dependabot-uv 0.393.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0b2c86fecd6361c11d682fd96da7135b08179f251f7a524d045824341ccbe9e
-  data.tar.gz: df43361f2dd0a76a17da2a6ea510086da7adadbe859d1d91975be7ebe84a61bc
+  metadata.gz: c5e87aed24a3d0d1e38f69d064fa0d05ea3aa5db358ffe8b8aca51b0ba814f41
+  data.tar.gz: a79f5e14f753586b9a66310917f590bf7ac1065318cbd9f18cecf43c54a4ae24
 SHA512:
-  metadata.gz: 3117ccb8929d12b1caff2b31607e8b459fbb61008495f3f9c5b195e7d4b888cabd0d2b47de2535d130660db0b4fe51fc2aede86b856bcd237d5f3e2eb20da37b
-  data.tar.gz: 162286da713782ed33c25c4fcea096c4365edcf219ad4da6bb93812fd64792a569e92e86b3c20d4f8814f10f141b1bf010ba0c3cf44a3c6e553c814e1006aad2
+  metadata.gz: e5c993116408e7948b8d4622ad7d76e1a9a4a9fde594072883d0dd1d8e8275531a5f4d2be045fb599b61f26577d72bee2e1111a226fccb39f73058d826f66e1f
+  data.tar.gz: 3fb63ce5867dc87ee0ee729cb97d67c88069517f31b046d46ca9db30e27138d617af03499392543360bab156018b2ef67550d3b49c7f041468611acf50ad0097

data/helpers/requirements.txt

@@ -1,13 +1,13 @@
-pip==26.1.1
-pip-tools==7.5.3
+pip==26.2.1
+pip-tools==7.6.1
 flake8==7.3.0
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.3.4
+poetry==2.4.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.1
+uv==0.12.7
 
 # Some dependencies will only install if Cython is present
-Cython==3.2.4
+Cython==3.3.0

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -9,6 +9,9 @@ require "dependabot/uv/file_parser"
 require "dependabot/uv/requirement"
 require "dependabot/errors"
 require "dependabot/uv/name_normaliser"
+require "dependabot/python/file_parser/pep_dependency"
+require "dependabot/python/file_parser/poetry_lock"
+require "dependabot/python/file_parser/pyproject_document"
 
 module Dependabot
   module Uv
@@ -16,6 +19,10 @@ module Dependabot
       class PyprojectFilesParser
         extend T::Sig
 
+        PepDependency = Dependabot::Python::FileParser::PepDependency
+        PoetryLock = Dependabot::Python::FileParser::PoetryLock
+        PyprojectDocument = Dependabot::Python::FileParser::PyprojectDocument
+
         POETRY_DEPENDENCY_TYPES = %w(dependencies dev-dependencies).freeze
 
         # https://python-poetry.org/docs/dependency-specification/
@@ -24,6 +31,8 @@ module Dependabot
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
+          @pyproject_document = T.let(nil, T.nilable(PyprojectDocument))
+          @poetry_lock_document = T.let(nil, T.nilable(PoetryLock))
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
@@ -61,13 +70,11 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           POETRY_DEPENDENCY_TYPES.each do |type|
-            deps_hash = T.must(poetry_root)[type] || {}
-            dependencies += parse_poetry_dependency_group(type, deps_hash)
+            dependencies += parse_poetry_dependency_group(type, pyproject_document.poetry_dependencies(type))
           end
 
-          groups = T.must(poetry_root)["group"] || {}
-          groups.each do |group, group_spec|
-            dependencies += parse_poetry_dependency_group(group, group_spec["dependencies"])
+          pyproject_document.poetry_groups.each do |group, dependencies_by_name|
+            dependencies += parse_poetry_dependency_group(group, dependencies_by_name)
           end
           dependencies
         end
@@ -85,20 +92,20 @@ module Dependabot
           parse_pep621_pep735_dependencies(pyproject_file).each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
-            next if dep["markers"]&.include?("<")
+            next if dep.markers&.include?("<")
 
             # In uv no constraint means any version is acceptable
-            requirement_value = dep["requirement"] && dep["requirement"].empty? ? "*" : dep["requirement"]
+            requirement_value = dep.requirement == "" ? "*" : dep.requirement
 
             dependencies <<
               Dependency.new(
-                name: normalised_name(dep["name"], dep["extras"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
+                name: normalised_name(dep.name, dep.extras),
+                version: dep.version&.include?("*") ? nil : dep.version,
                 requirements: [{
                   requirement: requirement_value,
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
+                  file: Pathname.new(dep.file).cleanpath.to_path,
                   source: nil,
-                  groups: [dep["requirement_type"]].compact
+                  groups: [dep.requirement_type].compact
                 }],
                 package_manager: "uv"
               )
@@ -139,8 +146,7 @@ module Dependabot
         def workspace_globs(key)
           return [] unless pyproject
 
-          globs = parsed_pyproject.dig("tool", "uv", "workspace", key)
-          globs.is_a?(Array) ? globs.grep(String) : []
+          pyproject_document.workspace_globs(key)
         end
 
         sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
@@ -172,17 +178,16 @@ module Dependabot
         sig do
           params(
             type: String,
-            deps_hash: T::Hash[String,
-                               T.untyped]
+            deps_hash: PyprojectDocument::PoetryDependencyMap
           ).returns(Dependabot::FileParsers::Base::DependencySet)
         end
         def parse_poetry_dependency_group(type, deps_hash)
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
-          deps_hash.each do |name, req|
+          deps_hash.each do |name, requirements_data|
             next if normalise(name) == "python"
 
-            requirements = parse_requirements_from(req, type)
+            requirements = parse_requirements_from(requirements_data, type)
             next if requirements.empty?
 
             dependencies << Dependency.new(
@@ -200,57 +205,62 @@ module Dependabot
           NameNormaliser.normalise_including_extras(name, extras)
         end
 
-        # @param req can be an Array, Hash or String that represents the constraints for a dependency
-        sig { params(req: T.untyped, type: String).returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
-        def parse_requirements_from(req, type)
-          [req].flatten.compact.filter_map do |requirement|
-            next if requirement.is_a?(Hash) && UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
+        sig do
+          params(
+            requirements_data: T::Array[PyprojectDocument::PoetryRequirement],
+            type: String
+          ).returns(T::Array[Dependabot::Dependency::RequirementInput])
+        end
+        def parse_requirements_from(requirements_data, type)
+          requirements_data.filter_map { |requirement| poetry_requirement(requirement, type) }
+        end
 
+        sig do
+          params(
+            requirement: PyprojectDocument::PoetryRequirement,
+            type: String
+          ).returns(T.nilable(Dependabot::Dependency::RequirementInput))
+        end
+        def poetry_requirement(requirement, type)
+          if requirement.is_a?(String)
             check_requirements(requirement)
-
-            if requirement.is_a?(String)
-              {
-                requirement: requirement,
-                file: T.must(pyproject).name,
-                source: nil,
-                groups: [type]
-              }
-            else
-              {
-                requirement: requirement["version"],
-                file: T.must(pyproject).name,
-                source: requirement.fetch("source", nil),
-                groups: [type]
-              }
-            end
+            return {
+              requirement: requirement,
+              file: T.must(pyproject).name,
+              source: nil,
+              groups: [type]
+            }
           end
+
+          return if UNSUPPORTED_DEPENDENCY_TYPES.intersect?(requirement.keys)
+
+          check_requirements(requirement)
+          {
+            requirement: requirement_string(requirement, "version"),
+            file: T.must(pyproject).name,
+            source: poetry_source(requirement["source"]),
+            groups: [type]
+          }
         end
 
-        sig { returns(T.nilable(T::Boolean)) }
+        sig { returns(T::Boolean) }
         def using_poetry?
-          !poetry_root.nil?
+          pyproject_document.poetry?
         end
 
         sig { returns(T::Boolean) }
         def using_pep621?
-          !parsed_pyproject.dig("project", "dependencies").nil? ||
-            !parsed_pyproject.dig("project", "optional-dependencies").nil? ||
-            !parsed_pyproject.dig("build-system", "requires").nil?
-        end
-
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-        def poetry_root
-          parsed_pyproject.dig("tool", "poetry")
+          pyproject_document.pep621?
         end
 
         sig { returns(T::Boolean) }
         def using_pep735?
-          parsed_pyproject.key?("dependency-groups")
+          pyproject_document.pep735?
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T::Boolean) }
         def using_pdm?
-          using_pep621? && pdm_lock
+          using_pep621? && !pdm_lock.nil?
         end
 
         # Create a DependencySet where each element has no requirement. Any
@@ -261,15 +271,15 @@ module Dependabot
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           source_types = %w(directory git url)
-          parsed_lockfile.fetch("package", []).each do |details|
-            next if source_types.include?(details.dig("source", "type"))
+          poetry_lock_document.packages.each do |package|
+            next if source_types.include?(package.source_type)
 
-            name = normalise(details.fetch("name"))
+            name = normalise(package.name)
 
             dependencies <<
               Dependency.new(
                 name: name,
-                version: details.fetch("version"),
+                version: package.version,
                 requirements: [],
                 package_manager: "uv",
                 subdependency_metadata: [{
@@ -292,8 +302,10 @@ module Dependabot
         sig { returns(T::Array[T.nilable(String)]) }
         def parse_production_dependency_names
           SharedHelpers.in_a_temporary_directory do
-            File.write(T.must(pyproject).name, T.must(pyproject).content)
-            File.write(lockfile.name, lockfile.content)
+            pyproject_file = T.must(pyproject)
+            lockfile_file = T.must(lockfile)
+            File.write(pyproject_file.name, pyproject_file.content)
+            File.write(lockfile_file.name, lockfile_file.content)
 
             begin
               output = SharedHelpers.run_shell_command("pyenv exec poetry show --only main")
@@ -312,18 +324,19 @@ module Dependabot
           end
         end
 
-        sig { params(dep_name: String).returns(T.untyped) }
+        sig { params(dep_name: String).returns(T.nilable(String)) }
         def version_from_lockfile(dep_name)
-          return unless parsed_lockfile
+          return unless poetry_lock
 
-          parsed_lockfile.fetch("package", [])
-                         .find { |p| normalise(p.fetch("name")) == normalise(dep_name) }
-                         &.fetch("version", nil)
+          poetry_lock_document.version_for(dep_name) { |name| normalise(name) }
         end
 
-        sig { params(req: T.untyped).returns(T::Array[Dependabot::Uv::Requirement]) }
+        sig do
+          params(req: PyprojectDocument::PoetryRequirement)
+            .returns(T::Array[Dependabot::Uv::Requirement])
+        end
         def check_requirements(req)
-          requirement = req.is_a?(String) ? req : req["version"]
+          requirement = req.is_a?(String) ? req : requirement_string(req, "version")
           Uv::Requirement.requirements_array(requirement)
         rescue Gem::Requirement::BadRequirementError => e
           raise Dependabot::DependencyFileNotEvaluatable, e.message
@@ -334,21 +347,14 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_pyproject
-          @parsed_pyproject ||= T.let(TomlRB.parse(T.must(pyproject).content), T.nilable(T::Hash[String, T.untyped]))
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(pyproject).path
+        sig { returns(PyprojectDocument) }
+        def pyproject_document
+          @pyproject_document ||= PyprojectDocument.from_file(T.must(pyproject))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_poetry_lock
-          @parsed_poetry_lock ||= T.let(
-            TomlRB.parse(T.must(poetry_lock).content),
-            T.nilable(T::Hash[String, T.untyped])
-          )
-        rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
-          raise Dependabot::DependencyFileNotParseable, T.must(poetry_lock).path
+        sig { returns(PoetryLock) }
+        def poetry_lock_document
+          @poetry_lock_document ||= PoetryLock.from_file(T.must(poetry_lock))
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -359,20 +365,22 @@ module Dependabot
           )
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           poetry_lock
         end
 
-        sig { params(pyproject_file: Dependabot::DependencyFile).returns(T.untyped) }
+        sig { params(pyproject_file: Dependabot::DependencyFile).returns(T::Array[PepDependency]) }
         def parse_pep621_pep735_dependencies(pyproject_file)
           SharedHelpers.in_a_temporary_directory do
             write_temporary_pyproject(pyproject_file)
 
-            SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_pep621_pep735_dependencies",
-              args: [pyproject_file.name]
+            PepDependency.from_helper_result(
+              SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "parse_pep621_pep735_dependencies",
+                args: [pyproject_file.name]
+              )
             )
           end
         end
@@ -384,11 +392,6 @@ module Dependabot
           File.write(path, pyproject_file.content)
         end
 
-        sig { returns(T.untyped) }
-        def parsed_lockfile
-          parsed_poetry_lock if poetry_lock
-        end
-
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def poetry_lock
           @poetry_lock ||= T.let(
@@ -397,6 +400,36 @@ module Dependabot
           )
         end
 
+        sig do
+          params(
+            requirement: T::Hash[String, Object],
+            key: String
+          ).returns(T.nilable(String))
+        end
+        def requirement_string(requirement, key)
+          value = requirement[key]
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          raise TypeError, "Poetry dependency #{key} must be a string or nil"
+        end
+
+        sig { params(value: T.nilable(Object)).returns(T.nilable(Dependabot::DependencyRequirement::Source)) }
+        def poetry_source(value)
+          return if value.nil?
+          return value if value.is_a?(String)
+          raise TypeError, "Poetry dependency source must be a string, object, or nil" unless value.is_a?(Hash)
+
+          source = T.let({}, Dependabot::DependencyRequirement::ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "Poetry dependency source keys must be strings" unless key.is_a?(String)
+
+            source[key] = T.cast(raw_value, Object)
+          end
+          source
+        end
+
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pdm_lock
           @pdm_lock ||= T.let(

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/authed_url_builder"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class CompileFileUpdater
         extend T::Sig
 
@@ -434,12 +434,17 @@ module Dependabot
             args << index_url if index_url
 
             begin
+              helper_result = SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "get_dependency_hash",
+                args: args
+              )
+
+              # Skip this index if helper returned nil (can happen with unavailable registries)
+              next if helper_result.nil?
+
               native_helper_hashes = T.cast(
-                SharedHelpers.run_helper_subprocess(
-                  command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                  function: "get_dependency_hash",
-                  args: args
-                ),
+                helper_result,
                 T::Array[T::Hash[String, String]]
               ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }
 
@@ -451,6 +456,8 @@ module Dependabot
             end
           end
 
+          raise DependencyFileNotResolvable, "Unable to find hashes for package #{name}" if hashes.empty?
+
           hashes
         end
 
@@ -665,7 +672,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/requirement_suffix_helper"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class LockFileUpdater
         extend T::Sig
 
@@ -44,21 +44,33 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_requirement
+
         sig do
           params(
             dependencies: T::Array[Dependency],
             dependency_files: T::Array[DependencyFile],
             credentials: T::Array[Dependabot::Credential],
             index_urls: T.nilable(T::Array[T.nilable(String)]),
-            repo_contents_path: T.nilable(String)
+            repo_contents_path: T.nilable(String),
+            target_requirement: T.nilable(String)
           ).void
         end
-        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil, repo_contents_path: nil)
+        def initialize(
+          dependencies:,
+          dependency_files:,
+          credentials:,
+          index_urls: nil,
+          repo_contents_path: nil,
+          target_requirement: nil
+        )
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
           @index_urls = index_urls
           @repo_contents_path = repo_contents_path
+          @target_requirement = target_requirement
           @prepared_pyproject = T.let(nil, T.nilable(String))
           @updated_lockfile_content = T.let(nil, T.nilable(String))
           @pyproject = T.let(nil, T.nilable(Dependabot::DependencyFile))
@@ -112,7 +124,9 @@ module Dependabot
             # Use updated_lockfile_content which might raise if the lockfile doesn't change
             new_content = updated_lockfile_content
 
-            raise "Expected lockfile to change!" if T.must(lockfile).content == new_content
+            if T.must(lockfile).content == new_content
+              raise DependencyFileContentNotChanged, "Expected lockfile to change!"
+            end
 
             updated_files << updated_file(file: T.must(lockfile), content: new_content)
           end
@@ -291,7 +305,14 @@ module Dependabot
           # Strip extras from the package name for the uv lock command
           # uv lock --upgrade-package expects the base package name without extras
           base_dep_name = normalise(dep_name)
-          package_spec = dep_version ? "#{base_dep_name}==#{dep_version}" : base_dep_name
+          package_spec =
+            if target_requirement
+              "#{base_dep_name}#{target_requirement}"
+            elsif dep_version
+              "#{base_dep_name}==#{dep_version}"
+            else
+              base_dep_name
+            end
 
           command = "pyenv exec uv lock --upgrade-package #{package_spec} #{options}"
           fingerprint = "pyenv exec uv lock --upgrade-package <dependency_name> #{options_fingerprint}"
@@ -777,7 +798,6 @@ module Dependabot
           )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/version_config_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -13,6 +13,8 @@ module Dependabot
       class VersionConfigParser
         extend T::Sig
 
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
         class VersionConfig < T::Struct
           extend T::Sig
 
@@ -32,7 +34,7 @@ module Dependabot
           @pyproject_content = pyproject_content
           @base_path = base_path
           @repo_root = repo_root
-          @parsed_pyproject = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @parsed_pyproject = T.let(nil, T.nilable(ObjectHash))
         end
 
         sig { returns(VersionConfig) }
@@ -56,15 +58,46 @@ module Dependabot
         sig { returns(String) }
         attr_reader :repo_root
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(ObjectHash) }
         def parsed_pyproject
           return @parsed_pyproject unless @parsed_pyproject.nil?
 
-          @parsed_pyproject = TomlRB.parse(pyproject_content)
+          @parsed_pyproject = object_hash(T.cast(TomlRB.parse(pyproject_content), Object))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           @parsed_pyproject = {}
         end
 
+        sig { params(value: Object).returns(ObjectHash) }
+        def object_hash(value)
+          raise TypeError, "Version configuration must be a table" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "Version configuration keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(path: T::Array[String]).returns(Object) }
+        def config_value(path)
+          value = T.let(parsed_pyproject, Object)
+          path.each do |key|
+            return nil if value.nil?
+
+            value = object_hash(value)[key]
+          end
+          value
+        end
+
+        sig { params(path: T::Array[String]).returns(T.nilable(ObjectHash)) }
+        def config_table(path)
+          value = config_value(path)
+          object_hash(value) if value.is_a?(Hash)
+        end
+
         sig { returns(T::Array[String]) }
         def collect_write_paths
           paths = []
@@ -82,8 +115,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def setuptools_scm_write_paths
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          return [] unless scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          return [] unless scm_config
 
           paths = []
 
@@ -98,8 +131,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_vcs_build_hook_write_paths
-          vcs_hook = parsed_pyproject.dig("tool", "hatch", "build", "hooks", "vcs")
-          return [] unless vcs_hook.is_a?(Hash)
+          vcs_hook = config_table(%w(tool hatch build hooks vcs))
+          return [] unless vcs_hook
 
           paths = []
 
@@ -111,8 +144,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_version_source_paths
-          hatch_version = parsed_pyproject.dig("tool", "hatch", "version")
-          return [] unless hatch_version.is_a?(Hash)
+          hatch_version = config_table(%w(tool hatch version))
+          return [] unless hatch_version
 
           paths = []
 
@@ -124,14 +157,14 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_fallback_version
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          if scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          if scm_config
             fallback = scm_config["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
 
-          raw_options = parsed_pyproject.dig("tool", "hatch", "version", "raw-options")
-          if raw_options.is_a?(Hash)
+          raw_options = config_table(%w(tool hatch version raw-options))
+          if raw_options
             fallback = raw_options["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
@@ -141,7 +174,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_package_name
-          name = parsed_pyproject.dig("project", "name")
+          name = config_value(%w(project name))
           return name if name.is_a?(String)
 
           nil

data/lib/dependabot/uv/update_checker/lock_file_resolver.rb

@@ -2,9 +2,17 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "toml-rb"
 
+require "dependabot/errors"
 require "dependabot/package/release_cooldown_options"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/uv/version"
+require "dependabot/uv/file_updater/lock_file_error_handler"
+require "dependabot/uv/file_updater/lock_file_updater"
+require "dependabot/uv/file_parser/python_requirement_parser"
+require "dependabot/uv/language_version_manager"
+require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirement"
 require "dependabot/uv/update_checker"
 require "dependabot/uv/update_checker/latest_version_finder"
@@ -42,33 +50,42 @@ module Dependabot
           @security_advisories = security_advisories
           @ignored_versions = ignored_versions
           @update_cooldown = update_cooldown
+          @latest_resolvable_versions = T.let(
+            {},
+            T::Hash[String, T.nilable(Dependabot::Uv::Version)]
+          )
+          @resolved_versions = T.let(
+            {},
+            T::Hash[String, T.nilable(Dependabot::Uv::Version)]
+          )
+          @resolvable_versions = T.let({}, T::Hash[String, T::Boolean])
         end
 
         sig { params(requirement: T.nilable(String)).returns(T.nilable(Dependabot::Uv::Version)) }
         def latest_resolvable_version(requirement:)
           return nil unless requirement
+          return @latest_resolvable_versions[requirement] if @latest_resolvable_versions.key?(requirement)
 
-          req = Uv::Requirement.new(requirement)
-
-          # Get the version from the dependency if available
-          version_from_dependency = dependency.version && Uv::Version.new(dependency.version)
-          return version_from_dependency if version_from_dependency && req.satisfied_by?(version_from_dependency)
-
-          nil
+          @latest_resolvable_versions[requirement] = fetch_latest_resolvable_version(requirement)
         end
 
-        sig { params(_version: T.anything).returns(T::Boolean) }
-        def resolvable?(_version)
-          # Always return true since we don't actually attempt resolution
-          # This is just a placeholder implementation
-          true
+        sig { params(version: Gem::Version).returns(T::Boolean) }
+        def resolvable?(version:)
+          target_version = Uv::Version.new(version.to_s)
+          key = target_version.to_s
+          return T.must(@resolvable_versions[key]) if @resolvable_versions.key?(key)
+
+          @resolvable_versions[key] = resolved_version("==#{key}", target_version)&.to_s == key
         end
 
         sig { returns(T.nilable(Dependabot::Uv::Version)) }
         def lowest_resolvable_security_fix_version
           # Delegate to LatestVersionFinder which handles security advisory filtering
-          fix_version = latest_version_finder.lowest_security_fix_version
-          return nil if fix_version.nil?
+          fix_version = latest_version_finder.lowest_security_fix_version(
+            language_version: python_version
+          )
+          return nil unless fix_version
+          return nil unless resolvable?(version: fix_version)
 
           # Return the fix version cast to Uv::Version
           Uv::Version.new(fix_version.to_s)
@@ -97,6 +114,191 @@ module Dependabot
         sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
         attr_reader :update_cooldown
 
+        sig { params(requirement_string: String).returns(T.nilable(Dependabot::Uv::Version)) }
+        def fetch_latest_resolvable_version(requirement_string)
+          requirement = Uv::Requirement.new(requirement_string)
+          current_version = dependency.version && Uv::Version.new(dependency.version)
+          eligible_versions = eligible_versions(requirement, current_version)
+          return current_version if no_newer_eligible_version?(requirement, current_version, eligible_versions)
+
+          native_version = resolved_version(
+            policy_requirement(requirement_string, requirement, current_version, eligible_versions),
+            nil
+          )
+          if eligible_native_version?(requirement, native_version, eligible_versions) &&
+             resolvable?(version: T.must(native_version))
+            return native_version
+          end
+
+          current_version if current_version && requirement.satisfied_by?(current_version)
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(T::Boolean)
+        end
+        def no_newer_eligible_version?(requirement, current_version, eligible_versions)
+          return false unless current_version && eligible_versions
+
+          requirement.satisfied_by?(current_version) && eligible_versions.empty?
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            native_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(T::Boolean)
+        end
+        def eligible_native_version?(requirement, native_version, eligible_versions)
+          return false unless native_version && requirement.satisfied_by?(native_version)
+
+          !eligible_versions || eligible_versions.include?(native_version)
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version)
+          ).returns(T.nilable(T::Array[Dependabot::Uv::Version]))
+        end
+        def eligible_versions(requirement, current_version)
+          releases = latest_version_finder.eligible_releases(
+            language_version: python_version
+          )
+          return unless releases
+
+          releases = Dependabot::UpdateCheckers::VersionFilters
+                     .filter_vulnerable_versions(releases, security_advisories)
+          releases
+            .map { |release| Uv::Version.new(release.version.to_s) }
+            .select { |version| requirement.satisfied_by?(version) && (!current_version || version > current_version) }
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            requirement: Dependabot::Uv::Requirement,
+            current_version: T.nilable(Dependabot::Uv::Version),
+            eligible_versions: T.nilable(T::Array[Dependabot::Uv::Version])
+          ).returns(String)
+        end
+        def policy_requirement(requirement_string, requirement, current_version, eligible_versions)
+          releases = latest_version_finder.available_versions
+          return requirement_string unless releases && eligible_versions
+
+          excluded_versions = releases
+                              .map { |release| Uv::Version.new(release.version.to_s) }
+                              .select do |version|
+            requirement.satisfied_by?(version) &&
+              (!current_version || version > current_version) &&
+              !eligible_versions.include?(version)
+          end
+
+          ([requirement_string] + excluded_versions.map { |version| "!=#{version}" }).join(",")
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          )
+            .returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def resolved_version(requirement_string, target_version)
+          return @resolved_versions[requirement_string] if @resolved_versions.key?(requirement_string)
+
+          @resolved_versions[requirement_string] = run_resolution(requirement_string, target_version)
+        end
+
+        sig do
+          params(
+            requirement_string: String,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          )
+            .returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def run_resolution(requirement_string, target_version)
+          updated_dependency = Dependabot::Dependency.new(
+            name: dependency.name,
+            version: nil,
+            previous_version: dependency.version,
+            requirements: [],
+            previous_requirements: [],
+            package_manager: dependency.package_manager
+          )
+
+          updated_files = FileUpdater::LockFileUpdater.new(
+            dependencies: [updated_dependency],
+            dependency_files: dependency_files,
+            credentials: credentials,
+            repo_contents_path: repo_contents_path,
+            target_requirement: requirement_string
+          ).updated_dependency_files
+
+          lockfile = updated_files.find { |file| file.name == "uv.lock" } || original_lockfile
+          resolved_locked_version(T.must(lockfile), target_version)
+        rescue Dependabot::DependencyFileContentNotChanged
+          resolved_locked_version(T.must(original_lockfile), target_version)
+        rescue Dependabot::UpdateNotPossible
+          nil
+        rescue Dependabot::DependencyFileNotResolvable => e
+          conflict = e.message.match?(FileUpdater::LockFileErrorHandler::UV_UNRESOLVABLE_REGEX) ||
+                     e.message.include?(FileUpdater::LockFileErrorHandler::RESOLUTION_IMPOSSIBLE_ERROR)
+          raise unless conflict
+
+          nil
+        end
+
+        sig do
+          params(
+            lockfile: Dependabot::DependencyFile,
+            target_version: T.nilable(Dependabot::Uv::Version)
+          ).returns(T.nilable(Dependabot::Uv::Version))
+        end
+        def resolved_locked_version(lockfile, target_version)
+          original_versions = locked_versions(T.must(original_lockfile))
+          updated_versions = locked_versions(lockfile)
+          current_version = dependency.version && Uv::Version.new(dependency.version)
+          return nil unless current_version && original_versions.min == current_version
+          return current_version if updated_versions.include?(current_version)
+
+          updated_version = updated_versions.min
+          return target_version if target_version && updated_version == target_version
+          return nil if target_version
+
+          updated_version
+        end
+
+        sig do
+          params(lockfile: Dependabot::DependencyFile)
+            .returns(T::Array[Dependabot::Uv::Version])
+        end
+        def locked_versions(lockfile)
+          parsed = T.cast(TomlRB.parse(T.must(lockfile.content)), T::Hash[String, Object])
+          packages = T.cast(parsed["package"], T.nilable(T::Array[T::Hash[String, Object]])) || []
+          dependency_name = NameNormaliser.normalise(dependency.name)
+          versions = T.let([], T::Array[Dependabot::Uv::Version])
+          packages.each do |package|
+            package_name = T.cast(package["name"], T.nilable(String))
+            package_version = T.cast(package["version"], T.nilable(String))
+            next unless package_name && NameNormaliser.normalise(package_name) == dependency_name
+            next unless Uv::Version.correct?(package_version)
+
+            versions << Uv::Version.new(package_version)
+          end
+
+          versions
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def original_lockfile
+          dependency_files.find { |file| file.name == "uv.lock" }
+        end
+
         sig { returns(LatestVersionFinder) }
         def latest_version_finder
           @latest_version_finder ||= T.let(
@@ -112,6 +314,18 @@ module Dependabot
             T.nilable(LatestVersionFinder)
           )
         end
+
+        sig { returns(String) }
+        def python_version
+          @python_version ||= T.let(
+            LanguageVersionManager.new(
+              python_requirement_parser: FileParser::PythonRequirementParser.new(
+                dependency_files: dependency_files
+              )
+            ).python_version,
+            T.nilable(String)
+          )
+        end
       end
     end
   end

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -24,7 +24,7 @@ module Dependabot
       # This class does version resolution for pip-compile. Its approach is:
       # - Unlock the dependency we're checking in the requirements.in file
       # - Run `pip-compile` and see what the result is
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class PipCompileVersionResolver
         extend T::Sig
 
@@ -595,7 +595,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
 
     class PipCompileErrorHandler

data/lib/dependabot/uv/update_checker.rb

@@ -228,11 +228,11 @@ module Dependabot
         requirement_files.any? { |f| f.end_with?("requirements.txt") }
       end
 
-      sig { override.returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { override.returns(T.nilable(PyprojectDocument::ProjectMetadata)) }
       def library_details
         @library_details ||= T.let(
-          standard_details || build_system_details,
-          T.nilable(T::Hash[String, T.untyped])
+          pyproject_document.project_metadata || pyproject_document.build_system_metadata,
+          T.nilable(PyprojectDocument::ProjectMetadata)
         )
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -183,28 +183,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib