dependabot-common 0.116.2 → 0.117.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 341698a302a0bda029a2404b6622caee807187c038ef0eca920ef22cd0141301
-  data.tar.gz: afe8641e292e52541ca1971d3790fdcf8820777c2b144f6bf131309dca10c6e1
+  metadata.gz: 7dabb5390c99314c33d5b64e07388e2deaf614dcba3be7eee39806e8b5deaff2
+  data.tar.gz: a71cbca736c9455ceb7ba73b6b3051b52b41b0b8c4c3155542f020e6a2211120
 SHA512:
-  metadata.gz: dca7601497209f6e70f3157ae48f8a9dcd437034b370c754be6c765d1c89ad91a151d2980853bfd8e0547527be9c3a9c2d1568470dcecdf2cbd2b07eb9ff33c1
-  data.tar.gz: 7e7d5313d1d148045f12e0da8eb0fb357d3551930db7d339c81f57e7a985ccfabe29ad58ea0361a77a4915694480fa9015388e6d47dc3bceaec0658166b814a8
+  metadata.gz: fd9cf03127407d8aa28b8d28bf1a926d99d13ecd43b3fe6ea0b172d96b2b33b9b9079be2047fd6508d266e99e322201baae741c2842b35b02326b4fdf5f85ceb
+  data.tar.gz: a2a7f212298b0d5eface9267659f15436b2e3291358146ca58ff93cb2f5a15fac664aba338a85f07198e99389231b9eebc5291a56ca2e1ddd6eadcc745e52442

data/lib/dependabot/git_metadata_fetcher.rb

@@ -156,16 +156,26 @@ module Dependabot
       cred = credentials.select { |c| c["type"] == "git_source" }.
              find { |c| bare_uri.start_with?(c["host"]) }
 
+      scheme = scheme_for_uri(uri)
+
       if bare_uri.match?(%r{[^/]+:[^/]+@})
         # URI already has authentication details
-        "https://#{bare_uri}"
+        "#{scheme}://#{bare_uri}"
       elsif cred&.fetch("username", nil) && cred&.fetch("password", nil)
         # URI doesn't have authentication details, but we have credentials
         auth_string = "#{cred.fetch('username')}:#{cred.fetch('password')}"
-        "https://#{auth_string}@#{bare_uri}"
+        "#{scheme}://#{auth_string}@#{bare_uri}"
+      else
+        # No credentials, so just return the http(s) URI
+        "#{scheme}://#{bare_uri}"
+      end
+    end
+
+    def scheme_for_uri(uri)
+      if uri.match?(%r{^http://})
+        "http"
       else
-        # No credentials, so just return the https URI
-        "https://#{bare_uri}"
+        "https"
       end
     end
 

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -27,7 +27,11 @@ module Dependabot
               elsif dependencies.count > 1 && updating_a_dependency_set?
                 dependency_set.fetch(:group)
               else
-                dependencies.map(&:name).join("-and-").tr(":", "-").tr("@", "")
+                dependencies.
+                  map(&:name).
+                  join("-and-").
+                  tr(":[]", "-").
+                  tr("@", "")
               end
 
             dep = dependencies.first
@@ -41,12 +45,8 @@ module Dependabot
             end
           end
 
-        branch_name = File.join(prefixes, @name).
-                      gsub(%r{/\.}, "/dot-").
-                      gsub(%r{/\.}, "/dot-")
-
         # Some users need branch names without slashes
-        branch_name.gsub("/", separator)
+        sanitize_ref(File.join(prefixes, @name).gsub("/", separator))
       end
 
       # rubocop:enable Metrics/PerceivedComplexity
@@ -113,8 +113,7 @@ module Dependabot
           gsub(">", "gt-").
           gsub("<", "lt-").
           gsub("*", "star").
-          gsub(",", "-and-").
-          sub(/\.$/, "")
+          gsub(",", "-and-")
       end
 
       def new_version(dependency)
@@ -169,6 +168,23 @@ module Dependabot
       def requirements_changed?(dependency)
         (dependency.requirements - dependency.previous_requirements).any?
       end
+
+      def sanitize_ref(ref)
+        # This isn't a complete implementation of git's ref validation, but it
+        # covers most cases that crop up. Its list of allowed charactersr is a
+        # bit stricter than git's, but that's for cosmetic reasons.
+        ref.
+          # Remove forbidden characters (those not already replaced elsewhere)
+          gsub(%r{[^A-Za-z0-9/\-_.(){}]}, "").
+          # Slashes can't be followed by periods
+          gsub(%r{/\.}, "/dot-").
+          # Two or more sequential periods are forbidden
+          gsub(/\.+/, ".").
+          # Two or more sequential slashes are forbidden
+          gsub(%r{/+}, "/").
+          # Trailing periods are forbidden
+          sub(/\.$/, "")
+      end
     end
   end
 end

data/lib/dependabot/pull_request_creator/codecommit.rb

@@ -50,6 +50,8 @@ module Dependabot
         branch = create_or_get_branch(base_commit)
         return unless branch
 
+        create_commit
+
         pull_request = codecommit_client_for_source.create_pull_request(
           pr_name,
           branch_name,

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -58,6 +58,7 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -73,12 +74,20 @@ module Dependabot
                 subnode.string_content = "#{repo}##{number}"
               end
 
-              node.url = node.url.gsub(
-                "github.com", github_redirection_service || "github.com"
-              )
+              node.url = replace_github_host(node.url)
+            elsif node.type == :text &&
+                  node.string_content.match?(GITHUB_REF_REGEX)
+              node.string_content = replace_github_host(node.string_content)
             end
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        def replace_github_host(text)
+          text.gsub(
+            "github.com", github_redirection_service || "github.com"
+          )
+        end
 
         def build_mention_nodes(text)
           nodes = []

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.116.2"
+  VERSION = "0.117.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.116.2
+  version: 0.117.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-10 00:00:00.000000000 Z
+date: 2020-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -62,16 +62,22 @@ dependencies:
   name: commonmarker
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.20.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.20.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
   name: docker_registry2
   requirement: !ruby/object:Gem::Requirement
@@ -300,26 +306,26 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.79.0
+        version: 0.80.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.79.0
+        version: 0.80.1
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency