig("tool", "uv", "workspace", key)
+          globs.is_a?(Array) ? globs.grep(String) : []
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def workspace_member_file?(file)
+          member_dir = File.dirname(file.name)
+
+          return false if workspace_exclude_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+
+          workspace_member_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+        end
+
+        sig { params(pattern: String, dir: String).returns(T::Boolean) }
+        def glob_matches_dir?(pattern, dir)
+          normalized_pattern = pattern.gsub(%r{^\./}, "").chomp("/")
+          File.fnmatch?(normalized_pattern, dir, File::FNM_PATHNAME)
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -178,9 +178,9 @@ module Dependabot
         def update_uncompiled_files(updated_files)
           updated_filenames = updated_files.map(&:name)
           all_old_reqs = T.must(dependency).previous_requirements
-          old_reqs = T.must(all_old_reqs).reject { |r| updated_filenames.include?(r[:file]) }
+          old_reqs = T.must(all_old_reqs).reject { |r| updated_filenames.include?(r.file) }
           all_new_reqs = T.must(dependency).requirements
-          new_reqs = all_new_reqs.reject { |r| updated_filenames.include?(r[:file]) }
+          new_reqs = all_new_reqs.reject { |r| updated_filenames.include?(r.file) }
 
           return [] if new_reqs.none?
 
@@ -283,15 +283,15 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(dependency).previous_requirements
-          old_req = old_req&.find { |r| r[:file] == file.name }
+          old_req = old_req&.find { |r| r.file == file.name }
 
           return file.content unless old_req
-          return file.content if old_req == "==#{T.must(dependency).version}"
+          return file.content if old_req.requirement_string == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
+            old_requirement: old_req.requirement_string,
             new_requirement: "==#{T.must(dependency).version}",
             index_urls: @index_urls
           ).updated_content
@@ -302,17 +302,17 @@ module Dependabot
           return file.content unless file.name.end_with?(".in")
 
           old_req = T.must(dependency).previous_requirements
-          old_req = old_req&.find { |r| r[:file] == file.name }
+          old_req = old_req&.find { |r| r.file == file.name }
           new_req = T.must(dependency).requirements
-          new_req = new_req.find { |r| r[:file] == file.name }
-          return file.content unless old_req&.fetch(:requirement)
+          new_req = new_req.find { |r| r.file == file.name }
+          return file.content unless old_req&.requirement_string
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: T.must(dependency).name,
-            old_requirement: old_req[:requirement],
-            new_requirement: T.must(new_req)[:requirement],
+            old_requirement: old_req.requirement_string,
+            new_requirement: T.must(T.must(new_req).requirement_string),
             index_urls: @index_urls
           ).updated_content
         end
@@ -547,7 +547,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             T.must(dependency).requirements
-             .map { |r| r[:file] }
+             .filter_map(&:file)
              .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -84,7 +84,7 @@ module Dependabot
         def build_system_only_dependency?
           return false unless dependency
 
-          groups = T.must(dependency).requirements.flat_map { |req| req[:groups] || [] }.compact.uniq
+          groups = T.must(dependency).requirements.flat_map { |req| req.groups || [] }.compact.uniq
           return false if groups.empty?
 
           groups.all?("build-system")
@@ -133,7 +133,7 @@ module Dependabot
           updated_content = content.dup
 
           T.must(dependency).requirements.zip(T.must(T.must(dependency).previous_requirements)).each do |new_r, old_r|
-            next unless new_r[:file] == file.name && T.must(old_r)[:file] == file.name
+            next unless new_r.file == file.name && T.must(old_r).file == file.name
 
             updated_content = replace_dep(T.must(dependency), updated_content, new_r, T.must(old_r))
           end
@@ -147,13 +147,13 @@ module Dependabot
           params(
             dep: Dependabot::Dependency,
             content: String,
-            new_r: T::Hash[Symbol, T.untyped],
-            old_r: T::Hash[Symbol, T.untyped]
+            new_r: Dependabot::DependencyRequirement,
+            old_r: Dependabot::DependencyRequirement
           ).returns(String)
         end
         def replace_dep(dep, content, new_r, old_r)
-          new_req = new_r[:requirement]
-          old_req = old_r[:requirement]
+          new_req = new_r.requirement_string
+          old_req = old_r.requirement_string
           escaped_name = escape_package_name(dep.name)
 
           regex = /(["']#{escaped_name})([^"']+)(["'])/x
@@ -634,7 +634,7 @@ module Dependabot
           return false unless file
 
           dependencies.any? do |dep|
-            dep.requirements.any? { |r| r[:file] == file.name } &&
+            dep.requirements.any? { |r| r.file == file.name } &&
               requirement_changed?(file, dep)
           end
         end
@@ -647,7 +647,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == T.must(file).name }
+          changed_requirements.any? { |f| f.file == T.must(file).name }
         end
 
         sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }
@@ -719,7 +719,7 @@ module Dependabot
         def create_or_update_lock_file?
           return true if lockfile && T.must(dependency).requirements.empty?
 
-          T.must(dependency).requirements.any? { _1[:file].end_with?(*REQUIRED_FILES) }
+          T.must(dependency).requirements.any? { |req| req.file&.end_with?(*REQUIRED_FILES) }
         end
 
         sig { returns(T::Hash[String, String]) }

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -409,14 +409,14 @@ module Dependabot
         def update_req_file(file, updated_req)
           return T.must(file.content) unless file.name.end_with?(".in")
 
-          req = dependency.requirements.find { |r| r[:file] == file.name }
+          req = dependency.requirements.find { |r| r.file == file.name }
 
-          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.fetch(:requirement)
+          return T.must(file.content) + "\n#{dependency.name} #{updated_req}" unless req&.requirement_string
 
           Uv::FileUpdater::RequirementReplacer.new(
             content: T.must(file.content),
             dependency_name: dependency.name,
-            old_requirement: req[:requirement],
+            old_requirement: req.requirement_string,
             new_requirement: updated_req
           ).updated_content
         end
@@ -454,7 +454,7 @@ module Dependabot
         def filenames_to_compile
           files_from_reqs =
             dependency.requirements
-                      .map { |r| r[:file] }
+                      .filter_map(&:file)
                       .select { |fn| fn.end_with?(".in") }
 
           files_from_compiled_files =

data/lib/dependabot/uv/update_checker.rb

@@ -98,10 +98,9 @@ module Dependabot
         raise "Claimed to be a sub-dependency, but no lockfile exists!"
       end
 
-      sig { override.params(reqs: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Boolean) }
+      sig { override.params(reqs: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def exact_requirement?(reqs)
-        reqs = reqs.map { |r| r.fetch(:requirement) }
-        reqs = reqs.compact
+        reqs = reqs.filter_map(&:requirement_string)
         reqs = reqs.flat_map { |r| r.split(",").map(&:strip) }
         reqs.any? { |r| Uv::Requirement.new(r).exact? }
       end
@@ -157,12 +156,13 @@ module Dependabot
         return if reqs.none?
 
         requirement = reqs.find do |r|
-          file = r[:file]
+          file = r.file
+          next false unless file
 
           file == "uv.lock" || file.end_with?("pyproject.toml") || file.end_with?(".in") || file.end_with?(".txt")
         end
 
-        requirement&.fetch(:requirement)
+        requirement&.requirement_string
       end
 
       sig { override.returns(String) }
@@ -187,7 +187,7 @@ module Dependabot
         return ">=#{dependency.version}" if dependency.version
 
         version_for_requirement =
-          requirements.filter_map { |r| r[:requirement] }
+          requirements.filter_map(&:requirement_string)
                       .reject { |req_string| req_string.start_with?("<") }
                       .select { |req_string| req_string.match?(VERSION_REGEX) }
                       .map { |req_string| req_string.match(VERSION_REGEX).to_s }
@@ -213,29 +213,6 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Boolean) }
-      def library?
-        return false unless updating_pyproject?
-        return false unless library_details
-
-        return false if T.must(library_details)["name"].nil?
-
-        # Hit PyPi and check whether there are details for a library with a
-        # matching name and description
-        index_response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
-        )
-
-        return false unless index_response.status == 200
-
-        pypi_info = JSON.parse(index_response.body)["info"] || {}
-        pypi_info["summary"] == T.must(library_details)["description"]
-      rescue Excon::Error::Timeout, Excon::Error::Socket
-        false
-      rescue URI::InvalidURIError
-        false
-      end
-
       sig { returns(T::Boolean) }
       def updating_pyproject?
         requirement_files.any? { |file| file.end_with?("pyproject.toml") }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib