pre-commit-localupdate 0.5.2__tar.gz → 0.6.0__tar.gz

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pre-commit-localupdate
-Version: 0.5.2
+Version: 0.6.0
 Summary: A CLI tool to automatically update additional dependencies within local hooks in pre-commit config files.
 Author: M. Farzalipour Tabriz
 Classifier: Development Status :: 3 - Alpha
@@ -16,7 +16,7 @@ Description-Content-Type: text/markdown
 
 # pre-commit-localupdate
 
-A CLI tool to automatically update dependencies in `pre-commit-config.yml` files. It specifically targets `additional_dependencies` within local hooks to ensure your tooling stays up-to-date. It also adds version to unversioned packages and pins exact version of loosely defined ones. You can also pin a specific package to an older version by adding a `# freeze` comment.
+A CLI tool to automatically update dependencies in `pre-commit-config.yml` files. It specifically targets `additional_dependencies` within local hooks to ensure your tooling stays up-to-date. It also adds version to unversioned packages and pins exact version of loosely defined ones to the absolute latest. You can also pin a specific package to an older version by adding a `# freeze` comment.
 
 ## Installation
 
@@ -36,8 +36,9 @@ All options:
 
 ```text
 usage: pre-commit-localupdate [-h] [--debug] [--dry-run] [-c PRE-COMMIT-CONFIG] [--timeout TIMEOUT]
-                              [--indent-mapping INDENT_MAPPING] [--indent-sequence INDENT_SEQUENCE]
-                              [--indent-offset INDENT_OFFSET] [--line-width LINE_WIDTH] [--version]
+                              [--request-delay REQUEST_DELAY] [--indent-mapping INDENT_MAPPING]
+                              [--indent-sequence INDENT_SEQUENCE] [--indent-offset INDENT_OFFSET]
+                              [--line-width LINE_WIDTH] [--version]
 
 Automatically update additional dependencies within local hooks in a pre-commit config file.
 
@@ -48,6 +49,7 @@ options:
                                      configuration file require an update. (default: False)
   -c, --config PRE-COMMIT-CONFIG     pre-commit config file path (default: .pre-commit-config.yaml)
   --timeout TIMEOUT                  connection timeout in seconds (default: 10)
+  --request-delay REQUEST_DELAY      minimum deplay between network requests in seconds (default: 1.0)
   --indent-mapping INDENT_MAPPING    YAML indentation for mappings (default: 2)
   --indent-sequence INDENT_SEQUENCE  YAML indentation for sequences (default: 4)
   --indent-offset INDENT_OFFSET      YAML indentation offset (default: 2)

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/README.md

@@ -1,6 +1,6 @@
 # pre-commit-localupdate
 
-A CLI tool to automatically update dependencies in `pre-commit-config.yml` files. It specifically targets `additional_dependencies` within local hooks to ensure your tooling stays up-to-date. It also adds version to unversioned packages and pins exact version of loosely defined ones. You can also pin a specific package to an older version by adding a `# freeze` comment.
+A CLI tool to automatically update dependencies in `pre-commit-config.yml` files. It specifically targets `additional_dependencies` within local hooks to ensure your tooling stays up-to-date. It also adds version to unversioned packages and pins exact version of loosely defined ones to the absolute latest. You can also pin a specific package to an older version by adding a `# freeze` comment.
 
 ## Installation
 
@@ -20,8 +20,9 @@ All options:
 
 ```text
 usage: pre-commit-localupdate [-h] [--debug] [--dry-run] [-c PRE-COMMIT-CONFIG] [--timeout TIMEOUT]
-                              [--indent-mapping INDENT_MAPPING] [--indent-sequence INDENT_SEQUENCE]
-                              [--indent-offset INDENT_OFFSET] [--line-width LINE_WIDTH] [--version]
+                              [--request-delay REQUEST_DELAY] [--indent-mapping INDENT_MAPPING]
+                              [--indent-sequence INDENT_SEQUENCE] [--indent-offset INDENT_OFFSET]
+                              [--line-width LINE_WIDTH] [--version]
 
 Automatically update additional dependencies within local hooks in a pre-commit config file.
 
@@ -32,6 +33,7 @@ options:
                                      configuration file require an update. (default: False)
   -c, --config PRE-COMMIT-CONFIG     pre-commit config file path (default: .pre-commit-config.yaml)
   --timeout TIMEOUT                  connection timeout in seconds (default: 10)
+  --request-delay REQUEST_DELAY      minimum deplay between network requests in seconds (default: 1.0)
   --indent-mapping INDENT_MAPPING    YAML indentation for mappings (default: 2)
   --indent-sequence INDENT_SEQUENCE  YAML indentation for sequences (default: 4)
   --indent-offset INDENT_OFFSET      YAML indentation offset (default: 2)

pre_commit_localupdate-0.6.0/pre_commit_localupdate/__init__.py

@@ -0,0 +1 @@
+__version__ = '0.6.0'

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/__main__.py

@@ -31,7 +31,11 @@ def main() -> None:
     )
     try:
         if update_additional_dependencies(
-            args.config, args.timeout, yaml_format, dry_run=args.dry_run
+            args.config,
+            args.timeout,
+            args.request_delay,
+            yaml_format,
+            dry_run=args.dry_run,
         ):
             if args.dry_run:
                 logging.info("Additional dependencies require updating!")

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/cli.py

@@ -7,6 +7,28 @@ from pathlib import Path
 from pre_commit_localupdate import __version__
 
 
+def positive_int(value: str) -> int:
+    """Convert a string argument to a positive integer.
+
+    Args:
+        value(str): input value
+    Returns:
+        int: positive integer equivalent
+    Raises:
+        argparse.ArgumentTypeError: if ``value`` cannot be converted to an integer
+            or is not a positive integer
+    """
+    try:
+        int_value = int(value)
+    except ValueError as err:
+        msg = f"'{value}' cannot be converted to integer"
+        raise argparse.ArgumentTypeError(msg) from err
+    if int_value <= 0:
+        msg = f"'{value}' is not a positive integer"
+        raise argparse.ArgumentTypeError(msg)
+    return int_value
+
+
 def parse_args() -> argparse.Namespace:
     """Parse command line arguments.
 
@@ -39,10 +61,16 @@ def parse_args() -> argparse.Namespace:
     )
     parser.add_argument(
         "--timeout",
-        type=int,
+        type=positive_int,
         help="connection timeout in seconds",
         default=10,
     )
+    parser.add_argument(
+        "--request-delay",
+        type=float,
+        help="minimum deplay between network requests in seconds",
+        default=1.0,
+    )
     parser.add_argument(
         "--indent-mapping",
         type=int,

pre_commit_localupdate-0.6.0/pre_commit_localupdate/logs.py

@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2026 M. Farzalipour Tabriz, Max Planck Institute for Physics
+# SPDX-License-Identifier: LGPL-3.0-or-later
+
+import logging
+
+
+class SafeFormatter(logging.Formatter):
+    """Custom formatter that escapes newlines and carriage returns to prevent log injection."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        """Sanitize logs and encode non-printable characters.
+
+        Args:
+            record (logging.LogRecord): log record to sanitize
+        Returns:
+            str: sanitized log message
+        """
+        processed_record = super().format(record)
+        if processed_record.isprintable():
+            return processed_record
+
+        max_8bit_uint: int = 0xFF
+        max_16bit_uint: int = 0xFFFF
+        sanitized_record_parts = []
+        for character in processed_record:
+            if character.isprintable():
+                sanitized_record_parts.append(character)
+            else:
+                character_code = ord(character)
+                if character_code <= max_8bit_uint:
+                    sanitized_record_parts.append(f"\\x{character_code:02x}")
+                elif character_code <= max_16bit_uint:
+                    sanitized_record_parts.append(f"\\u{character_code:04x}")
+                else:
+                    sanitized_record_parts.append(f"\\U{character_code:08x}")
+
+        return "".join(sanitized_record_parts)
+
+
+def setup_logging(*, debug: bool = False) -> None:
+    """Configure logging based on the debug flag.
+
+    Args:
+        debug (bool): activate debug logs
+    """
+    logger = logging.getLogger()
+    for handler in logger.handlers:
+        if not isinstance(handler, logging.NullHandler):
+            logger.warning("Logger has already been initialized!")
+            return
+
+    ch = logging.StreamHandler()
+    if debug:
+        log_format = "%(asctime)s - %(levelname)s - %(message)s"
+        logger.setLevel(logging.DEBUG)
+        ch.setLevel(logging.DEBUG)
+    else:
+        log_format = "%(levelname)s - %(message)s"
+        logger.setLevel(logging.INFO)
+        ch.setLevel(logging.INFO)
+
+    formatter = SafeFormatter(log_format)
+    ch.setFormatter(formatter)
+    logger.addHandler(ch)

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/packages/golang.py

@@ -8,6 +8,8 @@ import re
 
 import requests
 
+from urllib.parse import quote as url_quote
+
 from .package import PackageBase, QUERY_AGENT_STRING
 
 # Go Proxy API endpoints
@@ -71,6 +73,21 @@ class GoPackage(PackageBase):
 
         return package_path
 
+    @staticmethod
+    def _escape_module_path(package_path: str) -> str:
+        """Escape a module path per the Go module proxy protocol.
+
+        Args:
+            package_path (str): The module path.
+
+        Returns:
+            str: The URL escaped and encoded module path.
+        """
+        escaped = re.sub(
+            r"[A-Z]", lambda cap_char: "!" + cap_char.group(0).lower(), package_path
+        )
+        return url_quote(escaped, safe="/")
+
     def fetch_latest_version(self, connection_timeout: int) -> None:
         """Fetch the latest version of a Go module from proxy.golang.org.
 
@@ -80,17 +97,24 @@ class GoPackage(PackageBase):
         package_path = self._resolve_module_path(self.name)
         logging.debug("Fetching latest version for %s", package_path)
         try:
-            url = GO_PKG_LATEST_VERSION_API_URL.format(package_path=package_path)
+            safe_package_path = self._escape_module_path(package_path)
+            url = GO_PKG_LATEST_VERSION_API_URL.format(package_path=safe_package_path)
             headers = {"User-Agent": QUERY_AGENT_STRING}
             response = requests.get(url, headers=headers, timeout=connection_timeout)
             response.raise_for_status()
 
-            data = response.json()
-            latest_version = data.get("Version")
-
-            if isinstance(latest_version, str):
-                self.latest_version = latest_version
-
+            if response.headers.get("Content-Type", "").startswith("application/json"):
+                data = response.json()
+                latest_version = data.get("Version")
+
+                if isinstance(latest_version, str):
+                    self.latest_version = latest_version
+            else:
+                logging.warning(
+                    "Unexpected content type for %s: %s",
+                    package_path,
+                    response.headers.get("Content-Type", "<missing>"),
+                )
         except requests.exceptions.RequestException as exc:
             logging.warning(
                 "Could not fetch latest version for %s: %s", package_path, exc

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/packages/julia.py

@@ -75,6 +75,8 @@ class JuliaPackage(PackageBase):
     def fetch_latest_version(self, connection_timeout: int) -> None:
         """Fetch the latest version of a package from the Julia General Registry.
 
+        Ignores pre-release versions.
+
         Args:
             connection_timeout (int): Connection timeout in seconds.
         """
@@ -89,7 +91,8 @@ class JuliaPackage(PackageBase):
 
             data = tomllib.loads(response.text)
 
-            versions = list(data.keys())
+            versions = [ver for ver in data.keys() if "-" not in ver.split("+", 1)[0]]
+
             if versions:
                 versions.sort(key=lambda v: Version(v), reverse=True)
                 self.latest_version = versions[0]

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/packages/node.py

@@ -64,12 +64,18 @@ class NodePackage(PackageBase):
             headers = {"User-Agent": QUERY_AGENT_STRING}
             response = requests.get(url, headers=headers, timeout=connection_timeout)
             response.raise_for_status()
-            data = response.json()
-
-            latest_version = data.get("dist-tags", {}).get("latest")
-            if isinstance(latest_version, str):
-                self.latest_version = latest_version
 
+            if response.headers.get("Content-Type", "").startswith("application/json"):
+                data = response.json()
+                latest_version = data.get("dist-tags", {}).get("latest")
+                if isinstance(latest_version, str):
+                    self.latest_version = latest_version
+            else:
+                logging.warning(
+                    "Unexpected content type for %s: %s",
+                    self.name,
+                    response.headers.get("Content-Type", "<missing>"),
+                )
         except requests.exceptions.RequestException as exc:
             logging.warning("Could not fetch latest version for %s: %s", self.name, exc)
         except (KeyError, ValueError) as exc:

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/packages/python.py

@@ -59,11 +59,18 @@ class PyPackage(PackageBase):
             headers = {"User-Agent": QUERY_AGENT_STRING}
             response = requests.get(url, headers=headers, timeout=connection_timeout)
             response.raise_for_status()
-            data = response.json()
-            latest_version = data.get("info", {}).get("version")
-            if isinstance(latest_version, str):
-                self.latest_version = latest_version
 
+            if response.headers.get("Content-Type", "").startswith("application/json"):
+                data = response.json()
+                latest_version = data.get("info", {}).get("version")
+                if isinstance(latest_version, str):
+                    self.latest_version = latest_version
+            else:
+                logging.warning(
+                    "Unexpected content type for %s: %s",
+                    self.name,
+                    response.headers.get("Content-Type", "<missing>"),
+                )
         except requests.exceptions.RequestException as exc:
             logging.warning("Could not fetch latest version for %s: %s", self.name, exc)
         except (KeyError, ValueError) as exc:

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/packages/rust.py

@@ -67,11 +67,18 @@ class RustPackage(PackageBase):
             headers = {"User-Agent": QUERY_AGENT_STRING}
             response = requests.get(url, headers=headers, timeout=connection_timeout)
             response.raise_for_status()
-            data = response.json()
-            latest_version = data.get("crate", {}).get("max_version")
-            if isinstance(latest_version, str):
-                self.latest_version = latest_version
 
+            if response.headers.get("Content-Type", "").startswith("application/json"):
+                data = response.json()
+                latest_version = data.get("crate", {}).get("max_version")
+                if isinstance(latest_version, str):
+                    self.latest_version = latest_version
+            else:
+                logging.warning(
+                    "Unexpected content type for %s: %s",
+                    self.name,
+                    response.headers.get("Content-Type", "<missing>"),
+                )
         except requests.exceptions.RequestException as exc:
             logging.warning("Could not fetch latest version for %s: %s", self.name, exc)
         except (KeyError, ValueError) as exc:

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pre_commit_localupdate/pre_commit_config.py

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: LGPL-3.0-or-later
 
 import logging
+import time
 import re
 from pathlib import Path
 
@@ -13,10 +14,13 @@ from pre_commit_localupdate.error import PreCommitLocalUpdateError
 from pre_commit_localupdate.io import YAMLFormat, load_config_file, save_config_file
 from pre_commit_localupdate.packages import SUPPORTED_PACKAGES
 
+FREEZE_PATTERN = re.compile(r"^#\s*freeze(\s|$)")
+
 
 def update_additional_dependencies(
     file_path: Path,
     connection_timeout: int,
+    request_delay: float,
     yaml_format: YAMLFormat,
     *,
     dry_run: bool = False,
@@ -30,6 +34,7 @@ def update_additional_dependencies(
     Args:
         file_path (Path): Path to the pre-commit configuration file.
         connection_timeout (int): Connection timeout in seconds.
+        request_delay (float): Minimum delay between network requests in seconds.
         yaml_format (YAMLFormat): YAML file formatting parameters
         dry_run (bool): Do not update the pre-commit configuration file.
 
@@ -66,7 +71,9 @@ def update_additional_dependencies(
         )
 
     update_required = False
-    FREEZE_PATTERN = re.compile(r"^#\s*freeze(\s|$)")
+    latest_request_time: float = 0.0
+    # (package type, package name) -> latest version specification
+    queried_packages: dict[tuple[str, str], str | None] = {}
 
     if "repos" in config:
         logging.debug("Scanning repositories for local hooks")
@@ -90,7 +97,6 @@ def update_additional_dependencies(
                 package_type = SUPPORTED_PACKAGES[hook.get("language")]
 
                 for i, dep_str in enumerate(deps_list):
-
                     comment = None
                     if isinstance(deps_list, CommentedSeq):
                         comment = deps_list.ca.items.get(i, [None, None])[0]
@@ -101,7 +107,7 @@ def update_additional_dependencies(
                             logging.debug("Skipping frozen dependency: %s", dep_str)
                             continue
 
-                    logging.debug("Checking dependency: %s", dep_str)
+                    logging.debug("Processing dependency: %s", dep_str)
                     clean_dep_str = dep_str.strip().strip('"').strip("'")
                     package = package_type.from_specification(clean_dep_str)
                     if not package:
@@ -110,22 +116,32 @@ def update_additional_dependencies(
                         )
                         continue
 
-                    package.fetch_latest_version(connection_timeout)
-                    if not package.latest_version_specification():
+                    cache_key = (package_type.__name__, package.name)
+                    if cache_key in queried_packages:
+                        logging.debug(
+                            "Using cached latest version for package: %s",
+                            package.name,
+                        )
+                        latest_spec = queried_packages[cache_key]
+                    else:
+                        elapsed = time.monotonic() - latest_request_time
+                        if elapsed < request_delay:
+                            time.sleep(request_delay - elapsed)
+                        latest_request_time = time.monotonic()
+                        package.fetch_latest_version(connection_timeout)
+                        latest_spec = package.latest_version_specification()
+                        queried_packages[cache_key] = latest_spec
+
+                    if latest_spec is None:
                         continue
 
-                    if (
-                        package.latest_version_specification()
-                        != package.original_version_specification()
-                    ):
+                    if latest_spec != package.original_version_specification():
                         logging.debug(
                             "%s needs updating to %s",
                             package.original_version_specification(),
-                            package.latest_version_specification(),
+                            latest_spec,
                         )
-                        hook["additional_dependencies"][
-                            i
-                        ] = package.latest_version_specification()
+                        hook["additional_dependencies"][i] = latest_spec
 
                         update_required = True
                     else:

{pre_commit_localupdate-0.5.2 → pre_commit_localupdate-0.6.0}/pyproject.toml

@@ -29,7 +29,7 @@ dynamic = []
 name = "pre-commit-localupdate"
 readme = "README.md"
 requires-python = "<3.15,>=3.11"
-version = "0.5.2"
+version = "0.6.0"
 
 [project.scripts]
 pre-commit-localupdate = "pre_commit_localupdate.__main__:main"

pre_commit_localupdate-0.5.2/pre_commit_localupdate/__init__.py

@@ -1 +0,0 @@
-__version__ = '0.5.2'

pre_commit_localupdate-0.5.2/pre_commit_localupdate/logs.py

@@ -1,19 +0,0 @@
-# SPDX-FileCopyrightText: 2026 M. Farzalipour Tabriz, Max Planck Institute for Physics
-# SPDX-License-Identifier: LGPL-3.0-or-later
-
-import logging
-import sys
-
-
-def setup_logging(*, debug: bool = False) -> None:
-    """Configure logging based on the debug flag.
-
-    Args:
-        debug (bool): activate debug logs
-    """
-    level = logging.DEBUG if debug else logging.INFO
-    logging.basicConfig(
-        level=level,
-        format="%(asctime)s - %(levelname)s - %(message)s",
-        stream=sys.stdout,
-    )