Handle Python requirements with no version specifier in the requirement file updater

A version specifier is optional per PEP 508 and the pip requirements format
(bare names, URL/VCS/editable/local-path references, unpinned pip-tools inputs,
PEP 621 / [tool.uv.sources]). The requirement file updater assumed every
requirement carried one and crashed with a TypeError when it did not.

Guard the nil at the single shared call site so a no-specifier requirement is
left unchanged instead of forced through the replacer, matching the existing
pip-compile nil-guard. uv reuses this updater, so the fix covers pip and uv.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: v-kbukum1

python/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -107,11 +107,18 @@ def unique_requirement_changes
           ).returns(String)
         end
         def updated_requirement_or_setup_file_content(content, new_req, old_req)
+          # A version specifier is optional in Python packaging (PEP 508, pip
+          # requirements format, PEP 621 / [tool.uv.sources]). When the new
+          # requirement carries none there is nothing to rewrite, so leave the
+          # file untouched rather than forcing nil through the replacer.
+          new_requirement = new_req.requirement_string
+          return content unless new_requirement
+
           RequirementReplacer.new(
             content: content,
             dependency_name: dependency.name,
             old_requirement: old_req&.requirement_string,
-            new_requirement: T.must(new_req.requirement_string),
+            new_requirement: new_requirement,
             new_hash_version: dependency.version,
             index_urls: @index_urls
           ).updated_content

python/spec/dependabot/python/file_updater/requirement_file_updater_spec.rb

@@ -95,6 +95,73 @@
         its(:content) { is_expected.to include "psycopg2==2.8.1  # Comment!\n" }
       end
 
+      context "when the new requirement has no version specifier" do
+        # A version specifier is optional in Python packaging, so the updater
+        # must leave such requirements untouched rather than crashing.
+        subject(:updated_files) { updater.updated_dependency_files }
+
+        context "with a bare package name" do
+          let(:requirements) do
+            Dependabot::DependencyFile.new(
+              content: "psycopg2\n",
+              name: "requirements.txt"
+            )
+          end
+          let(:dependency) do
+            Dependabot::Dependency.new(
+              name: "psycopg2",
+              version: "2.8.1",
+              requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: nil
+              }],
+              previous_requirements: [],
+              package_manager: "pip"
+            )
+          end
+
+          it "does not raise and leaves the file unchanged" do
+            expect { updated_files }.not_to raise_error
+            expect(updated_files).to be_empty
+          end
+        end
+
+        context "with a URL/VCS direct reference" do
+          let(:requirements) do
+            Dependabot::DependencyFile.new(
+              content: "psycopg2 @ git+https://github.com/psycopg/psycopg2.git@2.6.1\n",
+              name: "requirements.txt"
+            )
+          end
+          let(:dependency) do
+            Dependabot::Dependency.new(
+              name: "psycopg2",
+              version: "2.8.1",
+              requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: { type: "git", url: "https://github.com/psycopg/psycopg2.git", ref: "2.8.1" }
+              }],
+              previous_requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: { type: "git", url: "https://github.com/psycopg/psycopg2.git", ref: "2.6.1" }
+              }],
+              package_manager: "pip"
+            )
+          end
+
+          it "does not raise and leaves the file unchanged" do
+            expect { updated_files }.not_to raise_error
+            expect(updated_files).to be_empty
+          end
+        end
+      end
+
       context "with an unknown package" do
         let(:dependency) do
           Dependabot::Dependency.new(

uv/spec/dependabot/uv/file_updater/requirement_file_updater_spec.rb

@@ -95,6 +95,73 @@
         its(:content) { is_expected.to include "psycopg2==2.8.1  # Comment!\n" }
       end
 
+      context "when the new requirement has no version specifier" do
+        # A version specifier is optional in Python packaging, so the shared
+        # updater must leave such requirements untouched rather than crashing.
+        subject(:updated_files) { updater.updated_dependency_files }
+
+        context "with a bare package name" do
+          let(:requirements) do
+            Dependabot::DependencyFile.new(
+              content: "psycopg2\n",
+              name: "requirements.txt"
+            )
+          end
+          let(:dependency) do
+            Dependabot::Dependency.new(
+              name: "psycopg2",
+              version: "2.8.1",
+              requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: nil
+              }],
+              previous_requirements: [],
+              package_manager: "uv"
+            )
+          end
+
+          it "does not raise and leaves the file unchanged" do
+            expect { updated_files }.not_to raise_error
+            expect(updated_files).to be_empty
+          end
+        end
+
+        context "with a URL/VCS direct reference" do
+          let(:requirements) do
+            Dependabot::DependencyFile.new(
+              content: "psycopg2 @ git+https://github.com/psycopg/psycopg2.git@2.6.1\n",
+              name: "requirements.txt"
+            )
+          end
+          let(:dependency) do
+            Dependabot::Dependency.new(
+              name: "psycopg2",
+              version: "2.8.1",
+              requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: { type: "git", url: "https://github.com/psycopg/psycopg2.git", ref: "2.8.1" }
+              }],
+              previous_requirements: [{
+                file: "requirements.txt",
+                requirement: nil,
+                groups: [],
+                source: { type: "git", url: "https://github.com/psycopg/psycopg2.git", ref: "2.6.1" }
+              }],
+              package_manager: "uv"
+            )
+          end
+
+          it "does not raise and leaves the file unchanged" do
+            expect { updated_files }.not_to raise_error
+            expect(updated_files).to be_empty
+          end
+        end
+      end
+
       context "with an unknown package" do
         let(:dependency) do
           Dependabot::Dependency.new(