Python poetry undefined method `strip' for nil:NilClass

[HariSekhon]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

python poetry

Manifest location and content before the Dependabot update

/pyproject.toml

dependabot.yml content

version: 2
updates:
  - package-ecosystem: pip
    directory: "/"
    schedule:
      interval: daily
      time: "11:30"
    groups:
      python-packages:
        patterns:
          - "*"

What you expected to see, versus what you actually saw

Expected to see a useful error message.

Got this raw unhandled code error instead:

updater | 2023/08/21 23:48:50 ERROR <job_712118307> undefined method `strip' for nil:NilClass
updater | 
updater |           url = url.strip.gsub(%r{/*$}, "") + "/"
updater |                    ^^^^^^

[HariSekhon]

Reading the code is appears to be caused by this line:

https://github.com/dependabot/dependabot-core/blob/fe7e6aa337d98282afcb6993e01672e8f6fc0faf/python/lib/dependabot/python/update_checker/index_finder.rb#L152C1-L153C50

    def clean_check_and_remove_environment_variables(url)
      url = url.strip.gsub(%r{/*$}, "") + "/"

called here:

https://github.com/dependabot/dependabot-core/blob/fe7e6aa337d98282afcb6993e01672e8f6fc0faf/python/lib/dependabot/python/update_checker/index_finder.rb#L54C60-L54C60

and here:

dependabot-core/python/lib/dependabot/python/update_checker/index_finder.rb

Line 28 in fe7e6aa

clean_check_and_remove_environment_variables(url)

which seems to imply that this is a problem of URL being passed in, ie. a possible configuration problem.

I wonder if this is caused by a private JFrog Artifactory Cloud url in the pyproject.toml and requires private registry configuration:

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#configuring-private-registries

I think this code needs to be written more defensively to surface better root cause analysis error messages.

[deivid-rodriguez]

Duplicate of #7431 and #7724. We will be fixing this shortly.

[HariSekhon]

Ah, thanks for the reply, I didn't realize this was possibly also due to the official default PyPI url not being supplied in the config explicitly.