dependabot-common 0.263.0 → 0.265.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22016be70b3847889c81eabf845be31526245c9236559a27b5109d47018d7235
-  data.tar.gz: 13cd4ef806fe2f7e9d3957a053a221282098c1246802b1973900b0679a13911d
+  metadata.gz: 4715cad47e5311ab6deb63b425cb37b8e9ad44266d20154ada92f5eebeb1072a
+  data.tar.gz: 4194a3c0d440f8d320cfad7789f2e0237871236e0d39da5dc8b8705608c6176f
 SHA512:
-  metadata.gz: bf3a197a93951f0296ea1258ee4a8a941732a2cc4a72fb319a31fc9561fa2e661c4079bbc8f3771c7a8d1d774ef38912fbc2c2abf23cad7565929eda505a77b4
-  data.tar.gz: 0d8b54e3ff114cc8a3bb58eb8843d781befcf111df3261ac814aa77b262ccda2131aedfe46acd3e556a86e220c90457b3475598d2431bbaf581f954d21e83ddc
+  metadata.gz: d86205634fc7375b9b652137782d4686c4763c278456ce52cd5af6d2778aa19540e4be8fa0203770234264e8e6af15105fffc428d4c5b160b94d6b1719b50a4f
+  data.tar.gz: f3db0f9d9fd293ae3904812b81ec15f400a6b16973e4327f6c23556b27ce35bc767821693a4c6f105ed49b2d316546c906d586f9955e55ffcf8301b20720967e

data/lib/dependabot/errors.rb

@@ -17,6 +17,7 @@ module Dependabot
     DEPENDENCY_GROUPS = "job-dependency-groups"
     JOB_ID            = "job-id"
     PACKAGE_MANAGER   = "package-manager"
+    SECURITY_UPDATE   = "security-update"
   end
 
   # rubocop:disable Metrics/MethodLength

data/lib/dependabot/file_fetchers/base.rb

@@ -93,12 +93,13 @@ module Dependabot
       #
       # options supports custom feature enablement
       sig do
-        params(
-          source: Dependabot::Source,
-          credentials: T::Array[Dependabot::Credential],
-          repo_contents_path: T.nilable(String),
-          options: T::Hash[String, String]
-        )
+        overridable
+          .params(
+            source: Dependabot::Source,
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String),
+            options: T::Hash[String, String]
+          )
           .void
       end
       def initialize(source:, credentials:, repo_contents_path: nil, options: {})

data/lib/dependabot/git_commit_checker.rb

@@ -144,14 +144,14 @@ module Dependabot
       max_local_tag(allowed_version_tags)
     end
 
-    sig { returns(T::Array[T.nilable(T::Hash[Symbol, T.untyped])]) }
+    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
     def local_tags_for_allowed_versions_matching_existing_precision
-      select_matching_existing_precision(allowed_version_tags).map { |t| to_local_tag(t) }
+      select_matching_existing_precision(allowed_version_tags).filter_map { |t| to_local_tag(t) }
     end
 
-    sig { returns(T::Array[T.nilable(T::Hash[Symbol, T.untyped])]) }
+    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
     def local_tags_for_allowed_versions
-      allowed_version_tags.map { |t| to_local_tag(t) }
+      allowed_version_tags.filter_map { |t| to_local_tag(t) }
     end
 
     sig { returns(T::Array[Dependabot::GitRef]) }

data/lib/dependabot/shared_helpers.rb

@@ -131,16 +131,18 @@ module Dependabot
       params(
         command: String,
         function: String,
-        args: T.any(T::Array[String], T::Hash[Symbol, String]),
+        args: T.any(T::Array[T.any(String, T::Array[T::Hash[String, T.untyped]])], T::Hash[Symbol, String]),
         env: T.nilable(T::Hash[String, String]),
         stderr_to_stdout: T::Boolean,
-        allow_unsafe_shell_command: T::Boolean
+        allow_unsafe_shell_command: T::Boolean,
+        error_class: T.class_of(HelperSubprocessFailed)
       )
         .returns(T.nilable(T.any(String, T::Hash[String, T.untyped], T::Array[T::Hash[String, T.untyped]])))
     end
     def self.run_helper_subprocess(command:, function:, args:, env: nil,
                                    stderr_to_stdout: false,
-                                   allow_unsafe_shell_command: false)
+                                   allow_unsafe_shell_command: false,
+                                   error_class: HelperSubprocessFailed)
       start = Time.now
       stdin_data = JSON.dump(function: function, args: args)
       cmd = allow_unsafe_shell_command ? command : escape_command(command)
@@ -180,33 +182,54 @@ module Dependabot
         process_termsig: process.termsig
       }
 
-      check_out_of_memory_error(stderr, error_context)
+      check_out_of_memory_error(stderr, error_context, error_class)
 
       begin
         response = JSON.parse(stdout)
         return response["result"] if process.success?
 
-        raise HelperSubprocessFailed.new(
+        raise error_class.new(
           message: response["error"],
           error_class: response["error_class"],
           error_context: error_context,
           trace: response["trace"]
         )
       rescue JSON::ParserError
-        raise HelperSubprocessFailed.new(
-          message: stdout || "No output from command",
-          error_class: "JSON::ParserError",
-          error_context: error_context
-        )
+        raise handle_json_parse_error(stdout, stderr, error_context, error_class)
       end
     end
 
+    sig do
+      params(stdout: String, stderr: String, error_context: T::Hash[Symbol, T.untyped],
+             error_class: T.class_of(HelperSubprocessFailed))
+        .returns(HelperSubprocessFailed)
+    end
+    def self.handle_json_parse_error(stdout, stderr, error_context, error_class)
+      # If the JSON is invalid, the helper has likely failed
+      # We should raise a more helpful error message
+      message = if !stdout.strip.empty?
+                  stdout
+                elsif !stderr.strip.empty?
+                  stderr
+                else
+                  "No output from command"
+                end
+      error_class.new(
+        message: message,
+        error_class: "JSON::ParserError",
+        error_context: error_context
+      )
+    end
+
     # rubocop:enable Metrics/MethodLength
-    sig { params(stderr: T.nilable(String), error_context: T::Hash[Symbol, String]).void }
-    def self.check_out_of_memory_error(stderr, error_context)
+    sig do
+      params(stderr: T.nilable(String), error_context: T::Hash[Symbol, String],
+             error_class: T.class_of(HelperSubprocessFailed)).void
+    end
+    def self.check_out_of_memory_error(stderr, error_context, error_class)
       return unless stderr&.include?("JavaScript heap out of memory")
 
-      raise HelperSubprocessFailed.new(
+      raise error_class.new(
         message: "JavaScript heap out of memory",
         error_class: "Dependabot::OutOfMemoryError",
         error_context: error_context

data/lib/dependabot/update_checkers/base.rb

@@ -136,7 +136,7 @@ module Dependabot
 
       # Lowest available security fix version not checking resolvability
       # @return [Dependabot::<package manager>::Version, #to_s] version class
-      sig { overridable.returns(Dependabot::Version) }
+      sig { overridable.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         raise NotImplementedError, "#{self.class} must implement #lowest_security_fix_version"
       end
@@ -363,7 +363,7 @@ module Dependabot
       end
 
       # TODO: Should this return Dependabot::Version?
-      sig { returns(T.nilable(Gem::Version)) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       def current_version
         @current_version ||=
           T.let(

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.263.0"
+  VERSION = "0.265.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.263.0
+  version: 0.265.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-27 00:00:00.000000000 Z
+date: 2024-07-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -597,7 +597,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.263.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.265.0
 post_install_message: 
 rdoc_options: []
 require_paths: