strip extras from Python PURLs in DG payload

[jakecoffman]

What are you trying to accomplish?

Python can specify dependency extras like cachecontrol[filecache]==0.14.2 where filecache specifies a set of transitive dependencies that are optionally specified.

Dependabot carries this extra data in the Dependency name (e.g. cachecontrol[filecache]) probably so when it bumps it preserves the extras.

For submitting this data to Dependency Graph we need to strip it, because the package is just cachecontrol.

Anything you want to highlight for special attention from reviewers?

How will you know you've accomplished your goal?

We'll see correct names show up in Dependency Graph.

Running this in Dependabot CLI shows it's working now. This used to be coverage[toml]

$ dependabot graph pip encode/httpx
...
updater |         "pkg:pypi/coverage@7.10.6": {
...

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR updates the Python Dependency Grapher’s PURL generation to drop Python “extras” (e.g., cachecontrol[filecache]) so Dependency Graph receives the base package name (e.g., cachecontrol).

Changes:

• Override Python grapher purl_name_for to normalize names and strip extras before building PURLs.
• Add specs ensuring extras are removed from generated PyPI PURLs.
• Add a spec case confirming requirements.txt remains a valid relevant dependency file when it contains extras.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
python/lib/dependabot/python/dependency_grapher.rb	Overrides PURL name generation to use normalized base package names (extras removed).
python/spec/dependabot/python/dependency_grapher_spec.rb	Adds regression coverage for extras being stripped from PyPI PURLs and a requirements.txt selection case.