Fix medium-priority review issues in updates, versions, and caching

CHANGELOG.md

@@ -6,6 +6,21 @@ All notable changes to the "Python Dependencies Updater" extension will be docum
 
 ### Fixed
 
+- "Update All" plans safe updates from the document text after the registry
+  requests return. Inserting or deleting lines while versions load no longer
+  makes a patch bump land on the wrong line. Risky updates use that same
+  relocation, including edits made during the confirmation dialog.
+- Removed the `[UAT-PROBE]` log that `resolveCodeLens` wrote on every lens.
+- A requirements file whose lines all use extras (`requests[security]>=2.0`)
+  is parsed again. Brackets in an extra are not treated as a TOML table.
+- Version ordering follows PEP 440. `1.0.0rc1.post1` is less than `1.0.0`,
+  an epoch such as `1!1.0` sorts above `2.0`, and `1.0rc1+cpu` is a
+  pre-release. An epoch change is reported as a major update.
+- Package cache keys are PEP 503-normalized, so `foo_bar` and `foo-bar`
+  share one entry. Closing a requirements file drops it from the dependency
+  cache and from the status-bar total. Hover uses the same specifier-aware
+  resolution as the CodeLens.
+
 - Upgrading a multi-constraint requirement now bumps only the lower bound or
   pin. `requests>=2.0,<3.0` keeps its upper bound, `foo!=1.5,>=1.0` keeps the
   exclusion, and `django~=4.2` keeps two-component precision instead of

src/core/batchUpdate.ts

@@ -0,0 +1,84 @@
+/**
+ * Plan "Update All" edits against the document as it is now.
+ *
+ * Version lookups can take long enough for the user to insert or delete
+ * lines. Edits must be built from a fresh parse, not from the line numbers
+ * captured before those requests. Safe and risky updates go through the
+ * same relocation so a patch bump cannot land on the wrong line.
+ */
+
+import { planLineUpdate } from "../utils/dependencyUtils";
+import type { AnyDependency } from "./unifiedParser";
+import { parseDependencies } from "./unifiedParser";
+
+export interface BatchUpdate {
+	dep: AnyDependency;
+	newVersion: string;
+	kind: "safe" | "risky";
+}
+
+export interface PlannedEdit {
+	line: number;
+	startColumn: number;
+	endColumn: number;
+	replacement: string;
+	packageName: string;
+	kind: "safe" | "risky";
+}
+
+function dependencyKey(dep: AnyDependency): string {
+	const extra = "extra" in dep ? (dep.extra ?? "") : "";
+	return `${dep.packageName}|${extra}`;
+}
+
+/**
+ * Match each update to the current document by package name and extra,
+ * in document order, and plan the rewrite from the current line text.
+ * A dependency that disappeared while versions were loading is skipped.
+ */
+export function planRelocatedEdits(options: {
+	updates: BatchUpdate[];
+	fileName: string;
+	currentText: string;
+	isTOML: boolean;
+}): PlannedEdit[] {
+	const currentDeps = parseDependencies(options.fileName, options.currentText);
+	const byKey = new Map<string, AnyDependency[]>();
+	for (const dep of currentDeps) {
+		const key = dependencyKey(dep);
+		const list = byKey.get(key) ?? [];
+		list.push(dep);
+		byKey.set(key, list);
+	}
+
+	const lines = options.currentText.split("\n");
+	const edits: PlannedEdit[] = [];
+	for (const update of options.updates) {
+		const target = byKey.get(dependencyKey(update.dep))?.shift();
+		if (!target) {
+			continue;
+		}
+		const lineText = lines[target.line];
+		if (lineText === undefined) {
+			continue;
+		}
+		const planned = planLineUpdate(
+			lineText,
+			update.newVersion,
+			options.isTOML,
+			target.startColumn,
+		);
+		if (!planned) {
+			continue;
+		}
+		edits.push({
+			line: target.line,
+			startColumn: planned.match.startIndex,
+			endColumn: planned.match.endIndex,
+			replacement: planned.replacement,
+			packageName: target.packageName,
+			kind: update.kind,
+		});
+	}
+	return edits;
+}

src/core/packageName.ts

@@ -0,0 +1,23 @@
+/**
+ * Package name normalization shared by the in-memory and persisted caches.
+ * PEP 503: lowercase, and collapse every run of `-`, `_`, or `.` to one `-`.
+ */
+
+const DEFAULT_REGISTRY = "https://pypi.org";
+
+export function normalizePackageName(name: string): string {
+	const base = name.split("[")[0]?.trim() ?? "";
+	return base.toLowerCase().replace(/[-_.]+/g, "-");
+}
+
+/**
+ * Cache key for a package on a registry. `Foo_Bar` and `foo-bar` share one
+ * entry; a trailing slash on the registry does not create a second entry.
+ */
+export function versionCacheKey(
+	packageName: string,
+	registryUrl?: string,
+): string {
+	const registry = (registryUrl || DEFAULT_REGISTRY).replace(/\/+$/, "");
+	return `${registry}|${normalizePackageName(packageName)}`;
+}