Merge pull request #431 from pyupio/fix/recursive-deps-parsing

Returning deps after one unpinned dependency.

safety/util.py

@@ -70,7 +70,7 @@ def read_requirements(fh, resolve=True):
                 fg="yellow",
                 file=sys.stderr
             )
-            return
+            continue
 
         version = spec[1]
         if spec[0] == '==':

tests/reqs_pinned.txt

@@ -0,0 +1 @@
+django==4.1.3

tests/reqs_pinned_and_unpinned.txt

@@ -0,0 +1,4 @@
+-r reqs_pinned.txt
+packaging==21.3
+pipenv
+flower==1.2.0

tests/test_util.py

@@ -35,6 +35,14 @@ def test_recursive_requirement(self):
             result = list(read_requirements(fh, resolve=True))
         self.assertEqual(len(result), 2)
 
+    def test_recursive_requirement_pinned_after_unpinned(self):
+        # this should find 3 packages, unpinned are ignored
+        dirname = os.path.dirname(__file__)
+        test_filename = os.path.join(dirname, "reqs_pinned_and_unpinned.txt")
+        with open(test_filename) as fh:
+            result = list(read_requirements(fh, resolve=True))
+        self.assertEqual(len(result), 3)
+
     @patch("safety.util.get_flags_from_context")
     @patch.object(sys, 'argv', ['safety/__main__.py', 'check', '--key=my-key', '-i', '3232', '-i', '3231', '--ignore',
                                 '1212', '--json'])