dependabot-common 0.209.0 → 0.212.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 994a7ee1509cbaef535cc67655cb1707638d271e1f04645fc9fadff485259149
-  data.tar.gz: efca3b54851d22bfe9568f795cfcc6aa52177790d0c99f3b8dbf9f1d382e4534
+  metadata.gz: 5242196cd22b0092cbdaaf08f6d5ce3f4249d1eeccedada949822b0b14657e9c
+  data.tar.gz: f47437aa525423bdbb507dfa5b0978863e41f3010682ed1c6f321d2ac67efea9
 SHA512:
-  metadata.gz: 78ae2e2d95eb6b033548698e646c3dde4e15cfcfa4ad110604f6e9d2da21d9abe8029c95974c16f7b93bc87b58e4863b0ff17c7177427db57fafe928569852bf
-  data.tar.gz: a964c4d8e720d2787ed878bc8e003456ecc8a941c460e9404090f93e4012bdf35a78f2d828bf40b2a3540fbab19024e24235f125c964ec1e7c0e977a6d9c0b82
+  metadata.gz: cad3f4c8848f45b07d7769bdf4a1b351e3cca4f921bb449cee629ddffc3c579df3b1dfc9343ecfdabd1192d1f1e207e82f8af0c8ee0f142af5856e5bee769d0e
+  data.tar.gz: c564e966eba317b8b5e61bf4d82df255248ee4932711d85854e38e843ce0f26d0dc22a649cb7e2f475e01f2b0fd61dce160a46a5ecdc0cbe61d560fd5b004587

data/lib/dependabot/clients/azure.rb

@@ -310,7 +310,7 @@ module Dependabot
         # https://developercommunity.visualstudio.com/content/problem/608770/remove-4000-character-limit-on-pull-request-descri.html
         pr_description = pr_description.dup.force_encoding(Encoding::UTF_16)
         if pr_description.length > MAX_PR_DESCRIPTION_LENGTH
-          truncated_msg = "...\n\n_Description has been truncated_".dup.force_encoding(Encoding::UTF_16)
+          truncated_msg = (+"...\n\n_Description has been truncated_").force_encoding(Encoding::UTF_16)
           truncate_length = MAX_PR_DESCRIPTION_LENGTH - truncated_msg.length
           pr_description = (pr_description[0..truncate_length] + truncated_msg)
         end

data/lib/dependabot/clients/bitbucket.rb

@@ -189,8 +189,8 @@ module Dependabot
         raise NotFound if response.status == 404
 
         if response.status >= 400
-          raise "Unhandled Bitbucket error!\n"\
-                "Status: #{response.status}\n"\
+          raise "Unhandled Bitbucket error!\n" \
+                "Status: #{response.status}\n" \
                 "Body: #{response.body}"
         end
 

data/lib/dependabot/config/ignore_condition.rb

@@ -28,7 +28,7 @@ module Dependabot
       private
 
       def transformed_update_types
-        update_types.map(&:downcase).map(&:strip).compact
+        update_types.map(&:downcase).filter_map(&:strip)
       end
 
       def versions_by_type(dependency)

data/lib/dependabot/dependency.rb

@@ -41,7 +41,7 @@ module Dependabot
 
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil,
-                   subdependency_metadata: [])
+                   subdependency_metadata: [], removed: false)
       @name = name
       @version = version
       @requirements = requirements.map { |req| symbolize_keys(req) }
@@ -53,6 +53,7 @@ module Dependabot
         @subdependency_metadata = subdependency_metadata&.
                                   map { |h| symbolize_keys(h) }
       end
+      @removed = removed
 
       check_values
     end
@@ -61,6 +62,10 @@ module Dependabot
       requirements.any?
     end
 
+    def removed?
+      @removed
+    end
+
     def to_h
       {
         "name" => name,
@@ -69,7 +74,8 @@ module Dependabot
         "previous_version" => previous_version,
         "previous_requirements" => previous_requirements,
         "package_manager" => package_manager,
-        "subdependency_metadata" => subdependency_metadata
+        "subdependency_metadata" => subdependency_metadata,
+        "removed" => removed? ? true : nil
       }.compact
     end
 
@@ -114,9 +120,7 @@ module Dependabot
     private
 
     def check_values
-      if [version, previous_version].any? { |v| v == "" }
-        raise ArgumentError, "blank strings must not be provided as versions"
-      end
+      raise ArgumentError, "blank strings must not be provided as versions" if [version, previous_version].any?("")
 
       check_requirement_fields
       check_subdependency_metadata
@@ -124,8 +128,8 @@ module Dependabot
 
     def check_requirement_fields
       requirement_fields = [requirements, previous_requirements].compact
-      unless requirement_fields.all? { |r| r.is_a?(Array) } &&
-             requirement_fields.flatten.all? { |r| r.is_a?(Hash) }
+      unless requirement_fields.all?(Array) &&
+             requirement_fields.flatten.all?(Hash)
         raise ArgumentError, "requirements must be an array of hashes"
       end
 
@@ -133,9 +137,9 @@ module Dependabot
       optional_keys = %i(metadata)
       unless requirement_fields.flatten.
              all? { |r| required_keys.sort == (r.keys - optional_keys).sort }
-        raise ArgumentError, "each requirement must have the following "\
-                             "required keys: #{required_keys.join(', ')}."\
-                             "Optionally, it may have the following keys: "\
+        raise ArgumentError, "each requirement must have the following " \
+                             "required keys: #{required_keys.join(', ')}." \
+                             "Optionally, it may have the following keys: " \
                              "#{optional_keys.join(', ')}."
       end
 
@@ -148,13 +152,13 @@ module Dependabot
       return unless subdependency_metadata
 
       unless subdependency_metadata.is_a?(Array) &&
-             subdependency_metadata.all? { |r| r.is_a?(Hash) }
+             subdependency_metadata.all?(Hash)
         raise ArgumentError, "subdependency_metadata must be an array of hashes"
       end
     end
 
     def symbolize_keys(hash)
-      hash.keys.map { |k| [k.to_sym, hash[k]] }.to_h
+      hash.keys.to_h { |k| [k.to_sym, hash[k]] }
     end
   end
 end

data/lib/dependabot/errors.rb

@@ -124,8 +124,8 @@ module Dependabot
 
     def initialize(source)
       @source = sanitize_source(source)
-      msg = "The following source could not be reached as it requires "\
-            "authentication (and any provided details were invalid or lacked "\
+      msg = "The following source could not be reached as it requires " \
+            "authentication (and any provided details were invalid or lacked " \
             "the required permissions): #{@source}"
       super(msg)
     end
@@ -173,7 +173,7 @@ module Dependabot
       @dependency_urls =
         dependency_urls.flatten.map { |uri| filter_sensitive_data(uri) }
 
-      msg = "The following git URLs could not be retrieved: "\
+      msg = "The following git URLs could not be retrieved: " \
             "#{@dependency_urls.join(', ')}"
       super(msg)
     end
@@ -185,7 +185,7 @@ module Dependabot
     def initialize(dependency)
       @dependency = dependency
 
-      msg = "The branch or reference specified for #{@dependency} could not "\
+      msg = "The branch or reference specified for #{@dependency} could not " \
             "be retrieved"
       super(msg)
     end
@@ -196,7 +196,7 @@ module Dependabot
 
     def initialize(*dependencies)
       @dependencies = dependencies.flatten
-      msg = "The following path based dependencies could not be retrieved: "\
+      msg = "The following path based dependencies could not be retrieved: " \
             "#{@dependencies.join(', ')}"
       super(msg)
     end
@@ -210,8 +210,8 @@ module Dependabot
       @declared_path = declared_path
       @discovered_path = discovered_path
 
-      msg = "The module path '#{@declared_path}' found in #{@go_mod} doesn't "\
-            "match the actual path '#{@discovered_path}' in the dependency's "\
+      msg = "The module path '#{@declared_path}' found in #{@go_mod} doesn't " \
+            "match the actual path '#{@discovered_path}' in the dependency's " \
             "go.mod"
       super(msg)
     end

data/lib/dependabot/file_fetchers/base.rb

@@ -141,7 +141,7 @@ module Dependabot
 
         path = Pathname.new(File.join(directory, filename)).cleanpath.to_path
         content = _fetch_file_content(path, fetch_submodules: fetch_submodules)
-        type = @linked_paths.key?(path.gsub(%r{^/}, "")) ? "symlink" : type
+        type = "symlink" if @linked_paths.key?(path.gsub(%r{^/}, ""))
 
         DependencyFile.new(
           name: Pathname.new(filename).cleanpath.to_path,
@@ -233,8 +233,8 @@ module Dependabot
         repo_path = File.join(clone_repo_contents, relative_path)
         return [] unless Dir.exist?(repo_path)
 
-        Dir.entries(repo_path).map do |name|
-          next if [".", ".."].include?(name)
+        Dir.entries(repo_path).filter_map do |name|
+          next if name == "." || name == ".."
 
           absolute_path = File.join(repo_path, name)
           type = if File.symlink?(absolute_path)
@@ -251,7 +251,7 @@ module Dependabot
             type: type,
             size: 0 # NOTE: added for parity with github contents API
           )
-        end.compact
+        end
       end
 
       def update_linked_paths(repo, path, commit, github_response)

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -10,7 +10,7 @@ module Dependabot
       class DependencySet
         def initialize(dependencies = [], case_sensitive: false)
           unless dependencies.is_a?(Array) &&
-                 dependencies.all? { |dep| dep.is_a?(Dependency) }
+                 dependencies.all?(Dependency)
             raise ArgumentError, "must be an array of Dependency objects"
           end
 

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -18,9 +18,9 @@ module Dependabot
         return [] unless repo_contents_path && vendor_dir
 
         Dir.chdir(repo_contents_path) do
-          relative_dir = Pathname.new(vendor_dir).relative_path_from(
-            repo_contents_path
-          )
+          # rubocop:disable Performance/DeletePrefix
+          relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(vendor_dir)
+          # rubocop:enable Performance/DeletePrefix
 
           status = SharedHelpers.run_shell_command(
             "git status --untracked-files all --porcelain v1 #{relative_dir}"

data/lib/dependabot/git_commit_checker.rb

@@ -86,6 +86,10 @@ module Dependabot
       raise Dependabot::GitDependencyReferenceNotFound, dependency.name
     end
 
+    def head_commit_for_local_branch(name)
+      local_repo_git_metadata_fetcher.head_commit_for_ref(name)
+    end
+
     def local_tags_for_latest_version_commit_sha
       tags = allowed_version_tags
       max_tag = max_version_tag(tags)
@@ -274,8 +278,8 @@ module Dependabot
     end
 
     def bitbucket_commit_comparison_status(ref1, ref2)
-      url = "https://api.bitbucket.org/2.0/repositories/"\
-            "#{listing_source_repo}/commits/?"\
+      url = "https://api.bitbucket.org/2.0/repositories/" \
+            "#{listing_source_repo}/commits/?" \
             "include=#{ref2}&exclude=#{ref1}"
 
       client = Clients::BitbucketWithRetries.

data/lib/dependabot/git_metadata_fetcher.rb

@@ -88,7 +88,7 @@ module Dependabot
       service_pack_uri = uri
       service_pack_uri += ".git" unless service_pack_uri.end_with?(".git")
 
-      env = { "PATH" => ENV["PATH"] }
+      env = { "PATH" => ENV.fetch("PATH", nil) }
       command = "git ls-remote #{service_pack_uri}"
       command = SharedHelpers.escape_command(command)
 
@@ -125,7 +125,7 @@ module Dependabot
         full_ref_name = line.split.last
         next unless full_ref_name.start_with?("refs/tags", "refs/heads")
 
-        peeled_lines << line && next if line.strip.end_with?("^{}")
+        (peeled_lines << line) && next if line.strip.end_with?("^{}")
 
         ref_name = full_ref_name.sub(%r{^refs/(tags|heads)/}, "").strip
         sha = sha_for_update_pack_line(line)

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -239,7 +239,7 @@ module Dependabot
           files += github_client.contents(source.repo, opts)
 
           files.uniq.each do |f|
-            next unless %w(doc docs).include?(f.name) && f.type == "dir"
+            next unless f.type == "dir" && f.name.match?(/docs?/o)
 
             opts = { path: f.path, ref: ref }.compact
             files += github_client.contents(source.repo, opts)
@@ -300,16 +300,16 @@ module Dependabot
         end
 
         def previous_ref
-          previous_refs = dependency.previous_requirements.map do |r|
+          previous_refs = dependency.previous_requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return previous_refs.first if previous_refs.count == 1
         end
 
         def new_ref
-          new_refs = dependency.requirements.map do |r|
+          new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return new_refs.first if new_refs.count == 1
         end
 

data/lib/dependabot/metadata_finders/base/changelog_pruner.rb

@@ -137,16 +137,16 @@ module Dependabot
         end
 
         def previous_ref
-          previous_refs = dependency.previous_requirements.map do |r|
+          previous_refs = dependency.previous_requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return previous_refs.first if previous_refs.count == 1
         end
 
         def new_ref
-          new_refs = dependency.requirements.map do |r|
+          new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return new_refs.first if new_refs.count == 1
         end
 

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -136,18 +136,18 @@ module Dependabot
         def previous_ref
           return unless git_source?(dependency.previous_requirements)
 
-          previous_refs = dependency.previous_requirements.map do |r|
+          previous_refs = dependency.previous_requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return previous_refs.first if previous_refs.count == 1
         end
 
         def new_ref
           return unless git_source?(dependency.previous_requirements)
 
-          new_refs = dependency.requirements.map do |r|
+          new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return new_refs.first if new_refs.count == 1
         end
 

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -275,16 +275,16 @@ module Dependabot
         end
 
         def previous_ref
-          previous_refs = dependency.previous_requirements.map do |r|
+          previous_refs = dependency.previous_requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return previous_refs.first if previous_refs.count == 1
         end
 
         def new_ref
-          new_refs = dependency.requirements.map do |r|
+          new_refs = dependency.requirements.filter_map do |r|
             r.dig(:source, "ref") || r.dig(:source, :ref)
-          end.compact.uniq
+          end.uniq
           return new_refs.first if new_refs.count == 1
         end
 

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -90,7 +90,9 @@ module Dependabot
       def branch_version_suffix
         dep = dependencies.first
 
-        if library? && ref_changed?(dep) && new_ref(dep)
+        if dep.removed?
+          "-removed"
+        elsif library? && ref_changed?(dep) && new_ref(dep)
           new_ref(dep)
         elsif library?
           sanitized_requirement(dep)
@@ -127,24 +129,24 @@ module Dependabot
         elsif dependency.version == dependency.previous_version &&
               package_manager == "docker"
           dependency.requirements.
-            map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }.
-            compact.first.split(":").last[0..6]
+            filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }.
+            first.split(":").last[0..6]
         else
           dependency.version
         end
       end
 
       def previous_ref(dependency)
-        previous_refs = dependency.previous_requirements.map do |r|
+        previous_refs = dependency.previous_requirements.filter_map do |r|
           r.dig(:source, "ref") || r.dig(:source, :ref)
-        end.compact.uniq
+        end.uniq
         return previous_refs.first if previous_refs.count == 1
       end
 
       def new_ref(dependency)
-        new_refs = dependency.requirements.map do |r|
+        new_refs = dependency.requirements.filter_map do |r|
           r.dig(:source, "ref") || r.dig(:source, :ref)
-        end.compact.uniq
+        end.uniq
         return new_refs.first if new_refs.count == 1
       end
 
@@ -185,11 +187,7 @@ module Dependabot
           # Remove forbidden characters (those not already replaced elsewhere)
           gsub(%r{[^A-Za-z0-9/\-_.(){}]}, "").
           # Slashes can't be followed by periods
-          gsub(%r{/\.}, "/dot-").
-          # Two or more sequential periods are forbidden
-          gsub(/\.+/, ".").
-          # Two or more sequential slashes are forbidden
-          gsub(%r{/+}, "/").
+          gsub(%r{/\.}, "/dot-").squeeze(".").squeeze("/").
           # Trailing periods are forbidden
           sub(/\.$/, "")
       end

data/lib/dependabot/pull_request_creator/github.rb

@@ -219,7 +219,7 @@ module Dependabot
         retry_count ||= 0
         retry_count += 1
         if retry_count > 10
-          raise "Repeatedly failed to create or update branch #{branch_name} "\
+          raise "Repeatedly failed to create or update branch #{branch_name} " \
                 "with commit #{commit.sha}."
         end
 
@@ -269,7 +269,7 @@ module Dependabot
 
       def add_reviewers_to_pull_request(pull_request)
         reviewers_hash =
-          reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }.to_h
+          reviewers.keys.to_h { |k| [k.to_sym, reviewers[k]] }
 
         github_client_for_source.request_pull_request_review(
           source.repo,
@@ -299,7 +299,7 @@ module Dependabot
 
       def comment_with_invalid_reviewer(pull_request, message)
         reviewers_hash =
-          reviewers.keys.map { |k| [k.to_sym, reviewers[k]] }.to_h
+          reviewers.keys.to_h { |k| [k.to_sym, reviewers[k]] }
         reviewers = []
         reviewers += reviewers_hash[:reviewers] || []
         reviewers += (reviewers_hash[:team_reviewers] || []).
@@ -315,9 +315,9 @@ module Dependabot
 
         msg = "Dependabot tried to add #{reviewers_string} as "
         msg += reviewers.count > 1 ? "reviewers" : "a reviewer"
-        msg += " to this PR, but received the following error from GitHub:\n\n"\
+        msg += " to this PR, but received the following error from GitHub:\n\n" \
                "```\n" \
-               "#{message}\n"\
+               "#{message}\n" \
                "```"
 
         github_client_for_source.add_comment(

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -105,7 +105,9 @@ module Dependabot
           new_version_parts = version(dep).split(/[.+]/)
           old_version_parts = previous_version(dep)&.split(/[.+]/) || []
           all_parts = new_version_parts.first(3) + old_version_parts.first(3)
+          # rubocop:disable Performance/RedundantEqualityComparisonBlock
           next 0 unless all_parts.all? { |part| part.to_i.to_s == part }
+          # rubocop:enable Performance/RedundantEqualityComparisonBlock
           next 1 if new_version_parts[0] != old_version_parts[0]
           next 2 if new_version_parts[1] != old_version_parts[1]
 

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -189,7 +189,7 @@ module Dependabot
         end
 
         def parent_node_link?(node)
-          node.type == :link || node.parent && parent_node_link?(node.parent)
+          node.type == :link || (node.parent && parent_node_link?(node.parent))
         end
       end
     end

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -63,7 +63,7 @@ module Dependabot
         def release_cascade
           return "" unless releases_text && releases_url
 
-          msg = "*Sourced from [#{dependency.display_name}'s releases]"\
+          msg = "*Sourced from [#{dependency.display_name}'s releases]" \
                 "(#{releases_url}).*\n\n"
           msg += quote_and_truncate(releases_text)
           msg = link_issues(text: msg)
@@ -80,8 +80,8 @@ module Dependabot
         def changelog_cascade
           return "" unless changelog_url && changelog_text
 
-          msg = "*Sourced from "\
-                "[#{dependency.display_name}'s changelog]"\
+          msg = "*Sourced from " \
+                "[#{dependency.display_name}'s changelog]" \
                 "(#{changelog_url}).*\n\n"
           msg += quote_and_truncate(changelog_text)
           msg = link_issues(text: msg)
@@ -95,8 +95,8 @@ module Dependabot
         def upgrade_guide_cascade
           return "" unless upgrade_guide_url && upgrade_guide_text
 
-          msg = "*Sourced from "\
-                "[#{dependency.display_name}'s upgrade guide]"\
+          msg = "*Sourced from " \
+                "[#{dependency.display_name}'s upgrade guide]" \
                 "(#{upgrade_guide_url}).*\n\n"
           msg += quote_and_truncate(upgrade_guide_text)
           msg = link_issues(text: msg)
@@ -112,7 +112,7 @@ module Dependabot
 
           msg = ""
 
-          commits.reverse.first(10).each do |commit|
+          commits.last(10).reverse_each do |commit|
             title = commit[:message].strip.split("\n").first
             title = title.slice(0..76) + "..." if title && title.length > 80
             title = title&.gsub(/(?<=[^\w.-])([_*`~])/, '\\1')
@@ -124,8 +124,8 @@ module Dependabot
 
           msg +=
             if commits.count > 10
-              "- Additional commits viewable in "\
-              "[compare view](#{commits_url})\n"
+              "- Additional commits viewable in " \
+                "[compare view](#{commits_url})\n"
             else
               "- See full diff in [compare view](#{commits_url})\n"
             end
@@ -175,8 +175,8 @@ module Dependabot
 
         def vulnerability_source_line(details)
           if details["source_url"] && details["source_name"]
-            "*Sourced from [#{details['source_name']}]"\
-            "(#{details['source_url']}).*\n\n"
+            "*Sourced from [#{details['source_name']}]" \
+              "(#{details['source_url']}).*\n\n"
           elsif details["source_name"]
             "*Sourced from #{details['source_name']}.*\n\n"
           else

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -74,9 +74,9 @@ module Dependabot
 
         pr_name +
           if dependencies.count == 1
-            "#{dependencies.first.display_name} requirement "\
-            "#{from_version_msg(old_library_requirement(dependencies.first))}"\
-            "to #{new_library_requirement(dependencies.first)}"
+            "#{dependencies.first.display_name} requirement " \
+              "#{from_version_msg(old_library_requirement(dependencies.first))}" \
+              "to #{new_library_requirement(dependencies.first)}"
           else
             names = dependencies.map(&:name)
             "requirements for #{names[0..-2].join(', ')} and #{names[-1]}"
@@ -90,19 +90,19 @@ module Dependabot
         pr_name +
           if dependencies.count == 1
             dependency = dependencies.first
-            "#{dependency.display_name} "\
-            "#{from_version_msg(previous_version(dependency))}"\
-            "to #{new_version(dependency)}"
+            "#{dependency.display_name} " \
+              "#{from_version_msg(previous_version(dependency))}" \
+              "to #{new_version(dependency)}"
           elsif updating_a_property?
             dependency = dependencies.first
-            "#{property_name} "\
-            "#{from_version_msg(previous_version(dependency))}"\
-            "to #{new_version(dependency)}"
+            "#{property_name} " \
+              "#{from_version_msg(previous_version(dependency))}" \
+              "to #{new_version(dependency)}"
           elsif updating_a_dependency_set?
             dependency = dependencies.first
-            "#{dependency_set.fetch(:group)} dependency set "\
-            "#{from_version_msg(previous_version(dependency))}"\
-            "to #{new_version(dependency)}"
+            "#{dependency_set.fetch(:group)} dependency set " \
+              "#{from_version_msg(previous_version(dependency))}" \
+              "to #{new_version(dependency)}"
           else
             names = dependencies.map(&:name)
             "#{names[0..-2].join(', ')} and #{names[-1]}"
@@ -174,8 +174,8 @@ module Dependabot
         return unless signoff_details.is_a?(Hash)
         return unless signoff_details[:org_name] && signoff_details[:org_email]
 
-        "On-behalf-of: @#{signoff_details[:org_name]} "\
-        "<#{signoff_details[:org_email]}>"
+        "On-behalf-of: @#{signoff_details[:org_name]} " \
+          "<#{signoff_details[:org_email]}>"
       end
 
       def requirement_commit_message_intro
@@ -200,8 +200,8 @@ module Dependabot
         return multidependency_intro if dependencies.count > 1
 
         dependency = dependencies.first
-        msg = "Bumps #{dependency_links.first} "\
-              "#{from_version_msg(previous_version(dependency))}"\
+        msg = "Bumps #{dependency_links.first} " \
+              "#{from_version_msg(previous_version(dependency))}" \
               "to #{new_version(dependency)}."
 
         msg += " This release includes the previously tagged commit." if switching_from_ref_to_release?(dependency)
@@ -220,23 +220,23 @@ module Dependabot
       def multidependency_property_intro
         dependency = dependencies.first
 
-        "Bumps `#{property_name}` "\
-        "#{from_version_msg(previous_version(dependency))}"\
-        "to #{new_version(dependency)}."
+        "Bumps `#{property_name}` " \
+          "#{from_version_msg(previous_version(dependency))}" \
+          "to #{new_version(dependency)}."
       end
 
       def dependency_set_intro
         dependency = dependencies.first
 
-        "Bumps `#{dependency_set.fetch(:group)}` "\
-        "dependency set #{from_version_msg(previous_version(dependency))}"\
-        "to #{new_version(dependency)}."
+        "Bumps `#{dependency_set.fetch(:group)}` " \
+          "dependency set #{from_version_msg(previous_version(dependency))}" \
+          "to #{new_version(dependency)}."
       end
 
       def multidependency_intro
-        "Bumps #{dependency_links[0..-2].join(', ')} "\
-        "and #{dependency_links[-1]}. These "\
-        "dependencies needed to be updated together."
+        "Bumps #{dependency_links[0..-2].join(', ')} " \
+          "and #{dependency_links[-1]}. These " \
+          "dependencies needed to be updated together."
       end
 
       def from_version_msg(previous_version)
@@ -293,10 +293,14 @@ module Dependabot
         return metadata_links_for_dep(dependencies.first) if dependencies.count == 1
 
         dependencies.map do |dep|
-          "\n\nUpdates `#{dep.display_name}` "\
-          "#{from_version_msg(previous_version(dep))}to "\
-          "#{new_version(dep)}"\
-          "#{metadata_links_for_dep(dep)}"
+          if dep.removed?
+            "\n\nRemoves `#{dep.display_name}`"
+          else
+            "\n\nUpdates `#{dep.display_name}` " \
+              "#{from_version_msg(previous_version(dep))}to " \
+              "#{new_version(dep)}" \
+              "#{metadata_links_for_dep(dep)}"
+          end
         end.join
       end
 
@@ -313,9 +317,13 @@ module Dependabot
         return metadata_cascades_for_dep(dependencies.first) if dependencies.one?
 
         dependencies.map do |dep|
-          msg = "\nUpdates `#{dep.display_name}` "\
-                "#{from_version_msg(previous_version(dep))}"\
-                "to #{new_version(dep)}"
+          msg = if dep.removed?
+                  "\nRemoves `#{dep.display_name}`"
+                else
+                  "\nUpdates `#{dep.display_name}` " \
+                    "#{from_version_msg(previous_version(dep))}" \
+                    "to #{new_version(dep)}"
+                end
 
           if vulnerabilities_fixed[dep.name]&.one?
             msg += " **This update includes a security fix.**"
@@ -328,6 +336,8 @@ module Dependabot
       end
 
       def metadata_cascades_for_dep(dependency)
+        return "" if dependency.removed?
+
         MetadataPresenter.new(
           dependency: dependency,
           source: source,
@@ -417,21 +427,21 @@ module Dependabot
 
       def docker_digest_from_reqs(requirements)
         requirements.
-          map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }.
-          compact.first
+          filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }.
+          first
       end
 
       def previous_ref(dependency)
-        previous_refs = dependency.previous_requirements.map do |r|
+        previous_refs = dependency.previous_requirements.filter_map do |r|
           r.dig(:source, "ref") || r.dig(:source, :ref)
-        end.compact.uniq
+        end.uniq
         return previous_refs.first if previous_refs.count == 1
       end
 
       def new_ref(dependency)
-        new_refs = dependency.requirements.map do |r|
+        new_refs = dependency.requirements.filter_map do |r|
           r.dig(:source, "ref") || r.dig(:source, :ref)
-        end.compact.uniq
+        end.uniq
         return new_refs.first if new_refs.count == 1
       end
 
@@ -483,7 +493,7 @@ module Dependabot
 
       def switching_from_ref_to_release?(dependency)
         unless dependency.previous_version&.match?(/^[0-9a-f]{40}$/) ||
-               dependency.previous_version.nil? && previous_ref(dependency)
+               (dependency.previous_version.nil? && previous_ref(dependency))
           return false
         end
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -280,8 +280,7 @@ module Dependabot
           reject { |c| c.author&.type == "Bot" }.
           reject { |c| c.commit&.message&.start_with?("Merge") }.
           map(&:commit).
-          map(&:message).
-          compact.
+          filter_map(&:message).
           map(&:strip)
       end
 
@@ -292,8 +291,7 @@ module Dependabot
         @recent_gitlab_commit_messages.
           reject { |c| c.author_email == dependabot_email }.
           reject { |c| c.message&.start_with?("merge !") }.
-          map(&:message).
-          compact.
+          filter_map(&:message).
           map(&:strip)
       end
 
@@ -304,8 +302,7 @@ module Dependabot
         @recent_azure_commit_messages.
           reject { |c| azure_commit_author_email(c) == dependabot_email }.
           reject { |c| c.fetch("comment")&.start_with?("Merge") }.
-          map { |c| c.fetch("comment") }.
-          compact.
+          filter_map { |c| c.fetch("comment") }.
           map(&:strip)
       end
 
@@ -315,8 +312,7 @@ module Dependabot
 
         @recent_bitbucket_commit_messages.
           reject { |c| bitbucket_commit_author_email(c) == dependabot_email }.
-          map { |c| c.fetch("message", nil) }.
-          compact.
+          filter_map { |c| c.fetch("message", nil) }.
           reject { |m| m.start_with?("Merge") }.
           map(&:strip)
       end
@@ -327,8 +323,7 @@ module Dependabot
         @recent_codecommit_commit_messages.commits.
           reject { |c| c.author.email == dependabot_email }.
           reject { |c| c.message&.start_with?("Merge") }.
-          map(&:message).
-          compact.
+          filter_map(&:message).
           map(&:strip)
       end
 

data/lib/dependabot/pull_request_updater/azure.rb

@@ -11,16 +11,17 @@ module Dependabot
       OBJECT_ID_FOR_BRANCH_DELETE = "0000000000000000000000000000000000000000"
 
       attr_reader :source, :files, :base_commit, :old_commit, :credentials,
-                  :pull_request_number
+                  :pull_request_number, :author_details
 
       def initialize(source:, files:, base_commit:, old_commit:,
-                     credentials:, pull_request_number:)
+                     credentials:, pull_request_number:, author_details: nil)
         @source = source
         @files = files
         @base_commit = base_commit
         @old_commit = old_commit
         @credentials = credentials
         @pull_request_number = pull_request_number
+        @author_details = author_details
       end
 
       def update
@@ -74,12 +75,15 @@ module Dependabot
       end
 
       def create_temp_branch
+        author = author_details&.slice(:name, :email, :date)
+        author = nil unless author&.any?
+
         response = azure_client_for_source.create_commit(
           temp_branch_name,
           base_commit,
           commit_message,
           files,
-          nil
+          author
         )
 
         JSON.parse(response.body).fetch("refUpdates").first.fetch("newObjectId")

data/lib/dependabot/pull_request_updater/github.rb

@@ -173,7 +173,7 @@ module Dependabot
 
         if e.message.match?(/protected branch/i) ||
            e.message.match?(/not authorized to push/i) ||
-           e.message.match?(/must not contain merge commits/) ||
+           e.message.include?("must not contain merge commits") ||
            e.message.match?(/required status check/i)
           raise BranchProtected
         end

data/lib/dependabot/security_advisory.rb

@@ -51,7 +51,7 @@ module Dependabot
     # @return [Boolean]
     def fixed_by?(dependency)
       # Handle case mismatch between the security advisory and parsed name
-      return false unless dependency_name.downcase == dependency.name.downcase
+      return false unless dependency_name.casecmp(dependency.name).zero?
       return false unless package_manager == dependency.package_manager
       # TODO: Support no previous version to the same level as dependency graph
       # and security alerts. We currently ignore dependency updates without a
@@ -62,6 +62,9 @@ module Dependabot
       # Ignore deps that weren't previously vulnerable
       return false unless affects_version?(dependency.previous_version)
 
+      # Removing a dependency is a way to fix the vulnerability
+      return true if dependency.removed?
+
       # Select deps that are now fixed
       !affects_version?(dependency.version)
     end
@@ -109,13 +112,13 @@ module Dependabot
     def check_version_requirements
       unless vulnerable_versions.is_a?(Array) &&
              vulnerable_versions.all? { |i| requirement_class <= i.class }
-        raise ArgumentError, "vulnerable_versions must be an array "\
+        raise ArgumentError, "vulnerable_versions must be an array " \
                              "of #{requirement_class} instances"
       end
 
       unless safe_versions.is_a?(Array) &&
              safe_versions.all? { |i| requirement_class <= i.class }
-        raise ArgumentError, "safe_versions must be an array "\
+        raise ArgumentError, "safe_versions must be an array " \
                              "of #{requirement_class} instances"
       end
     end

data/lib/dependabot/shared_helpers.rb

@@ -17,9 +17,9 @@ require "dependabot/version"
 module Dependabot
   module SharedHelpers
     GIT_CONFIG_GLOBAL_PATH = File.expand_path("~/.gitconfig")
-    USER_AGENT = "dependabot-core/#{Dependabot::VERSION} "\
-                 "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} "\
-                 "(#{RUBY_PLATFORM}) "\
+    USER_AGENT = "dependabot-core/#{Dependabot::VERSION} " \
+                 "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} " \
+                 "(#{RUBY_PLATFORM}) " \
                  "(+https://github.com/dependabot/dependabot-core)"
     SIGKILL = 9
 
@@ -32,7 +32,7 @@ module Dependabot
         reset_git_repo(repo_contents_path)
         # Handle missing directories by creating an empty one and relying on the
         # file fetcher to raise a DependencyFileNotFound error
-        FileUtils.mkdir_p(path) unless Dir.exist?(path)
+        FileUtils.mkdir_p(path)
         Dir.chdir(path) { yield(path) }
       else
         in_a_temporary_directory(directory, &block)
@@ -40,7 +40,7 @@ module Dependabot
     end
 
     def self.in_a_temporary_directory(directory = "/")
-      Dir.mkdir(Utils::BUMP_TMP_DIR_PATH) unless Dir.exist?(Utils::BUMP_TMP_DIR_PATH)
+      FileUtils.mkdir_p(Utils::BUMP_TMP_DIR_PATH)
       tmp_dir = Dir.mktmpdir(Utils::BUMP_TMP_FILE_PREFIX, Utils::BUMP_TMP_DIR_PATH)
 
       begin
@@ -188,7 +188,7 @@ module Dependabot
       # a wrapper binary that only allows non-mutating commands. Without this,
       # whenever the credentials are deemed to be invalid, they're erased.
       run_shell_command(
-        "git config --global credential.helper "\
+        "git config --global credential.helper " \
         "'!#{credential_helper_path} --file #{Dir.pwd}/git.store'",
         allow_unsafe_shell_command: true
       )
@@ -224,7 +224,7 @@ module Dependabot
         next unless cred["username"] && cred["password"]
 
         authenticated_url =
-          "https://#{cred.fetch('username')}:#{cred.fetch('password')}"\
+          "https://#{cred.fetch('username')}:#{cred.fetch('password')}" \
           "@#{cred.fetch('host')}"
 
         git_store_content += authenticated_url + "\n"
@@ -241,23 +241,23 @@ module Dependabot
       # NOTE: we use --global here (rather than --system) so that Dependabot
       # can be run without privileged access
       run_shell_command(
-        "git config --global --replace-all url.https://#{host}/."\
+        "git config --global --replace-all url.https://#{host}/." \
         "insteadOf ssh://git@#{host}/"
       )
       run_shell_command(
-        "git config --global --add url.https://#{host}/."\
+        "git config --global --add url.https://#{host}/." \
         "insteadOf ssh://git@#{host}:"
       )
       run_shell_command(
-        "git config --global --add url.https://#{host}/."\
+        "git config --global --add url.https://#{host}/." \
         "insteadOf git@#{host}:"
       )
       run_shell_command(
-        "git config --global --add url.https://#{host}/."\
+        "git config --global --add url.https://#{host}/." \
         "insteadOf git@#{host}/"
       )
       run_shell_command(
-        "git config --global --add url.https://#{host}/."\
+        "git config --global --add url.https://#{host}/." \
         "insteadOf git://#{host}/"
       )
     end

data/lib/dependabot/source.rb

@@ -109,8 +109,8 @@ module Dependabot
     def initialize(provider:, repo:, directory: nil, branch: nil, commit: nil,
                    hostname: nil, api_endpoint: nil)
       if (hostname.nil? ^ api_endpoint.nil?) && (provider != "codecommit")
-        msg = "Both hostname and api_endpoint must be specified if either "\
-              "are. Alternatively, both may be left blank to use the "\
+        msg = "Both hostname and api_endpoint must be specified if either " \
+              "are. Alternatively, both may be left blank to use the " \
               "provider's defaults."
         raise msg
       end

data/lib/dependabot/update_checkers/base.rb

@@ -287,7 +287,7 @@ module Dependabot
 
       def version_from_requirements
         @version_from_requirements ||=
-          dependency.requirements.map { |r| r.fetch(:requirement) }.compact.
+          dependency.requirements.filter_map { |r| r.fetch(:requirement) }.
           flat_map { |req_str| requirement_class.requirements_array(req_str) }.
           flat_map(&:requirements).
           reject { |req_array| req_array.first.start_with?("<") }.

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.209.0"
+  VERSION = "0.212.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.209.0
+  version: 0.212.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-17 00:00:00.000000000 Z
+date: 2022-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -98,20 +98,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.11'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.11'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: excon
   requirement: !ruby/object:Gem::Requirement
@@ -132,14 +132,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.0
+        version: 2.5.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.0
+        version: 2.5.2
 - !ruby/object:Gem::Dependency
   name: gitlab
   requirement: !ruby/object:Gem::Requirement
@@ -284,6 +284,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: parallel_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.12.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.12.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -332,14 +346,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.36.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.36.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-performance
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.14.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.14.2
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement