dependabot-uv 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9eee59202ca318e612e23d7303309e498d51999cda642a1660d41390a2bd4a8
-  data.tar.gz: 3b3bb2ea60f190db5d8c9bd36f1ff01531097788c3755c6638d5a4e8e3ebf923
+  metadata.gz: c5e87aed24a3d0d1e38f69d064fa0d05ea3aa5db358ffe8b8aca51b0ba814f41
+  data.tar.gz: a79f5e14f753586b9a66310917f590bf7ac1065318cbd9f18cecf43c54a4ae24
 SHA512:
-  metadata.gz: 2f6d9c0f1ea2c05bab8acea5563a4a74c016ab9b8bd77639afe9468a8f7b8cb18d238585b5bdc11b255bf8e8d0af01d7d470c07ab9b83792d8001156bb73a199
-  data.tar.gz: '09c83e67c0b94adf7ad3f848f17521b57e282ef33db9d4ac0b5991d0ea8135024fc9eb5e78a1515a7f9f4c826f8db3347e25b24ed842ed85681a0b3dd8289e94'
+  metadata.gz: e5c993116408e7948b8d4622ad7d76e1a9a4a9fde594072883d0dd1d8e8275531a5f4d2be045fb599b61f26577d72bee2e1111a226fccb39f73058d826f66e1f
+  data.tar.gz: 3fb63ce5867dc87ee0ee729cb97d67c88069517f31b046d46ca9db30e27138d617af03499392543360bab156018b2ef67550d3b49c7f041468611acf50ad0097

data/helpers/requirements.txt

@@ -7,7 +7,7 @@ plette==2.2.1
 poetry==2.4.1
 # TODO: Replace 3p package `tomli` with 3.11's new stdlib `tomllib` once we drop support for Python 3.10.
 tomli==2.4.1
-uv==0.12.5
+uv==0.12.7
 
 # Some dependencies will only install if Cython is present
 Cython==3.3.0

data/lib/dependabot/uv/file_updater/compile_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/authed_url_builder"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class CompileFileUpdater
         extend T::Sig
 
@@ -434,12 +434,17 @@ module Dependabot
             args << index_url if index_url
 
             begin
+              helper_result = SharedHelpers.run_helper_subprocess(
+                command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
+                function: "get_dependency_hash",
+                args: args
+              )
+
+              # Skip this index if helper returned nil (can happen with unavailable registries)
+              next if helper_result.nil?
+
               native_helper_hashes = T.cast(
-                SharedHelpers.run_helper_subprocess(
-                  command: "pyenv exec python3 #{NativeHelpers.python_helper_path}",
-                  function: "get_dependency_hash",
-                  args: args
-                ),
+                helper_result,
                 T::Array[T::Hash[String, String]]
               ).map { |h| "--hash=#{algorithm}:#{h['hash']}" }
 
@@ -451,6 +456,8 @@ module Dependabot
             end
           end
 
+          raise DependencyFileNotResolvable, "Unable to find hashes for package #{name}" if hashes.empty?
+
           hashes
         end
 
@@ -665,7 +672,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/lock_file_updater.rb

@@ -18,7 +18,7 @@ require "dependabot/uv/requirement_suffix_helper"
 module Dependabot
   module Uv
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class LockFileUpdater
         extend T::Sig
 
@@ -798,7 +798,6 @@ module Dependabot
           )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/uv/file_updater/version_config_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "toml-rb"
@@ -13,6 +13,8 @@ module Dependabot
       class VersionConfigParser
         extend T::Sig
 
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
         class VersionConfig < T::Struct
           extend T::Sig
 
@@ -32,7 +34,7 @@ module Dependabot
           @pyproject_content = pyproject_content
           @base_path = base_path
           @repo_root = repo_root
-          @parsed_pyproject = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @parsed_pyproject = T.let(nil, T.nilable(ObjectHash))
         end
 
         sig { returns(VersionConfig) }
@@ -56,15 +58,46 @@ module Dependabot
         sig { returns(String) }
         attr_reader :repo_root
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(ObjectHash) }
         def parsed_pyproject
           return @parsed_pyproject unless @parsed_pyproject.nil?
 
-          @parsed_pyproject = TomlRB.parse(pyproject_content)
+          @parsed_pyproject = object_hash(T.cast(TomlRB.parse(pyproject_content), Object))
         rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
           @parsed_pyproject = {}
         end
 
+        sig { params(value: Object).returns(ObjectHash) }
+        def object_hash(value)
+          raise TypeError, "Version configuration must be a table" unless value.is_a?(Hash)
+
+          result = T.let({}, ObjectHash)
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "Version configuration keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(path: T::Array[String]).returns(Object) }
+        def config_value(path)
+          value = T.let(parsed_pyproject, Object)
+          path.each do |key|
+            return nil if value.nil?
+
+            value = object_hash(value)[key]
+          end
+          value
+        end
+
+        sig { params(path: T::Array[String]).returns(T.nilable(ObjectHash)) }
+        def config_table(path)
+          value = config_value(path)
+          object_hash(value) if value.is_a?(Hash)
+        end
+
         sig { returns(T::Array[String]) }
         def collect_write_paths
           paths = []
@@ -82,8 +115,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def setuptools_scm_write_paths
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          return [] unless scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          return [] unless scm_config
 
           paths = []
 
@@ -98,8 +131,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_vcs_build_hook_write_paths
-          vcs_hook = parsed_pyproject.dig("tool", "hatch", "build", "hooks", "vcs")
-          return [] unless vcs_hook.is_a?(Hash)
+          vcs_hook = config_table(%w(tool hatch build hooks vcs))
+          return [] unless vcs_hook
 
           paths = []
 
@@ -111,8 +144,8 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def hatch_version_source_paths
-          hatch_version = parsed_pyproject.dig("tool", "hatch", "version")
-          return [] unless hatch_version.is_a?(Hash)
+          hatch_version = config_table(%w(tool hatch version))
+          return [] unless hatch_version
 
           paths = []
 
@@ -124,14 +157,14 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_fallback_version
-          scm_config = parsed_pyproject.dig("tool", "setuptools_scm")
-          if scm_config.is_a?(Hash)
+          scm_config = config_table(%w(tool setuptools_scm))
+          if scm_config
             fallback = scm_config["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
 
-          raw_options = parsed_pyproject.dig("tool", "hatch", "version", "raw-options")
-          if raw_options.is_a?(Hash)
+          raw_options = config_table(%w(tool hatch version raw-options))
+          if raw_options
             fallback = raw_options["fallback_version"]
             return fallback if fallback.is_a?(String)
           end
@@ -141,7 +174,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_package_name
-          name = parsed_pyproject.dig("project", "name")
+          name = config_value(%w(project name))
           return name if name.is_a?(String)
 
           nil

data/lib/dependabot/uv/update_checker/pip_compile_version_resolver.rb

@@ -24,7 +24,7 @@ module Dependabot
       # This class does version resolution for pip-compile. Its approach is:
       # - Unlock the dependency we're checking in the requirements.in file
       # - Run `pip-compile` and see what the result is
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class PipCompileVersionResolver
         extend T::Sig
 
@@ -595,7 +595,6 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
 
     class PipCompileErrorHandler

data/lib/dependabot/uv/update_checker.rb

@@ -228,11 +228,11 @@ module Dependabot
         requirement_files.any? { |f| f.end_with?("requirements.txt") }
       end
 
-      sig { override.returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { override.returns(T.nilable(PyprojectDocument::ProjectMetadata)) }
       def library_details
         @library_details ||= T.let(
-          standard_details || build_system_details,
-          T.nilable(T::Hash[String, T.untyped])
+          pyproject_document.project_metadata || pyproject_document.build_system_metadata,
+          T.nilable(PyprojectDocument::ProjectMetadata)
         )
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-uv
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -192,19 +192,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -301,7 +301,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib