dependabot-common 0.122.1 → 0.124.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86a9ccf63224238e2e7f39527f062c1f24f393d321adef7fb79a6723f943baa2
-  data.tar.gz: fac6a851e46d4be8107ca182e24beaea98849a59ab8bd3881e4149646e9f7e13
+  metadata.gz: f8c1c6ce7dbce6606fe13ea021cddbdf6cc73561227f1e944024b0cd59c066f8
+  data.tar.gz: 43be3e7cd0d8c583d2286a909d5c616b126eda8d1800db931ebf9ed66ee013bd
 SHA512:
-  metadata.gz: 7cbc55bfba0ad3fe380e192fa93fa1b789ca03a997357656a226b671b80425d5a84d4e769a2df9b7571659e8a218427573e7a139fc8a01956cb940a4e5028769
-  data.tar.gz: dbf7ee136e1f93f7fa27a5495c70e6dcc6c0107728000f386c1605e621ab3a287a62d00fd60fd4debe1967e611b4e64aa7e25a7451fe55520eea5107841bec14
+  metadata.gz: d8a3a6a7ca1e6910132f9c102c13547310eb38e1ac899df526a7fe6bf0cb8ebc264962b3f5ff9376a77f85e5cc5f385de81d58a1ccbfd165c295a9c9c5270d96
+  data.tar.gz: 90c3aa1296c25e4616de3f29b83d5fb49c6dea2e05ccc12fa1c1f69d37342442cfc41acad10a9258d88352c21ff988a3417ae768fb559365873e317413194c23

data/lib/dependabot/pull_request_creator.rb

@@ -73,7 +73,7 @@ module Dependabot
     end
 
     def check_dependencies_have_previous_version
-      return if library? && dependencies.all? { |d| requirements_changed?(d) }
+      return if dependencies.all? { |d| requirements_changed?(d) }
       return if dependencies.all?(&:previous_version)
 
       raise "Dependencies must have a previous version or changed " \
@@ -214,12 +214,6 @@ module Dependabot
         )
     end
 
-    def library?
-      return true if files.any? { |file| file.name.end_with?(".gemspec") }
-
-      dependencies.any? { |d| !d.appears_in_lockfile? }
-    end
-
     def includes_security_fixes?
       vulnerabilities_fixed.values.flatten.any?
     end

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -165,12 +165,12 @@ module Dependabot
         updated_reqs.first[:requirement]
       end
 
-      # TODO: Look into bringing this in line with existing library checks that
-      # we do in the update checkers, which are also overriden by passing an
-      # explicit `requirements_update_strategy`.
+      # TODO: Bring this in line with existing library checks that we do in the
+      # update checkers, which are also overriden by passing an explicit
+      # `requirements_update_strategy`.
+      #
+      # TODO re-use in MessageBuilder
       def library?
-        return true if files.map(&:name).any? { |nm| nm.end_with?(".gemspec") }
-
         dependencies.any? { |d| !d.appears_in_lockfile? }
       end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -459,8 +459,16 @@ module Dependabot
         previous_ref(dependency) != new_ref(dependency)
       end
 
+      # TODO: Bring this in line with existing library checks that we do in the
+      # update checkers, which are also overriden by passing an explicit
+      # `requirements_update_strategy`.
+      #
+      # TODO re-use in BranchNamer
       def library?
-        return true if files.map(&:name).any? { |nm| nm.end_with?(".gemspec") }
+        # Reject any nested child gemspecs/vendored git dependencies
+        root_files = files.map(&:name).
+                     select { |p| Pathname.new(p).dirname.to_s == "." }
+        return true if root_files.select { |nm| nm.end_with?(".gemspec") }.any?
 
         dependencies.any? { |d| previous_version(d).nil? }
       end

data/lib/dependabot/security_advisory.rb

@@ -43,6 +43,42 @@ module Dependabot
       safe_versions.any?
     end
 
+    def fixes_advisory?(dependency)
+      return false unless dependency_name == dependency.name
+      return false unless package_manager == dependency.package_manager
+      # TODO: Support no previous version to the same level as dependency graph
+      # and security alerts. We currently ignore dependency updates without a
+      # previous version because we don't know if the dependency was vulerable.
+      return false unless dependency.previous_version
+      return false unless version_class.correct?(dependency.previous_version)
+
+      # Ignore deps that weren't previously vulnerable
+      return false unless affects_version?(dependency.previous_version)
+
+      # Select deps that are now fixed
+      !affects_version?(dependency.version)
+    end
+
+    def affects_version?(version)
+      return false unless version_class.correct?(version)
+      return false unless [*safe_versions, *vulnerable_versions].any?
+
+      version = version_class.new(version)
+
+      # If version is known safe for this advisory, it's not vulnerable
+      return false if safe_versions.any? { |r| r.satisfied_by?(version) }
+
+      # If in the vulnerable range and not known safe, it's vulnerable
+      return true if vulnerable_versions.any? { |r| r.satisfied_by?(version) }
+
+      # If a vulnerable range present but not met, it's not vulnerable
+      return false if vulnerable_versions.any?
+
+      # Finally, if no vulnerable range provided, but a safe range provided,
+      # and this versions isn't included (checked earler), it's vulnerable
+      safe_versions.any?
+    end
+
     private
 
     def convert_string_version_requirements

data/lib/dependabot/shared_helpers.rb

@@ -57,34 +57,12 @@ module Dependabot
       end
     end
 
-    def self.in_a_forked_process
-      read, write = IO.pipe
-
-      pid = fork do
-        read.close
-        result = yield
-      rescue Exception => e # rubocop:disable Lint/RescueException
-        result = { _error_details: { error_class: e.class.to_s,
-                                     error_message: e.message,
-                                     error_backtrace: e.backtrace } }
-      ensure
-        Marshal.dump(result, write)
-        exit!(0)
-      end
-
-      write.close
-      result = read.read
-      Process.wait(pid)
-      result = Marshal.load(result) # rubocop:disable Security/MarshalLoad
-
-      return result unless result.is_a?(Hash) && result[:_error_details]
-
-      raise ChildProcessFailed, result[:_error_details]
-    end
-
     class HelperSubprocessFailed < StandardError
-      def initialize(message:, error_context:)
+      attr_reader :error_class, :error_context
+
+      def initialize(message:, error_context:, error_class: nil)
         super(message)
+        @error_class = error_class || ""
         @error_context = error_context
         @command = error_context[:command]
       end
@@ -110,6 +88,11 @@ module Dependabot
       stdout, stderr, process = Open3.capture3(*env_cmd, stdin_data: stdin_data)
       time_taken = Time.now - start
 
+      if ENV["DEBUG_HELPERS"] == "true"
+        puts stdout
+        puts stderr
+      end
+
       # Some package managers output useful stuff to stderr instead of stdout so
       # we want to parse this, most package manager will output garbage here so
       # would mess up json response from stdout
@@ -129,11 +112,13 @@ module Dependabot
 
       raise HelperSubprocessFailed.new(
         message: response["error"],
+        error_class: response["error_class"],
         error_context: error_context
       )
     rescue JSON::ParserError
       raise HelperSubprocessFailed.new(
         message: stdout || "No output from command",
+        error_class: "JSON::ParserError",
         error_context: error_context
       )
     end

data/lib/dependabot/update_checkers/base.rb

@@ -79,6 +79,12 @@ module Dependabot
         raise NotImplementedError
       end
 
+      # Lowest available security fix version not checking resolvability
+      # @return [Dependabot::<package manager>::Version, #to_s] version class
+      def lowest_security_fix_version
+        raise NotImplementedError
+      end
+
       def lowest_resolvable_security_fix_version
         raise NotImplementedError
       end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.122.1"
+  VERSION = "0.124.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.122.1
+  version: 0.124.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-13 00:00:00.000000000 Z
+date: 2020-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit