dependabot-common 0.118.3 → 0.118.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d722e5df4607da96bfecc6e9f8fee39ff7ece6b069aaa25652c37fe1899e862b
-  data.tar.gz: '002249968a3815f8ece501ee39825d7b98630d44a2015c3e198346452646cb33'
+  metadata.gz: 3aa2fa4ee99aae2148aba335da32c724f150b7b444ce0da890b348951a92833c
+  data.tar.gz: 0f51c1cf161b807edab14e3b0d025aa554122e103a206c39e6e1ecaf6f99b6d4
 SHA512:
-  metadata.gz: 255df4e43643c130fd8e947a49e8c951234e6e66da0fef3c165f4521d176b478c70bff9dd2fa223a26641c4124280681100d8cd3c17ec3839cebf99465a3b7a8
-  data.tar.gz: 5beed00fd52d9f8ed67e50580f9eb509dab6071c8ade88f22002e70d4007cefc88b4a592360b887356cd74d4a76e58db575a970822bbe8db90a132ab577f9b73
+  metadata.gz: e6da87803c67049bdca51fd5594a92eee652942c3fd51f868ca583856a78770b908285bc04008d6c23ff944b8565213727ff73e53c09a0931c98d28f93bdb021
+  data.tar.gz: 9e155ad29f7c812a38e4fdb5925bf449e3bc4014d320344cab90466e2bd3e31936e02db7adb79838427d0116362d7e14f4b82e456783da92b4491372d877988f

data/lib/dependabot/git_metadata_fetcher.rb

@@ -47,7 +47,6 @@ module Dependabot
 
     attr_reader :url, :credentials
 
-    # rubocop:disable Metrics/CyclomaticComplexity
     # rubocop:disable Metrics/PerceivedComplexity
     def fetch_upload_pack_for(uri)
       response = fetch_raw_upload_pack_for(uri)
@@ -79,7 +78,6 @@ module Dependabot
 
       raise Dependabot::GitDependenciesNotReachable, [uri]
     end
-    # rubocop:enable Metrics/CyclomaticComplexity
     # rubocop:enable Metrics/PerceivedComplexity
 
     def fetch_raw_upload_pack_for(uri)

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -76,7 +76,6 @@ module Dependabot
 
         private
 
-        # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/PerceivedComplexity
         def changelog
           return unless changelog_from_suggested_url || source
@@ -98,7 +97,6 @@ module Dependabot
           # Fall back to the changelog (or nil) from the default branch
           default_branch_changelog
         end
-        # rubocop:enable Metrics/CyclomaticComplexity
         # rubocop:enable Metrics/PerceivedComplexity
 
         def changelog_from_suggested_url

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -89,21 +89,9 @@ module Dependabot
         @automerge_candidate
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       def update_type
         return unless dependencies.any?(&:previous_version)
 
-        precision = dependencies.map do |dep|
-          new_version_parts = version(dep).split(".")
-          old_version_parts = previous_version(dep)&.split(".") || []
-          all_parts = new_version_parts.first(3) + old_version_parts.first(3)
-          next 0 unless all_parts.all? { |part| part.to_i.to_s == part }
-          next 1 if new_version_parts[0] != old_version_parts[0]
-          next 2 if new_version_parts[1] != old_version_parts[1]
-
-          3
-        end.min
-
         case precision
         when 0 then "non-semver"
         when 1 then "major"
@@ -112,7 +100,18 @@ module Dependabot
         end
       end
 
-      # rubocop:enable Metrics/PerceivedComplexity
+      def precision
+        dependencies.map do |dep|
+          new_version_parts = version(dep).split(/[.+]/)
+          old_version_parts = previous_version(dep)&.split(/[.+]/) || []
+          all_parts = new_version_parts.first(3) + old_version_parts.first(3)
+          next 0 unless all_parts.all? { |part| part.to_i.to_s == part }
+          next 1 if new_version_parts[0] != old_version_parts[0]
+          next 2 if new_version_parts[1] != old_version_parts[1]
+
+          3
+        end.min
+      end
 
       def version(dep)
         return dep.version if version_class.correct?(dep.version)
@@ -192,8 +191,10 @@ module Dependabot
         !security_label.nil?
       end
 
+      # Find the exact match first and then fallback to * security* label
       def security_label
-        labels.find { |l| l.match?(/security/i) }
+        labels.find { |l| l == DEFAULT_SECURITY_LABEL } ||
+          labels.find { |l| l.match?(/security/i) }
       end
 
       def label_update_type?

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -323,7 +323,7 @@ module Dependabot
         msg += commits_cascade(dep)
         msg += maintainer_changes_cascade(dep)
         msg += break_tag unless msg == ""
-        "\n" + sanitize_links_and_mentions(msg)
+        "\n" + sanitize_links_and_mentions(msg, unsafe: true)
       end
 
       def vulnerabilities_cascade(dep)
@@ -437,7 +437,7 @@ module Dependabot
 
         build_details_tag(
           summary: "Maintainer changes",
-          body: maintainer_changes(dep) + "\n"
+          body: sanitize_links_and_mentions(maintainer_changes(dep)) + "\n"
         )
       end
 
@@ -680,12 +680,12 @@ module Dependabot
         end
       end
 
-      def sanitize_links_and_mentions(text)
+      def sanitize_links_and_mentions(text, unsafe: false)
         return text unless source.provider == "github"
 
         LinkAndMentionSanitizer.
           new(github_redirection_service: github_redirection_service).
-          sanitize_links_and_mentions(text: text)
+          sanitize_links_and_mentions(text: text, unsafe: unsafe)
       end
 
       def sanitize_template_tags(text)

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -17,9 +17,8 @@ module Dependabot
         MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}.freeze
         # End of string
         EOS_REGEX = /\z/.freeze
-        # We rely on GitHub to do the HTML sanitization
         COMMONMARKER_OPTIONS = %i(
-          UNSAFE GITHUB_PRE_LANG FULL_INFO_STRING
+          GITHUB_PRE_LANG FULL_INFO_STRING
         ).freeze
         COMMONMARKER_EXTENSIONS = %i(
           table tasklist strikethrough autolink tagfilter
@@ -31,14 +30,15 @@ module Dependabot
           @github_redirection_service = github_redirection_service
         end
 
-        def sanitize_links_and_mentions(text:)
+        def sanitize_links_and_mentions(text:, unsafe: false)
           doc = CommonMarker.render_doc(
             text, :LIBERAL_HTML_TAG, COMMONMARKER_EXTENSIONS
           )
 
           sanitize_mentions(doc)
           sanitize_links(doc)
-          doc.to_html(COMMONMARKER_OPTIONS, COMMONMARKER_EXTENSIONS)
+          mode = unsafe ? :UNSAFE : :DEFAULT
+          doc.to_html(([mode] + COMMONMARKER_OPTIONS), COMMONMARKER_EXTENSIONS)
         end
 
         private

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.118.3"
+  VERSION = "0.118.8"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.118.3
+  version: 0.118.8
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-18 00:00:00.000000000 Z
+date: 2020-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -104,28 +104,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.75'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.75'
 - !ruby/object:Gem::Dependency
   name: gitlab
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.15.0
+        version: 4.16.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.15.0
+        version: 4.16.1
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -306,14 +306,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement