dependabot-common 0.116.1 → 0.116.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7cca726367cd7cac7db77b5526207c6e09c4ccbe88369005545fe3d2865d2de
-  data.tar.gz: cf8374c303913e6ff4e206421d0886468acbc8192cdde75b738ef6578f351d60
+  metadata.gz: cd6d1cb619675f1da2656b37b2eb4d27a6ae0c8789b516c51bce122497cb923a
+  data.tar.gz: c9eaca28c8869517e55aeb9605b9e2bfdc698505ebf5cc757eaa565678b4294e
 SHA512:
-  metadata.gz: e5b4ef63e9ad79240b8ace2f81808b39566f77cf044c3b0968eec44a91412c20280008f22a43fc571f2f437255b25c879403306f1aea90e6bcb73fdccd94109e
-  data.tar.gz: 00b12b3a70f1091df496a0c986e99dfa8e47840a415eb9e96772dad0b7eb9cc140f77f52807c818a4e106c6c8e7c0f9a735ccdc1489651d6b417100d82b23cdd
+  metadata.gz: 618053c87e601c5c5de915b2da255a4e18748fc30ed414894383b2a83fa19526bbab8671e4eeefeefa7f5753977f2569eb43c5086853f049c7ea689354695803
+  data.tar.gz: 3fcbdf49ee0f6077fcf33b8bc3ce9895215f4dd9a9d70798f5c84bc73b4913c49d879ab4614a02f751c522366b6d634d5f8df9b1ca336603c8110118782b7a78

data/lib/dependabot/git_metadata_fetcher.rb

@@ -156,16 +156,26 @@ module Dependabot
       cred = credentials.select { |c| c["type"] == "git_source" }.
              find { |c| bare_uri.start_with?(c["host"]) }
 
+      scheme = scheme_for_uri(uri)
+
       if bare_uri.match?(%r{[^/]+:[^/]+@})
         # URI already has authentication details
-        "https://#{bare_uri}"
+        "#{scheme}://#{bare_uri}"
       elsif cred&.fetch("username", nil) && cred&.fetch("password", nil)
         # URI doesn't have authentication details, but we have credentials
         auth_string = "#{cred.fetch('username')}:#{cred.fetch('password')}"
-        "https://#{auth_string}@#{bare_uri}"
+        "#{scheme}://#{auth_string}@#{bare_uri}"
+      else
+        # No credentials, so just return the http(s) URI
+        "#{scheme}://#{bare_uri}"
+      end
+    end
+
+    def scheme_for_uri(uri)
+      if uri.match?(%r{^http://})
+        "http"
       else
-        # No credentials, so just return the https URI
-        "https://#{bare_uri}"
+        "https"
       end
     end
 

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -27,7 +27,11 @@ module Dependabot
               elsif dependencies.count > 1 && updating_a_dependency_set?
                 dependency_set.fetch(:group)
               else
-                dependencies.map(&:name).join("-and-").tr(":", "-").tr("@", "")
+                dependencies.
+                  map(&:name).
+                  join("-and-").
+                  tr(":[]", "-").
+                  tr("@", "")
               end
 
             dep = dependencies.first
@@ -41,12 +45,8 @@ module Dependabot
             end
           end
 
-        branch_name = File.join(prefixes, @name).
-                      gsub(%r{/\.}, "/dot-").
-                      gsub(%r{/\.}, "/dot-")
-
         # Some users need branch names without slashes
-        branch_name.gsub("/", separator)
+        sanitize_ref(File.join(prefixes, @name).gsub("/", separator))
       end
 
       # rubocop:enable Metrics/PerceivedComplexity
@@ -113,8 +113,7 @@ module Dependabot
           gsub(">", "gt-").
           gsub("<", "lt-").
           gsub("*", "star").
-          gsub(",", "-and-").
-          sub(/\.$/, "")
+          gsub(",", "-and-")
       end
 
       def new_version(dependency)
@@ -169,6 +168,23 @@ module Dependabot
       def requirements_changed?(dependency)
         (dependency.requirements - dependency.previous_requirements).any?
       end
+
+      def sanitize_ref(ref)
+        # This isn't a complete implementation of git's ref validation, but it
+        # covers most cases that crop up. Its list of allowed charactersr is a
+        # bit stricter than git's, but that's for cosmetic reasons.
+        ref.
+          # Remove forbidden characters (those not already replaced elsewhere)
+          gsub(%r{[^A-Za-z0-9/\-_.(){}]}, "").
+          # Slashes can't be followed by periods
+          gsub(%r{/\.}, "/dot-").
+          # Two or more sequential periods are forbidden
+          gsub(/\.+/, ".").
+          # Two or more sequential slashes are forbidden
+          gsub(%r{/+}, "/").
+          # Trailing periods are forbidden
+          sub(/\.$/, "")
+      end
     end
   end
 end

data/lib/dependabot/update_checkers/base.rb

@@ -13,13 +13,15 @@ module Dependabot
 
       def initialize(dependency:, dependency_files:, credentials:,
                      ignored_versions: [], security_advisories: [],
-                     requirements_update_strategy: nil)
+                     requirements_update_strategy: nil,
+                     security_updates_only: false)
         @dependency = dependency
         @dependency_files = dependency_files
         @credentials = credentials
         @requirements_update_strategy = requirements_update_strategy
         @ignored_versions = ignored_versions
         @security_advisories = security_advisories
+        @security_updates_only = security_updates_only
       end
 
       def up_to_date?

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.116.1"
+  VERSION = "0.116.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.116.1
+  version: 0.116.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-08 00:00:00.000000000 Z
+date: 2020-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -62,16 +62,22 @@ dependencies:
   name: commonmarker
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.20.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.20.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
   name: docker_registry2
   requirement: !ruby/object:Gem::Requirement