dependabot-common 0.122.0 → 0.124.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cb8d42beb59f598224b8eeabe01953e3feb92f61e63231ae2e6842f1d848269
-  data.tar.gz: 5a89adfdc3206b73f54a7fc3d72dcb04c18524d6becdb910f9de5f89bbcb8ae3
+  metadata.gz: bd5f760de88f18b1b02d000700ee31816399598f649fb1c0dc517d9e4ee64f53
+  data.tar.gz: 66afb451c31cbcf860a06b605ccfc7303aea932ec52092f0c11206ae5f3d68e8
 SHA512:
-  metadata.gz: e97880807e925c059b3b48c9835f70981536b49b82a2e912c8d288fc19d46cb3e705c23a43cd31b3db626249f3383e95bbb334512cc4a7c834b625047c5d6640
-  data.tar.gz: 2f257b6b8e0344bd3992695fb6594702ec6df167f41043f450e22a6719907042286c0fb5f55cf8071d067f705aa4f24a57a9387c0937ea7f9e9f9754ab043f2f
+  metadata.gz: 9d83ee81a113febfbc73a802696a0cc2dbe0e09a3f55f86f7e601fe1f8e7692ff8c0bf21ddfa9c4e9d54b65327364a5cda53b3e1ee0c35483aaefa7239fc8f2c
+  data.tar.gz: 4dccba4c87d90ac14a87d8a2ef659da8c00746730c258b36b68b55bf76f15dce8914e61bce5a30c7b2de286093908c7b2e91bb59013b7cf86caa424921b78a9e

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -5,35 +5,6 @@ require "dependabot/dependency_file"
 module Dependabot
   module FileUpdaters
     class VendorUpdater
-      # notable filenames without a reliable extension:
-      TEXT_FILE_NAMES = [
-        "README",
-        "LICENSE",
-        "Gemfile",
-        "Gemfile.lock",
-        ".bundlecache",
-        ".gitignore"
-      ].freeze
-
-      TEXT_FILE_EXTS = [
-        # code
-        ".rb",
-        ".erb",
-        ".gemspec",
-        ".js",
-        ".html",
-        # config
-        ".json",
-        ".xml",
-        ".toml",
-        ".yaml",
-        ".yml",
-        # docs
-        ".md",
-        ".txt",
-        ".go"
-      ].freeze
-
       def initialize(repo_contents_path:, vendor_dir:)
         @repo_contents_path = repo_contents_path
         @vendor_dir = vendor_dir
@@ -73,13 +44,16 @@ module Dependabot
 
       private
 
+      BINARY_ENCODINGS = %w(application/x-tarbinary binary).freeze
+
       attr_reader :repo_contents_path, :vendor_dir
 
       def binary_file?(path)
-        return false if TEXT_FILE_NAMES.include?(File.basename(path))
-        return false if TEXT_FILE_EXTS.include?(File.extname(path))
+        return false unless File.exist?(path)
+
+        encoding = `file -b --mime-encoding #{path}`.strip
 
-        true
+        BINARY_ENCODINGS.include?(encoding)
       end
     end
   end

data/lib/dependabot/pull_request_creator.rb

@@ -73,7 +73,7 @@ module Dependabot
     end
 
     def check_dependencies_have_previous_version
-      return if library? && dependencies.all? { |d| requirements_changed?(d) }
+      return if dependencies.all? { |d| requirements_changed?(d) }
       return if dependencies.all?(&:previous_version)
 
       raise "Dependencies must have a previous version or changed " \
@@ -214,12 +214,6 @@ module Dependabot
         )
     end
 
-    def library?
-      return true if files.any? { |file| file.name.end_with?(".gemspec") }
-
-      dependencies.any? { |d| !d.appears_in_lockfile? }
-    end
-
     def includes_security_fixes?
       vulnerabilities_fixed.values.flatten.any?
     end

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -165,12 +165,12 @@ module Dependabot
         updated_reqs.first[:requirement]
       end
 
-      # TODO: Look into bringing this in line with existing library checks that
-      # we do in the update checkers, which are also overriden by passing an
-      # explicit `requirements_update_strategy`.
+      # TODO: Bring this in line with existing library checks that we do in the
+      # update checkers, which are also overriden by passing an explicit
+      # `requirements_update_strategy`.
+      #
+      # TODO re-use in MessageBuilder
       def library?
-        return true if files.map(&:name).any? { |nm| nm.end_with?(".gemspec") }
-
         dependencies.any? { |d| !d.appears_in_lockfile? }
       end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -459,8 +459,16 @@ module Dependabot
         previous_ref(dependency) != new_ref(dependency)
       end
 
+      # TODO: Bring this in line with existing library checks that we do in the
+      # update checkers, which are also overriden by passing an explicit
+      # `requirements_update_strategy`.
+      #
+      # TODO re-use in BranchNamer
       def library?
-        return true if files.map(&:name).any? { |nm| nm.end_with?(".gemspec") }
+        # Reject any nested child gemspecs/vendored git dependencies
+        root_files = files.map(&:name).
+                     select { |p| Pathname.new(p).dirname.to_s == "." }
+        return true if root_files.select { |nm| nm.end_with?(".gemspec") }.any?
 
         dependencies.any? { |d| previous_version(d).nil? }
       end

data/lib/dependabot/shared_helpers.rb

@@ -57,34 +57,12 @@ module Dependabot
       end
     end
 
-    def self.in_a_forked_process
-      read, write = IO.pipe
-
-      pid = fork do
-        read.close
-        result = yield
-      rescue Exception => e # rubocop:disable Lint/RescueException
-        result = { _error_details: { error_class: e.class.to_s,
-                                     error_message: e.message,
-                                     error_backtrace: e.backtrace } }
-      ensure
-        Marshal.dump(result, write)
-        exit!(0)
-      end
-
-      write.close
-      result = read.read
-      Process.wait(pid)
-      result = Marshal.load(result) # rubocop:disable Security/MarshalLoad
-
-      return result unless result.is_a?(Hash) && result[:_error_details]
-
-      raise ChildProcessFailed, result[:_error_details]
-    end
-
     class HelperSubprocessFailed < StandardError
-      def initialize(message:, error_context:)
+      attr_reader :error_class, :error_context
+
+      def initialize(message:, error_context:, error_class: nil)
         super(message)
+        @error_class = error_class || ""
         @error_context = error_context
         @command = error_context[:command]
       end
@@ -110,6 +88,11 @@ module Dependabot
       stdout, stderr, process = Open3.capture3(*env_cmd, stdin_data: stdin_data)
       time_taken = Time.now - start
 
+      if ENV["DEBUG_HELPERS"] == "true"
+        puts stdout
+        puts stderr
+      end
+
       # Some package managers output useful stuff to stderr instead of stdout so
       # we want to parse this, most package manager will output garbage here so
       # would mess up json response from stdout
@@ -129,11 +112,13 @@ module Dependabot
 
       raise HelperSubprocessFailed.new(
         message: response["error"],
+        error_class: response["error_class"],
         error_context: error_context
       )
     rescue JSON::ParserError
       raise HelperSubprocessFailed.new(
         message: stdout || "No output from command",
+        error_class: "JSON::ParserError",
         error_context: error_context
       )
     end
@@ -173,6 +158,9 @@ module Dependabot
     end
 
     def self.configure_git_to_use_https_with_credentials(credentials)
+      File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
+        file << "# Generated by dependabot/dependabot-core"
+      end
       configure_git_to_use_https
       configure_git_credentials(credentials)
     end
@@ -258,7 +246,10 @@ module Dependabot
     end
 
     def self.reset_global_git_config(backup_path)
-      return if backup_path.nil?
+      if backup_path.nil?
+        FileUtils.rm(GIT_CONFIG_GLOBAL_PATH)
+        return
+      end
       return unless File.exist?(backup_path)
 
       FileUtils.mv(backup_path, GIT_CONFIG_GLOBAL_PATH)

data/lib/dependabot/update_checkers/base.rb

@@ -79,6 +79,12 @@ module Dependabot
         raise NotImplementedError
       end
 
+      # Lowest available security fix version not checking resolvability
+      # @return [Dependabot::<package manager>::Version, #to_s] version class
+      def lowest_security_fix_version
+        raise NotImplementedError
+      end
+
       def lowest_resolvable_security_fix_version
         raise NotImplementedError
       end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.122.0"
+  VERSION = "0.124.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.122.0
+  version: 0.124.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-07 00:00:00.000000000 Z
+date: 2020-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -292,14 +292,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.92.0
+        version: 0.93.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.92.0
+        version: 0.93.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement