dependabot-uv 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8321e87aabcd72cae64306b506846ed940e8b1209ccacd81b01053f8e8fa60eb
-  data.tar.gz: 3c4321de425ebb554694d0fc3636383978a79f9b8c8a4fdda0d29f6d174ca672
+  metadata.gz: 8aae027d8e4328d4979db8067b5fc2a0c277a257e3bcf2394620a175f1b34273
+  data.tar.gz: 6defb5dddfbdcf1e698061faa33c0ad8e62fc92d6784ec3202c0bfbb7b2be708
 SHA512:
-  metadata.gz: e42ae4dad39bee817e1036b3b0eb43d390acb1be78882b4fc691ff13f7508ad0587c83b1ccda1579db016bc3095221bce548c9ac8b377bcd41dde4670d058753
-  data.tar.gz: 3f2d360fd9efb8afd3d23a3d41977763e04e5e193e210f04be6d0f863358a36b4dc824d03b41f1cfa32d86c55b328808fa9f20307b907e2dc65d8f73f779a61c
+  metadata.gz: 83215549f85c5492a144f50e6ed0c3588ba6aa64cf023aa749f629197319e1b5b8fdd001cf07874ba108d20ed107c579dcb753c1edfc8205f2a2b6cc274b9375
+  data.tar.gz: e84514279e143ae6125742d75d11b6b4d24262d2e7b423972be2e1132a8f82d77560e067bd1d1dff2aceecd7de892afc6428cefde84e32665f59ca7ab889e0cb

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.2.1
 poetry==2.3.4
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.11.8
+uv==0.11.31
 
 # Some dependencies will only install if Cython is present
 Cython==3.2.4

data/lib/dependabot/uv/dependency_grapher.rb

@@ -12,8 +12,8 @@ require "toml-rb"
 module Dependabot
   module Uv
     class DependencyGrapher < Dependabot::DependencyGraphers::Base
-      RUNTIME_GROUP = T.let("dependencies", String)
-      DEV_GROUP = T.let("dev-dependencies", String)
+      RUNTIME_GROUP = "dependencies"
+      DEV_GROUP = "dev-dependencies"
 
       sig { override.returns(Dependabot::DependencyFile) }
       def relevant_dependency_file

data/lib/dependabot/uv/file_fetcher/workspace_fetcher.rb

@@ -12,7 +12,7 @@ module Dependabot
       class WorkspaceFetcher
         extend T::Sig
 
-        README_FILENAMES = T.let(%w(README.md README.rst README.txt README).freeze, T::Array[String])
+        README_FILENAMES = %w(README.md README.rst README.txt README).freeze
 
         sig do
           params(

data/lib/dependabot/uv/file_fetcher.rb

@@ -16,7 +16,7 @@ module Dependabot
     class FileFetcher < Dependabot::Python::SharedFileFetcher
       extend T::Sig
 
-      ECOSYSTEM_SPECIFIC_FILES = T.let(%w(uv.lock).freeze, T::Array[String])
+      ECOSYSTEM_SPECIFIC_FILES = %w(uv.lock).freeze
 
       REQUIREMENT_FILE_PATTERNS = T.let(
         {
@@ -27,7 +27,7 @@ module Dependabot
       )
 
       # Projects that use README files for metadata may use any of these common names
-      README_FILENAMES = T.let(%w(README.md README.rst README.txt README).freeze, T::Array[String])
+      README_FILENAMES = %w(README.md README.rst README.txt README).freeze
 
       # Type alias for path dependency hashes
       PathDependency = T.type_alias { T::Hash[Symbol, String] }

data/lib/dependabot/uv/file_parser/python_requirement_parser.rb

@@ -92,7 +92,7 @@ module Dependabot
           end.reject(&:empty?)
 
           file_version = content_lines.first
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version
@@ -104,7 +104,7 @@ module Dependabot
 
           file_version = T.must(T.must(runtime_file).content)
                           .match(/(?<=python-).*/)&.to_s&.strip
-          return if file_version&.empty?
+          return if file_version && file_version.empty?
           return unless T.must(pyenv_versions).include?("#{file_version}\n")
 
           file_version

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -26,19 +26,14 @@ module Dependabot
         require_relative "requirement_file_updater"
         require_relative "lock_file_error_handler"
 
-        UNSAFE_PACKAGES = T.let(%w(setuptools distribute pip).freeze, T::Array[String])
-        INCOMPATIBLE_VERSIONS_REGEX = T.let(
-          /There are incompatible versions in the resolved dependencies:.*\z/m,
-          Regexp
-        )
-        WARNINGS = T.let(/\s*# WARNING:.*\Z/m, Regexp)
-        UNSAFE_NOTE = T.let(/\s*# The following packages are considered to be unsafe.*\Z/m, Regexp)
-        RESOLVER_REGEX = T.let(/(?<=--resolver=)(\w+)/, Regexp)
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
-        )
-        PYTHON_VERSION_REGEX = T.let(/--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/, Regexp)
+        UNSAFE_PACKAGES = %w(setuptools distribute pip).freeze
+        INCOMPATIBLE_VERSIONS_REGEX = /There are incompatible versions in the resolved dependencies:.*\z/m
+        WARNINGS = /\s*# WARNING:.*\Z/m
+        UNSAFE_NOTE = /\s*# The following packages are considered to be unsafe.*\Z/m
+        RESOLVER_REGEX = /(?<=--resolver=)(\w+)/
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
+        PYTHON_VERSION_REGEX = /--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/
 
         sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
@@ -58,10 +53,10 @@ module Dependabot
           ).void
         end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @index_urls = index_urls
           @build_isolation = T.let(true, T::Boolean)
         end
 

data/lib/dependabot/uv/file_updater/lock_file_error_handler.rb

@@ -11,35 +11,17 @@ module Dependabot
       class LockFileErrorHandler
         extend T::Sig
 
-        UV_UNRESOLVABLE_REGEX = T.let(/× No solution found when resolving dependencies.*[\s\S]*$/, Regexp)
-        UV_BUILD_FAILED_REGEX = T.let(/× Failed to build.*[\s\S]*$/, Regexp)
-        RESOLUTION_IMPOSSIBLE_ERROR = T.let("ResolutionImpossible", String)
-
-        GIT_DEPENDENCY_UNREACHABLE_REGEX = T.let(%r{git clone.*(?<url>https?://[^\s]+)}, Regexp)
-        GIT_REFERENCE_NOT_FOUND_REGEX = T.let(
-          /Did not find branch or tag '(?<tag>[^\n"']+)'/m,
-          Regexp
-        )
-        GIT_CREDENTIALS_ERROR_REGEX = T.let(
-          /could not read Username for '(?<url>[^']+)'/,
-          Regexp
-        )
-        GIT_DEPENDENCY_URL_FROM_UV_REGEX = T.let(
-          %r{git\+(?<url>https?://[^\s@#]+)},
-          Regexp
-        )
-        PYTHON_VERSION_ERROR_REGEX = T.let(
-          /Requires-Python|requires-python|python_requires|Python version/i,
-          Regexp
-        )
-        AUTH_ERROR_REGEX = T.let(
-          /authentication|unauthorized|forbidden|HTTP status code: 40[13]/i,
-          Regexp
-        )
-        TIMEOUT_ERROR_REGEX = T.let(
-          /timed?\s*out|connection.*reset|read timeout|connect timeout/i,
-          Regexp
-        )
+        UV_UNRESOLVABLE_REGEX = /× No solution found when resolving dependencies.*[\s\S]*$/
+        UV_BUILD_FAILED_REGEX = /× Failed to build.*[\s\S]*$/
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+
+        GIT_DEPENDENCY_UNREACHABLE_REGEX = %r{git clone.*(?<url>https?://[^\s]+)}
+        GIT_REFERENCE_NOT_FOUND_REGEX = /Did not find branch or tag '(?<tag>[^\n"']+)'/m
+        GIT_CREDENTIALS_ERROR_REGEX = /could not read Username for '(?<url>[^']+)'/
+        GIT_DEPENDENCY_URL_FROM_UV_REGEX = %r{git\+(?<url>https?://[^\s@#]+)}
+        PYTHON_VERSION_ERROR_REGEX = /Requires-Python|requires-python|python_requires|Python version/i
+        AUTH_ERROR_REGEX = /authentication|unauthorized|forbidden|HTTP status code: 40[13]/i
+        TIMEOUT_ERROR_REGEX = /timed?\s*out|connection.*reset|read timeout|connect timeout/i
         NETWORK_ERROR_REGEX = T.let(
           Regexp.union(
             /ConnectionError/i,
@@ -52,39 +34,17 @@ module Dependabot
           ),
           Regexp
         )
-        PACKAGE_NOT_FOUND_REGEX = T.let(
-          /No matching distribution found|package.*not found|No versions found/i,
-          Regexp
-        )
-        UV_REQUIRED_VERSION_REGEX = T.let(
-          /Required uv version `(?<required>[^`]+)` does not match the running version `(?<running>[^`]+)`/,
-          Regexp
-        )
-        TOML_PARSE_ERROR_REGEX = T.let(
-          /Failed to parse:?\s*`?(?<file>[^`\n]+\.toml)`?|TOML parse error/i,
-          Regexp
-        )
+        PACKAGE_NOT_FOUND_REGEX = /No matching distribution found|package.*not found|No versions found/i
+        UV_REQUIRED_VERSION_REGEX =
+          /Required uv version `(?<required>[^`]+)` does not match the running version `(?<running>[^`]+)`/
+        TOML_PARSE_ERROR_REGEX = /Failed to parse:?\s*`?(?<file>[^`\n]+\.toml)`?|TOML parse error/i
         # uv prefixes errors with interpreter info that should be stripped
-        USING_CPYTHON_LINE_REGEX = T.let(
-          /\AUsing CPython \S+ interpreter at: [^\n]+\n?/,
-          Regexp
-        )
-        PYPROJECT_SCHEMA_ERROR_REGEX = T.let(
-          /missing field `project`|missing.*\[project\].*table|Field `project\.name` is required/i,
-          Regexp
-        )
-        WORKSPACE_MEMBER_ERROR_REGEX = T.let(
-          /Failed to find workspace member|No `pyproject\.toml` found in workspace member/i,
-          Regexp
-        )
-        PATH_DEPENDENCY_ERROR_REGEX = T.let(
-          /Failed to read `(?<path>[^`]+)`|failed to read from file `(?<path>[^`]+)`/i,
-          Regexp
-        )
-        HTTP_STATUS_ERROR_REGEX = T.let(
-          /HTTP status code: (?<code>\d{3})/i,
-          Regexp
-        )
+        USING_CPYTHON_LINE_REGEX = /\AUsing CPython \S+ interpreter at: [^\n]+\n?/
+        PYPROJECT_SCHEMA_ERROR_REGEX =
+          /missing field `project`|missing.*\[project\].*table|Field `project\.name` is required/i
+        WORKSPACE_MEMBER_ERROR_REGEX = /Failed to find workspace member|No `pyproject\.toml` found in workspace member/i
+        PATH_DEPENDENCY_ERROR_REGEX = /Failed to read `(?<path>[^`]+)`|failed to read from file `(?<path>[^`]+)`/i
+        HTTP_STATUS_ERROR_REGEX = /HTTP status code: (?<code>\d{3})/i
         UV_MISCONFIGURED_REGEX = T.let(
           Regexp.union(
             /unknown field `[^`]+`, expected one of/i,
@@ -100,7 +60,7 @@ module Dependabot
         # This limit ensures error messages remain readable while providing enough
         # context for debugging. Most uv error messages convey the key information
         # within the first few lines.
-        MAX_ERROR_LINES = T.let(10, Integer)
+        MAX_ERROR_LINES = 10
 
         sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
         def handle_uv_error(error)

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -3,6 +3,7 @@
 
 require "toml-rb"
 require "open3"
+require "uri"
 require "dependabot/dependency"
 require "dependabot/shared_helpers"
 require "dependabot/uv/language_version_manager"
@@ -399,9 +400,12 @@ module Dependabot
             .reject { |cred| skip_lock_index_credential?(cred) }
         end
 
+        # Skip credentials whose index is already declared in pyproject.toml; those are
+        # authenticated via UV_INDEX_<NAME>_* env vars (see #pyproject_index_env_vars) so uv
+        # uses the pyproject.toml index entry directly, avoiding a duplicate --index flag.
         sig { params(credential: Dependabot::Credential).returns(T::Boolean) }
         def skip_lock_index_credential?(credential)
-          credential.replaces_base? ? defined_in_pyproject?(credential) : explicit_index?(credential)
+          defined_in_pyproject?(credential)
         end
 
         sig do
@@ -504,16 +508,6 @@ module Dependabot
           []
         end
 
-        sig { params(credential: Dependabot::Credential).returns(T::Boolean) }
-        def explicit_index?(credential)
-          return false if credential.replaces_base?
-
-          cred_url = normalize_index_url(credential["index-url"].to_s)
-          uv_indices.any? do |_name, config|
-            config["explicit"] == true && normalize_index_url(config["url"].to_s) == cred_url
-          end
-        end
-
         # Checks if a credential's index URL matches any index defined in pyproject.toml.
         # When true, authentication is provided via env vars so uv uses the pyproject.toml URL,
         # preserving URL format alignment between pyproject.toml and uv.lock.
@@ -522,8 +516,15 @@ module Dependabot
           !find_index_name_for_credential(credential).nil?
         end
 
+        # Strips trailing slashes and any embedded userinfo so a pyproject.toml URL like
+        # https://oauth2accesstoken@host/path matches a credential URL like https://host/path.
         sig { params(url: String).returns(String) }
         def normalize_index_url(url)
+          uri = URI.parse(url.chomp("/"))
+          uri.user = nil
+          uri.password = nil
+          uri.to_s
+        rescue URI::InvalidURIError
           url.chomp("/")
         end
 
@@ -545,8 +546,7 @@ module Dependabot
             next unless name
 
             result[name] = {
-              "url" => index["url"],
-              "explicit" => index["explicit"] == true
+              "url" => index["url"]
             }
           end
         rescue TomlRB::ParseError
@@ -719,7 +719,7 @@ module Dependabot
         def create_or_update_lock_file?
           return true if lockfile && T.must(dependency).requirements.empty?
 
-          T.must(dependency).requirements.select { _1[:file].end_with?(*REQUIRED_FILES) }.any?
+          T.must(dependency).requirements.any? { _1[:file].end_with?(*REQUIRED_FILES) }
         end
 
         sig { returns(T::Hash[String, String]) }

data/lib/dependabot/uv/requirement_suffix_helper.rb

@@ -8,13 +8,10 @@ module Dependabot
     module RequirementSuffixHelper
       extend T::Sig
 
-      REQUIREMENT_SUFFIX_REGEX = T.let(
-        Regexp.new(
-          "\\A(?<requirement>.*?)(?<suffix>\\s*(?:;|#).*)?\\z",
-          Regexp::MULTILINE
-        ).freeze,
-        Regexp
-      )
+      REQUIREMENT_SUFFIX_REGEX = Regexp.new(
+        "\\A(?<requirement>.*?)(?<suffix>\\s*(?:;|#).*)?\\z",
+        Regexp::MULTILINE
+      ).freeze
 
       sig { params(segment: String).returns(T::Array[String]) }
       def self.split(segment)

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -28,26 +28,18 @@ module Dependabot
       class PipCompileVersionResolver
         extend T::Sig
 
-        GIT_DEPENDENCY_UNREACHABLE_REGEX = T.let(/git clone --filter=blob:none --quiet (?<url>[^\s]+).* /, Regexp)
-        GIT_REFERENCE_NOT_FOUND_REGEX = T.let(/Did not find branch or tag '(?<tag>[^\n"]+)'/m, Regexp)
-        GIT_CREDENTIALS_ERROR_REGEX = T.let(
-          /could not read Username for '(?<url>[^']+)'/,
-          Regexp
-        )
-        GIT_DEPENDENCY_URL_FROM_UV_REGEX = T.let(
-          %r{git\+(?<url>https?://[^\s@#]+)},
-          Regexp
-        )
-        NATIVE_COMPILATION_ERROR = T.let(
-          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1",
-          String
-        )
+        GIT_DEPENDENCY_UNREACHABLE_REGEX = /git clone --filter=blob:none --quiet (?<url>[^\s]+).* /
+        GIT_REFERENCE_NOT_FOUND_REGEX = /Did not find branch or tag '(?<tag>[^\n"]+)'/m
+        GIT_CREDENTIALS_ERROR_REGEX = /could not read Username for '(?<url>[^']+)'/
+        GIT_DEPENDENCY_URL_FROM_UV_REGEX = %r{git\+(?<url>https?://[^\s@#]+)}
+        NATIVE_COMPILATION_ERROR =
+          "pip._internal.exceptions.InstallationSubprocessError: Getting requirements to build wheel exited with 1"
         # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#configuring-metadata
-        PYTHON_PACKAGE_NAME_REGEX = T.let(/[A-Za-z0-9_\-]+/, Regexp)
-        RESOLUTION_IMPOSSIBLE_ERROR = T.let("ResolutionImpossible", String)
-        ERROR_REGEX = T.let(/(?<=ERROR\:\W).*$/, Regexp)
-        UV_UNRESOLVABLE_REGEX = T.let(/ × No solution found when resolving dependencies:[\s\S]*$/, Regexp)
-        PYTHON_VERSION_REGEX = T.let(/--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/, Regexp)
+        PYTHON_PACKAGE_NAME_REGEX = /[A-Za-z0-9_\-]+/
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+        ERROR_REGEX = /(?<=ERROR\:\W).*$/
+        UV_UNRESOLVABLE_REGEX = / × No solution found when resolving dependencies:[\s\S]*$/
+        PYTHON_VERSION_REGEX = /--python-version[=\s]+(?<version>\d+\.\d+(?:\.\d+)?)/
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
@@ -73,10 +65,10 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:, repo_contents_path:)
-          @dependency               = T.let(dependency, Dependabot::Dependency)
-          @dependency_files         = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials              = T.let(credentials, T::Array[Dependabot::Credential])
-          @repo_contents_path       = T.let(repo_contents_path, T.nilable(String))
+          @dependency               = dependency
+          @dependency_files         = dependency_files
+          @credentials              = credentials
+          @repo_contents_path       = repo_contents_path
           @build_isolation = T.let(true, T::Boolean)
           @error_handler = T.let(PipCompileErrorHandler.new, PipCompileErrorHandler)
         end
@@ -609,13 +601,13 @@ module Dependabot
     class PipCompileErrorHandler
       extend T::Sig
 
-      SUBPROCESS_ERROR = T.let(/subprocess-exited-with-error/, Regexp)
+      SUBPROCESS_ERROR = /subprocess-exited-with-error/
 
-      INSTALLATION_ERROR = T.let(/InstallationError/, Regexp)
+      INSTALLATION_ERROR = /InstallationError/
 
-      INSTALLATION_SUBPROCESS_ERROR = T.let(/InstallationSubprocessError/, Regexp)
+      INSTALLATION_SUBPROCESS_ERROR = /InstallationSubprocessError/
 
-      HASH_MISMATCH = T.let(/HashMismatch/, Regexp)
+      HASH_MISMATCH = /HashMismatch/
 
       sig { params(error: String).void }
       def handle_pipcompile_error(error)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib