dependabot-uv 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1c6b85902cc78b5c3624f68a39a32e05a4d5206081bac206d54e8afa732489f
-  data.tar.gz: 401140b860009a2650a5b96fde815fc50f3813ad60104516d5d50c8f9635799c
+  metadata.gz: b0b2c86fecd6361c11d682fd96da7135b08179f251f7a524d045824341ccbe9e
+  data.tar.gz: df43361f2dd0a76a17da2a6ea510086da7adadbe859d1d91975be7ebe84a61bc
 SHA512:
-  metadata.gz: 399a2740238ae91547e49246a5fd309bfe228d2efbf05f9d8c9699201960158e92e115dd625b940a7a49a7664f683777957a371d9e5326af74823d883947a6f2
-  data.tar.gz: 7a2307ab70008dcbb760977f20c226e3b659df68cc4adf867f237e8196db5fc7462f18a10ef5cfe5ba008d04641cc009e40b8def58596c70b1bc5346e0bae253
+  metadata.gz: 3117ccb8929d12b1caff2b31607e8b459fbb61008495f3f9c5b195e7d4b888cabd0d2b47de2535d130660db0b4fe51fc2aede86b856bcd237d5f3e2eb20da37b
+  data.tar.gz: 162286da713782ed33c25c4fcea096c4365edcf219ad4da6bb93812fd64792a569e92e86b3c20d4f8814f10f141b1bf010ba0c3cf44a3c6e553c814e1006aad2

data/lib/dependabot/uv/file_fetcher/workspace_fetcher.rb

@@ -277,8 +277,8 @@ module Dependabot
           normalized_directory = directory.gsub(%r{(^/|/$)}, "")
 
           repo_contents(dir: base_dir, raise_errors: false)
-            .select { |file| T.unsafe(file).type == "dir" }
-            .map { |f| T.unsafe(f).path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
+            .select { |file| file.type == "dir" }
+            .map { |file| file.path.gsub(%r{^/?#{Regexp.escape(normalized_directory)}/?}, "") }
         end
 
         sig { params(paths: T::Array[String], pattern: String).returns(T::Array[String]) }

data/lib/dependabot/uv/file_fetcher.rb

@@ -276,7 +276,7 @@ module Dependabot
       def req_files_for_dir(requirements_dir)
         dir = directory.gsub(%r{(^/|/$)}, "")
         relative_reqs_dir =
-          requirements_dir.path&.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
+          requirements_dir.path.gsub(%r{^/?#{Regexp.escape(dir)}/?}, "")
 
         fetch_requirement_files_from_path(relative_reqs_dir)
       end
@@ -321,7 +321,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_requirement_files_from_dirs
         repo_contents
-          .select { |f| T.unsafe(f).type == "dir" }
+          .select { |f| f.type == "dir" }
           .flat_map { |dir| req_files_for_dir(dir) }
       end
 
@@ -333,10 +333,10 @@ module Dependabot
       end
       def filter_requirement_files(contents, base_path: nil)
         contents
-          .select { |f| T.unsafe(f).type == "file" }
-          .select { |f| file_matches_requirement_pattern?(T.unsafe(f).name) }
-          .reject { |f| T.unsafe(f).size > MAX_FILE_SIZE }
-          .map { |f| fetch_file_with_path(T.unsafe(f).name, base_path) }
+          .select { |f| f.type == "file" }
+          .select { |f| file_matches_requirement_pattern?(f.name) }
+          .reject { |f| f.size > MAX_FILE_SIZE }
+          .map { |f| fetch_file_with_path(f.name, base_path) }
           .select { |f| T.must(REQUIREMENT_FILE_PATTERNS[:filenames]).include?(f.name) || requirements_file?(f) }
       end
 

data/lib/dependabot/uv/file_parser/pyproject_files_parser.rb

@@ -109,7 +109,53 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         def workspace_member_pyproject_files
-          dependency_files.select { |file| file.support_file? && file.name.end_with?("pyproject.toml") }
+          return [] if workspace_member_patterns.empty?
+
+          dependency_files.select do |file|
+            next false unless file.support_file? && file.name.end_with?("pyproject.toml")
+
+            workspace_member_file?(file)
+          end
+        end
+
+        # Only pyprojects declared under `[tool.uv.workspace].members` in the root
+        # manifest are true workspace members whose requirements should be updated.
+        # Editable `[tool.uv.sources]` path dependencies are separate packages that
+        # are fetched as support files for resolution but must not be modified.
+        sig { returns(T::Array[String]) }
+        def workspace_member_patterns
+          workspace_globs("members")
+        end
+
+        # uv removes paths matching `[tool.uv.workspace].exclude` after expanding
+        # `members`, so an excluded directory is not a workspace member even when it
+        # matches a `members` glob.
+        sig { returns(T::Array[String]) }
+        def workspace_exclude_patterns
+          workspace_globs("exclude")
+        end
+
+        sig { params(key: String).returns(T::Array[String]) }
+        def workspace_globs(key)
+          return [] unless pyproject
+
+          globs = parsed_pyproject.dig("tool", "uv", "workspace", key)
+          globs.is_a?(Array) ? globs.grep(String) : []
+        end
+
+        sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+        def workspace_member_file?(file)
+          member_dir = File.dirname(file.name)
+
+          return false if workspace_exclude_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+
+          workspace_member_patterns.any? { |pattern| glob_matches_dir?(pattern, member_dir) }
+        end
+
+        sig { params(pattern: String, dir: String).returns(T::Boolean) }
+        def glob_matches_dir?(pattern, dir)
+          normalized_pattern = pattern.gsub(%r{^\./}, "").chomp("/")
+          File.fnmatch?(normalized_pattern, dir, File::FNM_PATHNAME)
         end
 
         sig { returns(Dependabot::FileParsers::Base::DependencySet) }

data/lib/dependabot/uv/update_checker.rb

@@ -213,29 +213,6 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Boolean) }
-      def library?
-        return false unless updating_pyproject?
-        return false unless library_details
-
-        return false if T.must(library_details)["name"].nil?
-
-        # Hit PyPi and check whether there are details for a library with a
-        # matching name and description
-        index_response = Dependabot::RegistryClient.get(
-          url: "https://pypi.org/pypi/#{normalised_name(T.must(library_details)['name'])}/json/"
-        )
-
-        return false unless index_response.status == 200
-
-        pypi_info = JSON.parse(index_response.body)["info"] || {}
-        pypi_info["summary"] == T.must(library_details)["description"]
-      rescue Excon::Error::Timeout, Excon::Error::Socket
-        false
-      rescue URI::InvalidURIError
-        false
-      end
-
       sig { returns(T::Boolean) }
       def updating_pyproject?
         requirement_files.any? { |file| file.end_with?("pyproject.toml") }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib