dependabot-uv 0.392.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1c6b85902cc78b5c3624f68a39a32e05a4d5206081bac206d54e8afa732489f
-  data.tar.gz: 401140b860009a2650a5b96fde815fc50f3813ad60104516d5d50c8f9635799c
+  metadata.gz: f9eee59202ca318e612e23d7303309e498d51999cda642a1660d41390a2bd4a8
+  data.tar.gz: 3b3bb2ea60f190db5d8c9bd36f1ff01531097788c3755c6638d5a4e8e3ebf923
 SHA512:
-  metadata.gz: 399a2740238ae91547e49246a5fd309bfe228d2efbf05f9d8c9699201960158e92e115dd625b940a7a49a7664f683777957a371d9e5326af74823d883947a6f2
-  data.tar.gz: 7a2307ab70008dcbb760977f20c226e3b659df68cc4adf867f237e8196db5fc7462f18a10ef5cfe5ba008d04641cc009e40b8def58596c70b1bc5346e0bae253
+  metadata.gz: 2f6d9c0f1ea2c05bab8acea5563a4a74c016ab9b8bd77639afe9468a8f7b8cb18d238585b5bdc11b255bf8e8d0af01d7d470c07ab9b83792d8001156bb73a199
+  data.tar.gz: '09c83e67c0b94adf7ad3f848f17521b57e282ef33db9d4ac0b5991d0ea8135024fc9eb5e78a1515a7f9f4c826f8db3347e25b24ed842ed85681a0b3dd8289e94'

data/helpers/requirements.txt

@@ -1,13 +1,13 @@
-pip==26.1.1
-pip-tools==7.5.3
+pip==26.2.1
+pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.3.4
+poetry==2.4.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.1
+uv==0.12.5
 
 # Some dependencies will only install if Cython is present
-Cython==3.2.4
+Cython==3.3.0

data/lib/dependabot/uv/file_fetcher/workspace_fetcher.rb

@@ -277,8 +277,8 @@ module Dependabot
           normalized_directory = directory.gsub(%r{(^/|/$)}, "")
 
           repo_contents(dir: base_dir, raise_errors: false)
-            .select { |file| T.unsafe(file).type == "dir" }
-            .map { |f| T.unsafe(f).path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
+            .select { |file| file.type == "dir" }
+            .map { |file| file.path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
         end
 
         sig { params(paths: T::Array[String], pattern: String).returns(T::Array[String]) }

data/lib/dependabot/uv/file_fetcher.rb

@@ -276,7 +276,7 @@ module Dependabot
       def req_files_for_dir(requirements_dir)
         dir = directory.gsub(%r{(^/|/$)}, "")
         relative_reqs_dir =
-          requirements_dir.path&.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
+          requirements_dir.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
 
         fetch_requirement_files_from_path(relative_reqs_dir)
       end
@@ -321,7 +321,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_requirement_files_from_dirs
         repo_contents
-          .select { |f| T.unsafe(f).type == "dir" }
+          .select { |f| f.type == "dir" }
           .flat_map { |dir| req_files_for_dir(dir) }
       end
 
@@ -333,10 +333,10 @@ module Dependabot
       end
       def filter_requirement_files(contents, base_path: nil)
         contents
-          .select { |f| T.unsafe(f).type == "file" }
-          .select { |f| file_matches_requirement_pattern?(T.unsafe(f).name) }
-          .reject { |f| T.unsafe(f).size > MAX_FILE_SIZE }
-          .map { |f| fetch_file_with_path(T.unsafe(f).name, base_path) }
+          .select { |f| f.type == "file" }
+          .select { |f| file_matches_requirement_pattern?(f.name) }
+          .reject { |f| f.size > MAX_FILE_SIZE }
+          .map { |f| fetch_file_with_path(f.name, base_path) }
           .select { |f| T.must(REQUIREMENT_FILE_PATTERNS[:filenames]).include?(f.name) || requirements_file?(f) }
       end
 

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -9,6 +9,9 @@ require "dependabot/uv/file_parser"
 require "dependabot/uv/requirement"
 require "dependabot/errors"
 require "dependabot/uv/name_normaliser"
+require "dependabot/python/file_parser/pep_dependency"
+require "dependabot/python/file_parser/poetry_lock"
+require "dependabot/python/file_parser/pyproject_document"
 
 module Dependabot
   module Uv
@@ -16,6 +19,10 @@ module Dependabot
       class PyprojectFilesParser
         extend T::Sig
 
+        PepDependency = Dependabot::Python::FileParser::PepDependency
+        PoetryLock = Dependabot::Python::FileParser::PoetryLock
+        PyprojectDocument = Dependabot::Python::FileParser::PyprojectDocument
+
         POETRY_DEPENDENCY_TYPES = %w(dependencies dev-dependencies).freeze
 
         # https://python-poetry.org/docs/dependency-specification/
@@ -24,6 +31,8 @@ module Dependabot
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
+          @pyproject_document = T.let(nil, T.nilable(PyprojectDocument))
+          @poetry_lock_document = T.let(nil, T.nilable(PoetryLock))
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -61,13 +70,11 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           POETRY_DEPENDENCY_TYPES.each do |type|
-            deps_hash = T.must(poetry_root)[type] || {}
-            dependencies += parse_poetry_dependency_group(type, deps_hash)
+            dependencies += parse_poetry_dependency_group(type, pyproject_document.poetry_dependencies(type))
           end
 
-          groups = T.must(poetry_root)["group"] || {}
-          groups.each do |group, group_spec|
-            dependencies += parse_poetry_dependency_group(group, group_spec["dependencies"])
+          pyproject_document.poetry_groups.each do |group, dependencies_by_name|
+            dependencies += parse_poetry_dependency_group(group, dependencies_by_name)
           end
           dependencies
         end
@@ -85,20 +92,20 @@ module Dependabot
           parse_pep621_pep735_dependencies(pyproject_file).each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
-            next if dep["markers"]&.include?("<")
+            next if dep.markers&.include?("<")
 
             # In uv no constraint means any version is acceptable
-            requirement_value = dep["requirement"] && dep["requirement"].empty? ? "*" : dep["requirement"]
+            requirement_value = dep.requirement == "" ? "*" : dep.requirement
 
             dependencies <<
               Dependency.new(
-                name: normalised_name(dep["name"], dep["extras"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
+                name: normalised_name(dep.name, dep.extras),
+                version: dep.version&.include?("*") ? nil : dep.version,
                 requirements: [{
                   requirement: requirement_value,
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
+                  file: Pathname.new(dep.file).cleanpath.to_path,
                   source: nil,
-                  groups: [dep["requirement_type"]].compact
+                  groups: [dep.requirement_type].compact
                 }],
                 package_manager: "uv"
               )
@@ -109,7 +116,52 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         def workspace_member_pyproject_files
-          dependency_files.select { |file| file.support_file? && file.name.end_with?("pyproject.toml") }
+          return [] if workspace_member_patterns.empty?
+
+          dependency_files.select do |file|
+            next false unless file.support_file? && file.name.end_with?("pyproject.toml")
+
+            workspace_member_file?(file)
+          end
+        end
+
+        # Only pyprojects declared under `[tool.uv.workspace].members` in the root
+        # manifest are true workspace members whose requirements should be updated.
+        # Editable `[tool.uv.sources]` path dependencies are separate packages that
+        # are fetched as support files for resolution but must not be modified.
+        sig { returns(T::Array[String]) }
+        def workspace_member_patterns
+          workspace_globs("members")
+        end
+
+        # uv removes paths matching `[tool.uv.workspace].exclude` after expanding
+        # `members`, so an excluded directory is not a workspace member even when it
+        # matches a `members` glob.
+        sig { returns(T::Array[String]) }
+        def workspace_exclude_patterns
+          workspace_globs("exclude")
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          return [] unless pyproject
+
+          pyproject_document.workspace_globs(key)
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def workspace_member_file?(file)
+          member_dir = File.dirname(file.name)
+
+          return false if workspace_exclude_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+
+          workspace_member_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+        end
+
+        sig { params(pattern: String, dir: String).returns(T::Boolean) }
+        def glob_matches_dir?(pattern, dir)
+          normalized_pattern = pattern.gsub(%r{^\./}, "").chomp("/")
+          File.fnmatch?(normalized_pattern, dir, File::FNM_PATHNAME)
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -126,17 +178,16 @@ module Dependabot
         sig do
           params(
             type: String,
-            deps_hash: T::Hash[String,
-                               T.untyped]
+            deps_hash: PyprojectDocument::PoetryDependencyMap
           ).returns(Dependabot::FileParsers::Base::DependencySet)
         end
         def parse_poetry_dependency_group(type, deps_hash)
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
-          deps_hash.each do |name, req|
+          deps_hash.each do |name, requirements_data|
             next if normalise(name) == "python"
 
-            requirements = parse_requirements_from(req, type)
+            requirements = parse_requirements_from(requirements_data, type)
             next if requirements.empty?
 
             dependencies << Dependency.new(
@@ -154,57 +205,62 @@ module Dependabot
           NameNormaliser.normalise_including_extras(name, extras)
         end
 
-        # @param req can be an Array, Hash or String that represents the constraints for a dependency
-        sig { params(req: T.untyped, type: String).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
-        def parse_requirements_from(req, type)
-          [req].flatten.compact.filter_map do |requirement|
-            next if requirement.is_a?(Hash) && UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
+        sig do
+          params(
+            requirements_data: T::Array[PyprojectDocument::PoetryRequirement],
+            type: String
+          ).returns(T::Array[Dependabot::Dependency::RequirementInput])
+        end
+        def parse_requirements_from(requirements_data, type)
+          requirements_data.filter_map { |requirement| poetry_requirement(requirement, type) }
+        end
 
+        sig do
+          params(
+            requirement: PyprojectDocument::PoetryRequirement,
+            type: String
+          ).returns(T.nilable(Dependabot::Dependency::RequirementInput))
+        end
+        def poetry_requirement(requirement, type)
+          if requirement.is_a?(String)
             check_requirements(requirement)
-
-            if requirement.is_a?(String)
-              {
-                requirement: requirement,
-                file: T.must(pyproject).name,
-                source: nil,
-                groups: [type]
-              }
-            else
-              {
-                requirement: requirement["version"],
-                file: T.must(pyproject).name,
-                source: requirement.fetch("source", nil),
-                groups: [type]
-              }
-            end
+            return {
+              requirement: requirement,
+              file: T.must(pyproject).name,
+              source: nil,
+              groups: [type]
+            }
           end
+
+          return if UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
+
+          check_requirements(requirement)
+          {
+            requirement: requirement_string(requirement, "version"),
+            file: T.must(pyproject).name,
+            source: poetry_source(requirement["source"]),
+            groups: [type]
+          }
         end
 
-        sig { returns(T.nilable(T::Boolean)) }
+        sig { returns(T::Boolean) }
         def using_poetry?
-          !poetry_root.nil?
+          pyproject_document.poetry?
         end
 
         sig { returns(T::Boolean) }
         def using_pep621?
-          !parsed_pyproject.dig("project", "dependencies").nil? ||
-            !parsed_pyproject.dig("project", "optional-dependencies").nil? ||
-            !parsed_pyproject.dig("build-system", "requires").nil?
-        end
-
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-        def poetry_root
-          parsed_pyproject.dig("tool", "poetry")
+          pyproject_document.pep621?
         end
 
         sig { returns(T::Boolean) }
         def using_pep735?
-          parsed_pyproject.key?("dependency-groups")
+          pyproject_document.pep735?
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Boolean) }
         def using_pdm?
-          using_pep621? && pdm_lock
+          using_pep621? && !pdm_lock.nil?
         end
 
         # Create a DependencySet where each element has no requirement. Any
@@ -215,15 +271,15 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           source_types = %w(directory git url)
-          parsed_lockfile.fetch("package", []).each do |details|
-            next if source_types.include?(details.dig("source", "type"))
+          poetry_lock_document.packages.each do |package|
+            next if source_types.include?(package.source_type)
 
-            name = normalise(details.fetch("name"))
+            name = normalise(package.name)
 
             dependencies <<
               Dependency.new(
                 name: name,
-                version: details.fetch("version"),
+                version: package.version,
                 requirements: [],
                 package_manager: "uv",
                 subdependency_metadata: [{
@@ -246,8 +302,10 @@ module Dependabot
         sig { returns(T::Array[T.nilable(String)]) }
         def parse_production_dependency_names
           SharedHelpers.in_a_temporary_directory do
-            File.write(T.must(pyproject).name, T.must(pyproject).content)
-            File.write(lockfile.name, lockfile.content)
+            pyproject_file = T.must(pyproject)
+            lockfile_file = T.must(lockfile)
+            File.write(pyproject_file.name, pyproject_file.content)
+            File.write(lockfile_file.name, lockfile_file.content)
 
             begin
               output = SharedHelpers.run_shell_command("pyenv exec poetry show --only main")
@@ -266,18 +324,19 @@ module Dependabot
           end
         end
 
-        sig { params(dep_name: String).returns(T.untyped) }
+        sig { params(dep_name: String).returns(T.nilable(String)) }
         def version_from_lockfile(dep_name)
-          return unless parsed_lockfile
+          return unless poetry_lock
 
-          parsed_lockfile.fetch("package", [])
-                         .find { |p| normalise(p.fetch("name")) == normalise(dep_name) }
-                         &.fetch("version", nil)
+          poetry_lock_document.version_for(dep_name) { |name| normalise(name) }
         end
 
-        sig { params(req: T.untyped).returns(T::Array[Dependabot::Uv::Requirement]) }
+        sig do
+          params(req: PyprojectDocument::PoetryRequirement)
+            .returns(T::Array[Dependabot::Uv::Requirement])
+        end
         def check_requirements(req)
-          requirement = req.is_a?(String) ? req : req["version"]
+          requirement = req.is_a?(String) ? req : requirement_string(req, "version")
           Uv::Requirement.requirements_array(requirement)
         rescue Gem::Requirement::BadRequirementError => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message
@@ -288,21 +347,14 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pyproject
-          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.nilable(T::Hash[String, T.untyped]))
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
+        sig { returns(PyprojectDocument) }
+        def pyproject_document
+          @pyproject_document ||= PyprojectDocument.from_file(T.must(pyproject))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_poetry_lock
-          @parsed_poetry_lock ||= T.let(
-            TomlRB.parse(T.must(poetry_lock).content),
-            T.nilable(T::Hash[String, T.untyped])
-          )
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(poetry_lock).path
+        sig { returns(PoetryLock) }
+        def poetry_lock_document
+          @poetry_lock_document ||= PoetryLock.from_file(T.must(poetry_lock))
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -313,20 +365,22 @@ module Dependabot
           )
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           poetry_lock
         end
 
-        sig { params(pyproject_file: Dependabot::DependencyFile).returns(T.untyped) }
+        sig { params(pyproject_file: Dependabot::DependencyFile).returns(T::Array[PepDependency]) }
         def parse_pep621_pep735_dependencies(pyproject_file)
           SharedHelpers.in_a_temporary_directory do
             write_temporary_pyproject(pyproject_file)
 
-            SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_pep621_pep735_dependencies",
-              args: [pyproject_file.name]
+            PepDependency.from_helper_result(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "parse_pep621_pep735_dependencies",
+                args: [pyproject_file.name]
+              )
             )
           end
         end
@@ -338,11 +392,6 @@ module Dependabot
           File.write(path, pyproject_file.content)
         end
 
-        sig { returns(T.untyped) }
-        def parsed_lockfile
-          parsed_poetry_lock if poetry_lock
-        end
-
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def poetry_lock
           @poetry_lock ||= T.let(
@@ -351,6 +400,36 @@ module Dependabot
           )
         end
 
+        sig do
+          params(
+            requirement: T::Hash[String, Object],
+            key: String
+          ).returns(T.nilable(String))
+        end
+        def requirement_string(requirement, key)
+          value = requirement[key]
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          raise TypeError, "Poetry dependency #{key} must be a string or nil"
+        end
+
+        sig { params(value: T.nilable(Object)).returns(T.nilable(Dependabot::DependencyRequirement::Source)) }
+        def poetry_source(value)
+          return if value.nil?
+          return value if value.is_a?(String)
+          raise TypeError, "Poetry dependency source must be a string, object, or nil" unless value.is_a?(Hash)
+
+          source = T.let({}, Dependabot::DependencyRequirement::ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "Poetry dependency source keys must be strings" unless key.is_a?(String)
+
+            source[key] = T.cast(raw_value, Object)
+          end
+          source
+        end
+
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pdm_lock
           @pdm_lock ||= T.let(

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -44,21 +44,33 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_requirement
+
         sig do
           params(
             dependencies: T::Array[Dependency],
             dependency_files: T::Array[DependencyFile],
             credentials: T::Array[Dependabot::Credential],
             index_urls: T.nilable(T::Array[T.nilable(String)]),
-            repo_contents_path: T.nilable(String)
+            repo_contents_path: T.nilable(String),
+            target_requirement: T.nilable(String)
           ).void
         end
-        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil, repo_contents_path: nil)
+        def initialize(
+          dependencies:,
+          dependency_files:,
+          credentials:,
+          index_urls: nil,
+          repo_contents_path: nil,
+          target_requirement: nil
+        )
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
           @index_urls = index_urls
           @repo_contents_path = repo_contents_path
+          @target_requirement = target_requirement
           @prepared_pyproject = T.let(nil, T.nilable(String))
           @updated_lockfile_content = T.let(nil, T.nilable(String))
           @pyproject = T.let(nil, T.nilable(Dependabot::DependencyFile))
@@ -112,7 +124,9 @@ module Dependabot
             # Use updated_lockfile_content which might raise if the lockfile doesn't change
             new_content = updated_lockfile_content
 
-            raise "Expected lockfile to change!" if T.must(lockfile).content == new_content
+            if T.must(lockfile).content == new_content
+              raise DependencyFileContentNotChanged, "Expected lockfile to change!"
+            end
 
             updated_files << updated_file(file: T.must(lockfile), content: new_content)
           end
@@ -291,7 +305,14 @@ module Dependabot
           # Strip extras from the package name for the uv lock command
           # uv lock --upgrade-package expects the base package name without extras
           base_dep_name = normalise(dep_name)
-          package_spec = dep_version ? "#{base_dep_name}==#{dep_version}" : base_dep_name
+          package_spec =
+            if target_requirement
+              "#{base_dep_name}#{target_requirement}"
+            elsif dep_version
+              "#{base_dep_name}==#{dep_version}"
+            else
+              base_dep_name
+            end
 
           command = "pyenv exec uv lock --upgrade-package #{package_spec} #{options}"
           fingerprint = "pyenv exec uv lock --upgrade-package <dependency_name> #{options_fingerprint}"

data/lib/dependabot/uv/update_checker/lock_file_resolver.rb

@@ -2,9 +2,17 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "toml-rb"
 
+require "dependabot/errors"
 require "dependabot/package/release_cooldown_options"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/uv/version"
+require "dependabot/uv/file_updater/lock_file_error_handler"
+require "dependabot/uv/file_updater/lock_file_updater"
+require "dependabot/uv/file_parser/python_requirement_parser"
+require "dependabot/uv/language_version_manager"
+require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirement"
 require "dependabot/uv/update_checker"
 require "dependabot/uv/update_checker/latest_version_finder"
@@ -42,33 +50,42 @@ module Dependabot
           @security_advisories = security_advisories
           @ignored_versions = ignored_versions
           @update_cooldown = update_cooldown
+          @latest_resolvable_versions = T.let(
+            {},
+            T::Hash[String, T.nilable(Dependabot::Uv::Version)]
+          )
+          @resolved_versions = T.let(
+            {},
+            T::Hash[String, T.nilable(Dependabot::Uv::Version)]
+          )
+          @resolvable_versions = T.let({}, T::Hash[String, T::Boolean])
         end
 
         sig { params(requirement: T.nilable(String)).returns(T.nilable(Dependabot::Uv::Version)) }
         def latest_resolvable_version(requirement:)
           return nil unless requirement
+          return @latest_resolvable_versions[requirement] if @latest_resolvable_versions.key?(requirement)
 
-          req = Uv::Requirement.new(requirement)
-
-          # Get the version from the dependency if available
-          version_from_dependency = dependency.version && Uv::Version.new(dependency.version)
-          return version_from_dependency if version_from_dependency && req.satisfied_by?(version_from_dependency)
-
-          nil
+          @latest_resolvable_versions[requirement] = fetch_latest_resolvable_version(requirement)
         end
 
-        sig { params(_version: T.anything).returns(T::Boolean) }
-        def resolvable?(_version)
-          # Always return true since we don't actually attempt resolution
-          # This is just a placeholder implementation
-          true
+        sig { params(version: Gem::Version).returns(T::Boolean) }
+        def resolvable?(version:)
+          target_version = Uv::Version.new(version.to_s)
+          key = target_version.to_s
+          return T.must(@resolvable_versions[key]) if @resolvable_versions.key?(key)
+
+          @resolvable_versions[key] = resolved_version("==#{key}", target_version)&.to_s == key
         end
 
         sig { returns(T.nilable(Dependabot::Uv::Version)) }
         def lowest_resolvable_security_fix_version
           # Delegate to LatestVersionFinder which handles security advisory filtering
-          fix_version = latest_version_finder.lowest_security_fix_version
-          return nil if fix_version.nil?
+          fix_version = latest_version_finder.lowest_security_fix_version(
+            language_version: python_version
+          )
+          return nil unless fix_version
+          return nil unless resolvable?(version: fix_version)
 
           # Return the fix version cast to Uv::Version
           Uv::Version.new(fix_version.to_s)
@@ -97,6 +114,191 @@ module Dependabot
         sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
         attr_reader :update_cooldown
 
+        sig { params(requirement_string: String).returns(T.nilable(Dependabot::Uv::Version)) }
+        def fetch_latest_resolvable_version(requirement_string)
+          requirement = Uv::Requirement.new(requirement_string)
+          current_version = dependency.version && Uv::Version.new(dependency.version)
+          eligible_versions = eligible_versions(requirement, current_version)
+          return current_version if no_newer_eligible_version?(requirement, current_version, eligible_versions)
+
+          native_version = resolved_version(
+            policy_requirement(requirement_string, requirement, current_version, eligible_versions),
+            nil
+          )
+          if eligible_native_version?(requirement, native_version, eligible_versions) &&
+             resolvable?(version: T.must(native_version))
+            return native_version
+          end
+
+          current_version if current_version && requirement.satisfied_by?(current_version)
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(T::Boolean)
+        end
+        def no_newer_eligible_version?(requirement, current_version, eligible_versions)
+          return false unless current_version && eligible_versions
+
+          requirement.satisfied_by?(current_version) && eligible_versions.empty?
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            native_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(T::Boolean)
+        end
+        def eligible_native_version?(requirement, native_version, eligible_versions)
+          return false unless native_version && requirement.satisfied_by?(native_version)
+
+          !eligible_versions || eligible_versions.include?(native_version)
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version)
+          ).returns(T.nilable(T::Array[Dependabot::Uv::Version]))
+        end
+        def eligible_versions(requirement, current_version)
+          releases = latest_version_finder.eligible_releases(
+            language_version: python_version
+          )
+          return unless releases
+
+          releases = Dependabot::UpdateCheckers::VersionFilters
+                     .filter_vulnerable_versions(releases, security_advisories)
+          releases
+            .map { |release| Uv::Version.new(release.version.to_s) }
+            .select { |version| requirement.satisfied_by?(version) && (!current_version || version > current_version) }
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(String)
+        end
+        def policy_requirement(requirement_string, requirement, current_version, eligible_versions)
+          releases = latest_version_finder.available_versions
+          return requirement_string unless releases && eligible_versions
+
+          excluded_versions = releases
+                              .map { |release| Uv::Version.new(release.version.to_s) }
+                              .select do |version|
+            requirement.satisfied_by?(version) &&
+              (!current_version || version > current_version) &&
+              !eligible_versions.include?(version)
+          end
+
+          ([requirement_string] + excluded_versions.map { |version| "!=#{version}" }).join(",")
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          )
+            .returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def resolved_version(requirement_string, target_version)
+          return @resolved_versions[requirement_string] if @resolved_versions.key?(requirement_string)
+
+          @resolved_versions[requirement_string] = run_resolution(requirement_string, target_version)
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          )
+            .returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def run_resolution(requirement_string, target_version)
+          updated_dependency = Dependabot::Dependency.new(
+            name: dependency.name,
+            version: nil,
+            previous_version: dependency.version,
+            requirements: [],
+            previous_requirements: [],
+            package_manager: dependency.package_manager
+          )
+
+          updated_files = FileUpdater::LockFileUpdater.new(
+            dependencies: [updated_dependency],
+            dependency_files: dependency_files,
+            credentials: credentials,
+            repo_contents_path: repo_contents_path,
+            target_requirement: requirement_string
+          ).updated_dependency_files
+
+          lockfile = updated_files.find { |file| file.name == "uv.lock" } || original_lockfile
+          resolved_locked_version(T.must(lockfile), target_version)
+        rescue Dependabot::DependencyFileContentNotChanged
+          resolved_locked_version(T.must(original_lockfile), target_version)
+        rescue Dependabot::UpdateNotPossible
+          nil
+        rescue Dependabot::DependencyFileNotResolvable => e
+          conflict = e.message.match?(FileUpdater::LockFileErrorHandler::UV_UNRESOLVABLE_REGEX) ||
+                     e.message.include?(FileUpdater::LockFileErrorHandler::RESOLUTION_IMPOSSIBLE_ERROR)
+          raise unless conflict
+
+          nil
+        end
+
+        sig do
+          params(
+            lockfile: Dependabot::DependencyFile,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          ).returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def resolved_locked_version(lockfile, target_version)
+          original_versions = locked_versions(T.must(original_lockfile))
+          updated_versions = locked_versions(lockfile)
+          current_version = dependency.version && Uv::Version.new(dependency.version)
+          return nil unless current_version && original_versions.min == current_version
+          return current_version if updated_versions.include?(current_version)
+
+          updated_version = updated_versions.min
+          return target_version if target_version && updated_version == target_version
+          return nil if target_version
+
+          updated_version
+        end
+
+        sig do
+          params(lockfile: Dependabot::DependencyFile)
+            .returns(T::Array[Dependabot::Uv::Version])
+        end
+        def locked_versions(lockfile)
+          parsed = T.cast(TomlRB.parse(T.must(lockfile.content)), T::Hash[String, Object])
+          packages = T.cast(parsed["package"], T.nilable(T::Array[T::Hash[String, Object]])) || []
+          dependency_name = NameNormaliser.normalise(dependency.name)
+          versions = T.let([], T::Array[Dependabot::Uv::Version])
+          packages.each do |package|
+            package_name = T.cast(package["name"], T.nilable(String))
+            package_version = T.cast(package["version"], T.nilable(String))
+            next unless package_name && NameNormaliser.normalise(package_name) == dependency_name
+            next unless Uv::Version.correct?(package_version)
+
+            versions << Uv::Version.new(package_version)
+          end
+
+          versions
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def original_lockfile
+          dependency_files.find { |file| file.name == "uv.lock" }
+        end
+
         sig { returns(LatestVersionFinder) }
         def latest_version_finder
           @latest_version_finder ||= T.let(
@@ -112,6 +314,18 @@ module Dependabot
             T.nilable(LatestVersionFinder)
           )
         end
+
+        sig { returns(String) }
+        def python_version
+          @python_version ||= T.let(
+            LanguageVersionManager.new(
+              python_requirement_parser: FileParser::PythonRequirementParser.new(
+                dependency_files: dependency_files
+              )
+            ).python_version,
+            T.nilable(String)
+          )
+        end
       end
     end
   end

data/lib/dependabot/uv/update_checker.rb

@@ -213,29 +213,6 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Boolean) }
-      def library?
-        return false unless updating_pyproject?
-        return false unless library_details
-
-        return false if T.must(library_details)["name"].nil?
-
-        # Hit PyPi and check whether there are details for a library with a
-        # matching name and description
-        index_response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
-        )
-
-        return false unless index_response.status == 200
-
-        pypi_info = JSON.parse(index_response.body)["info"] || {}
-        pypi_info["summary"] == T.must(library_details)["description"]
-      rescue Excon::Error::Timeout, Excon::Error::Socket
-        false
-      rescue URI::InvalidURIError
-        false
-      end
-
       sig { returns(T::Boolean) }
       def updating_pyproject?
         requirement_files.any? { |file| file.end_with?("pyproject.toml") }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -183,14 +183,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib