dependabot-uv 0.394.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9eee59202ca318e612e23d7303309e498d51999cda642a1660d41390a2bd4a8
-  data.tar.gz: 3b3bb2ea60f190db5d8c9bd36f1ff01531097788c3755c6638d5a4e8e3ebf923
+  metadata.gz: 027ad1367a86b529db5967ecbd9aed18f7ccdceb9d4df8ff8cdfddcaf5ec5d97
+  data.tar.gz: 24335d0faa175e847520483ddbfcf8f63e6a40148051a38d83d71542c34656e9
 SHA512:
-  metadata.gz: 2f6d9c0f1ea2c05bab8acea5563a4a74c016ab9b8bd77639afe9468a8f7b8cb18d238585b5bdc11b255bf8e8d0af01d7d470c07ab9b83792d8001156bb73a199
-  data.tar.gz: '09c83e67c0b94adf7ad3f848f17521b57e282ef33db9d4ac0b5991d0ea8135024fc9eb5e78a1515a7f9f4c826f8db3347e25b24ed842ed85681a0b3dd8289e94'
+  metadata.gz: 5db0cb74fe436d25c525a42d306c9da0e6708dc176915fa6daf3d57f1d482404cad6ed0a061d1f6ee2b5e7235c57e6963cb6e85defca8be39b8bd4a209af64f3
+  data.tar.gz: cf36a1b60e34ef5325b5b9108a098f923d0245f1eca864ab1d83e16be64f31afaf86f7c71fc4867af057c569ce5a0e90be66f98aab732667790aa22d4b83aba0

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.2.1
 poetry==2.4.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.5
+uv==0.12.7
 
 # Some dependencies will only install if Cython is present
 Cython==3.3.0

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -89,11 +89,17 @@ module Dependabot
           # undesirable. Leave PDM alone until properly supported
           return dependencies if using_pdm?
 
+          unresolvable_sources = PyprojectDocument.from_file(pyproject_file)
+                                                  .unresolvable_uv_source_names
+                                                  .map { |name| normalise(name) }
+
           parse_pep621_pep735_dependencies(pyproject_file).each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
             next if dep.markers&.include?("<")
 
+            next if unresolvable_sources.include?(normalise(dep.name))
+
             # In uv no constraint means any version is acceptable
             requirement_value = dep.requirement == "" ? "*" : dep.requirement
 

data/lib/dependabot/uv/file_parser.rb

@@ -16,6 +16,7 @@ require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirements_file_matcher"
 require "dependabot/uv/language_version_manager"
 require "dependabot/uv/package_manager"
+require "dependabot/python/file_parser/pep_dependency"
 require "toml-rb"
 
 module Dependabot
@@ -235,16 +236,16 @@ module Dependabot
         parsed_requirement_files.each do |dep|
           next if blocking_marker?(dep)
 
-          name = dep["name"]
-          file = dep["file"]
-          version = dep["version"]
+          name = dep.name
+          file = dep.file
+          version = dep.version
           original_file = get_original_file(file)
 
           requirements =
             if original_file && requirements_in_file_matcher.compiled_file?(original_file) then []
             else
               [{
-                requirement: dep["requirement"],
+                requirement: dep.requirement,
                 file: Pathname.new(file).cleanpath.to_path,
                 source: nil,
                 groups: group_from_filename(file)
@@ -256,7 +257,7 @@ module Dependabot
 
           dependencies <<
             Dependency.new(
-              name: normalised_name(name, dep["extras"]),
+              name: normalised_name(name, dep.extras),
               version: version&.include?("*") ? nil : version,
               requirements: requirements,
               package_manager: "uv"
@@ -281,35 +282,32 @@ module Dependabot
         end
       end
 
-      sig { params(dep: T.untyped).returns(T::Boolean) }
+      sig { params(dep: Dependabot::Python::FileParser::PepDependency).returns(T::Boolean) }
       def blocking_marker?(dep)
-        return false if dep["markers"] == "None"
+        marker = dep.markers
+        return false if marker.nil? || marker == "None"
 
-        marker = dep["markers"]
         version = python_raw_version
 
         if marker.include?("python_version")
           !marker_satisfied?(marker, version)
         else
-          return true if dep["markers"].include?("<")
-          return false if dep["markers"].include?(">")
-          return false if dep["requirement"].nil?
+          return true if marker.include?("<")
+          return false if marker.include?(">")
 
-          dep["requirement"].include?("<")
+          dep.requirement&.include?("<") || false
         end
       end
 
-      sig do
-        params(marker: T.untyped, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean)
-      end
+      sig { params(marker: String, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean) }
       def marker_satisfied?(marker, python_version)
         conditions = marker.split(/\s+(and|or)\s+/)
 
-        result = T.let(evaluate_condition?(conditions.shift, python_version), T::Boolean)
+        result = T.let(evaluate_condition?(T.must(conditions.shift), python_version), T::Boolean)
 
         until conditions.empty?
           operator = conditions.shift
-          next_condition = conditions.shift
+          next_condition = T.must(conditions.shift)
           next_result = evaluate_condition?(next_condition, python_version)
 
           result = if operator == "and"
@@ -324,12 +322,13 @@ module Dependabot
 
       sig do
         params(
-          condition: T.untyped,
+          condition: String,
           python_version: T.any(String, Integer, Gem::Version)
         ).returns(T::Boolean)
       end
       def evaluate_condition?(condition, python_version)
         operator, version = condition.match(/([<>=!]=?)\s*"?([\d.]+)"?/)&.captures
+        return false unless version
 
         case operator
         when "<"
@@ -347,17 +346,18 @@ module Dependabot
         end
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T::Array[Dependabot::Python::FileParser::PepDependency]) }
       def parsed_requirement_files
         SharedHelpers.in_a_temporary_directory do
           write_temporary_dependency_files
 
-          requirements = SharedHelpers.run_helper_subprocess(
+          result = SharedHelpers.run_helper_subprocess(
             command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
             function: "parse_requirements",
             args: [Dir.pwd]
           )
 
+          requirements = Dependabot::Python::FileParser::PepDependency.from_requirements_helper_result(result)
           check_requirements(requirements)
           requirements
         end
@@ -368,12 +368,13 @@ module Dependabot
         raise DependencyFileNotEvaluatable, e.message
       end
 
-      sig { params(requirements: T.untyped).returns(T.untyped) }
+      sig { params(requirements: T::Array[Dependabot::Python::FileParser::PepDependency]).void }
       def check_requirements(requirements)
         requirements.each do |dep|
-          next unless dep["requirement"]
+          requirement = dep.requirement
+          next unless requirement
 
-          Requirement.new(dep["requirement"].split(","))
+          Requirement.new(requirement.split(","))
         rescue Gem::Requirement::BadRequirementError => e
           raise DependencyFileNotEvaluatable, e.message
         end

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/authed_url_builder"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class CompileFileUpdater
         extend T::Sig
 
@@ -434,12 +434,17 @@ module Dependabot
             args << index_url if index_url
 
             begin
+              helper_result = SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "get_dependency_hash",
+                args: args
+              )
+
+              # Skip this index if helper returned nil (can happen with unavailable registries)
+              next if helper_result.nil?
+
               native_helper_hashes = T.cast(
-                SharedHelpers.run_helper_subprocess(
-                  command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                  function: "get_dependency_hash",
-                  args: args
-                ),
+                helper_result,
                 T::Array[T::Hash[String, String]]
               ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }
 
@@ -451,6 +456,8 @@ module Dependabot
             end
           end
 
+          raise DependencyFileNotResolvable, "Unable to find hashes for package #{name}" if hashes.empty?
+
           hashes
         end
 
@@ -665,7 +672,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/requirement_suffix_helper"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class LockFileUpdater
         extend T::Sig
 
@@ -798,7 +798,6 @@ module Dependabot
           )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/version_config_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -13,6 +13,8 @@ module Dependabot
       class VersionConfigParser
         extend T::Sig
 
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
         class VersionConfig < T::Struct
           extend T::Sig
 
@@ -32,7 +34,7 @@ module Dependabot
           @pyproject_content = pyproject_content
           @base_path = base_path
           @repo_root = repo_root
-          @parsed_pyproject = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @parsed_pyproject = T.let(nil, T.nilable(ObjectHash))
         end
 
         sig { returns(VersionConfig) }
@@ -56,15 +58,46 @@ module Dependabot
         sig { returns(String) }
         attr_reader :repo_root
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(ObjectHash) }
         def parsed_pyproject
           return @parsed_pyproject unless @parsed_pyproject.nil?
 
-          @parsed_pyproject = TomlRB.parse(pyproject_content)
+          @parsed_pyproject = object_hash(T.cast(TomlRB.parse(pyproject_content), Object))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           @parsed_pyproject = {}
         end
 
+        sig { params(value: Object).returns(ObjectHash) }
+        def object_hash(value)
+          raise TypeError, "Version configuration must be a table" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "Version configuration keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(path: T::Array[String]).returns(Object) }
+        def config_value(path)
+          value = T.let(parsed_pyproject, Object)
+          path.each do |key|
+            return nil if value.nil?
+
+            value = object_hash(value)[key]
+          end
+          value
+        end
+
+        sig { params(path: T::Array[String]).returns(T.nilable(ObjectHash)) }
+        def config_table(path)
+          value = config_value(path)
+          object_hash(value) if value.is_a?(Hash)
+        end
+
         sig { returns(T::Array[String]) }
         def collect_write_paths
           paths = []
@@ -82,8 +115,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def setuptools_scm_write_paths
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          return [] unless scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          return [] unless scm_config
 
           paths = []
 
@@ -98,8 +131,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_vcs_build_hook_write_paths
-          vcs_hook = parsed_pyproject.dig("tool", "hatch", "build", "hooks", "vcs")
-          return [] unless vcs_hook.is_a?(Hash)
+          vcs_hook = config_table(%w(tool hatch build hooks vcs))
+          return [] unless vcs_hook
 
           paths = []
 
@@ -111,8 +144,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_version_source_paths
-          hatch_version = parsed_pyproject.dig("tool", "hatch", "version")
-          return [] unless hatch_version.is_a?(Hash)
+          hatch_version = config_table(%w(tool hatch version))
+          return [] unless hatch_version
 
           paths = []
 
@@ -124,14 +157,14 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_fallback_version
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          if scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          if scm_config
             fallback = scm_config["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
 
-          raw_options = parsed_pyproject.dig("tool", "hatch", "version", "raw-options")
-          if raw_options.is_a?(Hash)
+          raw_options = config_table(%w(tool hatch version raw-options))
+          if raw_options
             fallback = raw_options["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
@@ -141,7 +174,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_package_name
-          name = parsed_pyproject.dig("project", "name")
+          name = config_value(%w(project name))
           return name if name.is_a?(String)
 
           nil

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -24,7 +24,7 @@ module Dependabot
       # This class does version resolution for pip-compile. Its approach is:
       # - Unlock the dependency we're checking in the requirements.in file
       # - Run `pip-compile` and see what the result is
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class PipCompileVersionResolver
         extend T::Sig
 
@@ -595,7 +595,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
 
     class PipCompileErrorHandler

data/lib/dependabot/uv/update_checker.rb

@@ -228,11 +228,11 @@ module Dependabot
         requirement_files.any? { |f| f.end_with?("requirements.txt") }
       end
 
-      sig { override.returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { override.returns(T.nilable(PyprojectDocument::ProjectMetadata)) }
       def library_details
         @library_details ||= T.let(
-          standard_details || build_system_details,
-          T.nilable(T::Hash[String, T.untyped])
+          pyproject_document.project_metadata || pyproject_document.build_system_metadata,
+          T.nilable(PyprojectDocument::ProjectMetadata)
         )
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -192,19 +192,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib