dependabot-common 0.182.3 → 0.184.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a267ab86dd573b42a5e59a3c774c6eebff8408c6e4971aae9094c2187c28a4d
-  data.tar.gz: a78c5e2c3faa1a6e348a7d7d85bb302a54db7985fc3f4bb4a9cad1bc7ad8cacb
+  metadata.gz: 1f44df2ce3890d903dec3b0d80f09e001663aa8f4f8d312b2a58725234e7c0f2
+  data.tar.gz: 8ba71628492c1dcc6f16b0c1250439b591f21839116a20f0e50e59c80a6a728b
 SHA512:
-  metadata.gz: 51ce9e29e664405eb9ebfa7f820c3fbe8955870812149ad944573b5299c8f372a7990397fcbd4dec70aeffd649e738add07d8992d592d6fade9c757de0ea09c3
-  data.tar.gz: 011547f88cfc9308b013ddc9511f8a25826dc0d0eb322bbaa5ba386facf8562bea6beb8ecca23bdba1d44d3e0b3937595d6e627c0245a80d565ce5af829258e3
+  metadata.gz: 504bcbf1da5aa92ab8bc47dee907e45a0faa9e04cb095cba0391765e66e6c99978063ae807674e05d24301b2cb640e08da80efb456151649994d23280721f3a9
+  data.tar.gz: 5a62bdb0538b6eabfcb6b7ee7b5b17892a8766e45093139bba29701d2a3a59dc297a969407a4b47b46a3fd2ae86df847e88d2b14f033a1f72cff1079e0ba6e1e

data/lib/dependabot/clients/bitbucket.rb

@@ -160,7 +160,8 @@ module Dependabot
           url,
           user: credentials&.fetch("username", nil),
           password: credentials&.fetch("password", nil),
-          idempotent: true,
+          # Setting to false to prevent Excon retries, use BitbucketWithRetries for retries.
+          idempotent: false,
           **Dependabot::SharedHelpers.excon_defaults(
             headers: auth_header
           )

data/lib/dependabot/git_metadata_fetcher.rb

@@ -48,7 +48,6 @@ module Dependabot
 
     attr_reader :url, :credentials
 
-    # rubocop:disable Metrics/PerceivedComplexity
     def fetch_upload_pack_for(uri)
       response = fetch_raw_upload_pack_for(uri)
       return response.body if response.status == 200
@@ -70,15 +69,10 @@ module Dependabot
 
       raise Dependabot::GitDependenciesNotReachable, [uri]
     rescue Excon::Error::Socket, Excon::Error::Timeout
-      retry_count ||= 0
-      retry_count += 1
-
-      sleep(rand(0.9)) && retry if retry_count <= 2 && uri.match?(KNOWN_HOSTS)
       raise if uri.match?(KNOWN_HOSTS)
 
       raise Dependabot::GitDependenciesNotReachable, [uri]
     end
-    # rubocop:enable Metrics/PerceivedComplexity
 
     def fetch_raw_upload_pack_for(uri)
       url = service_pack_uri(uri)

data/lib/dependabot/shared_helpers.rb

@@ -160,8 +160,8 @@ module Dependabot
     end
 
     def self.with_git_configured(credentials:)
-      backup_git_config_path = stash_global_git_config
-      configure_git_to_use_https_with_credentials(credentials)
+      backup_git_config_path, safe_directories = stash_global_git_config
+      configure_git_to_use_https_with_credentials(credentials, safe_directories)
       yield
     rescue Errno::ENOSPC => e
       raise Dependabot::OutOfDisk, e.message
@@ -175,7 +175,7 @@ module Dependabot
 
     # rubocop:disable Metrics/AbcSize
     # rubocop:disable Metrics/PerceivedComplexity
-    def self.configure_git_to_use_https_with_credentials(credentials)
+    def self.configure_git_to_use_https_with_credentials(credentials, safe_directories)
       File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
         file << "# Generated by dependabot/dependabot-core"
       end
@@ -190,6 +190,12 @@ module Dependabot
         allow_unsafe_shell_command: true
       )
 
+      # see https://github.blog/2022-04-12-git-security-vulnerability-announced/
+      safe_directories ||= []
+      safe_directories.each do |path|
+        run_shell_command("git config --global --add safe.directory #{path}")
+      end
+
       github_credentials = credentials.
                            select { |c| c["type"] == "git_source" }.
                            select { |c| c["host"] == "github.com" }.
@@ -267,8 +273,13 @@ module Dependabot
       digest = Digest::SHA2.hexdigest(contents)[0...10]
       backup_path = GIT_CONFIG_GLOBAL_PATH + ".backup-#{digest}"
 
+      # to preserve safe directories from global .gitconfig
+      output, process = Open3.capture2("git config --global --get-all safe.directory")
+      safe_directories = []
+      safe_directories = output.split("\n").compact if process.success?
+
       FileUtils.mv(GIT_CONFIG_GLOBAL_PATH, backup_path)
-      backup_path
+      [backup_path, safe_directories]
     end
 
     def self.reset_global_git_config(backup_path)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.182.3"
+  VERSION = "0.184.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.182.3
+  version: 0.184.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-25 00:00:00.000000000 Z
+date: 2022-05-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -222,20 +222,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.4.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.4.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -312,28 +298,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.27.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.27.0
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.28.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.28.2
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -497,7 +469,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.7.3
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Shared code used between Dependabot package managers