From fbdad5a358a1f42c55077d12e05732e41c4003fb Mon Sep 17 00:00:00 2001 From: Jeroen Bobbeldijk Date: Mon, 17 Oct 2022 16:39:41 +0200 Subject: [PATCH] Only run pip-compile a second time when handling non-top-level dependencies Also, update the comment about why we do this. --- .../file_updater/pip_compile_file_updater.rb | 6 ------ .../update_checker/pip_compile_version_resolver.rb | 14 +++++++++++--- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/python/lib/dependabot/python/file_updater/pip_compile_file_updater.rb b/python/lib/dependabot/python/file_updater/pip_compile_file_updater.rb index 267b695bf87..85d6732ba46 100644 --- a/python/lib/dependabot/python/file_updater/pip_compile_file_updater.rb +++ b/python/lib/dependabot/python/file_updater/pip_compile_file_updater.rb @@ -81,12 +81,6 @@ def compile_new_requirement_files "#{SharedHelpers.escape_command(version_part)}", allow_unsafe_shell_command: true ) - # Run pip-compile a second time, without an update argument, to - # ensure it resets the right comments. - run_pip_compile_command( - "pyenv exec pip-compile #{pip_compile_options(filename)} " \ - "#{filename}" - ) end # Remove any .python-version file before parsing the reqs diff --git a/python/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb b/python/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb index d0b32fdc387..aa6547de6e2 100644 --- a/python/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb +++ b/python/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb @@ -80,9 +80,17 @@ def fetch_latest_resolvable_version_string(requirement:) run_pip_compile_command( "pyenv exec pip-compile -v #{pip_compile_options(filename)} -P #{dependency.name} #{filename}" ) - # Run pip-compile a second time, without an update argument, - # to ensure it handles markers correctly - write_original_manifest_files unless dependency.top_level? + + next if dependency.top_level? + + # Run pip-compile a second time for transient dependencies + # to make sure we do not update dependencies that are + # superfluous. pip-compile does not detect these when + # updating a specific dependency with the -P option. + # Running pip-compile a second time will automatically remove + # superfluous dependencies. Dependabot then marks those with + # update_not_possible. + write_original_manifest_files run_pip_compile_command( "pyenv exec pip-compile #{pip_compile_options(filename)} #{filename}" )