dependabot-uv 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a21c1fc9597ab5ac799394151df83043ad6c6d1b62fb408c0657a9a4e67c6bc
-  data.tar.gz: 42f770b5019c335bba7129bb87d8a875502b07d2ecab72af74169d59a2327b29
+  metadata.gz: 7bbb68bb0a2bc28ad6791a412231ba074cbfaa658252e6e1c3cceac992a05469
+  data.tar.gz: cea56c236a2c71bcf1c0fb6fc5a342631acb720925122241a2ee3405c68b32df
 SHA512:
-  metadata.gz: aabd1f1f406790c8a4fa4b2fe0418d03993c49b54a86be43e749d352dcfccc5e791587461bfa4a4bfc63c142d789097f40a9b012769ec21705b8b3cb96728fe2
-  data.tar.gz: abb80225b2a528c131fea6c1119a15bbba6c15e50c3df8990c0497ed2e3775b60d9bd984d4b8715cdc58cbac104eaf2f50673567b7c1cae28f1a1fd0f7f35dfd
+  metadata.gz: 333c7cba768d01f88b1e075c3f639e4ab799802c63ac7bd6fa8cd5fae6564b27145a5e1c2881f7d3a8b550564baecb85f636bf2e6de14ecf1bd948655c0e30e4
+  data.tar.gz: 0a1647d7b40b5297f3320c37ff7e61922f6bbe627fdf76fd2b55ad2215545600852c833cd7f31b2067a6f8d54b961609c4a2567216457e145696ec5504f00cb6

data/helpers/requirements.txt

@@ -1,13 +1,13 @@
 pip==26.2.1
 pip-tools==7.6.1
-flake8==7.3.0
+flake8==7.4.1
 hashin==1.0.5
 pipenv==2024.4.1
 plette==2.2.1
-poetry==2.4.3
+poetry==2.5.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.15
+uv==0.12.18
 
 # Some dependencies will only install if Cython is present
 Cython==3.3.0

data/lib/dependabot/uv/dependency_grapher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,7 +7,7 @@ require "dependabot/dependency"
 require "dependabot/dependency_graphers"
 require "dependabot/dependency_graphers/base"
 require "dependabot/uv/file_parser"
-require "toml-rb"
+require "dependabot/uv/lockfile_document"
 
 module Dependabot
   module Uv
@@ -42,19 +42,17 @@ module Dependabot
       sig { returns(T::Hash[String, T::Array[String]]) }
       def package_relationships
         @package_relationships ||= T.let(
-          package_relationships_from_lockfile(T.must(T.must(uv_lock).content)),
+          package_relationships_from_lockfile(T.must(uv_lock)),
           T.nilable(T::Hash[String, T::Array[String]])
         )
       end
 
       sig { void }
       def prepare_from_lockfile!
-        lockfile = T.must(uv_lock)
-        parsed = TomlRB.parse(lockfile.content)
-        packages = T.cast(parsed.fetch("package", []), T::Array[T.untyped])
-        manifest = parsed.fetch("manifest", {})
+        document = LockfileDocument.from_file(T.must(uv_lock))
+        packages = document.graph_packages
 
-        root_names = root_package_names(packages, manifest)
+        root_names = root_package_names(packages, document.workspace_members.to_set)
         direct_runtime, direct_dev = direct_dependency_names(packages, root_names)
 
         @dependencies = packages.filter_map do |pkg|
@@ -73,14 +71,15 @@ module Dependabot
         @prepared = true
       end
 
-      sig { params(lockfile_content: String).returns(T::Hash[String, T::Array[String]]) }
-      def package_relationships_from_lockfile(lockfile_content)
-        lockfile_packages(lockfile_content).each_with_object({}) do |package_data, rels|
-          parent = lockfile_parent_name(package_data)
-          next unless parent
+      sig { params(lockfile: Dependabot::DependencyFile).returns(T::Hash[String, T::Array[String]]) }
+      def package_relationships_from_lockfile(lockfile)
+        relationships = T.let({}, T::Hash[String, T::Array[String]])
+        LockfileDocument.from_file(lockfile).graph_packages.each_with_object(relationships) do |package, rels|
+          name = package.name
+          next unless name
 
-          rels[parent] ||= []
-          rels[parent].concat(lockfile_child_names(package_data))
+          parent = normalised_dependency_name(name)
+          (rels[parent] ||= []).concat(lockfile_child_names(package))
         end
       rescue StandardError => e
         errored_fetching_subdependencies!
@@ -89,48 +88,15 @@ module Dependabot
         {}
       end
 
-      sig { params(lockfile_content: String).returns(T::Array[T.untyped]) }
-      def lockfile_packages(lockfile_content)
-        parsed = TomlRB.parse(lockfile_content)
-        T.cast(parsed.fetch("package", []), T::Array[T.untyped])
-      end
-
-      sig { params(package_data: T.untyped).returns(T.nilable(String)) }
-      def lockfile_parent_name(package_data)
-        return unless package_data.is_a?(Hash)
-
-        package_name = package_data["name"]
-        return unless package_name.is_a?(String)
-
-        normalised_dependency_name(package_name)
-      end
-
       # Mirrors uv's `create_dependencies` (crates/uv-resolver/src/lock/export/cyclonedx_json.rs),
       # which chains a package's `dependencies`, `optional-dependencies`, and
       # `dev-dependencies` when building the SBOM dependency graph.
-      sig { params(package_data: T.untyped).returns(T::Array[String]) }
-      def lockfile_child_names(package_data)
-        return [] unless package_data.is_a?(Hash)
-
-        names = T.let([], T::Array[String])
-        collect_dep_names(package_data["dependencies"], names)
-        collect_dep_names_from_groups(package_data["optional-dependencies"], names)
-        collect_dep_names_from_groups(package_data["dev-dependencies"], names)
+      sig { params(package: LockfileDocument::GraphPackage).returns(T::Array[String]) }
+      def lockfile_child_names(package)
+        names = package.dependencies + package.optional_dependencies + package.dev_dependencies
         names.map { |name| normalised_dependency_name(name) }.uniq
       end
 
-      sig { params(dependency_data: T.untyped).returns(T.nilable(String)) }
-      def lockfile_dependency_name(dependency_data)
-        if dependency_data.is_a?(Hash)
-          name = dependency_data["name"]
-          return name if name.is_a?(String)
-        end
-
-        return dependency_data if dependency_data.is_a?(String)
-
-        nil
-      end
-
       # Identifies the workspace member packages whose `dependencies`,
       # `optional-dependencies`, and `dev-dependencies` arrays describe the
       # project's direct deps.
@@ -144,32 +110,17 @@ module Dependabot
       # Fallback for single-member workspaces (which omit `[manifest] members`):
       # match packages whose `source` is a local variant — `virtual`, `editable`,
       # or `directory` — per the `SourceWire` enum in the same file.
-      sig { params(packages: T::Array[T.untyped], manifest: T.untyped).returns(T::Set[String]) }
-      def root_package_names(packages, manifest)
-        declared = declared_workspace_members(manifest)
+      sig do
+        params(packages: T::Array[LockfileDocument::GraphPackage], declared: T::Set[String]).returns(T::Set[String])
+      end
+      def root_package_names(packages, declared)
         return declared unless declared.empty?
 
         packages.each_with_object(Set.new) do |pkg, set|
-          next unless pkg.is_a?(Hash)
-
-          source = pkg["source"]
-          next unless source.is_a?(Hash)
-          next unless source.key?("virtual") || source.key?("editable") || source.key?("directory")
+          next unless pkg.local_source
 
-          name = pkg["name"]
-          set << name if name.is_a?(String)
-        end
-      end
-
-      sig { params(manifest: T.untyped).returns(T::Set[String]) }
-      def declared_workspace_members(manifest)
-        return Set.new unless manifest.is_a?(Hash)
-
-        members = manifest["members"]
-        return Set.new unless members.is_a?(Array)
-
-        members.each_with_object(Set.new) do |name, set|
-          set << name if name.is_a?(String)
+          name = pkg.name
+          set << name if name
         end
       end
 
@@ -180,7 +131,7 @@ module Dependabot
       # semantics because the dependency graph reports what *could* be installed, not what was
       # selected for a particular sync.
       sig do
-        params(packages: T::Array[T.untyped], root_names: T::Set[String])
+        params(packages: T::Array[LockfileDocument::GraphPackage], root_names: T::Set[String])
           .returns([T::Set[String], T::Set[String]])
       end
       def direct_dependency_names(packages, root_names)
@@ -188,47 +139,29 @@ module Dependabot
         dev = T.let(Set.new, T::Set[String])
 
         packages.each do |pkg|
-          next unless pkg.is_a?(Hash) && root_names.include?(pkg["name"])
+          name = pkg.name
+          next unless name && root_names.include?(name)
 
-          collect_dep_names(pkg["dependencies"], runtime)
-          collect_dep_names_from_groups(pkg["optional-dependencies"], runtime)
-          collect_dep_names_from_groups(pkg["dev-dependencies"], dev)
+          runtime.merge(pkg.dependencies)
+          runtime.merge(pkg.optional_dependencies)
+          dev.merge(pkg.dev_dependencies)
         end
 
         [runtime, dev]
       end
 
-      sig { params(entries: T.untyped, collection: T.any(T::Set[String], T::Array[String])).void }
-      def collect_dep_names(entries, collection)
-        return unless entries.is_a?(Array)
-
-        entries.each do |entry|
-          name = lockfile_dependency_name(entry)
-          collection << name if name.is_a?(String)
-        end
-      end
-
-      sig { params(groups: T.untyped, collection: T.any(T::Set[String], T::Array[String])).void }
-      def collect_dep_names_from_groups(groups, collection)
-        return unless groups.is_a?(Hash)
-
-        groups.each_value { |entries| collect_dep_names(entries, collection) }
-      end
-
       sig do
         params(
-          pkg: T.untyped,
+          pkg: LockfileDocument::GraphPackage,
           root_names: T::Set[String],
           direct_runtime: T::Set[String],
           direct_dev: T::Set[String]
         ).returns(T.nilable(Dependabot::Dependency))
       end
       def build_dependency(pkg, root_names, direct_runtime, direct_dev)
-        return unless pkg.is_a?(Hash)
-
-        name = pkg["name"]
-        version = pkg["version"]
-        return unless name.is_a?(String) && version.is_a?(String)
+        name = pkg.name
+        version = pkg.version
+        return unless name && version
 
         # Root project packages get requirements: [] (indirect, runtime) to
         # match the prior FileParser-derived behaviour where uv.lock packages

data/lib/dependabot/uv/file_parser.rb

@@ -16,8 +16,8 @@ require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirements_file_matcher"
 require "dependabot/uv/language_version_manager"
 require "dependabot/uv/package_manager"
+require "dependabot/uv/lockfile_document"
 require "dependabot/python/file_parser/pep_dependency"
-require "toml-rb"
 
 module Dependabot
   module Uv
@@ -199,15 +199,10 @@ module Dependabot
         dependency_set = DependencySet.new
 
         uv_lock_files.each do |file|
-          lockfile_content = TomlRB.parse(file.content)
-          packages = lockfile_content.fetch("package", [])
-
-          packages.each do |package_data|
-            next unless package_data.is_a?(Hash) && package_data["name"] && package_data["version"]
-
+          LockfileDocument.from_file(file).each_dependency do |package|
             dependency_set << Dependency.new(
-              name: normalised_name(package_data["name"]),
-              version: package_data["version"],
+              name: normalised_name(package.name),
+              version: package.version,
               requirements: [], # Lock files don't contain requirements
               package_manager: "uv"
             )

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -322,9 +322,19 @@ module Dependabot
           content = replace_header_with_original(updated_content, T.must(file.content))
           content = remove_new_warnings(content, T.must(file.content))
           content = update_hashes_if_required(content, T.must(file.content))
+          content = scrub_index_url_credentials(content)
           replace_absolute_file_paths(content, T.must(file.content))
         end
 
+        # Index URLs are passed to `uv pip compile` with credentials embedded so
+        # the private index can be fetched, and uv emits those URLs verbatim
+        # into the compiled file when `--emit-index-url` is active. Strip any
+        # userinfo so tokens are never written into the regenerated file.
+        sig { params(content: String).returns(String) }
+        def scrub_index_url_credentials(content)
+          content.gsub(%r{^(--(?:extra-)?index-url[= ]https?://)[^/\s]+@}, "\\1")
+        end
+
         sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_header_with_original(updated_content, original_content)
           original_header_lines =

data/lib/dependabot/uv/lockfile_document.rb

@@ -0,0 +1,167 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "toml-rb"
+
+require "dependabot/dependency_file"
+
+module Dependabot
+  module Uv
+    class LockfileDocument
+      extend T::Sig
+
+      LOCAL_SOURCE_KEYS = %w(virtual editable directory).freeze
+
+      class GraphPackage < T::ImmutableStruct
+        const :name, T.nilable(String)
+        const :version, T.nilable(String)
+        const :local_source, T::Boolean
+        const :dependencies, T::Array[String]
+        const :optional_dependencies, T::Array[String]
+        const :dev_dependencies, T::Array[String]
+      end
+
+      class LockedPackage < T::ImmutableStruct
+        const :name, String
+        const :version, String
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(LockfileDocument) }
+      def self.from_file(file)
+        new(data: T.cast(TomlRB.parse(T.must(file.content)), Object), context: file.path)
+      end
+
+      sig { params(data: Object, context: String).void }
+      def initialize(data:, context:)
+        @context = context
+        @data = T.let(object_hash(data), T::Hash[String, Object])
+      end
+
+      sig { returns(T::Array[String]) }
+      def workspace_members
+        manifest = @data["manifest"]
+        return [] unless manifest.is_a?(Hash)
+
+        members = T.cast(manifest["members"], Object)
+        return [] unless members.is_a?(Array)
+
+        members.filter_map { |member| string_or_nil(T.cast(member, Object)) }
+      end
+
+      sig { returns(T::Array[GraphPackage]) }
+      def graph_packages
+        package_entries.filter_map do |entry|
+          next unless entry.is_a?(Hash)
+
+          package = object_hash(entry)
+          source = package["source"]
+          GraphPackage.new(
+            name: string_or_nil(package["name"]),
+            version: string_or_nil(package["version"]),
+            local_source: source.is_a?(Hash) && LOCAL_SOURCE_KEYS.any? { |key| source.key?(key) },
+            dependencies: dependency_names(package["dependencies"]),
+            optional_dependencies: grouped_dependency_names(package["optional-dependencies"]),
+            dev_dependencies: grouped_dependency_names(package["dev-dependencies"])
+          )
+        end
+      end
+
+      sig { params(block: T.proc.params(package: LockedPackage).void).void }
+      def each_dependency(&block)
+        # The file parser historically skips the pairs yielded by an object-shaped package section.
+        return if @data["package"].is_a?(Hash)
+
+        package_entries.each_with_index do |entry, index|
+          next unless entry.is_a?(Hash)
+
+          package = object_hash(entry)
+          name = package["name"]
+          version = package["version"]
+          next unless name && version
+
+          yield(LockedPackage.new(
+            name: string(name, "package[#{index}].name"),
+            version: string(version, "package[#{index}].version")
+          ))
+        end
+      end
+
+      sig { returns(T::Array[LockedPackage]) }
+      def resolution_packages
+        return [] if @data["package"].nil?
+
+        package_entries.each_with_index.filter_map do |entry, index|
+          # String#[] cannot produce a valid version from the "version" lookup.
+          next if entry.is_a?(String)
+
+          package = object_hash(entry)
+          name = optional_string(package["name"], "package[#{index}].name")
+          version = optional_string(package["version"], "package[#{index}].version")
+          next unless name && version
+
+          LockedPackage.new(name: name, version: version)
+        end
+      end
+
+      private
+
+      sig { returns(T::Array[Object]) }
+      def package_entries
+        packages = @data.fetch("package", [])
+        raise TypeError, "#{@context} package must be an array" unless packages.is_a?(Array)
+
+        packages.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object).returns(T::Hash[String, Object]) }
+      def object_hash(value)
+        raise TypeError, "#{@context} must be an object" unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{@context} keys must be strings" unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+
+      sig { params(value: Object).returns(T.nilable(String)) }
+      def string_or_nil(value)
+        value if value.is_a?(String)
+      end
+
+      sig { params(value: Object, field: String).returns(T.nilable(String)) }
+      def optional_string(value, field)
+        return if value.nil?
+
+        string(value, field)
+      end
+
+      sig { params(value: Object, field: String).returns(String) }
+      def string(value, field)
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{@context} #{field} must be a string"
+      end
+
+      sig { params(entries: Object).returns(T::Array[String]) }
+      def dependency_names(entries)
+        return [] unless entries.is_a?(Array)
+
+        entries.filter_map do |raw_entry|
+          entry = T.cast(raw_entry, Object)
+          name = entry.is_a?(Hash) ? T.cast(entry["name"], Object) : entry
+          string_or_nil(name)
+        end
+      end
+
+      sig { params(groups: Object).returns(T::Array[String]) }
+      def grouped_dependency_names(groups)
+        return [] unless groups.is_a?(Hash)
+
+        groups.values.flat_map { |entries| dependency_names(T.cast(entries, Object)) }
+      end
+    end
+  end
+end

data/lib/dependabot/uv/update_checker/lock_file_resolver.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
-require "toml-rb"
+require "dependabot/uv/lockfile_document"
 
 require "dependabot/errors"
 require "dependabot/package/release_cooldown_options"
@@ -278,20 +278,13 @@ module Dependabot
             .returns(T::Array[Dependabot::Uv::Version])
         end
         def locked_versions(lockfile)
-          parsed = T.cast(TomlRB.parse(T.must(lockfile.content)), T::Hash[String, Object])
-          packages = T.cast(parsed["package"], T.nilable(T::Array[T::Hash[String, Object]])) || []
           dependency_name = NameNormaliser.normalise(dependency.name)
-          versions = T.let([], T::Array[Dependabot::Uv::Version])
-          packages.each do |package|
-            package_name = T.cast(package["name"], T.nilable(String))
-            package_version = T.cast(package["version"], T.nilable(String))
-            next unless package_name && NameNormaliser.normalise(package_name) == dependency_name
-            next unless Uv::Version.correct?(package_version)
-
-            versions << Uv::Version.new(package_version)
-          end
+          LockfileDocument.from_file(lockfile).resolution_packages.filter_map do |package|
+            next unless NameNormaliser.normalise(package.name) == dependency_name
+            next unless Uv::Version.correct?(package.version)
 
-          versions
+            Uv::Version.new(package.version)
+          end
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -280,6 +280,7 @@ files:
 - lib/dependabot/uv/file_updater/version_config_parser.rb
 - lib/dependabot/uv/language.rb
 - lib/dependabot/uv/language_version_manager.rb
+- lib/dependabot/uv/lockfile_document.rb
 - lib/dependabot/uv/metadata_finder.rb
 - lib/dependabot/uv/name_normaliser.rb
 - lib/dependabot/uv/native_helpers.rb
@@ -301,7 +302,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib