dependabot-common 0.154.2 → 0.155.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11d71b6ef97735d3dfdcd6fd67314262bf53d6c7ec565c78a975803c8665c15a
-  data.tar.gz: 51d69fc1c885d25c3016634573acd3290595be8aa48119ba8206ec6989981654
+  metadata.gz: 9e87672cce71dc3ce34fee4e3b62e137345631139157c6bdd4586718af432f4d
+  data.tar.gz: 54691c078c9a37674a4a1fa4fe84027c4571963911eefe394eb7ba27c6f5ab87
 SHA512:
-  metadata.gz: 6d070601406562596178c17385dd8ff387444eab6e5d78f894e45d5c9aed76295a362f188e95efd6224bf049db43973279d22b56b373263332de9919899c9a44
-  data.tar.gz: 39220483eaf1adb2f820c0bf6aceb03e8c42d5ee4d2dedc55a2af4a07bf3fe874e2ea7f6073e6d9e442cb6039d8e317027d915dfa5eed35f9df58252af9cde94
+  metadata.gz: 2c91a3a0842721537868b41dbac05b3478bddbcd76f8dae2ed1bcbdd96e3307abb92fa790ed9ab2ab422713a9e803b57e0bebd03060175deeb5e2d4b9f00d840
+  data.tar.gz: 2f424cb2939cbdd6c018dae3ad361a0eb5ba22c21e983ff033e49ecda4216e03f68b03f6d22151b718bb84129fc2c3685977b81d1f36842f3769837ed45afd78

data/lib/dependabot/dependency.rb

@@ -154,7 +154,7 @@ module Dependabot
     end
 
     def symbolize_keys(hash)
-      Hash[hash.keys.map { |k| [k.to_sym, hash[k]] }]
+      hash.keys.map { |k| [k.to_sym, hash[k]] }.to_h
     end
   end
 end

data/lib/dependabot/file_fetchers/base.rb

@@ -330,8 +330,8 @@ module Dependabot
 
         response.files.map do |file|
           OpenStruct.new(
-            name: file.absolute_path,
-            path: file.absolute_path,
+            name: File.basename(file.relative_path),
+            path: file.relative_path,
             type: "file",
             size: 0 # file size would require new api call per file..
           )

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -25,7 +25,7 @@ module Dependabot
           status = SharedHelpers.run_shell_command(
             "git status --untracked-files all --porcelain v1 #{relative_dir}"
           )
-          changed_paths = status.split("\n").map { |l| l.split(" ") }
+          changed_paths = status.split("\n").map(&:split)
           changed_paths.map do |type, path|
             # The following types are possible to be returned:
             # M = Modified = Default for DependencyFile

data/lib/dependabot/git_metadata_fetcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "open3"
 require "dependabot/errors"
 
 module Dependabot
@@ -52,6 +53,9 @@ module Dependabot
       response = fetch_raw_upload_pack_for(uri)
       return response.body if response.status == 200
 
+      response_with_git = fetch_raw_upload_pack_with_git_for(uri)
+      return response_with_git.body if response_with_git.status == 200
+
       raise Dependabot::GitDependenciesNotReachable, [uri] unless uri.match?(KNOWN_HOSTS)
 
       raise "Unexpected response: #{response.status} - #{response.body}" if response.status < 400
@@ -86,6 +90,23 @@ module Dependabot
       )
     end
 
+    def fetch_raw_upload_pack_with_git_for(uri)
+      service_pack_uri = uri
+      service_pack_uri += ".git" unless service_pack_uri.end_with?(".git")
+
+      command = "git ls-remote #{service_pack_uri}"
+      env = { "PATH" => ENV["PATH"] }
+
+      stdout, stderr, process = Open3.capture3(env, command)
+      # package the command response like a HTTP response so error handling
+      # remains unchanged
+      if process.success?
+        OpenStruct.new(body: stdout, status: 200)
+      else
+        OpenStruct.new(body: stderr, status: 500)
+      end
+    end
+
     def tags_for_upload_pack
       refs_for_upload_pack.
         select { |ref| ref.ref_type == :tag }.
@@ -106,7 +127,7 @@ module Dependabot
       peeled_lines = []
 
       result = upload_pack.lines.each_with_object({}) do |line, res|
-        full_ref_name = line.split(" ").last
+        full_ref_name = line.split.last
         next unless full_ref_name.start_with?("refs/tags", "refs/heads")
 
         peeled_lines << line && next if line.strip.end_with?("^{}")
@@ -174,7 +195,7 @@ module Dependabot
     end
 
     def sha_for_update_pack_line(line)
-      line.split(" ").first.chars.last(40).join
+      line.split.first.chars.last(40).join
     end
 
     def excon_defaults

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -167,7 +167,7 @@ module Dependabot
 
         def serialize_release(release)
           rel = release
-          title = "## #{rel.name.to_s != '' ? rel.name : rel.tag_name}\n"
+          title = "## #{rel.name.to_s == '' ? rel.tag_name : rel.name}\n"
           body = if rel.body.to_s.gsub(/\n*\z/m, "") == ""
                    "No release notes provided."
                  else
@@ -178,7 +178,7 @@ module Dependabot
         end
 
         def release_body_includes_title?(release)
-          title = release.name.to_s != "" ? release.name : release.tag_name
+          title = release.name.to_s == "" ? release.tag_name : release.name
           release.body.to_s.match?(/\A\s*\#*\s*#{Regexp.quote(title)}/m)
         end
 

data/lib/dependabot/pull_request_creator/github.rb

@@ -267,7 +267,7 @@ module Dependabot
 
       def add_reviewers_to_pull_request(pull_request)
         reviewers_hash =
-          Hash[reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }]
+          reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }.to_h
 
         github_client_for_source.request_pull_request_review(
           source.repo,
@@ -297,7 +297,7 @@ module Dependabot
 
       def comment_with_invalid_reviewer(pull_request, message)
         reviewers_hash =
-          Hash[reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }]
+          reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }.to_h
         reviewers = []
         reviewers += reviewers_hash[:reviewers] || []
         reviewers += (reviewers_hash[:team_reviewers] || []).

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -153,7 +153,7 @@ module Dependabot
 
       def add_approvers_to_merge_request(merge_request)
         approvers_hash =
-          Hash[approvers.keys.map { |k| [k.to_sym, approvers[k]] }]
+          approvers.keys.map { |k| [k.to_sym, approvers[k]] }.to_h
 
         gitlab_client_for_source.edit_merge_request_approvers(
           source.repo,

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -51,10 +51,10 @@ module Dependabot
           doc.walk do |node|
             if node.type == :text &&
                node.string_content.match?(MENTION_REGEX)
-              nodes = if !parent_node_link?(node)
-                        build_mention_nodes(node.string_content)
-                      else
+              nodes = if parent_node_link?(node)
                         build_mention_link_text_nodes(node.string_content)
+                      else
+                        build_mention_nodes(node.string_content)
                       end
 
               nodes.each do |n|

data/lib/dependabot/shared_helpers.rb

@@ -65,7 +65,7 @@ module Dependabot
 
     # Escapes all special characters, e.g. = & | <>
     def self.escape_command(command)
-      command_parts = command.split(" ").map(&:strip).reject(&:empty?)
+      command_parts = command.split.map(&:strip).reject(&:empty?)
       Shellwords.join(command_parts)
     end
 

data/lib/dependabot/update_checkers/version_filters.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module UpdateCheckers
+    module VersionFilters
+      def self.filter_vulnerable_versions(versions_array, security_advisories)
+        versions_array.reject do |v|
+          security_advisories.any? do |a|
+            if v.is_a?(Gem::Version)
+              a.vulnerable?(v)
+            else
+              a.vulnerable?(v.fetch(:version))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.154.2"
+  VERSION = "0.155.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.154.2
+  version: 0.155.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-17 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -81,7 +81,7 @@ dependencies:
         version: 0.20.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 0.23.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -91,7 +91,7 @@ dependencies:
         version: 0.20.1
     - - "<"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 0.23.0
 - !ruby/object:Gem::Dependency
   name: docker_registry2
   requirement: !ruby/object:Gem::Requirement
@@ -446,6 +446,7 @@ files:
 - lib/dependabot/update_checkers.rb
 - lib/dependabot/update_checkers/README.md
 - lib/dependabot/update_checkers/base.rb
+- lib/dependabot/update_checkers/version_filters.rb
 - lib/dependabot/utils.rb
 - lib/dependabot/version.rb
 - lib/rubygems_version_patch.rb