Skip to content

Commit 7a25e2c

Browse files
Fix crash when updating libraries with multiple manifests
If a library has both a pyproject.toml file and a standard requirements.txt file, we'd end up using the `:widen` strategy for the dependencies in the `requirements.txt` file and eventually crashing with an error like the following: ``` /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:266:in `block in preferred_version_resolvable_with_unlock?': undefined method `[]' for nil:NilClass (NoMethodError) updated_requirements.none? { |r| r[:requirement] == :unfixable } ^^^^^^^^^^^^^^ from /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:266:in `none?' from /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:266:in `preferred_version_resolvable_with_unlock?' from /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:249:in `numeric_version_can_update?' from /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:199:in `version_can_update?' from /home/dependabot/dependabot-core/common/lib/dependabot/update_checkers/base.rb:44:in `can_update?' from bin/dry-run.rb:709:in `block in <main>' from bin/dry-run.rb:661:in `each' from bin/dry-run.rb:661:in `<main>' ``` I think the crash happens because the requirements.txt file updater does not supoort the `:widen` strategy. So my fix is to fallback to `increase` in this case, since requirements.txt files usually include pinned dependencies so widening probably doesn't make much sense there.
1 parent 458d3ff commit 7a25e2c

File tree

2 files changed

+47
-33
lines changed

2 files changed

+47
-33
lines changed

python/lib/dependabot/python/update_checker.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ def latest_version_finder
259259
end
260260

261261
def poetry_library?
262-
return false unless pyproject
262+
return false unless updating_pyproject?
263263

264264
# Hit PyPi and check whether there are details for a library with a
265265
# matching name and description

python/spec/dependabot/python/update_checker_spec.rb

+46-32
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@
5757
)
5858
end
5959
let(:requirements_fixture_name) { "version_specified.txt" }
60-
let(:dependency) do
60+
let(:requirements_dependency) do
6161
Dependabot::Dependency.new(
6262
name: dependency_name,
6363
version: dependency_version,
@@ -76,6 +76,8 @@
7676
}]
7777
end
7878

79+
let(:dependency) { requirements_dependency }
80+
7981
describe "#can_update?" do
8082
subject { checker.can_update?(requirements_to_unlock: :own) }
8183

@@ -507,44 +509,56 @@
507509
let(:dependency_files) { [requirements_file, pyproject] }
508510
let(:pyproject_fixture_name) { "caret_version.toml" }
509511

510-
let(:dependency) do
511-
Dependabot::Dependency.new(
512-
name: "requests",
513-
version: "1.2.3",
514-
requirements: [{
515-
file: "pyproject.toml",
516-
requirement: "^1.0.0",
517-
groups: [],
518-
source: nil
519-
}],
520-
package_manager: "pip"
521-
)
522-
end
512+
context "and updating a dependency inside" do
513+
let(:dependency) do
514+
Dependabot::Dependency.new(
515+
name: "requests",
516+
version: "1.2.3",
517+
requirements: [{
518+
file: "pyproject.toml",
519+
requirement: "^1.0.0",
520+
groups: [],
521+
source: nil
522+
}],
523+
package_manager: "pip"
524+
)
525+
end
523526

524-
let(:pypi_url) { "https://pypi.org/simple/requests/" }
525-
let(:pypi_response) do
526-
fixture("pypi", "pypi_simple_response_requests.html")
527-
end
527+
let(:pypi_url) { "https://pypi.org/simple/requests/" }
528+
let(:pypi_response) do
529+
fixture("pypi", "pypi_simple_response_requests.html")
530+
end
528531

529-
context "for a library" do
530-
before do
531-
stub_request(:get, "https://pypi.org/pypi/pendulum/json/").
532-
to_return(
533-
status: 200,
534-
body: fixture("pypi", "pypi_response_pendulum.json")
535-
)
532+
context "for a library" do
533+
before do
534+
stub_request(:get, "https://pypi.org/pypi/pendulum/json/").
535+
to_return(
536+
status: 200,
537+
body: fixture("pypi", "pypi_response_pendulum.json")
538+
)
539+
end
540+
541+
its([:requirement]) { is_expected.to eq(">=1,<3") }
536542
end
537543

538-
its([:requirement]) { is_expected.to eq(">=1,<3") }
539-
end
544+
context "for a non-library" do
545+
before do
546+
stub_request(:get, "https://pypi.org/pypi/pendulum/json/").
547+
to_return(status: 404)
548+
end
540549

541-
context "for a non-library" do
542-
before do
543-
stub_request(:get, "https://pypi.org/pypi/pendulum/json/").
544-
to_return(status: 404)
550+
its([:requirement]) { is_expected.to eq("^2.19.1") }
545551
end
552+
end
553+
554+
context "and updating a dependency in an additional requirements file" do
555+
let(:dependency_files) { super().append(requirements_file) }
546556

547-
its([:requirement]) { is_expected.to eq("^2.19.1") }
557+
let(:dependency) { requirements_dependency }
558+
559+
it "does not get affected by whether it's a library or not and updates using the :increase strategy" do
560+
expect(subject[:requirement]).to eq("==2.6.0")
561+
end
548562
end
549563
end
550564

0 commit comments

Comments
 (0)