dependabot-common 0.270.0 → 0.272.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8336bf850c0c749141b14ff8f2bb993879de06c84a14818653933bd4b4262f4b
-  data.tar.gz: 2b6990991baa15d9c4a6b5054042d9e0b2923cf8462cdecaf5a5481db70912cb
+  metadata.gz: 317e2fbaa5340fe4a995a419da5ace365912a1a47de42ebc79adf23cc704b98c
+  data.tar.gz: 214d238bc3b6de57972e5676aac6e6b837187fb6fee5c050d673257ed751ef9c
 SHA512:
-  metadata.gz: a723881c0963e1b4e828470fea6222cf02bbcdb09911ccefa14db7034edf37e5b8b294ef913f176f75046baa32b1817a492c5bee0a0a813c570bd918c78ab26f
-  data.tar.gz: 1780bdea6b0a6a4d668289321940eed913ece2e0534b9c167a251f840b337ec8790668a375fbbeaadb259736c67ae2a9d98cb35cd6580369d1cf6ebe741efae8
+  metadata.gz: 64b49b8b1dec8d348b62090c5d67b5793f1ded64126b493fbc848aea8075ccaaa2c852cf14702bfd3bcea4c26b79a0e99cfe54f9d0a7f326af8a97aa2f53bd34
+  data.tar.gz: e1020c4794c5ca79434d4c488d20f565fbc6b0694f03def3e948700803aa46fa6ecfa19bdf740b83b68764bd9624c46496e51fe8dddecebeda6b1d6afe9370ad

data/lib/dependabot/errors.rb

@@ -226,6 +226,11 @@ module Dependabot
           "error-message": error.message
         }
       }
+    when Dependabot::OutOfDisk
+      {
+        "error-type": "out_of_disk",
+        "error-detail": {}
+      }
     when Dependabot::GoModulePathMismatch
       {
         "error-type": "go_module_path_mismatch",
@@ -235,6 +240,11 @@ module Dependabot
           "go-mod": error.go_mod
         }
       }
+    when BadRequirementError
+      {
+        "error-type": "illformed_requirement",
+        "error-detail": { message: error.message }
+      }
     when
       IncompatibleCPU,
       NetworkUnsafeHTTP
@@ -508,6 +518,8 @@ module Dependabot
 
   class DependencyFileNotResolvable < DependabotError; end
 
+  class BadRequirementError < Gem::Requirement::BadRequirementError; end
+
   #######################
   # Source level errors #
   #######################

data/lib/dependabot/file_parsers/base.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 require "dependabot/credential"
+require "dependabot/package_manager"
 
 module Dependabot
   module FileParsers
@@ -53,6 +54,11 @@ module Dependabot
       sig { abstract.returns(T::Array[Dependabot::Dependency]) }
       def parse; end
 
+      sig { returns(T.nilable(PackageManagerBase)) }
+      def package_manager
+        nil
+      end
+
       private
 
       sig { abstract.void }

data/lib/dependabot/file_updaters/base.rb

@@ -28,8 +28,8 @@ module Dependabot
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
-      sig { overridable.params(allowlist_enabled: T::Boolean).returns(T::Array[Regexp]) }
-      def self.updated_files_regex(allowlist_enabled = false)
+      sig { overridable.returns(T::Array[Regexp]) }
+      def self.updated_files_regex
         raise NotImplementedError
       end
 

data/lib/dependabot/notices.rb

@@ -0,0 +1,168 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/package_manager"
+
+module Dependabot
+  class Notice
+    extend T::Sig
+
+    sig { returns(String) }
+    attr_reader :mode, :type, :package_manager_name, :message, :markdown
+
+    # Initializes a new Notice object.
+    # @param mode [String] The mode of the notice (e.g., "WARN", "ERROR").
+    # @param type [String] The type of the notice (e.g., "bundler_deprecated_warn").
+    # @param package_manager_name [String] The name of the package manager (e.g., "bundler").
+    # @param message [String] The main message of the notice.
+    # @param markdown [String] The markdown formatted message.
+    sig do
+      params(
+        mode: String,
+        type: String,
+        package_manager_name: String,
+        message: String,
+        markdown: String
+      ).void
+    end
+    def initialize(mode:, type:, package_manager_name:, message: "", markdown: "")
+      @mode = mode
+      @type = type
+      @package_manager_name = package_manager_name
+      @message = message
+      @markdown = markdown
+    end
+
+    # Converts the Notice object to a hash.
+    # @return [Hash] The hash representation of the notice.
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    def to_hash
+      {
+        mode: @mode,
+        type: @type,
+        package_manager_name: @package_manager_name,
+        message: @message,
+        markdown: @markdown
+      }
+    end
+
+    # Generates a message for supported versions.
+    # @param supported_versions [Array<Dependabot::Version>, nil] The supported versions of the package manager.
+    # @param support_later_versions [Boolean] Whether later versions are supported.
+    # @return [String, nil] The generated message or nil if no supported versions are provided.
+    sig do
+      params(
+        supported_versions: T.nilable(T::Array[Dependabot::Version]),
+        support_later_versions: T::Boolean
+      ).returns(String)
+    end
+    def self.generate_supported_versions_message(supported_versions, support_later_versions)
+      return "" unless supported_versions&.any?
+
+      versions_string = supported_versions.map { |version| "`v#{version}`" }
+
+      versions_string[-1] = "or #{versions_string[-1]}" if versions_string.count > 1 && !support_later_versions
+
+      versions_string = versions_string.join(", ")
+
+      later_message = support_later_versions ? ", or later" : ""
+
+      return "Please upgrade to version #{versions_string}#{later_message}." if supported_versions.count == 1
+
+      "Please upgrade to one of the following versions: #{versions_string}#{later_message}."
+    end
+
+    # Generates a support notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated notice or nil if no notice is applicable.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_support_notice(package_manager)
+      deprecation_notice = generate_pm_deprecation_notice(package_manager)
+
+      return deprecation_notice if deprecation_notice
+
+      generate_pm_unsupported_notice(package_manager)
+    end
+
+    # Generates a deprecation notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated deprecation notice or nil if the package manager is not deprecated.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_pm_deprecation_notice(package_manager)
+      return nil unless package_manager.deprecated?
+
+      mode = "WARN"
+      supported_versions_message = generate_supported_versions_message(
+        package_manager.supported_versions,
+        package_manager.support_later_versions?
+      )
+      notice_type = "#{package_manager.name}_deprecated_#{mode.downcase}"
+      message = "Dependabot will stop supporting `#{package_manager.name} v#{package_manager.version}`!"
+      ## Create a warning markdown message
+      markdown = "> [!WARNING]\n"
+      ## Add the deprecation warning to the message
+      markdown += "> #{message}\n>\n"
+
+      ## Add the supported versions to the message
+      unless supported_versions_message.empty?
+        message += "\n#{supported_versions_message}\n"
+        markdown += "> #{supported_versions_message}\n>\n"
+      end
+
+      Notice.new(
+        mode: mode,
+        type: notice_type,
+        package_manager_name: package_manager.name,
+        message: message,
+        markdown: markdown
+      )
+    end
+
+    # Generates an unsupported notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated unsupported notice or nil if the package manager is not unsupported.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_pm_unsupported_notice(package_manager)
+      return nil unless package_manager.unsupported?
+
+      mode = "ERROR"
+      supported_versions_message = generate_supported_versions_message(
+        package_manager.supported_versions,
+        package_manager.support_later_versions?
+      )
+      notice_type = "#{package_manager.name}_unsupported_#{mode.downcase}"
+      message = "Dependabot no longer supports `#{package_manager.name} v#{package_manager.version}`!"
+      ## Create an error markdown message
+      markdown = "> [!IMPORTANT]\n"
+      ## Add the error message to the message
+      markdown += "> #{message}\n>\n"
+
+      ## Add the supported versions to the message
+      unless supported_versions_message.empty?
+        message += "\n#{supported_versions_message}\n"
+        markdown += "> #{supported_versions_message}\n>\n"
+      end
+
+      Notice.new(
+        mode: mode,
+        type: notice_type,
+        package_manager_name: package_manager.name,
+        message: message,
+        markdown: markdown
+      )
+    end
+  end
+end

data/lib/dependabot/package_manager.rb

@@ -0,0 +1,84 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class PackageManagerBase
+    extend T::Sig
+    extend T::Helpers
+
+    abstract!
+
+    # The name of the package manager (e.g., "bundler").
+    # @example
+    #   package_manager.name #=> "bundler"
+    sig { abstract.returns(String) }
+    def name; end
+
+    # The version of the package manager (e.g., Dependabot::Version.new("2.1.4")).
+    # @example
+    #   package_manager.version #=> Dependabot::Version.new("2.1.4")
+    sig { abstract.returns(Dependabot::Version) }
+    def version; end
+
+    # Returns an array of deprecated versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.deprecated_versions #=> [Dependabot::Version.new("1.0.0"), Dependabot::Version.new("1.1.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def deprecated_versions
+      []
+    end
+
+    # Returns an array of unsupported versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.unsupported_versions #=> [Dependabot::Version.new("0.9.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def unsupported_versions
+      []
+    end
+
+    # Returns an array of supported versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.supported_versions #=> [Dependabot::Version.new("2.0.0"), Dependabot::Version.new("2.1.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def supported_versions
+      []
+    end
+
+    # Checks if the current version is deprecated.
+    # Returns true if the version is in the deprecated_versions array; false otherwise.
+    # @example
+    #   package_manager.deprecated? #=> true
+    sig { returns(T::Boolean) }
+    def deprecated?
+      deprecated_versions.include?(version)
+    end
+
+    # Checks if the current version is unsupported.
+    # Returns true if the version is in the unsupported_versions array; false otherwise.
+    # @example
+    #   package_manager.unsupported? #=> false
+    sig { returns(T::Boolean) }
+    def unsupported?
+      return true if unsupported_versions.include?(version)
+
+      supported_versions = self.supported_versions
+      return version < supported_versions.first if supported_versions.any?
+
+      false
+    end
+
+    # Indicates if the package manager supports later versions beyond those listed in supported_versions.
+    # By default, returns false if not overridden in the subclass.
+    # @example
+    #   package_manager.support_later_versions? #=> true
+    sig { returns(T::Boolean) }
+    def support_later_versions?
+      false
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -12,6 +12,7 @@ require "dependabot/logger"
 require "dependabot/metadata_finders"
 require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/message"
+require "dependabot/notices"
 
 # rubocop:disable Metrics/ClassLength
 module Dependabot
@@ -64,6 +65,9 @@ module Dependabot
       sig { returns(T::Array[T::Hash[String, String]]) }
       attr_reader :ignore_conditions
 
+      sig { returns(T.nilable(T::Array[Dependabot::Notice])) }
+      attr_reader :notices
+
       TRUNCATED_MSG = "...\n\n_Description has been truncated_"
 
       sig do
@@ -80,7 +84,8 @@ module Dependabot
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           pr_message_max_length: T.nilable(Integer),
           pr_message_encoding: T.nilable(Encoding),
-          ignore_conditions: T::Array[T::Hash[String, String]]
+          ignore_conditions: T::Array[T::Hash[String, String]],
+          notices: T.nilable(T::Array[Dependabot::Notice])
         )
           .void
       end
@@ -88,7 +93,8 @@ module Dependabot
                      pr_message_header: nil, pr_message_footer: nil,
                      commit_message_options: {}, vulnerabilities_fixed: {},
                      github_redirection_service: DEFAULT_GITHUB_REDIRECTION_SERVICE,
-                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil, ignore_conditions: [])
+                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil,
+                     ignore_conditions: [], notices: nil)
         @dependencies               = dependencies
         @files                      = files
         @source                     = source
@@ -102,6 +108,7 @@ module Dependabot
         @pr_message_max_length      = pr_message_max_length
         @pr_message_encoding        = pr_message_encoding
         @ignore_conditions          = ignore_conditions
+        @notices                    = notices
       end
 
       sig { params(pr_message_max_length: Integer).returns(Integer) }
@@ -119,7 +126,8 @@ module Dependabot
 
       sig { returns(String) }
       def pr_message
-        msg = "#{suffixed_pr_message_header}" \
+        msg = "#{pr_notices}" \
+              "#{suffixed_pr_message_header}" \
               "#{commit_message_intro}" \
               "#{metadata_cascades}" \
               "#{ignore_conditions_table}" \
@@ -131,6 +139,18 @@ module Dependabot
         suffixed_pr_message_header + prefixed_pr_message_footer
       end
 
+      sig { returns(T.nilable(String)) }
+      def pr_notices
+        notices = @notices || []
+        unique_messages = notices.filter_map do |notice|
+          markdown = notice.markdown if notice
+          markdown unless markdown.empty?
+        end.uniq
+
+        message = unique_messages.join("\n\n")
+        message.empty? ? nil : message
+      end
+
       # Truncate PR message as determined by the pr_message_max_length and pr_message_encoding instance variables
       # The encoding is used when calculating length, all messages are returned as ruby UTF_8 encoded string
       sig { params(msg: String).returns(String) }
@@ -316,6 +336,8 @@ module Dependabot
       def suffixed_pr_message_header
         return "" unless pr_message_header
 
+        return "#{pr_message_header}\n\n" if notices
+
         "#{pr_message_header}\n\n"
       end
 

data/lib/dependabot/sem_version2.rb

@@ -0,0 +1,131 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+# See https://semver.org/spec/v2.0.0.html for semver 2 details
+#
+module Dependabot
+  class SemVersion2
+    extend T::Sig
+    extend T::Helpers
+    include Comparable
+
+    SEMVER2_REGEX = /^
+      (0|[1-9]\d*)\. # major
+      (0|[1-9]\d*)\. # minor
+      (0|[1-9]\d*)   # patch
+      (?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))? # pre release
+      (?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))? # build metadata
+    $/x
+
+    sig { returns(String) }
+    attr_accessor :major
+
+    sig { returns(String) }
+    attr_accessor :minor
+
+    sig { returns(String) }
+    attr_accessor :patch
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :build
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :prerelease
+
+    sig { params(version: String).void }
+    def initialize(version)
+      tokens = parse(version)
+      @major = T.let(T.must(tokens[:major]), String)
+      @minor = T.let(T.must(tokens[:minor]), String)
+      @patch = T.let(T.must(tokens[:patch]), String)
+      @build = T.let(tokens[:build], T.nilable(String))
+      @prerelease = T.let(tokens[:prerelease], T.nilable(String))
+    end
+
+    sig { returns(T::Boolean) }
+    def prerelease?
+      !!prerelease
+    end
+
+    sig { returns(String) }
+    def to_s
+      value = [major, minor, patch].join(".")
+      value += "-#{prerelease}" if prerelease
+      value += "+#{build}" if build
+      value
+    end
+
+    sig { returns(String) }
+    def inspect
+      "#<#{self.class} #{self}>"
+    end
+
+    sig { params(other: ::Dependabot::SemVersion2).returns(T::Boolean) }
+    def eql?(other)
+      other.is_a?(self.class) && to_s == other.to_s
+    end
+
+    sig { params(other: ::Dependabot::SemVersion2).returns(Integer) }
+    def <=>(other)
+      result = major.to_i <=> other.major.to_i
+      return result unless result.zero?
+
+      result = minor.to_i <=> other.minor.to_i
+      return result unless result.zero?
+
+      result = patch.to_i <=> other.patch.to_i
+      return result unless result.zero?
+
+      compare_prereleases(prerelease, other.prerelease)
+    end
+
+    sig { params(version: T.nilable(String)).returns(T::Boolean) }
+    def self.correct?(version)
+      return false if version.nil?
+
+      version.match?(SEMVER2_REGEX)
+    end
+
+    private
+
+    sig { params(version: String).returns(T::Hash[Symbol, T.nilable(String)]) }
+    def parse(version)
+      match = version.match(SEMVER2_REGEX)
+      raise ArgumentError, "Malformed version number string #{version}" unless match
+
+      major, minor, patch, prerelease, build = match.captures
+
+      { major: major, minor: minor, patch: patch, prerelease: prerelease, build: build }
+    end
+
+    sig { params(prerelease1: T.nilable(String), prerelease2: T.nilable(String)).returns(Integer) }
+    def compare_prereleases(prerelease1, prerelease2) # rubocop:disable Metrics/PerceivedComplexity
+      return 0 if prerelease1.nil? && prerelease2.nil?
+      return -1 if prerelease2.nil?
+      return 1 if prerelease1.nil?
+
+      prerelease1_tokens = prerelease1.split(".")
+      prerelease2_tokens = prerelease2.split(".")
+
+      prerelease1_tokens.zip(prerelease2_tokens) do |t1, t2|
+        return 1 if t2.nil? # t1 is more specific e.g. 1.0.0-rc1.1 vs 1.0.0-rc1
+
+        if t1 =~ /^\d+$/ && t2 =~ /^\d+$/
+          # t1 and t2 are both ints so compare them as such
+          a = t1.to_i
+          b = t2.to_i
+          compare = a <=> b
+          return compare unless compare.zero?
+        end
+
+        comp = t1 <=> t2
+        return T.must(comp) unless T.must(comp).zero?
+      end
+
+      # prereleases are equal or prerelease2 is more specific e.g. 1.0.0-rc1 vs 1.0.0-rc1.1
+      prerelease1_tokens.length == prerelease2_tokens.length ? 0 : -1
+    end
+  end
+end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.270.0"
+  VERSION = "0.272.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.270.0
+  version: 0.272.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-15 00:00:00.000000000 Z
+date: 2024-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -551,6 +551,8 @@ files:
 - lib/dependabot/metadata_finders/base/changelog_pruner.rb
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
+- lib/dependabot/notices.rb
+- lib/dependabot/package_manager.rb
 - lib/dependabot/pull_request_creator.rb
 - lib/dependabot/pull_request_creator/azure.rb
 - lib/dependabot/pull_request_creator/bitbucket.rb
@@ -578,6 +580,7 @@ files:
 - lib/dependabot/requirements_update_strategy.rb
 - lib/dependabot/requirements_updater/base.rb
 - lib/dependabot/security_advisory.rb
+- lib/dependabot/sem_version2.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
 - lib/dependabot/source.rb
@@ -597,7 +600,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.270.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.272.0
 post_install_message: 
 rdoc_options: []
 require_paths: