dependabot-uv 0.349.0 → 0.350.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55b564d1c18b3b690b6bd6b857c47e618ec6f6350d316642ddcd33150daa8181
-  data.tar.gz: 0e5737a7ae48bd53c845c6346eccb2a74ae34a6b6a71d8a2ec885387479cca71
+  metadata.gz: b23c5beac181aafb8e92f670984121a88254da3a1804dbd7891e9e6bc274b84c
+  data.tar.gz: c5007c5452b38eac6210eac2df08635c69e3ed7fb7410e8173e9964678902d9b
 SHA512:
-  metadata.gz: 60b62b77c2f49a0c1a8993cf37af124492cf17c5185478fe121fbf9ae594d5d3cda5481039487806384ca4f86f250bafd914fc3379498635140ac62eda6a493c
-  data.tar.gz: 4873f91475324508c1bb7b3fc24af31561bdef46488249c3e94d6d252ac0812d2465fdfd0563b839cd2526eafe474fcac1a4361880ee463b90e5a708df83646d
+  metadata.gz: f646e21b2dd5f869a1fc56a48ab0f04051d202b4efc6f98a4d3dd2efca28526ffae66068ee3d59fd2ad5e03ad243db060ddcc703df018cefb4c1f06369043887
+  data.tar.gz: e5044b7cd9b6bb4f3a8273309e1d20a0ffb784aa5c5b92401f28e0a885cef9ac239ee2e4a51fdff6978425644529e705a835b8d58932bd45aae92e47d9dfc3e5

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.1.0
 poetry==1.8.5
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.0.1
-uv==0.9.8
+uv==0.9.11
 
 # Some dependencies will only install if Cython is present
 Cython==3.0.10

data/lib/dependabot/uv/authed_url_builder.rb

@@ -2,35 +2,11 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/python/authed_url_builder"
 
 module Dependabot
   module Uv
-    class AuthedUrlBuilder
-      extend T::Sig
-
-      sig { params(credential: Credential).returns(String) }
-      def self.authed_url(credential:)
-        token = T.let(credential.fetch("token", nil), T.nilable(String))
-        url = T.let(credential.fetch("index-url", nil), T.nilable(String))
-        return "" unless url
-        return url unless token
-
-        basic_auth_details =
-          if token.ascii_only? && token.include?(":") then token
-          elsif Base64.decode64(token).ascii_only? &&
-                Base64.decode64(token).include?(":")
-            Base64.decode64(token)
-          else
-            token
-          end
-
-        if basic_auth_details.include?(":")
-          username, _, password = basic_auth_details.partition(":")
-          basic_auth_details = "#{CGI.escape(username)}:#{CGI.escape(password)}"
-        end
-
-        url.sub("://", "://#{basic_auth_details}@")
-      end
-    end
+    # UV uses the same authenticated URL building logic as Python
+    AuthedUrlBuilder = Dependabot::Python::AuthedUrlBuilder
   end
 end

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -127,16 +127,39 @@ module Dependabot
         def replace_dep(dep, content, new_r, old_r)
           new_req = new_r[:requirement]
           old_req = old_r[:requirement]
+          escaped_name = Regexp.escape(dep.name)
 
-          declaration_regex = declaration_regex(dep, old_r)
-          declaration_match = content.match(declaration_regex)
-          if declaration_match
-            declaration = declaration_match[:declaration]
-            new_declaration = T.must(declaration).sub(old_req, new_req)
-            content.sub(T.must(declaration), new_declaration)
-          else
-            content
+          regex = /(["']#{escaped_name})([^"']+)(["'])/x
+
+          replaced = T.let(false, T::Boolean)
+
+          updated_content = content.gsub(regex) do
+            captured_requirement = Regexp.last_match(2)
+
+            if requirements_match?(T.must(captured_requirement), old_req)
+              replaced = true
+              "#{Regexp.last_match(1)}#{new_req}#{Regexp.last_match(3)}"
+            else
+              Regexp.last_match(0)
+            end
+          end
+
+          unless replaced
+            updated_content = content.sub(regex) do
+              "#{Regexp.last_match(1)}#{new_req}#{Regexp.last_match(3)}"
+            end
+          end
+
+          updated_content
+        end
+
+        sig { params(req1: String, req2: String).returns(T::Boolean) }
+        def requirements_match?(req1, req2)
+          normalize = lambda do |req|
+            req.split(",").map(&:strip).sort.join(",")
           end
+
+          normalize.call(req1) == normalize.call(req2)
         end
 
         sig { returns(String) }
@@ -313,24 +336,6 @@ module Dependabot
           url.gsub(%r{^https?://}, "").gsub(/[^a-zA-Z0-9]/, "_").upcase
         end
 
-        sig { params(dep: T.untyped, old_req: T.untyped).returns(Regexp) }
-        def declaration_regex(dep, old_req)
-          escaped_name = Regexp.escape(dep.name)
-          # Extract the requirement operator and version
-          operator = old_req.fetch(:requirement).match(/^(.+?)[0-9]/)&.captures&.first
-          # Escape special regex characters in the operator
-          escaped_operator = Regexp.escape(operator) if operator
-
-          # Match various formats of dependency declarations:
-          # 1. "dependency==1.0.0" (with quotes around the entire string)
-          # 2. dependency==1.0.0 (without quotes)
-          # The declaration should only include the package name, operator, and version
-          # without the enclosing quotes
-          /
-            ["']?(?<declaration>#{escaped_name}\s*#{escaped_operator}[\d\.\*]+)["']?
-          /x
-        end
-
         sig { returns(String) }
         def lock_options
           options = lock_index_options

data/lib/dependabot/uv/metadata_finder.rb

@@ -1,220 +1,16 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "excon"
 require "sorbet-runtime"
-require "uri"
-
+require "dependabot/python/metadata_finder"
 require "dependabot/metadata_finders"
-require "dependabot/metadata_finders/base"
-require "dependabot/registry_client"
-require "dependabot/uv/authed_url_builder"
-require "dependabot/uv/name_normaliser"
 
 module Dependabot
   module Uv
-    class MetadataFinder < Dependabot::MetadataFinders::Base
-      extend T::Sig
-
-      MAIN_PYPI_URL = "https://pypi.org/pypi"
-
-      sig do
-        params(
-          dependency: Dependabot::Dependency,
-          credentials: T::Array[Dependabot::Credential]
-        )
-          .void
-      end
-      def initialize(dependency:, credentials:)
-        super
-        @pypi_listing = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
-        @source_from_description = T.let(nil, T.nilable(String))
-        @source_from_homepage = T.let(nil, T.nilable(String))
-        @homepage_response = T.let(nil, T.nilable(Excon::Response))
-      end
-
-      sig { returns(T.nilable(String)) }
-      def homepage_url
-        pypi_listing.dig("info", "home_page") ||
-          pypi_listing.dig("info", "project_urls", "Homepage") ||
-          pypi_listing.dig("info", "project_urls", "homepage") ||
-          super
-      end
-
-      private
-
-      sig { override.returns(T.nilable(Dependabot::Source)) }
-      def look_up_source
-        potential_source_urls = [
-          pypi_listing.dig("info", "project_urls", "Source"),
-          pypi_listing.dig("info", "project_urls", "Repository"),
-          pypi_listing.dig("info", "home_page"),
-          pypi_listing.dig("info", "download_url"),
-          pypi_listing.dig("info", "docs_url")
-        ].compact
-
-        potential_source_urls +=
-          (pypi_listing.dig("info", "project_urls") || {}).values
-
-        source_url = potential_source_urls.find { |url| Source.from_url(url) }
-        source_url ||= source_from_description
-        source_url ||= source_from_homepage
-
-        Source.from_url(source_url)
-      end
-
-      # rubocop:disable Metrics/PerceivedComplexity
-      sig { returns(T.nilable(String)) }
-      def source_from_description
-        potential_source_urls = []
-        desc = pypi_listing.dig("info", "description")
-        return unless desc
-
-        desc.scan(Source::SOURCE_REGEX) do
-          potential_source_urls << Regexp.last_match.to_s
-        end
-
-        # Looking for a source where the repo name exactly matches the
-        # dependency name
-        match_url = potential_source_urls.find do |url|
-          repo = Source.from_url(url)&.repo
-          repo&.downcase&.end_with?(normalised_dependency_name)
-        end
-
-        return match_url if match_url
-
-        # Failing that, look for a source where the full dependency name is
-        # mentioned when the link is followed
-        @source_from_description ||= T.let(
-          potential_source_urls.find do |url|
-            full_url = Source.from_url(url)&.url
-            next unless full_url
-
-            response = Dependabot::RegistryClient.get(url: full_url)
-            next unless response.status == 200
-
-            response.body.include?(normalised_dependency_name)
-          end,
-          T.nilable(String)
-        )
-      end
-      # rubocop:enable Metrics/PerceivedComplexity
-
-      # rubocop:disable Metrics/PerceivedComplexity
-      sig { returns(T.nilable(String)) }
-      def source_from_homepage
-        homepage_body_local = homepage_body
-        return unless homepage_body_local
-
-        potential_source_urls = []
-        homepage_body_local.scan(Source::SOURCE_REGEX) do
-          potential_source_urls << Regexp.last_match.to_s
-        end
-
-        match_url = potential_source_urls.find do |url|
-          repo = Source.from_url(url)&.repo
-          repo&.downcase&.end_with?(normalised_dependency_name)
-        end
-
-        return match_url if match_url
-
-        @source_from_homepage ||= T.let(
-          potential_source_urls.find do |url|
-            full_url = Source.from_url(url)&.url
-            next unless full_url
-
-            response = Dependabot::RegistryClient.get(url: full_url)
-            next unless response.status == 200
-
-            response.body.include?(normalised_dependency_name)
-          end,
-          T.nilable(String)
-        )
-      end
-      # rubocop:enable Metrics/PerceivedComplexity
-
-      sig { returns(T.nilable(String)) }
-      def homepage_body
-        homepage_url = pypi_listing.dig("info", "home_page")
-
-        return unless homepage_url
-        return if [
-          "pypi.org",
-          "pypi.python.org"
-        ].include?(URI(homepage_url).host)
-
-        @homepage_response ||= T.let(
-          begin
-            Dependabot::RegistryClient.get(url: homepage_url)
-          rescue Excon::Error::Timeout, Excon::Error::Socket,
-                 Excon::Error::TooManyRedirects, ArgumentError
-            nil
-          end,
-          T.nilable(Excon::Response)
-        )
-
-        return unless @homepage_response&.status == 200
-
-        @homepage_response&.body
-      end
-
-      sig { returns(T::Hash[String, T.untyped]) }
-      def pypi_listing
-        return @pypi_listing unless @pypi_listing.nil?
-        return @pypi_listing = {} if dependency.version&.include?("+")
-
-        possible_listing_urls.each do |url|
-          response = fetch_authed_url(url)
-          next unless response.status == 200
-
-          @pypi_listing = JSON.parse(response.body)
-          return @pypi_listing
-        rescue JSON::ParserError
-          next
-        rescue Excon::Error::Timeout
-          next
-        end
-
-        @pypi_listing = {} # No listing found
-      end
-
-      sig { params(url: String).returns(Excon::Response) }
-      def fetch_authed_url(url)
-        if url.match(%r{(.*)://(.*?):(.*)@([^@]+)$}) &&
-           Regexp.last_match&.captures&.[](1)&.include?("@")
-          protocol, user, pass, url = T.must(Regexp.last_match).captures
-
-          Dependabot::RegistryClient.get(
-            url: "#{protocol}://#{url}",
-            options: {
-              user: user,
-              password: pass
-            }
-          )
-        else
-          Dependabot::RegistryClient.get(url: url)
-        end
-      end
-
-      sig { returns(T::Array[String]) }
-      def possible_listing_urls
-        credential_urls =
-          credentials
-          .select { |cred| cred["type"] == "python_index" }
-          .map { |c| AuthedUrlBuilder.authed_url(credential: c) }
-
-        (credential_urls + [MAIN_PYPI_URL]).map do |base_url|
-          base_url.gsub(%r{/$}, "") + "/#{normalised_dependency_name}/json"
-        end
-      end
-
-      # Strip [extras] from name (dependency_name[extra_dep,other_extra])
-      sig { returns(String) }
-      def normalised_dependency_name
-        NameNormaliser.normalise(dependency.name)
-      end
-    end
+    # UV uses Python's PyPI metadata lookup, so we delegate to Python::MetadataFinder
+    MetadataFinder = Dependabot::Python::MetadataFinder
   end
 end
 
-Dependabot::MetadataFinders.register("uv", Dependabot::Uv::MetadataFinder)
+Dependabot::MetadataFinders
+  .register("uv", Dependabot::Uv::MetadataFinder)

data/lib/dependabot/uv/name_normaliser.rb

@@ -2,25 +2,11 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/python/name_normaliser"
 
 module Dependabot
   module Uv
-    module NameNormaliser
-      extend T::Sig
-
-      sig { params(name: String).returns(String) }
-      def self.normalise(name)
-        extras_regex = /\[.+\]/
-        name.downcase.gsub(/[-_.]+/, "-").gsub(extras_regex, "")
-      end
-
-      sig { params(name: String, extras: T::Array[String]).returns(String) }
-      def self.normalise_including_extras(name, extras)
-        normalised_name = normalise(name)
-        return normalised_name if extras.empty?
-
-        normalised_name + "[" + extras.join(",") + "]"
-      end
-    end
+    # UV uses the same Python package name normalization (PEP 503)
+    NameNormaliser = Dependabot::Python::NameNormaliser
   end
 end

data/lib/dependabot/uv/requirement.rb

@@ -1,206 +1,14 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
-
-require "dependabot/requirement"
+require "dependabot/python/requirement"
 require "dependabot/utils"
-require "dependabot/uv/version"
 
 module Dependabot
   module Uv
-    class Requirement < Dependabot::Requirement
-      extend T::Sig
-
-      OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9)*])\s*\|+/, Regexp)
-
-      # Add equality and arbitrary-equality matchers
-      OPS = T.let(
-        OPS.merge(
-          "==" => ->(v, r) { v == r },
-          "===" => ->(v, r) { v.to_s == r.to_s }
-        ),
-        T::Hash[String, T.proc.params(arg0: T.untyped, arg1: T.untyped).returns(T.untyped)]
-      )
-
-      quoted = OPS.keys.sort_by(&:length).reverse
-                  .map { |k| Regexp.quote(k) }.join("|")
-      version_pattern = Uv::Version::VERSION_PATTERN
-
-      PATTERN_RAW = T.let("\\s*(?<op>#{quoted})?\\s*(?<version>#{version_pattern})\\s*".freeze, String)
-      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
-      PARENS_PATTERN = T.let(/\A\(([^)]+)\)\z/, Regexp)
-
-      sig { params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
-      def self.parse(obj)
-        return ["=", Uv::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
-
-        line = obj.to_s
-        if (matches = PARENS_PATTERN.match(line))
-          line = matches[1]
-        end
-
-        unless (matches = PATTERN.match(line))
-          msg = "Illformed requirement [#{obj.inspect}]"
-          raise BadRequirementError, msg
-        end
-
-        return DefaultRequirement if matches[:op] == ">=" && matches[:version] == "0"
-
-        [matches[:op] || "=", Uv::Version.new(T.must(matches[:version]))]
-      end
-
-      # Returns an array of requirements. At least one requirement from the
-      # returned array must be satisfied for a version to be valid.
-      #
-      # NOTE: Or requirements are only valid for Poetry.
-      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
-      def self.requirements_array(requirement_string)
-        return [new(nil)] if requirement_string.nil?
-
-        if (matches = PARENS_PATTERN.match(requirement_string))
-          requirement_string = matches[1]
-        end
-
-        T.must(requirement_string).strip.split(OR_SEPARATOR).map do |req_string|
-          new(req_string.strip)
-        end
-      end
-
-      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
-      def initialize(*requirements)
-        requirements = requirements.flatten.flat_map do |req_string|
-          next if req_string.nil?
-
-          # Standard python doesn't support whitespace in requirements, but Poetry does.
-          req_string = req_string.gsub(/(\d +)([<=>])/, '\1,\2')
-
-          req_string.split(",").map(&:strip).map do |r|
-            convert_python_constraint_to_ruby_constraint(r)
-          end
-        end
-
-        super(requirements)
-      end
-
-      sig { params(version: T.any(Gem::Version, String)).returns(T::Boolean) }
-      def satisfied_by?(version)
-        version = Uv::Version.new(version.to_s)
-
-        requirements.all? { |op, rv| T.must(OPS[op] || OPS["="]).call(version, rv) }
-      end
-
-      sig { returns(T::Boolean) }
-      def exact?
-        return false unless requirements.size == 1
-
-        %w(= == ===).include?(requirements[0][0])
-      end
-
-      private
-
-      sig { params(req_string: T.nilable(String)).returns(T.nilable(T.any(String, T::Array[String]))) }
-      def convert_python_constraint_to_ruby_constraint(req_string)
-        return nil if req_string.nil? || req_string.strip.empty?
-        return nil if req_string == "*"
-
-        req_string = req_string.gsub("~=", "~>")
-        req_string = req_string.gsub(/(?<=\d)[<=>].*\Z/, "")
-
-        if req_string.match?(/~[^>]/) then convert_tilde_req(req_string)
-        elsif req_string.start_with?("^") then convert_caret_req(req_string)
-        elsif req_string.match?(/^=?={0,2}\s*\d+\.\d+(\.\d+)?(-[a-z0-9.-]+)?(\.\*)?$/i)
-          convert_exact(req_string)
-        elsif req_string.include?(".*") then convert_wildcard(req_string)
-        else
-          req_string
-        end
-      end
-
-      # Poetry uses ~ requirements.
-      # https://github.com/sdispater/poetry#tilde-requirements
-      sig { params(req_string: String).returns(String) }
-      def convert_tilde_req(req_string)
-        version = req_string.gsub(/^~\>?/, "")
-        parts = version.split(".")
-        parts << "0" if parts.count < 3
-        "~> #{parts.join('.')}"
-      end
-
-      # Poetry uses ^ requirements
-      # https://github.com/sdispater/poetry#caret-requirement
-      sig { params(req_string: String).returns(T::Array[String]) }
-      def convert_caret_req(req_string)
-        version = req_string.gsub(/^\^/, "")
-        parts = version.split(".")
-        parts.fill("0", parts.length...3)
-        first_non_zero = parts.find { |d| d != "0" }
-        first_non_zero_index =
-          first_non_zero ? parts.index(first_non_zero) : parts.count - 1
-        upper_bound = parts.map.with_index do |part, i|
-          if i < T.must(first_non_zero_index) then part
-          elsif i == first_non_zero_index then (part.to_i + 1).to_s
-          # .dev has lowest precedence: https://packaging.python.org/en/latest/specifications/version-specifiers/#summary-of-permitted-suffixes-and-relative-ordering
-          elsif i > T.must(first_non_zero_index) && i == 2 then "0.dev"
-          else
-            "0"
-          end
-        end.join(".")
-
-        [">= #{version}", "< #{upper_bound}"]
-      end
-
-      sig { params(req_string: String).returns(String) }
-      def convert_wildcard(req_string)
-        # NOTE: This isn't perfect. It replaces the "!= 1.0.*" case with
-        # "!= 1.0.0". There's no way to model this correctly in Ruby :'(
-        quoted_ops = OPS.keys.sort_by(&:length).reverse
-                        .map { |k| Regexp.quote(k) }.join("|")
-        op_match = req_string.match(/\A\s*(#{quoted_ops})?/)
-        op = op_match&.captures&.first.to_s.strip
-        exact_op = ["", "=", "==", "==="].include?(op)
-
-        req_string.strip
-                  .split(".")
-                  .first(T.must(req_string.split(".").index { |s| s.include?("*") }) + 1)
-                  .join(".")
-                  .gsub(/\*(?!$)/, "0")
-                  .gsub(/\*$/, "0.dev")
-                  .tap { |s| exact_op ? s.gsub!(/^(?<!!)=*/, "~>") : s }
-      end
-
-      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
-      def convert_exact(req_string)
-        arbitrary_equality = req_string.start_with?("===")
-        cleaned_version = req_string.gsub(/^=+/, "").strip
-
-        return ["=== #{cleaned_version}"] if arbitrary_equality
-
-        # Handle versions wildcarded with .*, e.g. 1.0.*
-        if cleaned_version.include?(".*")
-          # Remove all characters after the first .*, and the .*
-          cleaned_version = cleaned_version.split(".*").first
-          version = Version.new(cleaned_version)
-          # Get the release segment parts [major, minor, patch]
-          version_parts = version.release_segment
-
-          if version_parts.length == 1
-            major = T.must(version_parts[0])
-            [">= #{major}.0.0.dev", "< #{major + 1}.0.0"]
-          elsif version_parts.length == 2
-            major, minor = version_parts
-            "~> #{major}.#{minor}.0.dev"
-          elsif version_parts.length == 3
-            major, minor, patch = version_parts
-            "~> #{major}.#{minor}.#{patch}.dev"
-          else
-            "= #{cleaned_version}"
-          end
-        else
-          "= #{cleaned_version}"
-        end
-      end
-    end
+    # UV uses Python's requirement scheme, so we delegate to Python::Requirement
+    Requirement = Dependabot::Python::Requirement
   end
 end
 

data/lib/dependabot/uv/requirement_parser.rb

@@ -1,60 +1,12 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/python/requirement_parser"
+
 module Dependabot
   module Uv
-    class RequirementParser
-      NAME = /[a-zA-Z0-9](?:[a-zA-Z0-9\-_\.]*[a-zA-Z0-9])?/
-      EXTRA = /[a-zA-Z0-9\-_\.]+/
-      COMPARISON = /===|==|>=|<=|<|>|~=|!=/
-      VERSION = /([1-9][0-9]*!)?[0-9]+[a-zA-Z0-9\-_.*]*(\+[0-9a-zA-Z]+(\.[0-9a-zA-Z]+)*)?/
-
-      REQUIREMENT = /(?<comparison>#{COMPARISON})\s*\\?\s*v?(?<version>#{VERSION})/
-      HASH = /--hash=(?<algorithm>.*?):(?<hash>.*?)(?=\s|\\|$)/
-      REQUIREMENTS = /#{REQUIREMENT}(\s*,\s*\\?\s*#{REQUIREMENT})*/
-      HASHES = /#{HASH}(\s*\\?\s*#{HASH})*/
-      MARKER_OP = /\s*(#{COMPARISON}|(\s*in)|(\s*not\s*in))/
-      PYTHON_STR_C = %r{[a-zA-Z0-9\s\(\)\.\{\}\-_\*#:;/\?\[\]!~`@\$%\^&=\+\|<>]}
-      PYTHON_STR = /('(#{PYTHON_STR_C}|")*'|"(#{PYTHON_STR_C}|')*")/
-      ENV_VAR =
-        /python_version|python_full_version|os_name|sys_platform|
-         platform_release|platform_system|platform_version|platform_machine|
-         platform_python_implementation|implementation_name|
-         implementation_version/
-      MARKER_VAR = /\s*(#{ENV_VAR}|#{PYTHON_STR})/
-      MARKER_EXPR_ONE = /#{MARKER_VAR}#{MARKER_OP}#{MARKER_VAR}/
-      MARKER_EXPR = /(#{MARKER_EXPR_ONE}|\(\s*|\s*\)|\s+and\s+|\s+or\s+)+/
-
-      INSTALL_REQ_WITH_REQUIREMENT =
-        /\s*\\?\s*(?<name>#{NAME})
-          \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-          \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})\)?
-          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
-          \s*\\?\s*(?<hashes>#{HASHES})?
-          \s*#*\s*(?<comment>.+)?
-        /x
-
-      INSTALL_REQ_WITHOUT_REQUIREMENT =
-        /^\s*\\?\s*(?<name>#{NAME})
-          \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
-          \s*\\?\s*(?<hashes>#{HASHES})?
-          \s*#*\s*(?<comment>.+)?$
-        /x
-
-      VALID_REQ_TXT_REQUIREMENT =
-        /^\s*\\?\s*(?<name>#{NAME})
-          \s*\\?\s*(\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-          \s*\\?\s*\(?(?<requirements>#{REQUIREMENTS})?\)?
-          \s*\\?\s*(;\s*(?<markers>#{MARKER_EXPR}))?
-          \s*\\?\s*(?<hashes>#{HASHES})?
-          \s*(\#+\s*(?<comment>.*))?$
-        /x
-
-      NAME_WITH_EXTRAS =
-        /\s*\\?\s*(?<name>#{NAME})
-          (\s*\\?\s*\[\s*(?<extras>#{EXTRA}(\s*,\s*#{EXTRA})*)\s*\])?
-        /x
-    end
+    # UV uses the same Python requirement parsing regex patterns (PEP 508)
+    RequirementParser = Dependabot::Python::RequirementParser
   end
 end

data/lib/dependabot/uv/version.rb

@@ -1,331 +1,14 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
-
-require "dependabot/version"
+require "dependabot/python/version"
 require "dependabot/utils"
 
-# See https://packaging.python.org/en/latest/specifications/version-specifiers for spec details.
-
 module Dependabot
   module Uv
-    class Version < Dependabot::Version
-      extend T::Sig
-
-      sig { returns(Integer) }
-      attr_reader :epoch
-
-      sig { returns(T::Array[Integer]) }
-      attr_reader :release_segment
-
-      sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
-      attr_reader :dev
-
-      sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
-      attr_reader :pre
-
-      sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
-      attr_reader :post
-
-      sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
-      attr_reader :local
-
-      INFINITY = T.let(1000, Integer)
-      NEGATIVE_INFINITY = T.let(-INFINITY, Integer)
-
-      # See https://peps.python.org/pep-0440/#appendix-b-parsing-version-strings-with-regular-expressions
-      VERSION_PATTERN = /
-        v?
-        (?:
-          (?:(?<epoch>[0-9]+)!)?                          # epoch
-          (?<release>[0-9]+(?:\.[0-9]+)*)                 # release
-          (?<pre>                                         # prerelease
-            [-_\.]?
-            (?<pre_l>(a|b|c|rc|alpha|beta|pre|preview))
-            [-_\.]?
-            (?<pre_n>[0-9]+)?
-          )?
-          (?<post>                                        # post release
-            (?:-(?<post_n1>[0-9]+))
-            |
-            (?:
-                [-_\.]?
-                (?<post_l>post|rev|r)
-                [-_\.]?
-                (?<post_n2>[0-9]+)?
-            )
-          )?
-          (?<dev>                                          # dev release
-            [-_\.]?
-            (?<dev_l>dev)
-            [-_\.]?
-            (?<dev_n>[0-9]+)?
-          )?
-        )
-        (?:\+(?<local>[a-z0-9]+(?:[-_\.][a-z0-9]+)*))?    # local version
-      /ix
-
-      ANCHORED_VERSION_PATTERN = /\A\s*#{VERSION_PATTERN}\s*\z/
-
-      sig { override.params(version: VersionParameter).returns(T::Boolean) }
-      def self.correct?(version)
-        return false if version.nil?
-
-        version.to_s.match?(ANCHORED_VERSION_PATTERN)
-      end
-
-      sig { override.params(version: VersionParameter).void }
-      def initialize(version) # rubocop:disable Metrics/AbcSize
-        raise Dependabot::BadRequirementError, "Malformed version string - string is nil" if version.nil?
-
-        @version_string = T.let(version.to_s, String)
-
-        raise Dependabot::BadRequirementError, "Malformed version string - string is empty" if @version_string.empty?
-
-        matches = ANCHORED_VERSION_PATTERN.match(@version_string.downcase)
-
-        unless matches
-          raise Dependabot::BadRequirementError,
-                "Malformed version string - #{@version_string} does not match regex"
-        end
-
-        @epoch = T.let(matches["epoch"].to_i, Integer)
-        @release_segment = T.let(matches["release"]&.split(".")&.map(&:to_i) || [], T::Array[Integer])
-        @pre = T.let(
-          parse_letter_version(matches["pre_l"], matches["pre_n"]),
-          T.nilable(T::Array[T.any(String, Integer)])
-        )
-        @post = T.let(
-          parse_letter_version(matches["post_l"], matches["post_n1"] || matches["post_n2"]),
-          T.nilable(T::Array[T.any(String, Integer)])
-        )
-        @dev = T.let(
-          parse_letter_version(matches["dev_l"], matches["dev_n"]),
-          T.nilable(T::Array[T.any(String, Integer)])
-        )
-        @local = T.let(parse_local_version(matches["local"]), T.nilable(T::Array[T.any(String, Integer)]))
-        super(matches["release"] || "")
-      end
-
-      sig { override.params(version: VersionParameter).returns(Dependabot::Uv::Version) }
-      def self.new(version)
-        T.cast(super, Dependabot::Uv::Version)
-      end
-
-      sig { returns(String) }
-      def to_s
-        @version_string
-      end
-
-      sig { returns(String) }
-      def inspect # :nodoc:
-        "#<#{self.class} #{@version_string}>"
-      end
-
-      sig { returns(T::Boolean) }
-      def prerelease?
-        !!(pre || dev)
-      end
-
-      sig { returns(Dependabot::Uv::Version) }
-      def release
-        Dependabot::Uv::Version.new(release_segment.join("."))
-      end
-
-      sig { params(other: VersionParameter).returns(Integer) }
-      def <=>(other)
-        other = Dependabot::Uv::Version.new(other.to_s) unless other.is_a?(Dependabot::Uv::Version)
-
-        epoch_comparison = epoch <=> other.epoch
-        return epoch_comparison unless epoch_comparison.zero?
-
-        release_comparison = release_version_comparison(other)
-        return release_comparison unless release_comparison.zero?
-
-        pre_comparison = compare_keys(pre_cmp_key, other.pre_cmp_key)
-        return pre_comparison unless pre_comparison.zero?
-
-        post_comparison = compare_keys(post_cmp_key, other.post_cmp_key)
-        return post_comparison unless post_comparison.zero?
-
-        dev_comparison = compare_keys(dev_cmp_key, other.dev_cmp_key)
-        return dev_comparison unless dev_comparison.zero?
-
-        compare_keys(local_cmp_key, other.local_cmp_key)
-      end
-
-      sig do
-        params(
-          key: T.any(Integer, T::Array[T.any(String, Integer)]),
-          other_key: T.any(Integer, T::Array[T.any(String, Integer)])
-        ).returns(Integer)
-      end
-      def compare_keys(key, other_key)
-        if key.is_a?(Integer) && other_key.is_a?(Integer)
-          key <=> other_key
-        elsif key.is_a?(Array) && other_key.is_a?(Array)
-          key <=> other_key
-        elsif key.is_a?(Integer)
-          key == NEGATIVE_INFINITY ? -1 : 1
-        elsif other_key.is_a?(Integer)
-          other_key == NEGATIVE_INFINITY ? 1 : -1
-        end
-      end
-
-      sig { returns(T.any(Integer, T::Array[T.any(String, Integer)])) }
-      def pre_cmp_key
-        if pre.nil? && post.nil? && dev # sort 1.0.dev0 before 1.0a0
-          NEGATIVE_INFINITY
-        elsif pre.nil?
-          INFINITY # versions without a pre-release should sort after those with one.
-        else
-          T.must(pre)
-        end
-      end
-
-      sig { returns(T.any(Integer, T::Array[T.any(String, Integer)])) }
-      def local_cmp_key
-        if local.nil?
-          # Versions without a local segment should sort before those with one.
-          NEGATIVE_INFINITY
-        else
-          # According to PEP440.
-          # - Alphanumeric segments sort before numeric segments
-          # - Alphanumeric segments sort lexicographically
-          # - Numeric segments sort numerically
-          # - Shorter versions sort before longer versions when the prefixes match exactly
-          T.must(local).map do |token|
-            if token.is_a?(Integer)
-              [token, ""]
-            else
-              [NEGATIVE_INFINITY, token]
-            end
-          end.flatten
-        end
-      end
-
-      sig { returns(T.any(Integer, T::Array[T.any(String, Integer)])) }
-      def post_cmp_key
-        # Versions without a post segment should sort before those with one.
-        return NEGATIVE_INFINITY if post.nil?
-
-        T.must(post)
-      end
-
-      sig { returns(T.any(Integer, T::Array[T.any(String, Integer)])) }
-      def dev_cmp_key
-        # Versions without a dev segment should sort after those with one.
-        return INFINITY if dev.nil?
-
-        T.must(dev)
-      end
-
-      sig { returns(String) }
-      def lowest_prerelease_suffix
-        "dev0"
-      end
-
-      sig { override.returns(T::Array[String]) }
-      def ignored_patch_versions
-        parts = release_segment # e.g [1,2,3] if version is 1.2.3-alpha3
-        version_parts = parts.fill(0, parts.length...2)
-        upper_parts = version_parts.first(1) + [version_parts[1].to_i + 1] + [lowest_prerelease_suffix]
-        lower_bound = "> #{self}"
-        upper_bound = "< #{upper_parts.join('.')}"
-
-        ["#{lower_bound}, #{upper_bound}"]
-      end
-
-      sig { override.returns(T::Array[String]) }
-      def ignored_minor_versions
-        parts = release_segment # e.g [1,2,3] if version is 1.2.3-alpha3
-        version_parts = parts.fill(0, parts.length...2)
-        lower_parts = version_parts.first(1) + [version_parts[1].to_i + 1] + [lowest_prerelease_suffix]
-        upper_parts = version_parts.first(0) + [version_parts[0].to_i + 1] + [lowest_prerelease_suffix]
-        lower_bound = ">= #{lower_parts.join('.')}"
-        upper_bound = "< #{upper_parts.join('.')}"
-
-        ["#{lower_bound}, #{upper_bound}"]
-      end
-
-      sig { override.returns(T::Array[String]) }
-      def ignored_major_versions
-        version_parts = release_segment # e.g [1,2,3] if version is 1.2.3-alpha3
-        lower_parts = [version_parts[0].to_i + 1] + [lowest_prerelease_suffix] # earliest next major version prerelease
-        lower_bound = ">= #{lower_parts.join('.')}"
-
-        [lower_bound]
-      end
-
-      private
-
-      sig { params(other: Dependabot::Uv::Version).returns(Integer) }
-      def release_version_comparison(other)
-        tokens, other_tokens = pad_for_comparison(release_segment, other.release_segment)
-        tokens <=> other_tokens
-      end
-
-      sig do
-        params(
-          tokens: T::Array[Integer],
-          other_tokens: T::Array[Integer]
-        ).returns(T::Array[T::Array[Integer]])
-      end
-      def pad_for_comparison(tokens, other_tokens)
-        tokens = tokens.dup
-        other_tokens = other_tokens.dup
-
-        longer = [tokens, other_tokens].max_by(&:count)
-        shorter = [tokens, other_tokens].min_by(&:count)
-
-        difference = T.must(longer).length - T.must(shorter).length
-
-        difference.times { T.must(shorter) << 0 }
-
-        [tokens, other_tokens]
-      end
-
-      sig { params(local: T.nilable(String)).returns(T.nilable(T::Array[T.any(String, Integer)])) }
-      def parse_local_version(local)
-        return if local.nil?
-
-        # Takes a string like abc.1.twelve and turns it into ["abc", 1, "twelve"]
-        local.split(/[\._-]/).map { |s| /^\d+$/.match?(s) ? s.to_i : s }
-      end
-
-      sig do
-        params(
-          letter: T.nilable(String), number: T.nilable(String)
-        ).returns(T.nilable(T::Array[T.any(String, Integer)]))
-      end
-      def parse_letter_version(letter = nil, number = nil)
-        return if letter.nil? && number.nil?
-
-        if letter
-          # Implicit 0 for cases where prerelease has no numeral
-          number ||= 0
-
-          # Normalize alternate spellings
-          if letter == "alpha"
-            letter = "a"
-          elsif letter == "beta"
-            letter = "b"
-          elsif %w(c pre preview).include? letter
-            letter = "rc"
-          elsif %w(rev r).include? letter
-            letter = "post"
-          end
-
-          return letter, number.to_i
-        end
-
-        # Number but no letter i.e. implicit post release syntax (e.g. 1.0-1)
-        letter = "post"
-
-        [letter, number.to_i]
-      end
-    end
+    # UV uses Python's version scheme, so we delegate to Python::Version
+    Version = Dependabot::Python::Version
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.349.0
+  version: 0.350.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.349.0
+        version: 0.350.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.349.0
+        version: 0.350.0
+- !ruby/object:Gem::Dependency
+  name: dependabot-python
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.350.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.350.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -253,7 +267,6 @@ files:
 - lib/dependabot/uv/file_parser.rb
 - lib/dependabot/uv/file_parser/pyproject_files_parser.rb
 - lib/dependabot/uv/file_parser/python_requirement_parser.rb
-- lib/dependabot/uv/file_parser/setup_file_parser.rb
 - lib/dependabot/uv/file_updater.rb
 - lib/dependabot/uv/file_updater/compile_file_updater.rb
 - lib/dependabot/uv/file_updater/lock_file_updater.rb
@@ -268,7 +281,6 @@ files:
 - lib/dependabot/uv/package/package_details_fetcher.rb
 - lib/dependabot/uv/package/package_registry_finder.rb
 - lib/dependabot/uv/package_manager.rb
-- lib/dependabot/uv/pipenv_runner.rb
 - lib/dependabot/uv/requirement.rb
 - lib/dependabot/uv/requirement_parser.rb
 - lib/dependabot/uv/requirements_file_matcher.rb
@@ -284,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.349.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.350.0
 rdoc_options: []
 require_paths:
 - lib

data/lib/dependabot/uv/file_parser/setup_file_parser.rb

@@ -1,194 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-require "dependabot/dependency"
-require "dependabot/errors"
-require "dependabot/file_parsers/base/dependency_set"
-require "dependabot/shared_helpers"
-require "dependabot/uv/file_parser"
-require "dependabot/uv/native_helpers"
-require "dependabot/uv/name_normaliser"
-require "sorbet-runtime"
-
-module Dependabot
-  module Uv
-    class FileParser
-      class SetupFileParser
-        extend T::Sig
-
-        INSTALL_REQUIRES_REGEX = /install_requires\s*=\s*\[/m
-        SETUP_REQUIRES_REGEX = /setup_requires\s*=\s*\[/m
-        TESTS_REQUIRE_REGEX = /tests_require\s*=\s*\[/m
-        EXTRAS_REQUIRE_REGEX = /extras_require\s*=\s*\{/m
-
-        CLOSING_BRACKET = T.let({ "[" => "]", "{" => "}" }.freeze, T.any(T.untyped, T.untyped))
-
-        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
-        def initialize(dependency_files:)
-          @dependency_files = dependency_files
-        end
-
-        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
-        def dependency_set
-          dependencies = Dependabot::FileParsers::Base::DependencySet.new
-
-          parsed_setup_file.each do |dep|
-            # If a requirement has a `<` or `<=` marker then updating it is
-            # probably blocked. Ignore it.
-            next if dep["markers"].include?("<")
-
-            # If the requirement is our inserted version, ignore it
-            # (we wouldn't be able to update it)
-            next if dep["version"] == "0.0.1+dependabot"
-
-            dependencies <<
-              Dependency.new(
-                name: normalised_name(dep["name"], dep["extras"]),
-                version: dep["version"]&.include?("*") ? nil : dep["version"],
-                requirements: [{
-                  requirement: dep["requirement"],
-                  file: Pathname.new(dep["file"]).cleanpath.to_path,
-                  source: nil,
-                  groups: [dep["requirement_type"]]
-                }],
-                package_manager: "uv"
-              )
-          end
-          dependencies
-        end
-
-        private
-
-        sig { returns(T::Array[Dependabot::DependencyFile]) }
-        attr_reader :dependency_files
-
-        sig { returns(T.untyped) }
-        def parsed_setup_file
-          SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
-
-            requirements = SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_setup",
-              args: [Dir.pwd]
-            )
-
-            check_requirements(requirements)
-            requirements
-          end
-        rescue SharedHelpers::HelperSubprocessFailed => e
-          raise Dependabot::DependencyFileNotEvaluatable, e.message if e.message.start_with?("InstallationError")
-
-          return [] unless setup_file
-
-          parsed_sanitized_setup_file
-        end
-
-        sig { returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]]))) }
-        def parsed_sanitized_setup_file
-          SharedHelpers.in_a_temporary_directory do
-            write_sanitized_setup_file
-
-            requirements = SharedHelpers.run_helper_subprocess(
-              command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-              function: "parse_setup",
-              args: [Dir.pwd]
-            )
-
-            check_requirements(requirements)
-            requirements
-          end
-        rescue SharedHelpers::HelperSubprocessFailed
-          # Assume there are no dependencies in setup.py files that fail to
-          # parse. This isn't ideal, and we should continue to improve
-          # parsing, but there are a *lot* of things that can go wrong at
-          # the moment!
-          []
-        end
-
-        sig { params(requirements: T.untyped).returns(T.untyped) }
-        def check_requirements(requirements)
-          requirements&.each do |dep|
-            next unless dep["requirement"]
-
-            Uv::Requirement.new(dep["requirement"].split(","))
-          rescue Gem::Requirement::BadRequirementError => e
-            raise Dependabot::DependencyFileNotEvaluatable, e.message
-          end
-        end
-
-        sig { void }
-        def write_temporary_dependency_files
-          dependency_files
-            .reject { |f| f.name == ".python-version" }
-            .each do |file|
-              path = file.name
-              FileUtils.mkdir_p(Pathname.new(path).dirname)
-              File.write(path, file.content)
-            end
-        end
-
-        # Write a setup.py with only entries for the requires fields.
-        #
-        # This sanitization is far from perfect (it will fail if any of the
-        # entries are dynamic), but it is an alternative approach to the one
-        # used in parser.py which sometimes succeeds when that has failed.
-        sig { void }
-        def write_sanitized_setup_file
-          install_requires = get_regexed_req_array(INSTALL_REQUIRES_REGEX)
-          setup_requires = get_regexed_req_array(SETUP_REQUIRES_REGEX)
-          tests_require = get_regexed_req_array(TESTS_REQUIRE_REGEX)
-          extras_require = get_regexed_req_dict(EXTRAS_REQUIRE_REGEX)
-
-          tmp = "from setuptools import setup\n\n" \
-                "setup(name=\"sanitized-package\",version=\"0.0.1\","
-
-          tmp += "install_requires=#{install_requires}," if install_requires
-          tmp += "setup_requires=#{setup_requires}," if setup_requires
-          tmp += "tests_require=#{tests_require}," if tests_require
-          tmp += "extras_require=#{extras_require}," if extras_require
-          tmp += ")"
-
-          File.write("setup.py", tmp)
-        end
-
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_array(regex)
-          return unless (mch = setup_file.content.match(regex))
-
-          "[#{mch.post_match[0..closing_bracket_index(mch.post_match, '[')]}"
-        end
-
-        sig { params(regex: Regexp).returns(T.nilable(String)) }
-        def get_regexed_req_dict(regex)
-          return unless (mch = setup_file.content.match(regex))
-
-          "{#{mch.post_match[0..closing_bracket_index(mch.post_match, '{')]}"
-        end
-
-        sig { params(string: String, bracket: String).returns(Integer) }
-        def closing_bracket_index(string, bracket)
-          closes_required = 1
-
-          string.chars.each_with_index do |char, index|
-            closes_required += 1 if char == bracket
-            closes_required -= 1 if char == CLOSING_BRACKET.fetch(bracket)
-            return index if closes_required.zero?
-          end
-
-          0
-        end
-
-        sig { params(name: String, extras: T::Array[String]).returns(String) }
-        def normalised_name(name, extras)
-          NameNormaliser.normalise_including_extras(name, extras)
-        end
-
-        sig { returns(T.untyped) }
-        def setup_file
-          dependency_files.find { |f| f.name == "setup.py" }
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/uv/pipenv_runner.rb

@@ -1,110 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-require "dependabot/shared_helpers"
-require "dependabot/uv/file_parser"
-require "json"
-require "sorbet-runtime"
-
-module Dependabot
-  module Uv
-    class PipenvRunner
-      extend T::Sig
-
-      sig do
-        params(
-          dependency: Dependabot::Dependency,
-          lockfile: T.nilable(Dependabot::DependencyFile),
-          language_version_manager: LanguageVersionManager
-        )
-          .void
-      end
-      def initialize(dependency:, lockfile:, language_version_manager:)
-        @dependency = dependency
-        @lockfile = lockfile
-        @language_version_manager = language_version_manager
-      end
-
-      sig { params(constraint: String).returns(String) }
-      def run_upgrade(constraint)
-        constraint = "" if constraint == "*"
-        command = "pyenv exec pipenv upgrade --verbose #{dependency_name}#{constraint}"
-        command << " --dev" if lockfile_section == "develop"
-
-        run(command, fingerprint: "pyenv exec pipenv upgrade --verbose <dependency_name><constraint>")
-      end
-
-      sig { params(constraint: String).returns(T.nilable(String)) }
-      def run_upgrade_and_fetch_version(constraint)
-        run_upgrade(constraint)
-
-        updated_lockfile = JSON.parse(File.read("Pipfile.lock"))
-
-        fetch_version_from_parsed_lockfile(updated_lockfile)
-      end
-
-      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
-      def run(command, fingerprint: nil)
-        run_command(
-          "pyenv local #{language_version_manager.python_major_minor}",
-          fingerprint: "pyenv local <python_major_minor>"
-        )
-
-        run_command(command, fingerprint: fingerprint)
-      end
-
-      private
-
-      sig { returns(Dependabot::Dependency) }
-      attr_reader :dependency
-
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      attr_reader :lockfile
-
-      sig { returns(LanguageVersionManager) }
-      attr_reader :language_version_manager
-
-      sig { params(updated_lockfile: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
-      def fetch_version_from_parsed_lockfile(updated_lockfile)
-        deps = updated_lockfile[lockfile_section] || {}
-
-        deps.dig(dependency_name, "version")
-            &.gsub(/^==/, "")
-      end
-
-      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
-      def run_command(command, fingerprint: nil)
-        SharedHelpers.run_shell_command(command, env: pipenv_env_variables, fingerprint: fingerprint)
-      end
-
-      sig { returns(String) }
-      def lockfile_section
-        if dependency.requirements.any?
-          T.must(dependency.requirements.first)[:groups].first
-        else
-          Uv::FileParser::DEPENDENCY_GROUP_KEYS.each do |keys|
-            section = keys.fetch(:lockfile)
-            return section if JSON.parse(T.must(T.must(lockfile).content))[section].keys.any?(dependency_name)
-          end
-        end
-      end
-
-      sig { returns(String) }
-      def dependency_name
-        dependency.metadata[:original_name] || dependency.name
-      end
-
-      sig { returns(T::Hash[String, String]) }
-      def pipenv_env_variables
-        {
-          "PIPENV_YES" => "true",        # Install new Python ver if needed
-          "PIPENV_MAX_RETRIES" => "3",   # Retry timeouts
-          "PIPENV_NOSPIN" => "1",        # Don't pollute logs with spinner
-          "PIPENV_TIMEOUT" => "600",     # Set install timeout to 10 minutes
-          "PIP_DEFAULT_TIMEOUT" => "60", # Set pip timeout to 1 minute
-          "COLUMNS" => "250"             # Avoid line wrapping
-        }
-      end
-    end
-  end
-end