From 37f38e101c2179d58af5abdb777e5eed6643fc18 Mon Sep 17 00:00:00 2001 From: Ali Zulfiqar Date: Sat, 5 Sep 2026 22:21:26 +0500 Subject: [PATCH 1/3] Do not treat wildcard requirements as exact version pins Signed-off-by: Ali Zulfiqar --- src/python_inspector/dependencies.py | 7 ++++++- tests/test_requirement_pins.py | 25 +++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 tests/test_requirement_pins.py diff --git a/src/python_inspector/dependencies.py b/src/python_inspector/dependencies.py index 0c491304..d16d64fb 100644 --- a/src/python_inspector/dependencies.py +++ b/src/python_inspector/dependencies.py @@ -54,7 +54,12 @@ def get_extra_data_from_requirements(requirements_file="requirements.txt") -> It def is_requirement_pinned(requirement: Requirement) -> bool: specifiers = requirement.specifier - return specifiers and len(specifiers) == 1 and next(iter(specifiers)).operator in {"==", "==="} + if len(specifiers) != 1: + return False + specifier = next(iter(specifiers)) + return specifier.operator == "===" or ( + specifier.operator == "==" and not specifier.version.endswith(".*") + ) def get_dependency(specifier) -> DependentPackage: diff --git a/tests/test_requirement_pins.py b/tests/test_requirement_pins.py new file mode 100644 index 00000000..d868644f --- /dev/null +++ b/tests/test_requirement_pins.py @@ -0,0 +1,25 @@ +import pytest + +from packvers.requirements import Requirement +from python_inspector.dependencies import get_dependency +from python_inspector.dependencies import is_requirement_pinned + +@pytest.mark.parametrize( + "text,expected", + [ + ("demo", False), + ("demo==1.2.*", False), + ("demo>=1", False), + ("demo==1.2", True), + ("demo===1.2", True), + ("demo===1.2.*", True), + ], +) +def test_requirement_pins(text, expected): + assert is_requirement_pinned(Requirement(text)) is expected + + +def test_wildcard_dependency_has_no_exact_version(): + dependency = get_dependency("demo==1.2.*") + assert dependency.purl == "pkg:pypi/demo" + assert dependency.is_resolved is False From a351067f2afb4bcb274c27dcc4037ab21469e52e Mon Sep 17 00:00:00 2001 From: Ali Zulfiqar Date: Sat, 5 Sep 2026 22:31:21 +0500 Subject: [PATCH 2/3] Address review feedback and strengthen regression coverage Signed-off-by: Ali Zulfiqar --- tests/test_requirement_pins.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/test_requirement_pins.py b/tests/test_requirement_pins.py index d868644f..bea5059d 100644 --- a/tests/test_requirement_pins.py +++ b/tests/test_requirement_pins.py @@ -1,3 +1,7 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 +# See https://github.com/aboutcode-org/python-inspector for support or download. + import pytest from packvers.requirements import Requirement From e82b092b448494bb797cdd4d03336dd52ac9a5e0 Mon Sep 17 00:00:00 2001 From: Ali Zulfiqar Date: Sat, 5 Sep 2026 22:35:36 +0500 Subject: [PATCH 3/3] Apply repository formatting to regression tests Signed-off-by: Ali Zulfiqar --- tests/test_requirement_pins.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/test_requirement_pins.py b/tests/test_requirement_pins.py index bea5059d..1d76de8e 100644 --- a/tests/test_requirement_pins.py +++ b/tests/test_requirement_pins.py @@ -8,6 +8,7 @@ from python_inspector.dependencies import get_dependency from python_inspector.dependencies import is_requirement_pinned + @pytest.mark.parametrize( "text,expected", [