dependabot-uv 0.375.0 → 0.376.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70d931188f97da35d9640f12c9e46ce6448d11e217a5929c42147d0bc5921da0
-  data.tar.gz: 9fbff1b9ec1f035932b1e8183d51d0c2b3c1fba55ecf5d7432ec9933f1262f98
+  metadata.gz: ffa5301357ed8bc41bd3e7c6340995930729bcb883ff889903799f1ea85af6d0
+  data.tar.gz: ed9478cc3ad8de5daa94fa28ecb21e251185ca8fd9343aa58b315aba7487c9c3
 SHA512:
-  metadata.gz: 2617fb6467bbaee53b2aeb34ef1674312b7266a8a301ae8fbb60d77cadce8ca95edf35aeca16939eb0d1782b5f8ae35e6b619953a804535ebd602fbf954129c2
-  data.tar.gz: 4d9bd0393f2c71a08aa867c81440a4ee0aefa7d770bf0c4da9ed428badce9d78e4599937512336123b85bc0c036dea96bc14c48abe6a395efaf8ae2aefe075a1
+  metadata.gz: 8094326c0920dffde4de036f748cc3f8b5734115eaa3c4ff270f23d3d74252628d362a2f81c24921410b89569a5e32e56478b095a36c24ee6202e38684189c14
+  data.tar.gz: f7fca95aef0f444d590beb49a9cf3a7e5bf57d11e14071687e02cac1e33139f6557cd17470faf443d3b9218c57f8e495ba6d1bf76f9ed84e369e4333c1f77590

data/lib/dependabot/uv/file_parser.rb

@@ -8,6 +8,7 @@ require "dependabot/file_parsers/base"
 require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/shared_helpers"
 require "dependabot/uv/requirement"
+require "dependabot/uv/requirement_parser"
 require "dependabot/errors"
 require "dependabot/uv/language"
 require "dependabot/uv/native_helpers"
@@ -82,7 +83,7 @@ module Dependabot
 
           setup_python_environment
 
-          SharedHelpers.run_shell_command(command)
+          SharedHelpers.run_shell_command(command, allow_unsafe_shell_command: true)
         end
       end
 
@@ -382,6 +383,7 @@ module Dependabot
       def write_temporary_dependency_files
         dependency_files
           .reject { |f| f.name == ".python-version" }
+          .reject { |f| skip_for_requirements_parsing?(f) }
           .each do |file|
             path = file.name
             FileUtils.mkdir_p(Pathname.new(path).dirname)
@@ -389,6 +391,28 @@ module Dependabot
           end
       end
 
+      # The `parse_requirements` Python helper globs every `*.txt` and `*.in`
+      # file in the working directory and asks pip to parse each one. Skip
+      # writing `.txt`/`.in` support files (e.g. a `LICENSE.txt` pulled in via
+      # PEP 621 `project.license.file`) whose contents don't look like a pip
+      # requirements file, so they aren't misparsed as requirements.
+      sig { params(file: DependencyFile).returns(T::Boolean) }
+      def skip_for_requirements_parsing?(file)
+        return false unless file.support_file?
+        return false unless file.name.end_with?(".txt", ".in")
+
+        content = file.content
+        return false unless content&.valid_encoding?
+        return false if File.basename(file.name).match?(/requirements/i)
+
+        !content.lines.all? do |line|
+          stripped = line.strip
+          stripped.empty? ||
+            stripped.start_with?("#", "-r ", "-c ", "-e ", "--") ||
+            line.match?(RequirementParser::VALID_REQ_TXT_REQUIREMENT)
+        end
+      end
+
       sig { params(file: T.untyped).returns(T.untyped) }
       def remove_imports(file)
         return file.content if file.path.end_with?(".tar.gz", ".whl", ".zip")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.375.0
+  version: 0.376.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.375.0
+        version: 0.376.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.375.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.376.0
 rdoc_options: []
 require_paths:
 - lib