dependabot-cargo 0.105.1 → 0.105.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e5f15a1f3a4c07bed9ce51c04e55803afa77ceaec81d3c0546c76f772331178
-  data.tar.gz: a9fc25784a81d03801abc799d5bbbaefde5f6f3749000b081540d5067b0044d5
+  metadata.gz: fb9ae721373ea83ce53431736dc8563b24ab9afd42d9e1a79f33c8d4a5acd098
+  data.tar.gz: 28dfc2048936fe8d44f7b6f59043232cdb7fff52ef6d0ef7062d241b3d411450
 SHA512:
-  metadata.gz: 0f182d77e664a3312479f3a364fe2cc287bc206ec83487822b6cdace7cf1da0635daef6a3b29aca020b1426e77379b10ebc41ceb7281f5d0f71063fb673b9565
-  data.tar.gz: 6a2ee99dfe9b2f263555bfeb8229ab19ffeff4bc8eada596c4f6ca952a8b92e4a575bae737825505f44213cdf6b9823f7b56499bc633545f98d85fa4be77dc43
+  metadata.gz: 103b0825ad0d75dfb4e8ca509edbbcca0c29b048d20cbac1c7aa254c64660e219f9dd3c03c451da8f8274e0dfa24192f71f8ecb81e1f744fd8d739f48cb9eefa
+  data.tar.gz: c425d8c74f039d1124a14c4c81b33bb18bbd641330263ac8d57e5740893f7712e859705f918c42a23fa04bf2dfe7cf9a55648c7344d80966d2cd82ff014434a3

data/lib/dependabot/cargo/update_checker.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "excon"
 require "dependabot/git_commit_checker"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
@@ -8,6 +7,7 @@ require "dependabot/update_checkers/base"
 module Dependabot
   module Cargo
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/file_preparer"
@@ -23,12 +23,7 @@ module Dependabot
             # they can't be passed to GitCommitChecker.
             nil
           else
-            versions = available_versions
-            versions.reject!(&:prerelease?) unless wants_prerelease?
-            versions.reject! do |v|
-              ignore_reqs.any? { |r| r.satisfied_by?(v) }
-            end
-            versions.max
+            latest_version_finder.latest_version
           end
       end
 
@@ -90,6 +85,16 @@ module Dependabot
         library? ? :bump_versions_if_necessary : :bump_versions
       end
 
+      def latest_version_finder
+        @latest_version_finder ||= LatestVersionFinder.new(
+          dependency: dependency,
+          dependency_files: dependency_files,
+          credentials: credentials,
+          ignored_versions: ignored_versions,
+          security_advisories: security_advisories
+        )
+      end
+
       def latest_version_for_git_dependency
         latest_git_version_sha
       end
@@ -213,25 +218,6 @@ module Dependabot
         sources.first
       end
 
-      def wants_prerelease?
-        if dependency.version &&
-           version_class.new(dependency.version).prerelease?
-          return true
-        end
-
-        dependency.requirements.any? do |req|
-          reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
-          reqs.any? { |r| r.match?(/[A-Za-z]/) }
-        end
-      end
-
-      def available_versions
-        crates_listing.
-          fetch("versions", []).
-          reject { |v| v["yanked"] }.
-          map { |v| version_class.new(v.fetch("num")) }
-      end
-
       def git_dependency?
         git_commit_checker.git_dependency?
       end
@@ -258,24 +244,6 @@ module Dependabot
             credentials: credentials
           )
       end
-
-      def crates_listing
-        return @crates_listing unless @crates_listing.nil?
-
-        response = Excon.get(
-          "https://crates.io/api/v1/crates/#{dependency.name}",
-          idempotent: true,
-          **SharedHelpers.excon_defaults
-        )
-
-        @crates_listing = JSON.parse(response.body)
-      rescue Excon::Error::Timeout
-        retrying ||= false
-        raise if retrying
-
-        retrying = true
-        sleep(rand(1.0..5.0)) && retry
-      end
     end
   end
 end

data/lib/dependabot/cargo/update_checker/latest_version_finder.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/cargo/update_checker"
+
+module Dependabot
+  module Cargo
+    class UpdateChecker
+      class LatestVersionFinder
+        def initialize(dependency:, dependency_files:, credentials:,
+                       ignored_versions:, security_advisories:)
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
+        end
+
+        def latest_version
+          @latest_version ||= fetch_latest_version
+        end
+
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
+        private
+
+        attr_reader :dependency, :dependency_files, :credentials,
+                    :ignored_versions, :security_advisories
+
+        def fetch_latest_version
+          versions = available_versions
+          versions = filter_prerelease_versions(versions)
+          versions = filter_ignored_versions(versions)
+          versions.max
+        end
+
+        def fetch_lowest_security_fix_version
+          versions = available_versions
+          versions = filter_prerelease_versions(versions)
+          versions = filter_ignored_versions(versions)
+          versions = filter_vulnerable_versions(versions)
+          versions = filter_lower_versions(versions)
+          versions.min
+        end
+
+        def filter_prerelease_versions(versions_array)
+          return versions_array if wants_prerelease?
+
+          versions_array.reject(&:prerelease?)
+        end
+
+        def filter_ignored_versions(versions_array)
+          versions_array.
+            reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+        end
+
+        def filter_vulnerable_versions(versions_array)
+          versions_array.
+            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
+        end
+
+        def filter_lower_versions(versions_array)
+          versions_array.
+            select { |version| version > version_class.new(dependency.version) }
+        end
+
+        def available_versions
+          crates_listing.
+            fetch("versions", []).
+            reject { |v| v["yanked"] }.
+            map { |v| version_class.new(v.fetch("num")) }
+        end
+
+        def crates_listing
+          return @crates_listing unless @crates_listing.nil?
+
+          response = Excon.get(
+            "https://crates.io/api/v1/crates/#{dependency.name}",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          @crates_listing = JSON.parse(response.body)
+        rescue Excon::Error::Timeout
+          retrying ||= false
+          raise if retrying
+
+          retrying = true
+          sleep(rand(1.0..5.0)) && retry
+        end
+
+        def wants_prerelease?
+          if dependency.version &&
+             version_class.new(dependency.version).prerelease?
+            return true
+          end
+
+          dependency.requirements.any? do |req|
+            reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
+            reqs.any? { |r| r.match?(/[A-Za-z]/) }
+          end
+        end
+
+        def ignore_reqs
+          ignored_versions.map { |req| requirement_class.new(req.split(",")) }
+        end
+
+        def version_class
+          Utils.version_class_for_package_manager(dependency.package_manager)
+        end
+
+        def requirement_class
+          Utils.requirement_class_for_package_manager(
+            dependency.package_manager
+          )
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.105.1
+  version: 0.105.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-17 00:00:00.000000000 Z
+date: 2019-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.105.1
+        version: 0.105.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.105.1
+        version: 0.105.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -153,6 +153,7 @@ files:
 - lib/dependabot/cargo/requirement.rb
 - lib/dependabot/cargo/update_checker.rb
 - lib/dependabot/cargo/update_checker/file_preparer.rb
+- lib/dependabot/cargo/update_checker/latest_version_finder.rb
 - lib/dependabot/cargo/update_checker/requirements_updater.rb
 - lib/dependabot/cargo/update_checker/version_resolver.rb
 - lib/dependabot/cargo/version.rb