dependabot-bundler 0.367.0 → 0.368.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08bc3f61dcacf086a98ccfbdc52a120ee74698135827ba2e6712ca087a56e535'
-  data.tar.gz: 157c272d2e2d0ee4d7f93c289680735af224d57c385b69aca4953c693fcb2317
+  metadata.gz: e34c3bf2b7d1d037cff87ab501f90038e63ed2befb7404fe2d34e4043e3c75fd
+  data.tar.gz: 8fe5e19a9305bcabf19a90caf59e00c3373cab545922f51420d812535b1fcf23
 SHA512:
-  metadata.gz: dd50f9b9706e19a685ded65ea60cf000c8d17d5ed88539eff6d456ef8ce4585c32bf21dd5317bdcbe8f7d7166ff91377ee0f82d0c1d6242d3add89d9c3ce6c52
-  data.tar.gz: bb4f45340ab7811b31cd2d21013af87185f764659982d1f570e7ccd9928135028d7125db5bccf3c5544076b093674605b204b983ad3e2560aa6dd2fc42111af3
+  metadata.gz: 03c246c7ddf1eb3ba6f8f40a08a818998fb97564a034a952ade14d24928ab127101a19cbd540b52a1d2b2a2388290ee9b9792ada80e3287264ecc07afcc51cc5
+  data.tar.gz: d47a12316edb81d78c36d84ff103a77597a8149993665d76d1a723c6cacb3e1bd35935c931930cad91eb310872f1a082ca948bbdfcf26f5dcf2b63060494f208

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -62,11 +62,11 @@ module Dependabot
         sig { override.returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
-        sig { returns(Dependabot::Package::PackageDetails) }
+        sig { returns(T.nilable(Dependabot::Package::PackageDetails)) }
         def fetch
           case source_type
           when GIT, OTHER
-            package_details([])
+            nil
           else
             rubygems_versions
           end
@@ -132,26 +132,6 @@ module Dependabot
         def rubygems_versions
           registry_url = get_url_from_dependency(dependency) || replaces_base_registry_url || "https://rubygems.org"
 
-          # TODO: Github private registry support
-          # registry_url = "https://rubygems.pkg.github.com/#{OWNER_NAME}"
-          # Corresponding API URL:
-          # curl  -H "Accept: application/json" \
-          #       -H "Authorization: Bearer <<TOKEN>>" \
-          #       https://api.github.com/orgs/dsp-testing/packages/rubygems/json/version
-
-          validate_and_check_registry(registry_url)
-        end
-
-        sig { params(registry_url: String).returns(Dependabot::Package::PackageDetails) }
-        def validate_and_check_registry(registry_url)
-          parsed_url = begin
-            URI.parse(registry_url)
-          rescue URI::InvalidURIError
-            raise "Invalid registry URL: #{registry_url}"
-          end
-
-          return github_packages_versions(registry_url) if parsed_url.host == "rubygems.pkg.github.com"
-
           fetch_and_process_rubygems_response(registry_url)
         end
 
@@ -253,61 +233,6 @@ module Dependabot
           )
         end
 
-        sig { params(registry_url: String).returns(Dependabot::Package::PackageDetails) }
-        def github_packages_versions(registry_url)
-          # Extract org name from URL like "https://rubygems.pkg.github.com/dsp-testing/"
-          org_name = registry_url.split("/").last
-
-          # GitHub Packages API endpoint for RubyGems packages
-          api_url = "https://api.github.com/orgs/#{org_name}/packages/rubygems/#{dependency.name}/versions"
-
-          response = Dependabot::RegistryClient.get(
-            url: api_url,
-            headers: {
-              "Accept" => "application/vnd.github.v3+json",
-              "Authorization" => "Bearer #{github_token}"
-            }
-          )
-
-          unless response.status == 200
-            error_details = "Status: #{response.status}"
-            error_details += " (Package not found in GitHub Registry)" if response.status == 404
-            error_message = "Failed to fetch versions for '#{dependency.name}' from GitHub Packages. #{error_details}"
-            Dependabot.logger.info(error_message)
-            return package_details([])
-          end
-
-          begin
-            versions_data = JSON.parse(response.body)
-            package_releases = versions_data.map do |version_info|
-              # GitHub Packages API returns different structure than RubyGems
-              version_number = version_info["name"] # GitHub uses "name" for version
-              created_at = version_info["created_at"]
-
-              package_release(
-                version: version_number,
-                released_at: Time.parse(created_at),
-                downloads: 0, # GitHub Packages doesn't provide download counts
-                url: "#{registry_url}/gems/#{dependency.name}-#{version_number}.gem",
-                ruby_version: nil # GitHub Packages API doesn't provide ruby version requirements
-              )
-            end
-
-            package_details(package_releases)
-          rescue JSON::ParserError => e
-            Dependabot.logger.info("Failed to parse GitHub Packages response: #{e.message}")
-            package_details([])
-          end
-        end
-
-        sig { returns(T.nilable(String)) }
-        def github_token
-          github_credential = credentials.find do |cred|
-            cred["type"] == "rubygems_server" && cred["host"] == "rubygems.pkg.github.com"
-          end
-          github_credential&.fetch("token", nil)
-        end
-
         sig { params(req_string: String).returns(Requirement) }
         def language_requirement(req_string)
           Requirement.new(req_string)

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -72,12 +72,17 @@ module Dependabot
 
         sig { override.returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
         def available_versions
-          return nil if package_details&.releases.nil?
+          releases = package_details&.releases
+          return nil if releases.nil?
 
           source_versions = releases_from_dependency_source
           return [] if source_versions.empty?
 
-          T.must(package_details).releases.select do |release|
+          # Some private registries don't support the versions API that we use for fetching release dates for cooldown.
+          # In that case, skip cooldown and just return all versions.
+          return source_versions if releases.empty?
+
+          releases.select do |release|
             source_versions.any? { |v| v.to_s == release.version.to_s }
           end
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.367.0
+  version: 0.368.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.367.0
+        version: 0.368.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.367.0
+        version: 0.368.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.367.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
 rdoc_options: []
 require_paths:
 - lib