dependabot-uv 0.323.0 → 0.324.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22aed0a62e5ca457d4119f57d745684dd1a34c59b8a43221f129b47df14e22ab
-  data.tar.gz: 58820ea5f761e188d8ab2dd46fc392b4425bfc2600e55be0ff02457416c59323
+  metadata.gz: 92b0138b2a802482348f4d0486e9dd5f48dfa8762d32f9495e01c10bcd05cdb8
+  data.tar.gz: f60d953ad7ceb7fa06dc74d82677fd43cf7425dd763a567c8161097bb388c82d
 SHA512:
-  metadata.gz: 9974793010858cfd8d63aaf413b32ed50cd3c5d3fc4e2190c82b5d355b1e798878e254782c2b2217e0d1344a4336d7dc74826227ae07fd3d6898611ce00461f7
-  data.tar.gz: 308081d1c876304cf522a4c09db5f13bb9b05182dbcb846adb0480cc370a9d864fe4695dc33683b8eca3c89003e4a003f45cab364439d064290ae601fa4c3763
+  metadata.gz: 270b22a94e3a16d3d5885ace094935c668f6a3c9608d0c185f4eb030629863efb03f6158cfaf67840e07d7011f361a0f60d04cae9bdef82397436c723fa2677b
+  data.tar.gz: 4cbc5d87ac6919a05159aca0c396b5688abbef23eb156cbfbc0380407066087b87a7a0105ad02fc1338ce18173656932e154eaf800b4c6377e9827110ebd0157

data/helpers/lib/parser.py

@@ -23,33 +23,71 @@ import tomli
 COMMENT_RE = re.compile(r'(^|\s+)#.*$')
 
 
-def parse_pep621_dependencies(pyproject_path):
+def parse_pep621_pep735_dependencies(pyproject_path):
     with open(pyproject_path, "rb") as file:
         project_toml = tomli.load(file)
 
+    def version_from_req(specifier_set):
+        if (len(specifier_set) == 1 and
+                next(iter(specifier_set)).operator in {"==", "==="}):
+            return next(iter(specifier_set)).version
+
+    def parse_requirement(entry, pyproject_path):
+        try:
+            req = Requirement(entry)
+        except InvalidRequirement as e:
+            print(json.dumps({"error": repr(e)}))
+            exit(1)
+        else:
+            data = {
+                "name": req.name,
+                "version": version_from_req(req.specifier),
+                "markers": str(req.marker) or None,
+                "file": pyproject_path,
+                "requirement": str(req.specifier),
+                "extras": sorted(list(req.extras)),
+            }
+            return data
+
     def parse_toml_section_pep621_dependencies(pyproject_path, dependencies):
         requirement_packages = []
 
-        def version_from_req(specifier_set):
-            if (len(specifier_set) == 1 and
-                    next(iter(specifier_set)).operator in {"==", "==="}):
-                return next(iter(specifier_set)).version
-
         for dependency in dependencies:
-            try:
-                req = Requirement(dependency)
-            except InvalidRequirement as e:
-                print(json.dumps({"error": repr(e)}))
-                exit(1)
-            else:
-                requirement_packages.append({
-                    "name": req.name,
-                    "version": version_from_req(req.specifier),
-                    "markers": str(req.marker) or None,
-                    "file": pyproject_path,
-                    "requirement": str(req.specifier),
-                    "extras": sorted(list(req.extras))
-                })
+            parsed_dependency = parse_requirement(dependency, pyproject_path)
+            requirement_packages.append(parsed_dependency)
+
+        return requirement_packages
+
+    def parse_toml_section_pep735_dependencies(
+        pyproject_path,
+        dependency_groups,
+        group_name,
+        visited=None,
+    ):
+        requirement_packages = []
+        visited = visited or set()
+
+        if group_name in visited:
+            return requirement_packages
+
+        visited.add(group_name)
+        dependencies = dependency_groups.get(group_name, [])
+        for entry in dependencies:
+            # Handle direct requirement
+            if isinstance(entry, str):
+                parsed_dependency = parse_requirement(entry, pyproject_path)
+                requirement_packages.append(parsed_dependency)
+            # Handle include-group directive
+            elif isinstance(entry, dict) and "include-group" in entry:
+                included_group = entry["include-group"]
+                requirement_packages.extend(
+                    parse_toml_section_pep735_dependencies(
+                        pyproject_path,
+                        dependency_groups,
+                        included_group,
+                        visited
+                    )
+                )
 
         return requirement_packages
 
@@ -77,6 +115,14 @@ def parse_pep621_dependencies(pyproject_path):
                 )
                 dependencies.extend(group_dependencies)
 
+    if 'dependency-groups' in project_toml:
+        dependency_groups = project_toml['dependency-groups']
+        for group_name in dependency_groups:
+            group_dependencies = parse_toml_section_pep735_dependencies(
+                pyproject_path, dependency_groups, group_name
+            )
+            dependencies.extend(group_dependencies)
+
     if 'build-system' in project_toml:
         build_system_section = project_toml['build-system']
         if 'requires' in build_system_section:

data/helpers/run.py

@@ -12,8 +12,8 @@ if __name__ == "__main__":
         print(parser.parse_requirements(args["args"][0]))
     elif args["function"] == "parse_setup":
         print(parser.parse_setup(args["args"][0]))
-    elif args["function"] == "parse_pep621_dependencies":
-        print(parser.parse_pep621_dependencies(args["args"][0]))
+    elif args["function"] == "parse_pep621_pep735_dependencies":
+        print(parser.parse_pep621_pep735_dependencies(args["args"][0]))
     elif args["function"] == "get_dependency_hash":
         print(hasher.get_dependency_hash(*args["args"]))
     elif args["function"] == "get_pipfile_hash":

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -29,7 +29,7 @@ module Dependabot
         def dependency_set
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
-          dependency_set += pyproject_dependencies if using_poetry? || using_pep621?
+          dependency_set += pyproject_dependencies if using_poetry? || using_pep621? || using_pep735?
           dependency_set += lockfile_dependencies if using_poetry? && lockfile
 
           dependency_set
@@ -45,7 +45,7 @@ module Dependabot
           if using_poetry?
             poetry_dependencies
           else
-            pep621_dependencies
+            pep621_pep735_dependencies
           end
         end
 
@@ -71,7 +71,7 @@ module Dependabot
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }
-        def pep621_dependencies
+        def pep621_pep735_dependencies
           dependencies = Dependabot::FileParsers::Base::DependencySet.new
 
           # PDM is not yet supported, so we want to ignore it for now because in
@@ -80,7 +80,7 @@ module Dependabot
           # undesirable. Leave PDM alone until properly supported
           return dependencies if using_pdm?
 
-          parsed_pep621_dependencies.each do |dep|
+          parse_pep621_pep735_dependencies.each do |dep|
             # If a requirement has a `<` or `<=` marker then updating it is
             # probably blocked. Ignore it.
             next if dep["markers"].include?("<")
@@ -177,6 +177,11 @@ module Dependabot
           parsed_pyproject.dig("tool", "poetry")
         end
 
+        sig { returns(T::Boolean) }
+        def using_pep735?
+          parsed_pyproject.key?("dependency-groups")
+        end
+
         sig { returns(T.untyped) }
         def using_pdm?
           using_pep621? && pdm_lock
@@ -287,13 +292,13 @@ module Dependabot
         end
 
         sig { returns(T.untyped) }
-        def parsed_pep621_dependencies
+        def parse_pep621_pep735_dependencies
           SharedHelpers.in_a_temporary_directory do
             write_temporary_pyproject
 
             SharedHelpers.run_helper_subprocess(
               command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_pep621_dependencies",
+              function: "parse_pep621_pep735_dependencies",
               args: [T.must(pyproject).name]
             )
           end

data/lib/dependabot/uv/language.rb

@@ -15,11 +15,11 @@ module Dependabot
       # ARG PY_3_13=3.13.2
       # When updating this list, also update python/lib/dependabot/python/language.rb
       PRE_INSTALLED_PYTHON_VERSIONS_RAW = %w(
-        3.13.3
-        3.12.10
-        3.11.12
-        3.10.17
-        3.9.22
+        3.13.5
+        3.12.11
+        3.11.13
+        3.10.18
+        3.9.23
       ).freeze
 
       PRE_INSTALLED_PYTHON_VERSIONS = T.let(PRE_INSTALLED_PYTHON_VERSIONS_RAW.map do |v|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.323.0
+  version: 0.324.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.323.0
+        version: 0.324.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.323.0
+        version: 0.324.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -284,7 +284,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.323.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.324.0
 rdoc_options: []
 require_paths:
 - lib