dependabot-common 0.250.0 → 0.252.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0983823ada7f861d47f3399954e68acd51ac9489e92a8720db43eff4d3cefb49'
-  data.tar.gz: 2fdc3a9999f7ed9d5127a350d17677618765f6c57bdf751c1f67402f48f35ef6
+  metadata.gz: 5386205cda5377a31b273b0a32125b9707407b93b7335e68d57a686024ff2adf
+  data.tar.gz: 35518f5984d6d5ca190853935dba3c70949f0d3c2ff3e4a617ba21913833a466
 SHA512:
-  metadata.gz: 27bc497b5c23a14648786d5406bb7e53c70b369fdb0e9f37c91fb6820bf6534bb4d4f6ecae92fb2d479eaf4624ee4d3788a69b563ae6803969397fd8e65a8227
-  data.tar.gz: 387cbc59de29fedd731f0c82352006e6f935a28afcae87a9ada8f78e0378c754482dc988ff690d9e68d858a08a302a29e10c8a2d945c11150bbea270c8069763
+  metadata.gz: ccb447cd57aeada38e4bbc4fe4be171e477452427850331644c5eb683b4f3d87fac9d7861a8112cd4d980fd60a377707d61ac2154b0584e2645a211d02290a81
+  data.tar.gz: ccf9ccfca47cb7c42197c6ed0c982e08fd1072dee050b4c244f032da4c4304c0635978e89cf5ad67b87a9c6919cbefd28ab068673a73df10ca5cc8fe43ea161d

data/lib/dependabot/dependency.rb

@@ -85,6 +85,8 @@ module Dependabot
     sig { returns(T::Hash[Symbol, T.untyped]) }
     attr_reader :metadata
 
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
         name: String,
@@ -110,8 +112,10 @@ module Dependabot
         end,
         T.nilable(String)
       )
+      @version = nil if @version == ""
       @requirements = T.let(requirements.map { |req| symbolize_keys(req) }, T::Array[T::Hash[Symbol, T.untyped]])
       @previous_version = previous_version
+      @previous_version = nil if @previous_version == ""
       @previous_requirements = T.let(
         previous_requirements&.map { |req| symbolize_keys(req) },
         T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
@@ -128,6 +132,8 @@ module Dependabot
 
       check_values
     end
+    # rubocop:enable Metrics/AbcSize
+    # rubocop:enable Metrics/PerceivedComplexity
 
     sig { returns(T::Boolean) }
     def top_level?
@@ -214,7 +220,7 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def humanized_version
-      return if removed?
+      return "removed" if removed?
 
       if T.must(version).match?(/^[0-9a-f]{40}/)
         return new_ref if ref_changed? && new_ref
@@ -238,6 +244,8 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def previous_ref
+      return nil if previous_requirements.nil?
+
       previous_refs = T.must(previous_requirements).filter_map do |r|
         r.dig(:source, "ref") || r.dig(:source, :ref)
       end.uniq
@@ -352,8 +360,6 @@ module Dependabot
 
     sig { void }
     def check_values
-      raise ArgumentError, "blank strings must not be provided as versions" if [version, previous_version].any?("")
-
       check_requirement_fields
       check_subdependency_metadata
     end

data/lib/dependabot/git_commit_checker.rb

@@ -132,6 +132,13 @@ module Dependabot
       max_local_tag_for_current_precision(allowed_refs)
     end
 
+    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    def local_ref_for_latest_version_lower_precision
+      allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs
+
+      max_local_tag_for_lower_precision(allowed_refs)
+    end
+
     sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
     def local_tag_for_latest_version
       max_local_tag(allowed_version_tags)
@@ -238,6 +245,11 @@ module Dependabot
       max_local_tag(select_matching_existing_precision(tags))
     end
 
+    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    def max_local_tag_for_lower_precision(tags)
+      max_local_tag(select_lower_precision(tags))
+    end
+
     sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
     def max_local_tag(tags)
       max_version_tag = tags.max_by { |t| version_from_tag(t) }
@@ -253,6 +265,14 @@ module Dependabot
       tags.select { |tag| precision(scan_version(tag.name)) == current_precision }
     end
 
+    # Find the latest version with a lower precision as the pinned version.
+    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T::Array[Dependabot::GitRef]) }
+    def select_lower_precision(tags)
+      current_precision = precision(T.must(dependency.version))
+
+      tags.select { |tag| precision(scan_version(tag.name)) <= current_precision }
+    end
+
     sig { params(version: String).returns(Integer) }
     def precision(version)
       version.split(".").length

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -128,6 +128,15 @@ module Dependabot
           tmp_files = T.unsafe(suggested_source_client).contents(suggested_source&.repo, opts)
 
           filename = T.must(T.must(suggested_changelog_url).split("/").last).split("#").first
+
+          # If the suggested source points to a specific directory
+          # then we will receive a hash for just the changelog file
+          if suggested_source&.directory && tmp_files[:name] == filename
+            return @changelog_from_suggested_url = tmp_files
+          end
+
+          # Otherwise we will get back an array of hashes representing the files
+          # in the root directory and we need to find the changelog
           @changelog_from_suggested_url =
             tmp_files.find { |f| f.name == filename }
         rescue Octokit::NotFound, Octokit::UnavailableForLegalReasons

data/lib/dependabot/pull_request_creator/github.rb

@@ -396,6 +396,7 @@ module Dependabot
         return true if message.include?("Could not resolve to a node")
         return true if message.include?("not a collaborator")
         return true if message.include?("Could not add requested reviewers")
+        return true if message.include?("Review cannot be requested from pull request author")
 
         false
       end

data/lib/dependabot/pull_request_creator/gitlab.rb

@@ -172,11 +172,16 @@ module Dependabot
       def create_commit
         return create_submodule_update_commit if files.count == 1 && T.must(files.first).type == "submodule"
 
+        options = {}
+        options[:author_email] = author_details&.fetch(:email) if author_details&.key?(:email)
+        options[:author_name] = author_details&.fetch(:name) if author_details&.key?(:name)
+
         gitlab_client_for_source.create_commit(
           source.repo,
           branch_name,
           commit_message,
-          files
+          files,
+          **options
         )
       end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -233,22 +233,41 @@ module Dependabot
 
       sig { returns(String) }
       def group_pr_name
+        if source.directories
+          grouped_directory_name
+        else
+          grouped_name
+        end
+      end
+
+      sig { returns(String) }
+      def grouped_name
+        updates = dependencies.map(&:name).uniq.count
+        if dependencies.count == 1
+          "#{solo_pr_name} in the #{T.must(dependency_group).name} group"
+        else
+          "bump the #{T.must(dependency_group).name} group#{pr_name_directory} " \
+            "with #{updates} update#{'s' if updates > 1}"
+        end
+      end
+
+      sig { returns(String) }
+      def grouped_directory_name
+        updates = dependencies.map(&:name).uniq.count
+
         directories_from_dependencies = dependencies.to_set { |dep| dep.metadata[:directory] }
 
         directories_with_updates = source.directories&.filter do |directory|
           directories_from_dependencies.include?(directory)
         end
 
-        updates = dependencies.map(&:name).uniq.count
-
-        if source.directories
+        if dependencies.count == 1
+          "#{solo_pr_name} in the #{T.must(dependency_group).name} group across " \
+            "#{T.must(directories_with_updates).count} directory"
+        else
           "bump the #{T.must(dependency_group).name} group across #{T.must(directories_with_updates).count} " \
             "#{T.must(directories_with_updates).count > 1 ? 'directories' : 'directory'} " \
             "with #{updates} update#{'s' if updates > 1}"
-        else
-          "bump the #{T.must(dependency_group).name} group#{pr_name_directory} with #{updates} update#{if updates > 1
-                                                                                                         's'
-                                                                                                       end}"
         end
       end
 
@@ -478,7 +497,7 @@ module Dependabot
                        "`#{dep.humanized_version}`"
                      ]
                    end
-                   "\n\n#{table([header] + rows)}"
+                   "\n\n#{table([header] + rows)}\n"
                  elsif update_count > 1
                    dependency_links_in_directory = dependency_links_for_directory(directory)
                    " #{T.must(T.must(dependency_links_in_directory)[0..-2]).join(', ')}" \
@@ -497,14 +516,16 @@ module Dependabot
 
       sig { returns(String) }
       def group_intro
-        update_count = dependencies.map(&:name).uniq.count
+        # Ensure dependencies are unique by name, from and to versions
+        unique_dependencies = dependencies.uniq { |dep| [dep.name, dep.previous_version, dep.version] }
+        update_count = unique_dependencies.count
 
         msg = "Bumps the #{T.must(dependency_group).name} group#{pr_name_directory} " \
               "with #{update_count} update#{update_count > 1 ? 's' : ''}:"
 
         msg += if update_count >= 5
                  header = %w(Package From To)
-                 rows = dependencies.map do |dep|
+                 rows = unique_dependencies.map do |dep|
                    [
                      dependency_link(dep),
                      "`#{dep.humanized_previous_version}`",

data/lib/dependabot/pull_request_updater/github.rb

@@ -213,6 +213,21 @@ module Dependabot
         )
       end
 
+      BRANCH_PROTECTION_ERROR_MESSAGES = T.let(
+        [
+          /protected branch/i,
+          /not authorized to push/i,
+          /must not contain merge commits/i,
+          /required status check/i,
+          /cannot force-push to this branch/i,
+          /pull request for this branch has been added to a merge queue/i,
+          # Unverified commits can be present when PR contains commits from other authors
+          /commits must have verified signatures/i,
+          /changes must be made through a pull request/i
+        ].freeze,
+        T::Array[Regexp]
+      )
+
       sig { params(commit: T.untyped).returns(T.untyped) }
       def update_branch(commit)
         T.unsafe(github_client_for_source).update_ref(
@@ -226,12 +241,7 @@ module Dependabot
         return nil if e.message.match?(/Reference does not exist/i)
         return nil if e.message.match?(/Reference cannot be updated/i)
 
-        if e.message.match?(/protected branch/i) ||
-           e.message.match?(/not authorized to push/i) ||
-           e.message.include?("must not contain merge commits") ||
-           e.message.match?(/required status check/i)
-          raise BranchProtected
-        end
+        raise BranchProtected, e.message if BRANCH_PROTECTION_ERROR_MESSAGES.any? { |msg| e.message.match?(msg) }
 
         raise
       end

data/lib/dependabot/update_checkers/base.rb

@@ -224,7 +224,7 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       def updated_dependency_without_unlock
         version = latest_resolvable_version_with_no_unlock.to_s
-        previous_version = latest_resolvable_previous_version(version)&.to_s
+        previous_version = latest_resolvable_previous_version(version)
 
         Dependency.new(
           name: dependency.name,
@@ -241,7 +241,7 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       def updated_dependency_with_own_req_unlock
         version = preferred_resolvable_version.to_s
-        previous_version = latest_resolvable_previous_version(version)&.to_s
+        previous_version = latest_resolvable_previous_version(version)
 
         Dependency.new(
           name: dependency.name,

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.250.0"
+  VERSION = "0.252.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.250.0
+  version: 0.252.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-02 00:00:00.000000000 Z
+date: 2024-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -583,7 +583,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.250.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.252.0
 post_install_message: 
 rdoc_options: []
 require_paths: