dependabot-common 0.119.1 → 0.119.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55d06a3a88c37d000b5380d1b1dcc12179e035967017f61ec7f310279836656a
-  data.tar.gz: 3bdff5a073acdb9d4440319bf3120d20687417ec3b6f4287ec7358f349baaa0a
+  metadata.gz: ce4dd778f67c7a4f612edfbe2f1ef0bae78566f7c50a46212f0244745cf07da1
+  data.tar.gz: 46f644e4de54337eb399265827d754e6ba82477603e046f42c6d79924b32cb86
 SHA512:
-  metadata.gz: 127a52768582e1e2e179ce49b95229d05b6b6d0c50a4991c131297cfc2ba126e2f82afb786dbd6da3222f567020f51da7273de336e489a88e703571c825f481d
-  data.tar.gz: cef7b76143722481b5c9a034104e211493489fe5815d73ea83dd2f2db0415211d36b8b87ec865f0dd3e01549057eba986e52888621ca31d791ca32e25de38d5e
+  metadata.gz: 73958fe712b9b38885ec5591114943367adec8cdb77af7efd9a7069261512b2b50b77d7c578335bf87e5f89bef934102c099dd1ec4353ecd075e0924a56d74d8
+  data.tar.gz: 54e51527b3f98b0e2b722b1c2617344d4601fde8272986b02c60edc8e9b1525ccb1ea093efb18a02c259279f75cf3e7ce41d9d6e01641ccc3b675335c930026b

data/lib/dependabot/clients/azure.rb

@@ -28,6 +28,7 @@ module Dependabot
       def initialize(source, credentials)
         @source = source
         @credentials = credentials
+        @auth_header = auth_header_for(credentials&.fetch("token", nil))
       end
 
       def fetch_commit(_repo, branch)
@@ -180,8 +181,9 @@ module Dependabot
       def get(url)
         response = Excon.get(
           url,
-          user: credentials&.fetch("username"),
-          password: credentials&.fetch("password"),
+          headers: auth_header,
+          user: credentials&.fetch("username", nil),
+          password: credentials&.fetch("password", nil),
           idempotent: true,
           **SharedHelpers.excon_defaults
         )
@@ -193,12 +195,14 @@ module Dependabot
       def post(url, json)
         response = Excon.post(
           url,
-          headers: {
-            "Content-Type" => "application/json"
-          },
+          headers: auth_header.merge(
+            {
+              "Content-Type" => "application/json"
+            }
+          ),
           body: json,
-          user: credentials&.fetch("username"),
-          password: credentials&.fetch("password"),
+          user: credentials&.fetch("username", nil),
+          password: credentials&.fetch("password", nil),
           idempotent: true,
           **SharedHelpers.excon_defaults
         )
@@ -209,6 +213,21 @@ module Dependabot
 
       private
 
+      def auth_header_for(token)
+        return {} unless token
+
+        if token.include?(":")
+          encoded_token = Base64.encode64(token).delete("\n")
+          { "Authorization" => "Basic #{encoded_token}" }
+        elsif Base64.decode64(token).ascii_only? &&
+              Base64.decode64(token).include?(":")
+          { "Authorization" => "Basic #{token.delete("\n")}" }
+        else
+          { "Authorization" => "Bearer #{token}" }
+        end
+      end
+
+      attr_reader :auth_header
       attr_reader :credentials
       attr_reader :source
     end

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -60,7 +60,6 @@ module Dependabot
           dependencies.find { |d| d.name&.downcase == name&.downcase }
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
         def combined_dependency(old_dep, new_dep)
           package_manager = old_dep.package_manager
           v_cls = Utils.version_class_for_package_manager(package_manager)
@@ -89,8 +88,6 @@ module Dependabot
             subdependency_metadata: subdependency_metadata
           )
         end
-
-        # rubocop:enable Metrics/PerceivedComplexity
       end
     end
   end

data/lib/dependabot/git_commit_checker.rb

@@ -86,6 +86,7 @@ module Dependabot
       raise Dependabot::GitDependencyReferenceNotFound, dependency.name
     end
 
+    # rubocop:disable Metrics/PerceivedComplexity
     def local_tag_for_latest_version
       tags =
         local_tags.
@@ -114,6 +115,7 @@ module Dependabot
         tag_sha: tag.tag_sha
       }
     end
+    # rubocop:enable Metrics/PerceivedComplexity
 
     def git_repo_reachable?
       local_upload_pack

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -143,6 +143,7 @@ module Dependabot
           select_best_changelog(files)
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def select_best_changelog(files)
           CHANGELOG_NAMES.each do |name|
             candidates = files.select { |f| f.name =~ /#{name}/i }
@@ -163,6 +164,7 @@ module Dependabot
 
           nil
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def tag_for_new_version
           @tag_for_new_version ||=

data/lib/dependabot/metadata_finders/base/changelog_pruner.rb

@@ -21,7 +21,6 @@ module Dependabot
           !old_version_changelog_line.nil?
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
         def pruned_text
           changelog_lines = changelog_text.split("\n")
 
@@ -51,7 +50,6 @@ module Dependabot
 
           changelog_lines.slice(slice_range).join("\n").sub(/\n*\z/, "")
         end
-        # rubocop:enable Metrics/PerceivedComplexity
 
         private
 

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -116,7 +116,6 @@ module Dependabot
           gsub(",", "-and-")
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       def new_version(dependency)
         # Version looks like a git SHA and we could be updating to a specific
         # ref in which case we return that otherwise we return a shorthand sha
@@ -135,7 +134,6 @@ module Dependabot
           dependency.version
         end
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
       def previous_ref(dependency)
         previous_refs = dependency.previous_requirements.map do |r|

data/lib/dependabot/pull_request_creator/github.rb

@@ -51,6 +51,7 @@ module Dependabot
         @require_up_to_date_base
       end
 
+      # rubocop:disable Metrics/PerceivedComplexity
       def branch_exists?(name)
         git_metadata_fetcher.ref_names.include?(name)
       rescue Dependabot::GitDependenciesNotReachable => e
@@ -66,6 +67,7 @@ module Dependabot
         retrying = true
         retry
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
       def unmerged_pull_request_exists?
         pull_requests_for_branch.reject(&:merged).any?

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -113,6 +113,7 @@ module Dependabot
         end.min
       end
 
+      # rubocop:disable Metrics/PerceivedComplexity
       def version(dep)
         return dep.version if version_class.correct?(dep.version)
 
@@ -127,7 +128,9 @@ module Dependabot
 
         version_from_ref
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
+      # rubocop:disable Metrics/PerceivedComplexity
       def previous_version(dep)
         version_str = dep.previous_version
         return version_str if version_class.correct?(version_str)
@@ -144,6 +147,7 @@ module Dependabot
 
         version_from_ref
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
       def create_default_dependencies_label_if_required
         return if custom_labels

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -10,6 +10,7 @@ require "dependabot/pull_request_creator"
 module Dependabot
   class PullRequestCreator
     class MessageBuilder
+      require_relative "message_builder/metadata_presenter"
       require_relative "message_builder/issue_linker"
       require_relative "message_builder/link_and_mention_sanitizer"
       require_relative "pr_name_prefixer"
@@ -312,240 +313,38 @@ module Dependabot
         end.join
       end
 
-      def metadata_cascades_for_dep(dep)
-        break_tag = source_provider_supports_html? ? "\n<br />" : "\n\n"
-
-        msg = ""
-        msg += vulnerabilities_cascade(dep)
-        msg += release_cascade(dep)
-        msg += changelog_cascade(dep)
-        msg += upgrade_guide_cascade(dep)
-        msg += commits_cascade(dep)
-        msg += maintainer_changes_cascade(dep)
-        msg += break_tag unless msg == ""
-        "\n" + sanitize_links_and_mentions(msg, unsafe: true)
-      end
-
-      def vulnerabilities_cascade(dep)
-        fixed_vulns = vulnerabilities_fixed[dep.name]
-        return "" unless fixed_vulns&.any?
-
-        msg = ""
-        fixed_vulns.each { |v| msg += serialized_vulnerability_details(v) }
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Vulnerabilities fixed", body: msg)
-      end
-
-      def release_cascade(dep)
-        return "" unless releases_text(dep) && releases_url(dep)
-
-        msg = "*Sourced from [#{dep.display_name}'s releases]"\
-              "(#{releases_url(dep)}).*\n\n"
-        msg +=
-          begin
-            release_note_lines = releases_text(dep).split("\n").first(50)
-            release_note_lines = release_note_lines.map { |line| "> #{line}\n" }
-            if release_note_lines.count == 50
-              release_note_lines << truncated_line
-            end
-            release_note_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(
-          text: msg,
-          base_url: source_url(dep) + "/blob/HEAD/"
-        )
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Release notes", body: msg)
-      end
-
-      def changelog_cascade(dep)
-        return "" unless changelog_url(dep) && changelog_text(dep)
-
-        msg = "*Sourced from "\
-              "[#{dep.display_name}'s changelog](#{changelog_url(dep)}).*\n\n"
-        msg +=
-          begin
-            changelog_lines = changelog_text(dep).split("\n").first(50)
-            changelog_lines = changelog_lines.map { |line| "> #{line}\n" }
-            changelog_lines << truncated_line if changelog_lines.count == 50
-            changelog_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(text: msg, base_url: changelog_url(dep))
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Changelog", body: msg)
-      end
-
-      def upgrade_guide_cascade(dep)
-        return "" unless upgrade_url(dep) && upgrade_text(dep)
-
-        msg = "*Sourced from "\
-              "[#{dep.display_name}'s upgrade guide]"\
-              "(#{upgrade_url(dep)}).*\n\n"
-        msg +=
-          begin
-            upgrade_lines = upgrade_text(dep).split("\n").first(50)
-            upgrade_lines = upgrade_lines.map { |line| "> #{line}\n" }
-            upgrade_lines << truncated_line if upgrade_lines.count == 50
-            upgrade_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(text: msg, base_url: upgrade_url(dep))
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Upgrade guide", body: msg)
-      end
-
-      def commits_cascade(dep)
-        return "" unless commits_url(dep) && commits(dep)
-
-        msg = ""
-
-        commits(dep).reverse.first(10).each do |commit|
-          title = commit[:message].strip.split("\n").first
-          title = title.slice(0..76) + "..." if title && title.length > 80
-          title = title&.gsub(/(?<=[^\w.-])([_*`~])/, '\\1')
-          sha = commit[:sha][0, 7]
-          msg += "- [`#{sha}`](#{commit[:html_url]}) #{title}\n"
-        end
-
-        msg = msg.gsub(/\<.*?\>/) { |tag| "\\#{tag}" }
-
-        msg +=
-          if commits(dep).count > 10
-            "- Additional commits viewable in "\
-            "[compare view](#{commits_url(dep)})\n"
-          else
-            "- See full diff in [compare view](#{commits_url(dep)})\n"
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Commits", body: msg)
-      end
-
-      def maintainer_changes_cascade(dep)
-        return "" unless maintainer_changes(dep)
-
-        build_details_tag(
-          summary: "Maintainer changes",
-          body: sanitize_links_and_mentions(maintainer_changes(dep)) + "\n"
-        )
-      end
-
-      def build_details_tag(summary:, body:)
-        # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
-        # CodeCommit does not support the <details> tag (no url available)
-        if source_provider_supports_html?
-          msg = "<details>\n<summary>#{summary}</summary>\n\n"
-          msg += body
-          msg + "</details>\n"
-        else
-          "\n\##{summary}\n\n#{body}"
-        end
-      end
-
-      def source_provider_supports_html?
-        !%w(azure codecommit).include?(source.provider)
-      end
-
-      def serialized_vulnerability_details(details)
-        msg = vulnerability_source_line(details)
-
-        if details["title"]
-          msg += "> **#{details['title'].lines.map(&:strip).join(' ')}**\n"
-        end
-
-        if (description = details["description"])
-          description.strip.lines.first(20).each { |line| msg += "> #{line}" }
-          msg += truncated_line if description.strip.lines.count > 20
-        end
-
-        msg += "\n" unless msg.end_with?("\n")
-        msg += "> \n"
-        msg += vulnerability_version_range_lines(details)
-        msg + "\n"
-      end
-
-      def vulnerability_source_line(details)
-        if details["source_url"] && details["source_name"]
-          "*Sourced from [#{details['source_name']}]"\
-          "(#{details['source_url']}).*\n\n"
-        elsif details["source_name"]
-          "*Sourced from #{details['source_name']}.*\n\n"
-        else
-          ""
-        end
-      end
-
-      def vulnerability_version_range_lines(details)
-        msg = ""
-        %w(patched_versions unaffected_versions affected_versions).each do |tp|
-          type = tp.split("_").first.capitalize
-          next unless details[tp]
-
-          versions_string = details[tp].any? ? details[tp].join("; ") : "none"
-          versions_string = versions_string.gsub(/(?<!\\)~/, '\~')
-          msg += "> #{type} versions: #{versions_string}\n"
-        end
-        msg
-      end
-
-      def truncated_line
-        # Tables can spill out of truncated details, so we close them
-        "></tr></table> ... (truncated)\n"
-      end
-
-      def releases_url(dependency)
-        metadata_finder(dependency).releases_url
-      end
-
-      def releases_text(dependency)
-        metadata_finder(dependency).releases_text
+      def metadata_cascades_for_dep(dependency)
+        MetadataPresenter.new(
+          dependency: dependency,
+          source: source,
+          metadata_finder: metadata_finder(dependency),
+          vulnerabilities_fixed: vulnerabilities_fixed[dependency.name],
+          github_redirection_service: github_redirection_service
+        ).to_s
       end
 
       def changelog_url(dependency)
         metadata_finder(dependency).changelog_url
       end
 
-      def changelog_text(dependency)
-        metadata_finder(dependency).changelog_text
-      end
-
-      def upgrade_url(dependency)
-        metadata_finder(dependency).upgrade_guide_url
-      end
-
-      def upgrade_text(dependency)
-        metadata_finder(dependency).upgrade_guide_text
-      end
-
       def commits_url(dependency)
         metadata_finder(dependency).commits_url
       end
 
-      def commits(dependency)
-        metadata_finder(dependency).commits
+      def homepage_url(dependency)
+        metadata_finder(dependency).homepage_url
       end
 
-      def maintainer_changes(dependency)
-        metadata_finder(dependency).maintainer_changes
+      def releases_url(dependency)
+        metadata_finder(dependency).releases_url
       end
 
       def source_url(dependency)
         metadata_finder(dependency).source_url
       end
 
-      def homepage_url(dependency)
-        metadata_finder(dependency).homepage_url
+      def upgrade_url(dependency)
+        metadata_finder(dependency).upgrade_guide_url
       end
 
       def metadata_finder(dependency)
@@ -567,7 +366,6 @@ module Dependabot
           )
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       def previous_version(dependency)
         # If we don't have a previous version, we *may* still be able to figure
         # one out if a ref was provided and has been changed (in which case the
@@ -590,7 +388,6 @@ module Dependabot
           dependency.previous_version
         end
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
       def new_version(dependency)
         if dependency.version.match?(/^[0-9a-f]{40}$/)
@@ -658,48 +455,6 @@ module Dependabot
         raise "No new requirement!"
       end
 
-      def link_issues(text:, dependency:)
-        IssueLinker.
-          new(source_url: source_url(dependency)).
-          link_issues(text: text)
-      end
-
-      def fix_relative_links(text:, base_url:)
-        text.gsub(/\[.*?\]\([^)]+\)/) do |link|
-          next link if link.include?("://")
-
-          relative_path = link.match(/\((.*?)\)/).captures.last
-          base = base_url.split("://").last.gsub(%r{[^/]*$}, "")
-          path = File.join(base, relative_path)
-          absolute_path =
-            base_url.sub(
-              %r{(?<=://).*$},
-              Pathname.new(path).cleanpath.to_s
-            )
-          link.gsub(relative_path, absolute_path)
-        end
-      end
-
-      def sanitize_links_and_mentions(text, unsafe: false)
-        return text unless source.provider == "github"
-
-        LinkAndMentionSanitizer.
-          new(github_redirection_service: github_redirection_service).
-          sanitize_links_and_mentions(text: text, unsafe: unsafe)
-      end
-
-      def sanitize_template_tags(text)
-        text.gsub(/\<.*?\>/) do |tag|
-          tag_contents = tag.match(/\<(.*?)\>/).captures.first.strip
-
-          # Unclosed calls to template overflow out of the blockquote block,
-          # wrecking the rest of our PRs. Other tags don't share this problem.
-          next "\\#{tag}" if tag_contents.start_with?("template")
-
-          tag
-        end
-      end
-
       def ref_changed?(dependency)
         previous_ref(dependency) != new_ref(dependency)
       end

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -58,7 +58,6 @@ module Dependabot
           end
         end
 
-        # rubocop:disable Metrics/PerceivedComplexity
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -81,7 +80,6 @@ module Dependabot
             end
           end
         end
-        # rubocop:enable Metrics/PerceivedComplexity
 
         def replace_github_host(text)
           text.gsub(

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -0,0 +1,270 @@
+# frozen_string_literal: true
+
+require "dependabot/pull_request_creator/message_builder"
+
+module Dependabot
+  class PullRequestCreator
+    class MessageBuilder
+      class MetadataPresenter
+        extend Forwardable
+
+        attr_reader :dependency, :source, :metadata_finder,
+                    :vulnerabilities_fixed, :github_redirection_service
+
+        def_delegators :metadata_finder,
+                       :changelog_url,
+                       :changelog_text,
+                       :commits_url,
+                       :commits,
+                       :maintainer_changes,
+                       :releases_url,
+                       :releases_text,
+                       :source_url,
+                       :upgrade_guide_url,
+                       :upgrade_guide_text
+
+        def initialize(dependency:, source:, metadata_finder:,
+                       vulnerabilities_fixed:, github_redirection_service:)
+          @dependency = dependency
+          @source = source
+          @metadata_finder = metadata_finder
+          @vulnerabilities_fixed = vulnerabilities_fixed
+          @github_redirection_service = github_redirection_service
+        end
+
+        def to_s
+          msg = ""
+          msg += vulnerabilities_cascade
+          msg += release_cascade
+          msg += changelog_cascade
+          msg += upgrade_guide_cascade
+          msg += commits_cascade
+          msg += maintainer_changes_cascade
+          msg += break_tag unless msg == ""
+          "\n" + sanitize_links_and_mentions(msg, unsafe: true)
+        end
+
+        private
+
+        def vulnerabilities_cascade
+          return "" unless vulnerabilities_fixed&.any?
+
+          msg = ""
+          vulnerabilities_fixed.each do |v|
+            msg += serialized_vulnerability_details(v)
+          end
+
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Vulnerabilities fixed", body: msg)
+        end
+
+        def release_cascade
+          return "" unless releases_text && releases_url
+
+          msg = "*Sourced from [#{dependency.display_name}'s releases]"\
+                "(#{releases_url}).*\n\n"
+          msg += quote_and_truncate(releases_text)
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(
+            text: msg,
+            base_url: source_url + "/blob/HEAD/"
+          )
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Release notes", body: msg)
+        end
+
+        def changelog_cascade
+          return "" unless changelog_url && changelog_text
+
+          msg = "*Sourced from "\
+                "[#{dependency.display_name}'s changelog]"\
+                "(#{changelog_url}).*\n\n"
+          msg += quote_and_truncate(changelog_text)
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(text: msg, base_url: changelog_url)
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Changelog", body: msg)
+        end
+
+        def upgrade_guide_cascade
+          return "" unless upgrade_guide_url && upgrade_guide_text
+
+          msg = "*Sourced from "\
+                "[#{dependency.display_name}'s upgrade guide]"\
+                "(#{upgrade_guide_url}).*\n\n"
+          msg += quote_and_truncate(upgrade_guide_text)
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Upgrade guide", body: msg)
+        end
+
+        def commits_cascade
+          return "" unless commits_url && commits
+
+          msg = ""
+
+          commits.reverse.first(10).each do |commit|
+            title = commit[:message].strip.split("\n").first
+            title = title.slice(0..76) + "..." if title && title.length > 80
+            title = title&.gsub(/(?<=[^\w.-])([_*`~])/, '\\1')
+            sha = commit[:sha][0, 7]
+            msg += "- [`#{sha}`](#{commit[:html_url]}) #{title}\n"
+          end
+
+          msg = msg.gsub(/\<.*?\>/) { |tag| "\\#{tag}" }
+
+          msg +=
+            if commits.count > 10
+              "- Additional commits viewable in "\
+              "[compare view](#{commits_url})\n"
+            else
+              "- See full diff in [compare view](#{commits_url})\n"
+            end
+          msg = link_issues(text: msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Commits", body: msg)
+        end
+
+        def maintainer_changes_cascade
+          return "" unless maintainer_changes
+
+          build_details_tag(
+            summary: "Maintainer changes",
+            body: sanitize_links_and_mentions(maintainer_changes) + "\n"
+          )
+        end
+
+        def build_details_tag(summary:, body:)
+          # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
+          # CodeCommit does not support the <details> tag (no url available)
+          if source_provider_supports_html?
+            msg = "<details>\n<summary>#{summary}</summary>\n\n"
+            msg += body
+            msg + "</details>\n"
+          else
+            "\n\##{summary}\n\n#{body}"
+          end
+        end
+
+        def serialized_vulnerability_details(details)
+          msg = vulnerability_source_line(details)
+
+          if details["title"]
+            msg += "> **#{details['title'].lines.map(&:strip).join(' ')}**\n"
+          end
+
+          if (description = details["description"])
+            description.strip.lines.first(20).each { |line| msg += "> #{line}" }
+            msg += truncated_line if description.strip.lines.count > 20
+          end
+
+          msg += "\n" unless msg.end_with?("\n")
+          msg += "> \n"
+          msg += vulnerability_version_range_lines(details)
+          msg + "\n"
+        end
+
+        def vulnerability_source_line(details)
+          if details["source_url"] && details["source_name"]
+            "*Sourced from [#{details['source_name']}]"\
+            "(#{details['source_url']}).*\n\n"
+          elsif details["source_name"]
+            "*Sourced from #{details['source_name']}.*\n\n"
+          else
+            ""
+          end
+        end
+
+        def vulnerability_version_range_lines(details)
+          msg = ""
+          %w(
+            patched_versions
+            unaffected_versions
+            affected_versions
+          ).each do |tp|
+            type = tp.split("_").first.capitalize
+            next unless details[tp]
+
+            versions_string = details[tp].any? ? details[tp].join("; ") : "none"
+            versions_string = versions_string.gsub(/(?<!\\)~/, '\~')
+            msg += "> #{type} versions: #{versions_string}\n"
+          end
+          msg
+        end
+
+        def link_issues(text:)
+          IssueLinker.
+            new(source_url: source_url).
+            link_issues(text: text)
+        end
+
+        def fix_relative_links(text:, base_url:)
+          text.gsub(/\[.*?\]\([^)]+\)/) do |link|
+            next link if link.include?("://")
+
+            relative_path = link.match(/\((.*?)\)/).captures.last
+            base = base_url.split("://").last.gsub(%r{[^/]*$}, "")
+            path = File.join(base, relative_path)
+            absolute_path =
+              base_url.sub(
+                %r{(?<=://).*$},
+                Pathname.new(path).cleanpath.to_s
+              )
+            link.gsub(relative_path, absolute_path)
+          end
+        end
+
+        def quote_and_truncate(text, limit: 50)
+          lines = text.split("\n")
+          lines.first(limit).tap do |limited_lines|
+            limited_lines.map! { |line| "> #{line}\n" }
+            limited_lines << truncated_line if lines.count > limit
+          end.join
+        end
+
+        def truncated_line
+          # Tables can spill out of truncated details, so we close them
+          "></tr></table> \n ... (truncated)\n"
+        end
+
+        def break_tag
+          source_provider_supports_html? ? "\n<br />" : "\n\n"
+        end
+
+        def source_provider_supports_html?
+          !%w(azure codecommit).include?(source.provider)
+        end
+
+        def sanitize_links_and_mentions(text, unsafe: false)
+          return text unless source.provider == "github"
+
+          LinkAndMentionSanitizer.
+            new(github_redirection_service: github_redirection_service).
+            sanitize_links_and_mentions(text: text, unsafe: unsafe)
+        end
+
+        def sanitize_template_tags(text)
+          text.gsub(/\<.*?\>/) do |tag|
+            tag_contents = tag.match(/\<(.*?)\>/).captures.first.strip
+
+            # Unclosed calls to template overflow out of the blockquote block,
+            # wrecking the rest of our PRs. Other tags don't share this problem.
+            next "\\#{tag}" if tag_contents.start_with?("template")
+
+            tag
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -172,6 +172,7 @@ module Dependabot
         last_dependabot_commit_message&.split(/[:(]/)&.first
       end
 
+      # rubocop:disable Metrics/PerceivedComplexity
       def using_angular_commit_messages?
         return false if recent_commit_messages.none?
 
@@ -202,6 +203,7 @@ module Dependabot
 
         true
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
       def using_eslint_commit_messages?
         return false if recent_commit_messages.none?

data/lib/dependabot/shared_helpers.rb

@@ -178,6 +178,7 @@ module Dependabot
       )
     end
 
+    # rubocop:disable Metrics/PerceivedComplexity
     def self.configure_git_credentials(credentials)
       # Then add a file-based credential store that loads a file in this repo.
       # Under the hood this uses git credential-store, but it's invoked through
@@ -221,6 +222,7 @@ module Dependabot
       # Save the file
       File.write("git.store", git_store_content)
     end
+    # rubocop:enable Metrics/PerceivedComplexity
 
     def self.reset_git_repo(path)
       Dir.chdir(path) do

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.119.1"
+  VERSION = "0.119.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.119.1
+  version: 0.119.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-28 00:00:00.000000000 Z
+date: 2020-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -292,14 +292,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 0.90.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 0.90.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -376,6 +376,7 @@ files:
 - lib/dependabot/pull_request_creator/message_builder.rb
 - lib/dependabot/pull_request_creator/message_builder/issue_linker.rb
 - lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb
+- lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb
 - lib/dependabot/pull_request_creator/pr_name_prefixer.rb
 - lib/dependabot/pull_request_updater.rb
 - lib/dependabot/pull_request_updater/github.rb