fix(project-detect): parse Python deps pinned with ~ and @ (was losing framework detection on compatible-release pins) (#2498)

* fix(project-detect): parse Python deps pinned with ~= and @ direct references

* test(project-detect): cover ~= compatible-release and @ direct-reference parsing

* test(project-detect): cover direct references

* fix(project-detect): skip bare VCS/URL requirement lines in getPythonDeps

A requirements.txt line like git+https://host/repo.git#egg=pkg carries
no leading package name, so the delimiter split recorded the whole URL
fragment as a dependency. Skip names that start with git+ or contain a
URL scheme, and tighten the test assertions so any leaked URL, scheme,
or @ delimiter fails loudly.
This commit is contained in:
黄云龙 2026-07-18 05:11:09 +08:00 committed by GitHub
parent 5d68ef3617
commit 5da21c2b66
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 58 additions and 3 deletions

View file

@ -198,10 +198,13 @@ function getPythonDeps(projectDir) {
const trimmed = line.trim();
if (trimmed && !trimmed.startsWith('#') && !trimmed.startsWith('-')) {
const name = trimmed
.split(/[>=<![;]/)[0]
.split(/[\s>=<!~@[;]/)[0]
.trim()
.toLowerCase();
if (name) deps.push(name);
// Bare VCS/URL requirement lines (e.g. `git+https://...#egg=pkg`)
// carry no leading package name; skip them instead of recording
// the URL fragment as a dependency name.
if (name && !name.startsWith('git+') && !name.includes('://')) deps.push(name);
}
});
}
@ -220,7 +223,7 @@ function getPythonDeps(projectDir) {
block.match(/"([^"]+)"/g)?.forEach(m => {
const name = m
.replace(/"/g, '')
.split(/[>=<![;]/)[0]
.split(/[\s>=<!~@[;]/)[0]
.trim()
.toLowerCase();
if (name) deps.push(name);