dependabot-uv 0.398.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f460c106ded2b40fb9c7e91e53baee1a2959a640e47bafaece6b43b0f112b022
-  data.tar.gz: 281ce9fee19f90b0b703145445bb05c83d2cbc81eadbd3f3fb8eef3f07d79a0b
+  metadata.gz: f0641cd3de66cb0651830673fbcb78f65ce4f6b4a0c59dc5858d0ec52c024968
+  data.tar.gz: cea56c236a2c71bcf1c0fb6fc5a342631acb720925122241a2ee3405c68b32df
 SHA512:
-  metadata.gz: 836cbb9770876a0f0c0f3c02d599cf0948739d7ad2ea12701f1cb78fcf1051b3f78364db63f46e4b4a12e2080d41a1797912e20803a1cbf201aa8ab857038314
-  data.tar.gz: f3144802f8314d9998824fe31164dc4d47cb092eb7a8ed0764e221d455cf60301c37a76033c5cf963e919fe43514e9e33347c4c74eca10575514332583beeb5a
+  metadata.gz: ecb3617457c815151845b615f703004722a0014507130bb3598eb4a8802ec7c7fd5883aeb7efce467e8be91b3abc0895c73aa09b401098b0c9eaff55d021dc95
+  data.tar.gz: 0a1647d7b40b5297f3320c37ff7e61922f6bbe627fdf76fd2b55ad2215545600852c833cd7f31b2067a6f8d54b961609c4a2567216457e145696ec5504f00cb6

data/lib/dependabot/uv/file_parser.rb

@@ -16,8 +16,8 @@ require "dependabot/uv/name_normaliser"
 require "dependabot/uv/requirements_file_matcher"
 require "dependabot/uv/language_version_manager"
 require "dependabot/uv/package_manager"
+require "dependabot/uv/lockfile_document"
 require "dependabot/python/file_parser/pep_dependency"
-require "toml-rb"
 
 module Dependabot
   module Uv
@@ -199,15 +199,10 @@ module Dependabot
         dependency_set = DependencySet.new
 
         uv_lock_files.each do |file|
-          lockfile_content = TomlRB.parse(file.content)
-          packages = lockfile_content.fetch("package", [])
-
-          packages.each do |package_data|
-            next unless package_data.is_a?(Hash) && package_data["name"] && package_data["version"]
-
+          LockfileDocument.from_file(file).each_dependency do |package|
             dependency_set << Dependency.new(
-              name: normalised_name(package_data["name"]),
-              version: package_data["version"],
+              name: normalised_name(package.name),
+              version: package.version,
               requirements: [], # Lock files don't contain requirements
               package_manager: "uv"
             )

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -322,9 +322,19 @@ module Dependabot
           content = replace_header_with_original(updated_content, T.must(file.content))
           content = remove_new_warnings(content, T.must(file.content))
           content = update_hashes_if_required(content, T.must(file.content))
+          content = scrub_index_url_credentials(content)
           replace_absolute_file_paths(content, T.must(file.content))
         end
 
+        # Index URLs are passed to `uv pip compile` with credentials embedded so
+        # the private index can be fetched, and uv emits those URLs verbatim
+        # into the compiled file when `--emit-index-url` is active. Strip any
+        # userinfo so tokens are never written into the regenerated file.
+        sig { params(content: String).returns(String) }
+        def scrub_index_url_credentials(content)
+          content.gsub(%r{^(--(?:extra-)?index-url[= ]https?://)[^/\s]+@}, "\\1")
+        end
+
         sig { params(updated_content: String, original_content: String).returns(String) }
         def replace_header_with_original(updated_content, original_content)
           original_header_lines =

data/lib/dependabot/uv/lockfile_document.rb

@@ -22,6 +22,11 @@ module Dependabot
         const :dev_dependencies, T::Array[String]
       end
 
+      class LockedPackage < T::ImmutableStruct
+        const :name, String
+        const :version, String
+      end
+
       sig { params(file: Dependabot::DependencyFile).returns(LockfileDocument) }
       def self.from_file(file)
         new(data: T.cast(TomlRB.parse(T.must(file.content)), Object), context: file.path)
@@ -62,6 +67,43 @@ module Dependabot
         end
       end
 
+      sig { params(block: T.proc.params(package: LockedPackage).void).void }
+      def each_dependency(&block)
+        # The file parser historically skips the pairs yielded by an object-shaped package section.
+        return if @data["package"].is_a?(Hash)
+
+        package_entries.each_with_index do |entry, index|
+          next unless entry.is_a?(Hash)
+
+          package = object_hash(entry)
+          name = package["name"]
+          version = package["version"]
+          next unless name && version
+
+          yield(LockedPackage.new(
+            name: string(name, "package[#{index}].name"),
+            version: string(version, "package[#{index}].version")
+          ))
+        end
+      end
+
+      sig { returns(T::Array[LockedPackage]) }
+      def resolution_packages
+        return [] if @data["package"].nil?
+
+        package_entries.each_with_index.filter_map do |entry, index|
+          # String#[] cannot produce a valid version from the "version" lookup.
+          next if entry.is_a?(String)
+
+          package = object_hash(entry)
+          name = optional_string(package["name"], "package[#{index}].name")
+          version = optional_string(package["version"], "package[#{index}].version")
+          next unless name && version
+
+          LockedPackage.new(name: name, version: version)
+        end
+      end
+
       private
 
       sig { returns(T::Array[Object]) }
@@ -89,6 +131,20 @@ module Dependabot
         value if value.is_a?(String)
       end
 
+      sig { params(value: Object, field: String).returns(T.nilable(String)) }
+      def optional_string(value, field)
+        return if value.nil?
+
+        string(value, field)
+      end
+
+      sig { params(value: Object, field: String).returns(String) }
+      def string(value, field)
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{@context} #{field} must be a string"
+      end
+
       sig { params(entries: Object).returns(T::Array[String]) }
       def dependency_names(entries)
         return [] unless entries.is_a?(Array)

data/lib/dependabot/uv/update_checker/lock_file_resolver.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
-require "toml-rb"
+require "dependabot/uv/lockfile_document"
 
 require "dependabot/errors"
 require "dependabot/package/release_cooldown_options"
@@ -278,20 +278,13 @@ module Dependabot
             .returns(T::Array[Dependabot::Uv::Version])
         end
         def locked_versions(lockfile)
-          parsed = T.cast(TomlRB.parse(T.must(lockfile.content)), T::Hash[String, Object])
-          packages = T.cast(parsed["package"], T.nilable(T::Array[T::Hash[String, Object]])) || []
           dependency_name = NameNormaliser.normalise(dependency.name)
-          versions = T.let([], T::Array[Dependabot::Uv::Version])
-          packages.each do |package|
-            package_name = T.cast(package["name"], T.nilable(String))
-            package_version = T.cast(package["version"], T.nilable(String))
-            next unless package_name && NameNormaliser.normalise(package_name) == dependency_name
-            next unless Uv::Version.correct?(package_version)
-
-            versions << Uv::Version.new(package_version)
-          end
+          LockfileDocument.from_file(lockfile).resolution_packages.filter_map do |package|
+            next unless NameNormaliser.normalise(package.name) == dependency_name
+            next unless Uv::Version.correct?(package.version)
 
-          versions
+            Uv::Version.new(package.version)
+          end
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.400.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.400.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -302,7 +302,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
 rdoc_options: []
 require_paths:
 - lib