dependabot-common 0.237.0 → 0.239.0

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -1,12 +1,43 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   class PullRequestCreator
     class BranchNamer
       class Base
-        attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length
+        extend T::Sig
+
+        sig { returns(T::Array[Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[DependencyFile]) }
+        attr_reader :files
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_branch
 
+        sig { returns(String) }
+        attr_reader :separator
+
+        sig { returns(String) }
+        attr_reader :prefix
+
+        sig { returns(T.nilable(Integer)) }
+        attr_reader :max_length
+
+        sig do
+          params(
+            dependencies: T::Array[Dependency],
+            files: T::Array[DependencyFile],
+            target_branch: T.nilable(String),
+            separator: String,
+            prefix: String,
+            max_length: T.nilable(Integer)
+          )
+            .void
+        end
         def initialize(dependencies:, files:, target_branch:, separator: "/",
                        prefix: "dependabot", max_length: nil)
           @dependencies  = dependencies
@@ -19,6 +50,7 @@ module Dependabot
 
         private
 
+        sig { params(ref_name: String).returns(String) }
         def sanitize_branch_name(ref_name)
           # General git ref validation
           sanitized_name = sanitize_ref(ref_name)
@@ -27,14 +59,15 @@ module Dependabot
           sanitized_name = sanitized_name.gsub("/", separator)
 
           # Shorten the ref in case users refs have length limits
-          if max_length && (sanitized_name.length > max_length)
-            sha = Digest::SHA1.hexdigest(sanitized_name)[0, max_length]
-            sanitized_name[[max_length - sha.size, 0].max..] = sha
+          if max_length && (sanitized_name.length > T.must(max_length))
+            sha = T.must(Digest::SHA1.hexdigest(sanitized_name)[0, T.must(max_length)])
+            sanitized_name[[T.must(max_length) - sha.size, 0].max..] = sha
           end
 
           sanitized_name
         end
 
+        sig { params(ref: String).returns(String) }
         def sanitize_ref(ref)
           # This isn't a complete implementation of git's ref validation, but it
           # covers most cases that crop up. Its list of allowed characters is a

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -8,17 +8,18 @@ module Dependabot
     class BranchNamer
       class DependencyGroupStrategy < Base
         def initialize(dependencies:, files:, target_branch:, dependency_group:,
-                       separator: "/", prefix: "dependabot", max_length: nil)
+                       separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes:)
           super(
             dependencies: dependencies,
             files: files,
             target_branch: target_branch,
             separator: separator,
             prefix: prefix,
-            max_length: max_length
+            max_length: max_length,
           )
 
           @dependency_group = dependency_group
+          @includes_security_fixes = includes_security_fixes
         end
 
         def new_branch_name
@@ -45,7 +46,11 @@ module Dependabot
         # Let's append a short hash digest of the dependency changes so that we can
         # meet this guarantee.
         def group_name_with_dependency_digest
-          "#{dependency_group.name}-#{dependency_digest}"
+          if @includes_security_fixes
+            "group-security-#{package_manager}-#{dependency_digest}"
+          else
+            "#{dependency_group.name}-#{dependency_digest}"
+          end
         end
 
         def dependency_digest
@@ -55,11 +60,11 @@ module Dependabot
         end
 
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
         def directory
-          files.first.directory.tr(" ", "-")
+          T.must(files.first).directory.tr(" ", "-")
         end
       end
     end

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -38,31 +38,31 @@ module Dependabot
           [
             prefix,
             package_manager,
-            files.first.directory.tr(" ", "-"),
+            T.must(files.first).directory.tr(" ", "-"),
             target_branch
           ].compact
         end
 
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
         def updating_a_property?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :property_name) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :property_name) }
         end
 
         def updating_a_dependency_set?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :dependency_set) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :dependency_set) }
         end
 
         def property_name
-          @property_name ||= dependencies.first.requirements
-                                         .find { |r| r.dig(:metadata, :property_name) }
-                                         &.dig(:metadata, :property_name)
+          @property_name ||= T.must(dependencies.first).requirements
+                              .find { |r| r.dig(:metadata, :property_name) }
+                              &.dig(:metadata, :property_name)
 
           raise "No property name!" unless @property_name
 
@@ -70,9 +70,9 @@ module Dependabot
         end
 
         def dependency_set
-          @dependency_set ||= dependencies.first.requirements
-                                          .find { |r| r.dig(:metadata, :dependency_set) }
-                                          &.dig(:metadata, :dependency_set)
+          @dependency_set ||= T.must(dependencies.first).requirements
+                               .find { |r| r.dig(:metadata, :dependency_set) }
+                               &.dig(:metadata, :dependency_set)
 
           raise "No dependency set!" unless @dependency_set
 
@@ -82,7 +82,7 @@ module Dependabot
         def branch_version_suffix
           dep = dependencies.first
 
-          if dep.removed?
+          if T.must(dep).removed?
             "-removed"
           elsif library? && ref_changed?(dep) && new_ref(dep)
             new_ref(dep)

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -11,10 +11,11 @@ require "dependabot/pull_request_creator/branch_namer/dependency_group_strategy"
 module Dependabot
   class PullRequestCreator
     class BranchNamer
-      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group
+      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group,
+                  :includes_security_fixes
 
       def initialize(dependencies:, files:, target_branch:, dependency_group: nil,
-                     separator: "/", prefix: "dependabot", max_length: nil)
+                     separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes: false)
         @dependencies  = dependencies
         @files         = files
         @target_branch = target_branch
@@ -22,6 +23,7 @@ module Dependabot
         @separator     = separator
         @prefix        = prefix
         @max_length    = max_length
+        @includes_security_fixes = includes_security_fixes
       end
 
       def new_branch_name
@@ -49,7 +51,8 @@ module Dependabot
               dependency_group: dependency_group,
               separator: separator,
               prefix: prefix,
-              max_length: max_length
+              max_length: max_length,
+              includes_security_fixes: includes_security_fixes
             )
           end
       end

data/lib/dependabot/pull_request_creator/github.rb

@@ -210,7 +210,7 @@ module Dependabot
 
             {
               path: file.realpath,
-              mode: (file.mode || Dependabot::DependencyFile::Mode::FILE),
+              mode: file.mode || Dependabot::DependencyFile::Mode::FILE,
               type: "blob"
             }.merge(content)
           end

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -148,7 +148,6 @@ module Dependabot
         end
 
         def build_details_tag(summary:, body:)
-          # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
           # Bitbucket does not support <details> tag (https://jira.atlassian.com/browse/BCLOUD-20231)
           # CodeCommit does not support the <details> tag (no url available)
           if source_provider_supports_html?
@@ -244,7 +243,7 @@ module Dependabot
         end
 
         def source_provider_supports_html?
-          !%w(azure bitbucket codecommit).include?(source.provider)
+          !%w(bitbucket codecommit).include?(source.provider)
         end
 
         def sanitize_links_and_mentions(text, unsafe: false)

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -85,7 +85,7 @@ module Dependabot
           msg = (msg[0..trunc_length] + tr_msg)
         end
         # if we used a custom encoding for calculating length, then we need to force back to UTF-8
-        msg.force_encoding(Encoding::UTF_8) unless pr_message_encoding.nil?
+        msg = msg.encode("utf-8", "binary", invalid: :replace, undef: :replace) unless pr_message_encoding.nil?
         msg
       end
 
@@ -162,7 +162,13 @@ module Dependabot
 
       def group_pr_name
         updates = dependencies.map(&:name).uniq.count
-        "bump the #{dependency_group.name} group#{pr_name_directory} with #{updates} update#{'s' if updates > 1}"
+
+        if source&.directories
+          "bump the #{dependency_group.name} across #{source.directories.count} directories " \
+            "with #{updates} update#{'s' if updates > 1}"
+        else
+          "bump the #{dependency_group.name} group#{pr_name_directory} with #{updates} update#{'s' if updates > 1}"
+        end
       end
 
       def pr_name_prefix
@@ -260,6 +266,8 @@ module Dependabot
       # rubocop:disable Metrics/PerceivedComplexity
       # rubocop:disable Metrics/AbcSize
       def version_commit_message_intro
+        return multi_directory_group_intro if dependency_group && source&.directories
+
         return group_intro if dependency_group
 
         return multidependency_property_intro if dependencies.count > 1 && updating_a_property?
@@ -346,6 +354,42 @@ module Dependabot
         msg
       end
 
+      def multi_directory_group_intro
+        msg = ""
+
+        source.directories.each do |directory|
+          dependencies_in_directory = dependencies.select { |dep| dep.metadata[:directory] == directory }
+          next unless dependencies_in_directory.any?
+
+          update_count = dependencies_in_directory.map(&:name).uniq.count
+
+          msg += "Bumps the #{dependency_group.name} " \
+                 "with #{update_count} update#{update_count > 1 ? 's' : ''} in the #{directory} directory:"
+
+          msg += if update_count >= 5
+                   header = %w(Package From To)
+                   rows = dependencies_in_directory.map do |dep|
+                     [
+                       dependency_link(dep),
+                       "`#{dep.humanized_previous_version}`",
+                       "`#{dep.humanized_version}`"
+                     ]
+                   end
+                   "\n\n#{table([header] + rows)}"
+                 elsif update_count > 1
+                   dependency_links_in_directory = dependency_links_for_directory(directory)
+                   " #{dependency_links_in_directory[0..-2].join(', ')} and #{dependency_links_in_directory[-1]}."
+                 else
+                   dependency_links_in_directory = dependency_links_for_directory(directory)
+                   " #{dependency_links_in_directory.first}."
+                 end
+
+          msg += "\n"
+        end
+
+        msg
+      end
+
       def group_intro
         update_count = dependencies.map(&:name).uniq.count
 
@@ -427,6 +471,12 @@ module Dependabot
         @dependency_links = uniq_deps.map { |dep| dependency_link(dep) }
       end
 
+      def dependency_links_for_directory(directory)
+        dependencies_in_directory = dependencies.select { |dep| dep.metadata[:directory] == directory }
+        uniq_deps = dependencies_in_directory.each_with_object({}) { |dep, memo| memo[dep.name] ||= dep }.values
+        @dependency_links = uniq_deps.map { |dep| dependency_link(dep) }
+      end
+
       def dependency_link(dependency)
         if source_url(dependency)
           "[#{dependency.display_name}](#{source_url(dependency)})"
@@ -442,7 +492,7 @@ module Dependabot
       end
 
       def metadata_links
-        return metadata_links_for_dep(dependencies.first) if dependencies.count == 1
+        return metadata_links_for_dep(dependencies.first) if dependencies.count == 1 && dependency_group.nil?
 
         dependencies.map do |dep|
           if dep.removed?
@@ -483,8 +533,8 @@ module Dependabot
         "| #{row.join(' | ')} |"
       end
 
-      def metadata_cascades
-        return metadata_cascades_for_dep(dependencies.first) if dependencies.one?
+      def metadata_cascades # rubocop:disable Metrics/PerceivedComplexity
+        return metadata_cascades_for_dep(dependencies.first) if dependencies.one? && !dependency_group
 
         dependencies.map do |dep|
           msg = if dep.removed?

data/lib/dependabot/pull_request_creator.rb

@@ -266,7 +266,8 @@ module Dependabot
           dependency_group: dependency_group,
           separator: branch_name_separator,
           prefix: branch_name_prefix,
-          max_length: branch_name_max_length
+          max_length: branch_name_max_length,
+          includes_security_fixes: includes_security_fixes?
         )
     end
 

data/lib/dependabot/requirement.rb

@@ -0,0 +1,20 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class Requirement < Gem::Requirement
+    extend T::Sig
+    extend T::Helpers
+
+    abstract!
+
+    sig do
+      abstract
+        .params(requirement_string: T.nilable(String))
+        .returns(T::Array[Requirement])
+    end
+    def self.requirements_array(requirement_string); end
+  end
+end

data/lib/dependabot/utils.rb

@@ -4,6 +4,8 @@
 require "tmpdir"
 require "set"
 require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/version"
 require "dependabot/config/file"
 
@@ -33,9 +35,9 @@ module Dependabot
       @version_classes[package_manager] = version_class
     end
 
-    @requirement_classes = T.let({}, T::Hash[String, T.class_of(Gem::Requirement)])
+    @requirement_classes = T.let({}, T::Hash[String, T.class_of(Dependabot::Requirement)])
 
-    sig { params(package_manager: String).returns(T.class_of(Gem::Requirement)) }
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::Requirement)) }
     def self.requirement_class_for_package_manager(package_manager)
       requirement_class = @requirement_classes[package_manager]
       return requirement_class if requirement_class
@@ -43,7 +45,7 @@ module Dependabot
       raise "Unregistered package_manager #{package_manager}"
     end
 
-    sig { params(package_manager: String, requirement_class: T.class_of(Gem::Requirement)).void }
+    sig { params(package_manager: String, requirement_class: T.class_of(Dependabot::Requirement)).void }
     def self.register_requirement_class(package_manager, requirement_class)
       validate_package_manager!(package_manager)
 

data/lib/dependabot/workspace/base.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.237.0"
+  VERSION = "0.239.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.237.0
+  version: 0.239.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-11-21 00:00:00.000000000 Z
+date: 2023-12-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -154,6 +154,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 4.19.0
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.7'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.7'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -360,14 +374,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -491,6 +505,7 @@ files:
 - lib/dependabot/file_updaters/vendor_updater.rb
 - lib/dependabot/git_commit_checker.rb
 - lib/dependabot/git_metadata_fetcher.rb
+- lib/dependabot/git_ref.rb
 - lib/dependabot/logger.rb
 - lib/dependabot/metadata_finders.rb
 - lib/dependabot/metadata_finders/README.md
@@ -522,6 +537,7 @@ files:
 - lib/dependabot/pull_request_updater/github.rb
 - lib/dependabot/pull_request_updater/gitlab.rb
 - lib/dependabot/registry_client.rb
+- lib/dependabot/requirement.rb
 - lib/dependabot/security_advisory.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
@@ -542,7 +558,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
 post_install_message: 
 rdoc_options: []
 require_paths: