dependabot-uv 0.397.0 → 0.398.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a21c1fc9597ab5ac799394151df83043ad6c6d1b62fb408c0657a9a4e67c6bc
-  data.tar.gz: 42f770b5019c335bba7129bb87d8a875502b07d2ecab72af74169d59a2327b29
+  metadata.gz: f460c106ded2b40fb9c7e91e53baee1a2959a640e47bafaece6b43b0f112b022
+  data.tar.gz: 281ce9fee19f90b0b703145445bb05c83d2cbc81eadbd3f3fb8eef3f07d79a0b
 SHA512:
-  metadata.gz: aabd1f1f406790c8a4fa4b2fe0418d03993c49b54a86be43e749d352dcfccc5e791587461bfa4a4bfc63c142d789097f40a9b012769ec21705b8b3cb96728fe2
-  data.tar.gz: abb80225b2a528c131fea6c1119a15bbba6c15e50c3df8990c0497ed2e3775b60d9bd984d4b8715cdc58cbac104eaf2f50673567b7c1cae28f1a1fd0f7f35dfd
+  metadata.gz: 836cbb9770876a0f0c0f3c02d599cf0948739d7ad2ea12701f1cb78fcf1051b3f78364db63f46e4b4a12e2080d41a1797912e20803a1cbf201aa8ab857038314
+  data.tar.gz: f3144802f8314d9998824fe31164dc4d47cb092eb7a8ed0764e221d455cf60301c37a76033c5cf963e919fe43514e9e33347c4c74eca10575514332583beeb5a

data/helpers/requirements.txt

@@ -1,13 +1,13 @@
 pip==26.2.1
 pip-tools==7.6.1
-flake8==7.3.0
+flake8==7.4.1
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.4.3
+poetry==2.5.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.15
+uv==0.12.18
 
 # Some dependencies will only install if Cython is present
 Cython==3.3.0

data/lib/dependabot/uv/dependency_grapher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,7 +7,7 @@ require "dependabot/dependency"
 require "dependabot/dependency_graphers"
 require "dependabot/dependency_graphers/base"
 require "dependabot/uv/file_parser"
-require "toml-rb"
+require "dependabot/uv/lockfile_document"
 
 module Dependabot
   module Uv
@@ -42,19 +42,17 @@ module Dependabot
       sig { returns(T::Hash[String, T::Array[String]]) }
       def package_relationships
         @package_relationships ||= T.let(
-          package_relationships_from_lockfile(T.must(T.must(uv_lock).content)),
+          package_relationships_from_lockfile(T.must(uv_lock)),
           T.nilable(T::Hash[String, T::Array[String]])
         )
       end
 
       sig { void }
       def prepare_from_lockfile!
-        lockfile = T.must(uv_lock)
-        parsed = TomlRB.parse(lockfile.content)
-        packages = T.cast(parsed.fetch("package", []), T::Array[T.untyped])
-        manifest = parsed.fetch("manifest", {})
+        document = LockfileDocument.from_file(T.must(uv_lock))
+        packages = document.graph_packages
 
-        root_names = root_package_names(packages, manifest)
+        root_names = root_package_names(packages, document.workspace_members.to_set)
         direct_runtime, direct_dev = direct_dependency_names(packages, root_names)
 
         @dependencies = packages.filter_map do |pkg|
@@ -73,14 +71,15 @@ module Dependabot
         @prepared = true
       end
 
-      sig { params(lockfile_content: String).returns(T::Hash[String, T::Array[String]]) }
-      def package_relationships_from_lockfile(lockfile_content)
-        lockfile_packages(lockfile_content).each_with_object({}) do |package_data, rels|
-          parent = lockfile_parent_name(package_data)
-          next unless parent
+      sig { params(lockfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Array[String]]) }
+      def package_relationships_from_lockfile(lockfile)
+        relationships = T.let({}, T::Hash[String, T::Array[String]])
+        LockfileDocument.from_file(lockfile).graph_packages.each_with_object(relationships) do |package, rels|
+          name = package.name
+          next unless name
 
-          rels[parent] ||= []
-          rels[parent].concat(lockfile_child_names(package_data))
+          parent = normalised_dependency_name(name)
+          (rels[parent] ||= []).concat(lockfile_child_names(package))
         end
       rescue StandardError => e
         errored_fetching_subdependencies!
@@ -89,48 +88,15 @@ module Dependabot
         {}
       end
 
-      sig { params(lockfile_content: String).returns(T::Array[T.untyped]) }
-      def lockfile_packages(lockfile_content)
-        parsed = TomlRB.parse(lockfile_content)
-        T.cast(parsed.fetch("package", []), T::Array[T.untyped])
-      end
-
-      sig { params(package_data: T.untyped).returns(T.nilable(String)) }
-      def lockfile_parent_name(package_data)
-        return unless package_data.is_a?(Hash)
-
-        package_name = package_data["name"]
-        return unless package_name.is_a?(String)
-
-        normalised_dependency_name(package_name)
-      end
-
       # Mirrors uv's `create_dependencies` (crates/uv-resolver/src/lock/export/cyclonedx_json.rs),
       # which chains a package's `dependencies`, `optional-dependencies`, and
       # `dev-dependencies` when building the SBOM dependency graph.
-      sig { params(package_data: T.untyped).returns(T::Array[String]) }
-      def lockfile_child_names(package_data)
-        return [] unless package_data.is_a?(Hash)
-
-        names = T.let([], T::Array[String])
-        collect_dep_names(package_data["dependencies"], names)
-        collect_dep_names_from_groups(package_data["optional-dependencies"], names)
-        collect_dep_names_from_groups(package_data["dev-dependencies"], names)
+      sig { params(package: LockfileDocument::GraphPackage).returns(T::Array[String]) }
+      def lockfile_child_names(package)
+        names = package.dependencies + package.optional_dependencies + package.dev_dependencies
         names.map { |name| normalised_dependency_name(name) }.uniq
       end
 
-      sig { params(dependency_data: T.untyped).returns(T.nilable(String)) }
-      def lockfile_dependency_name(dependency_data)
-        if dependency_data.is_a?(Hash)
-          name = dependency_data["name"]
-          return name if name.is_a?(String)
-        end
-
-        return dependency_data if dependency_data.is_a?(String)
-
-        nil
-      end
-
       # Identifies the workspace member packages whose `dependencies`,
       # `optional-dependencies`, and `dev-dependencies` arrays describe the
       # project's direct deps.
@@ -144,32 +110,17 @@ module Dependabot
       # Fallback for single-member workspaces (which omit `[manifest] members`):
       # match packages whose `source` is a local variant — `virtual`, `editable`,
       # or `directory` — per the `SourceWire` enum in the same file.
-      sig { params(packages: T::Array[T.untyped], manifest: T.untyped).returns(T::Set[String]) }
-      def root_package_names(packages, manifest)
-        declared = declared_workspace_members(manifest)
+      sig do
+        params(packages: T::Array[LockfileDocument::GraphPackage], declared: T::Set[String]).returns(T::Set[String])
+      end
+      def root_package_names(packages, declared)
         return declared unless declared.empty?
 
         packages.each_with_object(Set.new) do |pkg, set|
-          next unless pkg.is_a?(Hash)
-
-          source = pkg["source"]
-          next unless source.is_a?(Hash)
-          next unless source.key?("virtual") || source.key?("editable") || source.key?("directory")
+          next unless pkg.local_source
 
-          name = pkg["name"]
-          set << name if name.is_a?(String)
-        end
-      end
-
-      sig { params(manifest: T.untyped).returns(T::Set[String]) }
-      def declared_workspace_members(manifest)
-        return Set.new unless manifest.is_a?(Hash)
-
-        members = manifest["members"]
-        return Set.new unless members.is_a?(Array)
-
-        members.each_with_object(Set.new) do |name, set|
-          set << name if name.is_a?(String)
+          name = pkg.name
+          set << name if name
         end
       end
 
@@ -180,7 +131,7 @@ module Dependabot
       # semantics because the dependency graph reports what *could* be installed, not what was
       # selected for a particular sync.
       sig do
-        params(packages: T::Array[T.untyped], root_names: T::Set[String])
+        params(packages: T::Array[LockfileDocument::GraphPackage], root_names: T::Set[String])
           .returns([T::Set[String], T::Set[String]])
       end
       def direct_dependency_names(packages, root_names)
@@ -188,47 +139,29 @@ module Dependabot
         dev = T.let(Set.new, T::Set[String])
 
         packages.each do |pkg|
-          next unless pkg.is_a?(Hash) && root_names.include?(pkg["name"])
+          name = pkg.name
+          next unless name && root_names.include?(name)
 
-          collect_dep_names(pkg["dependencies"], runtime)
-          collect_dep_names_from_groups(pkg["optional-dependencies"], runtime)
-          collect_dep_names_from_groups(pkg["dev-dependencies"], dev)
+          runtime.merge(pkg.dependencies)
+          runtime.merge(pkg.optional_dependencies)
+          dev.merge(pkg.dev_dependencies)
         end
 
         [runtime, dev]
       end
 
-      sig { params(entries: T.untyped, collection: T.any(T::Set[String], T::Array[String])).void }
-      def collect_dep_names(entries, collection)
-        return unless entries.is_a?(Array)
-
-        entries.each do |entry|
-          name = lockfile_dependency_name(entry)
-          collection << name if name.is_a?(String)
-        end
-      end
-
-      sig { params(groups: T.untyped, collection: T.any(T::Set[String], T::Array[String])).void }
-      def collect_dep_names_from_groups(groups, collection)
-        return unless groups.is_a?(Hash)
-
-        groups.each_value { |entries| collect_dep_names(entries, collection) }
-      end
-
       sig do
         params(
-          pkg: T.untyped,
+          pkg: LockfileDocument::GraphPackage,
           root_names: T::Set[String],
           direct_runtime: T::Set[String],
           direct_dev: T::Set[String]
         ).returns(T.nilable(Dependabot::Dependency))
       end
       def build_dependency(pkg, root_names, direct_runtime, direct_dev)
-        return unless pkg.is_a?(Hash)
-
-        name = pkg["name"]
-        version = pkg["version"]
-        return unless name.is_a?(String) && version.is_a?(String)
+        name = pkg.name
+        version = pkg.version
+        return unless name && version
 
         # Root project packages get requirements: [] (indirect, runtime) to
         # match the prior FileParser-derived behaviour where uv.lock packages

data/lib/dependabot/uv/lockfile_document.rb

@@ -0,0 +1,111 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "toml-rb"
+
+require "dependabot/dependency_file"
+
+module Dependabot
+  module Uv
+    class LockfileDocument
+      extend T::Sig
+
+      LOCAL_SOURCE_KEYS = %w(virtual editable directory).freeze
+
+      class GraphPackage < T::ImmutableStruct
+        const :name, T.nilable(String)
+        const :version, T.nilable(String)
+        const :local_source, T::Boolean
+        const :dependencies, T::Array[String]
+        const :optional_dependencies, T::Array[String]
+        const :dev_dependencies, T::Array[String]
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(LockfileDocument) }
+      def self.from_file(file)
+        new(data: T.cast(TomlRB.parse(T.must(file.content)), Object), context: file.path)
+      end
+
+      sig { params(data: Object, context: String).void }
+      def initialize(data:, context:)
+        @context = context
+        @data = T.let(object_hash(data), T::Hash[String, Object])
+      end
+
+      sig { returns(T::Array[String]) }
+      def workspace_members
+        manifest = @data["manifest"]
+        return [] unless manifest.is_a?(Hash)
+
+        members = T.cast(manifest["members"], Object)
+        return [] unless members.is_a?(Array)
+
+        members.filter_map { |member| string_or_nil(T.cast(member, Object)) }
+      end
+
+      sig { returns(T::Array[GraphPackage]) }
+      def graph_packages
+        package_entries.filter_map do |entry|
+          next unless entry.is_a?(Hash)
+
+          package = object_hash(entry)
+          source = package["source"]
+          GraphPackage.new(
+            name: string_or_nil(package["name"]),
+            version: string_or_nil(package["version"]),
+            local_source: source.is_a?(Hash) && LOCAL_SOURCE_KEYS.any? { |key| source.key?(key) },
+            dependencies: dependency_names(package["dependencies"]),
+            optional_dependencies: grouped_dependency_names(package["optional-dependencies"]),
+            dev_dependencies: grouped_dependency_names(package["dev-dependencies"])
+          )
+        end
+      end
+
+      private
+
+      sig { returns(T::Array[Object]) }
+      def package_entries
+        packages = @data.fetch("package", [])
+        raise TypeError, "#{@context} package must be an array" unless packages.is_a?(Array)
+
+        packages.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object).returns(T::Hash[String, Object]) }
+      def object_hash(value)
+        raise TypeError, "#{@context} must be an object" unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{@context} keys must be strings" unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+
+      sig { params(value: Object).returns(T.nilable(String)) }
+      def string_or_nil(value)
+        value if value.is_a?(String)
+      end
+
+      sig { params(entries: Object).returns(T::Array[String]) }
+      def dependency_names(entries)
+        return [] unless entries.is_a?(Array)
+
+        entries.filter_map do |raw_entry|
+          entry = T.cast(raw_entry, Object)
+          name = entry.is_a?(Hash) ? T.cast(entry["name"], Object) : entry
+          string_or_nil(name)
+        end
+      end
+
+      sig { params(groups: Object).returns(T::Array[String]) }
+      def grouped_dependency_names(groups)
+        return [] unless groups.is_a?(Hash)
+
+        groups.values.flat_map { |entries| dependency_names(T.cast(entries, Object)) }
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.398.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -280,6 +280,7 @@ files:
 - lib/dependabot/uv/file_updater/version_config_parser.rb
 - lib/dependabot/uv/language.rb
 - lib/dependabot/uv/language_version_manager.rb
+- lib/dependabot/uv/lockfile_document.rb
 - lib/dependabot/uv/metadata_finder.rb
 - lib/dependabot/uv/name_normaliser.rb
 - lib/dependabot/uv/native_helpers.rb
@@ -301,7 +302,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
 rdoc_options: []
 require_paths:
 - lib