dependabot-common 0.123.1 → 0.124.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf06616b587097abdac55ec205266b02b7a601593d49318defc0240415d49e28
-  data.tar.gz: fcb15e0dfd5f07d5836ac4397f2b5ad247593dfd1aca0877299c929329ae5e0d
+  metadata.gz: 50e57b1a257d59576c24575a534069736197b6113cc7dd40cb893c3fd956163a
+  data.tar.gz: bbf0c5e4ddf71645bd79bce4926bcb4f8b57f3e511ae575d2db7843ee48a2110
 SHA512:
-  metadata.gz: c0caf4d2b293cfef2049a59e7bee8eb05cb3b2e6ab95168fdfe588fb6fb3e232363f9aaab14e20669440b8af84a23e5442eda65c90b76a7bceb51c52c634cf31
-  data.tar.gz: 5e301d79b9fa6fe51dbbdf49e1c901593d4ba796925e131ebad9b6c4258c132849318c311ed557badb8e131e6e46faba3d8ec8f9d51e21d04b0bd930ebeb83fd
+  metadata.gz: 73a199310a81d48b0c9325f6ff8568192cce7fbd89e9fd432a75636ff24d4bbe80e38f00ecaa61f1f80579c075e87872022a71b7fdfab345f0a75ea3248fa210
+  data.tar.gz: ef8e642c0cb9de980c1f07a766b6f61113353ca80e10fd0d82a1ac87a32f282a408e4a00f9cb1c1cd6829e039ae41eea9f0a51120a9e514b74f2bbcc7ccac42a

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -18,7 +18,10 @@ module Dependabot
         return [] unless repo_contents_path && vendor_dir
 
         Dir.chdir(repo_contents_path) do
-          relative_dir = vendor_dir.sub("#{repo_contents_path}/", "")
+          relative_dir = Pathname.new(vendor_dir).relative_path_from(
+            repo_contents_path
+          )
+
           status = SharedHelpers.run_shell_command(
             "git status --untracked-files=all --porcelain=v1 #{relative_dir}"
           )
@@ -31,8 +34,14 @@ module Dependabot
               encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
               encoded_content = Base64.encode64(encoded_content) unless deleted
             end
+
+            project_root =
+              Pathname.new(File.expand_path(File.join(Dir.pwd, base_directory)))
+            file_path =
+              Pathname.new(path).expand_path.relative_path_from(project_root)
+
             Dependabot::DependencyFile.new(
-              name: path,
+              name: file_path.to_s,
               content: encoded_content,
               directory: base_directory,
               deleted: deleted,

data/lib/dependabot/security_advisory.rb

@@ -43,6 +43,51 @@ module Dependabot
       safe_versions.any?
     end
 
+    # Check if the advisory is fixed by the updated dependency
+    #
+    # @param dependency [Dependabot::Dependency] Updated dependency
+    # @return [Boolean]
+    def fixed_by?(dependency)
+      # Handle case mismatch between the security advisory and parsed name
+      return false unless dependency_name.downcase == dependency.name.downcase
+      return false unless package_manager == dependency.package_manager
+      # TODO: Support no previous version to the same level as dependency graph
+      # and security alerts. We currently ignore dependency updates without a
+      # previous version because we don't know if the dependency was vulerable.
+      return false unless dependency.previous_version
+      return false unless version_class.correct?(dependency.previous_version)
+
+      # Ignore deps that weren't previously vulnerable
+      return false unless affects_version?(dependency.previous_version)
+
+      # Select deps that are now fixed
+      !affects_version?(dependency.version)
+    end
+
+    # Check if the version is affected by the advisory
+    #
+    # @param version [Dependabot::<Package Manager>::Version] version class
+    # @return [Boolean]
+    def affects_version?(version)
+      return false unless version_class.correct?(version)
+      return false unless [*safe_versions, *vulnerable_versions].any?
+
+      version = version_class.new(version)
+
+      # If version is known safe for this advisory, it's not vulnerable
+      return false if safe_versions.any? { |r| r.satisfied_by?(version) }
+
+      # If in the vulnerable range and not known safe, it's vulnerable
+      return true if vulnerable_versions.any? { |r| r.satisfied_by?(version) }
+
+      # If a vulnerable range present but not met, it's not vulnerable
+      return false if vulnerable_versions.any?
+
+      # Finally, if no vulnerable range provided, but a safe range provided,
+      # and this versions isn't included (checked earler), it's vulnerable
+      safe_versions.any?
+    end
+
     private
 
     def convert_string_version_requirements

data/lib/dependabot/shared_helpers.rb

@@ -42,6 +42,9 @@ module Dependabot
         path = Pathname.new(File.join(repo_contents_path, directory)).
                expand_path
         reset_git_repo(repo_contents_path)
+        # Handle missing directories by creating an empty one and relying on the
+        # file fetcher to raise a DependencyFileNotFound error
+        FileUtils.mkdir_p(path) unless Dir.exist?(path)
         Dir.chdir(path) { yield(path) }
       else
         in_a_temporary_directory(directory, &block)
@@ -58,13 +61,14 @@ module Dependabot
     end
 
     class HelperSubprocessFailed < StandardError
-      attr_reader :error_class, :error_context
+      attr_reader :error_class, :error_context, :trace
 
-      def initialize(message:, error_context:, error_class: nil)
+      def initialize(message:, error_context:, error_class: nil, trace: nil)
         super(message)
         @error_class = error_class || ""
         @error_context = error_context
         @command = error_context[:command]
+        @trace = trace
       end
 
       def raven_context
@@ -113,7 +117,8 @@ module Dependabot
       raise HelperSubprocessFailed.new(
         message: response["error"],
         error_class: response["error_class"],
-        error_context: error_context
+        error_context: error_context,
+        trace: response["trace"]
       )
     rescue JSON::ParserError
       raise HelperSubprocessFailed.new(

data/lib/dependabot/update_checkers/base.rb

@@ -79,6 +79,12 @@ module Dependabot
         raise NotImplementedError
       end
 
+      # Lowest available security fix version not checking resolvability
+      # @return [Dependabot::<package manager>::Version, #to_s] version class
+      def lowest_security_fix_version
+        raise NotImplementedError
+      end
+
       def lowest_resolvable_security_fix_version
         raise NotImplementedError
       end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.123.1"
+  VERSION = "0.124.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.123.1
+  version: 0.124.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-19 00:00:00.000000000 Z
+date: 2020-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -438,7 +438,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.7.3
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Shared code used between Dependabot package managers