diff --git a/pyproject.toml b/pyproject.toml index eac1682a..b1d7fd51 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -29,7 +29,7 @@ classifiers = [ dependencies = [ "CacheControl[filecache] >= 0.13.0", "cyclonedx-python-lib >= 5,< 12", - "packaging>=23.0.0", # https://github.com/pypa/pip-audit/issues/464 + "packaging>=23.0.0", "pip-api>=0.0.28", "pip-requirements-parser>=32.0.0", "requests >= 2.31.0", @@ -44,7 +44,11 @@ requires-python = ">=3.10" cov = [ "coverage[toml] ~= 7.0, != 7.3.3", # https://github.com/nedbat/coveragepy/issues/1713 ] -test = ["pretend", "pytest", "pip-audit[cov]"] +test = [ + "pretend", + "pytest", + "pip-audit[cov]" +] lint = [ "ruff >= 0.14", "interrogate ~= 1.6", diff --git a/test/dependency_source/test_requirement.py b/test/dependency_source/test_requirement.py index b8873f83..eb978d17 100644 --- a/test/dependency_source/test_requirement.py +++ b/test/dependency_source/test_requirement.py @@ -889,3 +889,21 @@ def test_requirement_source_disable_pip_editable_without_egg_fragment(req_file): ) in specs ) + + +def test_requirement_source_non_normalized_version(req_file): + """ + This test verifies the fix for issue https://github.com/pypa/pip-audit/issues/464, + where non-normalized version strings in requirements files could cause parsing errors. + With packaging>=23.0.0, these versions should be parsed and normalized correctly. + """ + source = _init_requirement( + [(req_file(), "setuptools==80.9.1.0")], disable_pip=True, no_deps=True + ) + + specs = list(source.collect()) + assert len(specs) == 1 + assert isinstance(specs[0], ResolvedDependency) + assert specs[0].name == "setuptools" + # Both versions should be considered equal + assert specs[0].version == Version("80.9.1") == Version("80.9.1.0")