dependabot-common 0.271.0 → 0.273.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91359b653469a0560b360dea6e500c5f345856efeea5cc9b37efe6ff7a05c03e
-  data.tar.gz: 3118159e7377979e45fb1d8da10a0b1b6892264ed84a1ba635d0fbaf98876bf4
+  metadata.gz: be0c28765d665424088cb737d933cf376c29d931e1d642f96562d362c406fcf0
+  data.tar.gz: de8f912ee099ed27b8d14811f7fb67f9b83119dc7db2483645947b2cd12b380d
 SHA512:
-  metadata.gz: ec357ae2737555fe8a0558e7bb286fdc1b86f8cfec0a2f194ab7a36b9956f3ecbddcb3daa67e0e09756d5faca7c7e668c2de565b1e1bd6120c9c0fb294f6e900
-  data.tar.gz: e6bcbed76ade501a2a17d3b800edb21827fedfc6351d952590e14f51ac7a1b83c84cc999ee715775d0fc7ff311ae3753b60680a9d1d7778ebfa86cded143d5fb
+  metadata.gz: e45c119606e121da9f919de9e40ff1ae63e22ad0167308bcb1e74b626296607fa8d05634ccb7ac922943d547c0f99820fab5c89fe105580146b5dc2224fbd97a
+  data.tar.gz: 2bc6a5d526316d9d81cbfb0e03d06699a28e03757ff36f07a46d870a1e55a89794ffd834f3c1c8e21c7ccf737ed325bc1af111a2e22234641c54e1bb9d8cd56b

data/lib/dependabot/errors.rb

@@ -226,6 +226,11 @@ module Dependabot
           "error-message": error.message
         }
       }
+    when Dependabot::OutOfDisk
+      {
+        "error-type": "out_of_disk",
+        "error-detail": {}
+      }
     when Dependabot::GoModulePathMismatch
       {
         "error-type": "go_module_path_mismatch",
@@ -235,6 +240,11 @@ module Dependabot
           "go-mod": error.go_mod
         }
       }
+    when BadRequirementError
+      {
+        "error-type": "illformed_requirement",
+        "error-detail": { message: error.message }
+      }
     when
       IncompatibleCPU,
       NetworkUnsafeHTTP
@@ -508,6 +518,8 @@ module Dependabot
 
   class DependencyFileNotResolvable < DependabotError; end
 
+  class BadRequirementError < Gem::Requirement::BadRequirementError; end
+
   #######################
   # Source level errors #
   #######################

data/lib/dependabot/file_parsers/base.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 require "dependabot/credential"
+require "dependabot/package_manager"
 
 module Dependabot
   module FileParsers
@@ -53,6 +54,11 @@ module Dependabot
       sig { abstract.returns(T::Array[Dependabot::Dependency]) }
       def parse; end
 
+      sig { returns(T.nilable(PackageManagerBase)) }
+      def package_manager
+        nil
+      end
+
       private
 
       sig { abstract.void }

data/lib/dependabot/file_updaters/base.rb

@@ -28,8 +28,8 @@ module Dependabot
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
-      sig { overridable.params(allowlist_enabled: T::Boolean).returns(T::Array[Regexp]) }
-      def self.updated_files_regex(allowlist_enabled = false)
+      sig { overridable.returns(T::Array[Regexp]) }
+      def self.updated_files_regex
         raise NotImplementedError
       end
 

data/lib/dependabot/notices.rb

@@ -0,0 +1,210 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/package_manager"
+
+module Dependabot
+  class Notice
+    module NoticeMode
+      INFO = "INFO"
+      WARN = "WARN"
+      ERROR = "ERROR"
+    end
+
+    extend T::Sig
+
+    sig { returns(String) }
+    attr_reader :mode, :type, :package_manager_name, :title, :description
+
+    sig { returns(T::Boolean) }
+    attr_reader :show_in_pr, :show_alert
+
+    # Initializes a new Notice object.
+    # @param mode [String] The mode of the notice (e.g., "WARN", "ERROR").
+    # @param type [String] The type of the notice (e.g., "bundler_deprecated_warn").
+    # @param package_manager_name [String] The name of the package manager (e.g., "bundler").
+    # @param title [String] The title of the notice.
+    # @param description [String] The main description of the notice.
+    # @param show_in_pr [Boolean] Whether the notice should be shown in a pull request.
+    # @param show_alert [Boolean] Whether the notice should be shown in alerts.
+    sig do
+      params(
+        mode: String,
+        type: String,
+        package_manager_name: String,
+        title: String,
+        description: String,
+        show_in_pr: T::Boolean,
+        show_alert: T::Boolean
+      ).void
+    end
+    def initialize(
+      mode:, type:, package_manager_name:,
+      title: "", description: "",
+      show_in_pr: false, show_alert: false
+    )
+      @mode = mode
+      @type = type
+      @package_manager_name = package_manager_name
+      @title = title
+      @description = description
+      @show_in_pr = show_in_pr
+      @show_alert = show_alert
+    end
+
+    # Converts the Notice object to a hash.
+    # @return [Hash] The hash representation of the notice.
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    def to_hash
+      {
+        mode: @mode,
+        type: @type,
+        package_manager_name: @package_manager_name,
+        title: @title,
+        description: @description,
+        show_in_pr: @show_in_pr,
+        show_alert: @show_alert
+      }
+    end
+
+    # Generates a description for supported versions.
+    # @param supported_versions [Array<Dependabot::Version>, nil] The supported versions of the package manager.
+    # @param support_later_versions [Boolean] Whether later versions are supported.
+    # @return [String, nil] The generated description or nil if no supported versions are provided.
+    sig do
+      params(
+        supported_versions: T.nilable(T::Array[Dependabot::Version]),
+        support_later_versions: T::Boolean
+      ).returns(String)
+    end
+    def self.generate_supported_versions_description(supported_versions, support_later_versions)
+      return "Please upgrade your package manager version" unless supported_versions&.any?
+
+      versions_string = supported_versions.map { |version| "`v#{version}`" }
+
+      versions_string[-1] = "or #{versions_string[-1]}" if versions_string.count > 1 && !support_later_versions
+
+      versions_string = versions_string.join(", ")
+
+      later_description = support_later_versions ? ", or later" : ""
+
+      return "Please upgrade to version #{versions_string}#{later_description}." if supported_versions.count == 1
+
+      "Please upgrade to one of the following versions: #{versions_string}#{later_description}."
+    end
+
+    # Generates a support notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated notice or nil if no notice is applicable.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_support_notice(package_manager)
+      deprecation_notice = generate_pm_deprecation_notice(package_manager)
+
+      return deprecation_notice if deprecation_notice
+
+      generate_pm_unsupported_notice(package_manager)
+    end
+
+    # Generates a deprecation notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated deprecation notice or nil if the package manager is not deprecated.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_pm_deprecation_notice(package_manager)
+      return nil unless package_manager.deprecated?
+
+      mode = NoticeMode::WARN
+      supported_versions_description = generate_supported_versions_description(
+        package_manager.supported_versions,
+        package_manager.support_later_versions?
+      )
+      notice_type = "#{package_manager.name}_deprecated_warn"
+      title = "Package manager deprecation notice"
+      description = "Dependabot will stop supporting `#{package_manager.name} v#{package_manager.version}`!"
+
+      ## Add the supported versions to the description
+      description += "\n\n#{supported_versions_description}\n" unless supported_versions_description.empty?
+
+      Notice.new(
+        mode: mode,
+        type: notice_type,
+        package_manager_name: package_manager.name,
+        title: title,
+        description: description,
+        show_in_pr: true,
+        show_alert: true
+      )
+    end
+
+    # Generates an unsupported notice for the given package manager.
+    # @param package_manager [PackageManagerBase] The package manager object.
+    # @return [Notice, nil] The generated unsupported notice or nil if the package manager is not unsupported.
+    sig do
+      params(
+        package_manager: PackageManagerBase
+      ).returns(T.nilable(Notice))
+    end
+    def self.generate_pm_unsupported_notice(package_manager)
+      return nil unless package_manager.unsupported?
+
+      mode = NoticeMode::ERROR
+      supported_versions_description = generate_supported_versions_description(
+        package_manager.supported_versions,
+        package_manager.support_later_versions?
+      )
+      notice_type = "#{package_manager.name}_unsupported_error"
+      title = "Package manager unsupported notice"
+      description = "Dependabot no longer supports `#{package_manager.name} v#{package_manager.version}`!"
+
+      ## Add the supported versions to the description
+      description += "\n\n#{supported_versions_description}\n" unless supported_versions_description.empty?
+
+      Notice.new(
+        mode: mode,
+        type: notice_type,
+        package_manager_name: package_manager.name,
+        title: title,
+        description: description,
+        show_in_pr: true,
+        show_alert: true
+      )
+    end
+
+    sig { params(notice: Notice).returns(T.nilable(String)) }
+    def self.markdown_from_description(notice)
+      description = notice.description
+
+      return if description.empty?
+
+      markdown = "> [!#{markdown_mode(notice.mode)}]\n"
+      # Log each non-empty line of the deprecation notice description
+      description.each_line do |line|
+        line = line.strip
+        markdown += "> #{line}\n"
+      end
+      markdown
+    end
+
+    sig { params(mode: String).returns(String) }
+    def self.markdown_mode(mode)
+      case mode
+      when NoticeMode::INFO
+        "INFO"
+      when NoticeMode::WARN
+        "WARNING"
+      when NoticeMode::ERROR
+        "IMPORTANT"
+      else
+        "INFO"
+      end
+    end
+  end
+end

data/lib/dependabot/package_manager.rb

@@ -0,0 +1,84 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class PackageManagerBase
+    extend T::Sig
+    extend T::Helpers
+
+    abstract!
+
+    # The name of the package manager (e.g., "bundler").
+    # @example
+    #   package_manager.name #=> "bundler"
+    sig { abstract.returns(String) }
+    def name; end
+
+    # The version of the package manager (e.g., Dependabot::Version.new("2.1.4")).
+    # @example
+    #   package_manager.version #=> Dependabot::Version.new("2.1.4")
+    sig { abstract.returns(Dependabot::Version) }
+    def version; end
+
+    # Returns an array of deprecated versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.deprecated_versions #=> [Dependabot::Version.new("1.0.0"), Dependabot::Version.new("1.1.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def deprecated_versions
+      []
+    end
+
+    # Returns an array of unsupported versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.unsupported_versions #=> [Dependabot::Version.new("0.9.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def unsupported_versions
+      []
+    end
+
+    # Returns an array of supported versions of the package manager.
+    # By default, returns an empty array if not overridden in the subclass.
+    # @example
+    #   package_manager.supported_versions #=> [Dependabot::Version.new("2.0.0"), Dependabot::Version.new("2.1.0")]
+    sig { returns(T::Array[Dependabot::Version]) }
+    def supported_versions
+      []
+    end
+
+    # Checks if the current version is deprecated.
+    # Returns true if the version is in the deprecated_versions array; false otherwise.
+    # @example
+    #   package_manager.deprecated? #=> true
+    sig { returns(T::Boolean) }
+    def deprecated?
+      deprecated_versions.include?(version)
+    end
+
+    # Checks if the current version is unsupported.
+    # Returns true if the version is in the unsupported_versions array; false otherwise.
+    # @example
+    #   package_manager.unsupported? #=> false
+    sig { returns(T::Boolean) }
+    def unsupported?
+      return true if unsupported_versions.include?(version)
+
+      supported_versions = self.supported_versions
+      return version < supported_versions.first if supported_versions.any?
+
+      false
+    end
+
+    # Indicates if the package manager supports later versions beyond those listed in supported_versions.
+    # By default, returns false if not overridden in the subclass.
+    # @example
+    #   package_manager.support_later_versions? #=> true
+    sig { returns(T::Boolean) }
+    def support_later_versions?
+      false
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -12,6 +12,7 @@ require "dependabot/logger"
 require "dependabot/metadata_finders"
 require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/message"
+require "dependabot/notices"
 
 # rubocop:disable Metrics/ClassLength
 module Dependabot
@@ -64,6 +65,9 @@ module Dependabot
       sig { returns(T::Array[T::Hash[String, String]]) }
       attr_reader :ignore_conditions
 
+      sig { returns(T.nilable(T::Array[Dependabot::Notice])) }
+      attr_reader :notices
+
       TRUNCATED_MSG = "...\n\n_Description has been truncated_"
 
       sig do
@@ -80,7 +84,8 @@ module Dependabot
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           pr_message_max_length: T.nilable(Integer),
           pr_message_encoding: T.nilable(Encoding),
-          ignore_conditions: T::Array[T::Hash[String, String]]
+          ignore_conditions: T::Array[T::Hash[String, String]],
+          notices: T.nilable(T::Array[Dependabot::Notice])
         )
           .void
       end
@@ -88,7 +93,8 @@ module Dependabot
                      pr_message_header: nil, pr_message_footer: nil,
                      commit_message_options: {}, vulnerabilities_fixed: {},
                      github_redirection_service: DEFAULT_GITHUB_REDIRECTION_SERVICE,
-                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil, ignore_conditions: [])
+                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil,
+                     ignore_conditions: [], notices: nil)
         @dependencies               = dependencies
         @files                      = files
         @source                     = source
@@ -102,6 +108,7 @@ module Dependabot
         @pr_message_max_length      = pr_message_max_length
         @pr_message_encoding        = pr_message_encoding
         @ignore_conditions          = ignore_conditions
+        @notices                    = notices
       end
 
       sig { params(pr_message_max_length: Integer).returns(Integer) }
@@ -119,7 +126,8 @@ module Dependabot
 
       sig { returns(String) }
       def pr_message
-        msg = "#{suffixed_pr_message_header}" \
+        msg = "#{pr_notices}" \
+              "#{suffixed_pr_message_header}" \
               "#{commit_message_intro}" \
               "#{metadata_cascades}" \
               "#{ignore_conditions_table}" \
@@ -131,6 +139,17 @@ module Dependabot
         suffixed_pr_message_header + prefixed_pr_message_footer
       end
 
+      sig { returns(T.nilable(String)) }
+      def pr_notices
+        notices = @notices || []
+        unique_messages = notices.filter_map do |notice|
+          Dependabot::Notice.markdown_from_description(notice) if notice.show_in_pr
+        end.uniq
+
+        message = unique_messages.join("\n\n")
+        message.empty? ? nil : message
+      end
+
       # Truncate PR message as determined by the pr_message_max_length and pr_message_encoding instance variables
       # The encoding is used when calculating length, all messages are returned as ruby UTF_8 encoded string
       sig { params(msg: String).returns(String) }
@@ -316,6 +335,8 @@ module Dependabot
       def suffixed_pr_message_header
         return "" unless pr_message_header
 
+        return "#{pr_message_header}\n\n" if notices
+
         "#{pr_message_header}\n\n"
       end
 

data/lib/dependabot/sem_version2.rb

@@ -0,0 +1,131 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+# See https://semver.org/spec/v2.0.0.html for semver 2 details
+#
+module Dependabot
+  class SemVersion2
+    extend T::Sig
+    extend T::Helpers
+    include Comparable
+
+    SEMVER2_REGEX = /^
+      (0|[1-9]\d*)\. # major
+      (0|[1-9]\d*)\. # minor
+      (0|[1-9]\d*)   # patch
+      (?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))? # pre release
+      (?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))? # build metadata
+    $/x
+
+    sig { returns(String) }
+    attr_accessor :major
+
+    sig { returns(String) }
+    attr_accessor :minor
+
+    sig { returns(String) }
+    attr_accessor :patch
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :build
+
+    sig { returns(T.nilable(String)) }
+    attr_accessor :prerelease
+
+    sig { params(version: String).void }
+    def initialize(version)
+      tokens = parse(version)
+      @major = T.let(T.must(tokens[:major]), String)
+      @minor = T.let(T.must(tokens[:minor]), String)
+      @patch = T.let(T.must(tokens[:patch]), String)
+      @build = T.let(tokens[:build], T.nilable(String))
+      @prerelease = T.let(tokens[:prerelease], T.nilable(String))
+    end
+
+    sig { returns(T::Boolean) }
+    def prerelease?
+      !!prerelease
+    end
+
+    sig { returns(String) }
+    def to_s
+      value = [major, minor, patch].join(".")
+      value += "-#{prerelease}" if prerelease
+      value += "+#{build}" if build
+      value
+    end
+
+    sig { returns(String) }
+    def inspect
+      "#<#{self.class} #{self}>"
+    end
+
+    sig { params(other: ::Dependabot::SemVersion2).returns(T::Boolean) }
+    def eql?(other)
+      other.is_a?(self.class) && to_s == other.to_s
+    end
+
+    sig { params(other: ::Dependabot::SemVersion2).returns(Integer) }
+    def <=>(other)
+      result = major.to_i <=> other.major.to_i
+      return result unless result.zero?
+
+      result = minor.to_i <=> other.minor.to_i
+      return result unless result.zero?
+
+      result = patch.to_i <=> other.patch.to_i
+      return result unless result.zero?
+
+      compare_prereleases(prerelease, other.prerelease)
+    end
+
+    sig { params(version: T.nilable(String)).returns(T::Boolean) }
+    def self.correct?(version)
+      return false if version.nil?
+
+      version.match?(SEMVER2_REGEX)
+    end
+
+    private
+
+    sig { params(version: String).returns(T::Hash[Symbol, T.nilable(String)]) }
+    def parse(version)
+      match = version.match(SEMVER2_REGEX)
+      raise ArgumentError, "Malformed version number string #{version}" unless match
+
+      major, minor, patch, prerelease, build = match.captures
+
+      { major: major, minor: minor, patch: patch, prerelease: prerelease, build: build }
+    end
+
+    sig { params(prerelease1: T.nilable(String), prerelease2: T.nilable(String)).returns(Integer) }
+    def compare_prereleases(prerelease1, prerelease2) # rubocop:disable Metrics/PerceivedComplexity
+      return 0 if prerelease1.nil? && prerelease2.nil?
+      return -1 if prerelease2.nil?
+      return 1 if prerelease1.nil?
+
+      prerelease1_tokens = prerelease1.split(".")
+      prerelease2_tokens = prerelease2.split(".")
+
+      prerelease1_tokens.zip(prerelease2_tokens) do |t1, t2|
+        return 1 if t2.nil? # t1 is more specific e.g. 1.0.0-rc1.1 vs 1.0.0-rc1
+
+        if t1 =~ /^\d+$/ && t2 =~ /^\d+$/
+          # t1 and t2 are both ints so compare them as such
+          a = t1.to_i
+          b = t2.to_i
+          compare = a <=> b
+          return compare unless compare.zero?
+        end
+
+        comp = t1 <=> t2
+        return T.must(comp) unless T.must(comp).zero?
+      end
+
+      # prereleases are equal or prerelease2 is more specific e.g. 1.0.0-rc1 vs 1.0.0-rc1.1
+      prerelease1_tokens.length == prerelease2_tokens.length ? 0 : -1
+    end
+  end
+end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.271.0"
+  VERSION = "0.273.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.271.0
+  version: 0.273.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-15 00:00:00.000000000 Z
+date: 2024-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -551,6 +551,8 @@ files:
 - lib/dependabot/metadata_finders/base/changelog_pruner.rb
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
+- lib/dependabot/notices.rb
+- lib/dependabot/package_manager.rb
 - lib/dependabot/pull_request_creator.rb
 - lib/dependabot/pull_request_creator/azure.rb
 - lib/dependabot/pull_request_creator/bitbucket.rb
@@ -578,6 +580,7 @@ files:
 - lib/dependabot/requirements_update_strategy.rb
 - lib/dependabot/requirements_updater/base.rb
 - lib/dependabot/security_advisory.rb
+- lib/dependabot/sem_version2.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
 - lib/dependabot/source.rb
@@ -597,7 +600,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.271.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.273.0
 post_install_message: 
 rdoc_options: []
 require_paths: