dependabot-uv 0.395.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5e87aed24a3d0d1e38f69d064fa0d05ea3aa5db358ffe8b8aca51b0ba814f41
-  data.tar.gz: a79f5e14f753586b9a66310917f590bf7ac1065318cbd9f18cecf43c54a4ae24
+  metadata.gz: 027ad1367a86b529db5967ecbd9aed18f7ccdceb9d4df8ff8cdfddcaf5ec5d97
+  data.tar.gz: 24335d0faa175e847520483ddbfcf8f63e6a40148051a38d83d71542c34656e9
 SHA512:
-  metadata.gz: e5c993116408e7948b8d4622ad7d76e1a9a4a9fde594072883d0dd1d8e8275531a5f4d2be045fb599b61f26577d72bee2e1111a226fccb39f73058d826f66e1f
-  data.tar.gz: 3fb63ce5867dc87ee0ee729cb97d67c88069517f31b046d46ca9db30e27138d617af03499392543360bab156018b2ef67550d3b49c7f041468611acf50ad0097
+  metadata.gz: 5db0cb74fe436d25c525a42d306c9da0e6708dc176915fa6daf3d57f1d482404cad6ed0a061d1f6ee2b5e7235c57e6963cb6e85defca8be39b8bd4a209af64f3
+  data.tar.gz: cf36a1b60e34ef5325b5b9108a098f923d0245f1eca864ab1d83e16be64f31afaf86f7c71fc4867af057c569ce5a0e90be66f98aab732667790aa22d4b83aba0

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -89,11 +89,17 @@ module Dependabot
           # undesirable. Leave PDM alone until properly supported
           return dependencies if using_pdm?
 
+          unresolvable_sources = PyprojectDocument.from_file(pyproject_file)
+                                                  .unresolvable_uv_source_names
+                                                  .map { |name| normalise(name) }
+
           parse_pep621_pep735_dependencies(pyproject_file).each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
             next if dep.markers&.include?("<")
 
+            next if unresolvable_sources.include?(normalise(dep.name))
+
             # In uv no constraint means any version is acceptable
             requirement_value = dep.requirement == "" ? "*" : dep.requirement
 

data/lib/dependabot/uv/file_parser.rb

@@ -16,6 +16,7 @@ require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirements_file_matcher"
 require "dependabot/uv/language_version_manager"
 require "dependabot/uv/package_manager"
+require "dependabot/python/file_parser/pep_dependency"
 require "toml-rb"
 
 module Dependabot
@@ -235,16 +236,16 @@ module Dependabot
         parsed_requirement_files.each do |dep|
           next if blocking_marker?(dep)
 
-          name = dep["name"]
-          file = dep["file"]
-          version = dep["version"]
+          name = dep.name
+          file = dep.file
+          version = dep.version
           original_file = get_original_file(file)
 
           requirements =
             if original_file && requirements_in_file_matcher.compiled_file?(original_file) then []
             else
               [{
-                requirement: dep["requirement"],
+                requirement: dep.requirement,
                 file: Pathname.new(file).cleanpath.to_path,
                 source: nil,
                 groups: group_from_filename(file)
@@ -256,7 +257,7 @@ module Dependabot
 
           dependencies <<
             Dependency.new(
-              name: normalised_name(name, dep["extras"]),
+              name: normalised_name(name, dep.extras),
               version: version&.include?("*") ? nil : version,
               requirements: requirements,
               package_manager: "uv"
@@ -281,35 +282,32 @@ module Dependabot
         end
       end
 
-      sig { params(dep: T.untyped).returns(T::Boolean) }
+      sig { params(dep: Dependabot::Python::FileParser::PepDependency).returns(T::Boolean) }
       def blocking_marker?(dep)
-        return false if dep["markers"] == "None"
+        marker = dep.markers
+        return false if marker.nil? || marker == "None"
 
-        marker = dep["markers"]
         version = python_raw_version
 
         if marker.include?("python_version")
           !marker_satisfied?(marker, version)
         else
-          return true if dep["markers"].include?("<")
-          return false if dep["markers"].include?(">")
-          return false if dep["requirement"].nil?
+          return true if marker.include?("<")
+          return false if marker.include?(">")
 
-          dep["requirement"].include?("<")
+          dep.requirement&.include?("<") || false
         end
       end
 
-      sig do
-        params(marker: T.untyped, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean)
-      end
+      sig { params(marker: String, python_version: T.any(String, Integer, Gem::Version)).returns(T::Boolean) }
       def marker_satisfied?(marker, python_version)
         conditions = marker.split(/\s+(and|or)\s+/)
 
-        result = T.let(evaluate_condition?(conditions.shift, python_version), T::Boolean)
+        result = T.let(evaluate_condition?(T.must(conditions.shift), python_version), T::Boolean)
 
         until conditions.empty?
           operator = conditions.shift
-          next_condition = conditions.shift
+          next_condition = T.must(conditions.shift)
           next_result = evaluate_condition?(next_condition, python_version)
 
           result = if operator == "and"
@@ -324,12 +322,13 @@ module Dependabot
 
       sig do
         params(
-          condition: T.untyped,
+          condition: String,
           python_version: T.any(String, Integer, Gem::Version)
         ).returns(T::Boolean)
       end
       def evaluate_condition?(condition, python_version)
         operator, version = condition.match(/([<>=!]=?)\s*"?([\d.]+)"?/)&.captures
+        return false unless version
 
         case operator
         when "<"
@@ -347,17 +346,18 @@ module Dependabot
         end
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T::Array[Dependabot::Python::FileParser::PepDependency]) }
       def parsed_requirement_files
         SharedHelpers.in_a_temporary_directory do
           write_temporary_dependency_files
 
-          requirements = SharedHelpers.run_helper_subprocess(
+          result = SharedHelpers.run_helper_subprocess(
             command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
             function: "parse_requirements",
             args: [Dir.pwd]
           )
 
+          requirements = Dependabot::Python::FileParser::PepDependency.from_requirements_helper_result(result)
           check_requirements(requirements)
           requirements
         end
@@ -368,12 +368,13 @@ module Dependabot
         raise DependencyFileNotEvaluatable, e.message
       end
 
-      sig { params(requirements: T.untyped).returns(T.untyped) }
+      sig { params(requirements: T::Array[Dependabot::Python::FileParser::PepDependency]).void }
       def check_requirements(requirements)
         requirements.each do |dep|
-          next unless dep["requirement"]
+          requirement = dep.requirement
+          next unless requirement
 
-          Requirement.new(dep["requirement"].split(","))
+          Requirement.new(requirement.split(","))
         rescue Gem::Requirement::BadRequirementError => e
           raise DependencyFileNotEvaluatable, e.message
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib