dependabot-common 0.284.0 → 0.285.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0e7ee494c1f62aa0a06d640dbfbce56140dc0a9317c7574771e334ba292a723
-  data.tar.gz: 78c644641f5217ed8612c140653334d799333d31477168ca38c48857391f75cd
+  metadata.gz: f715ae3932ff54488335714eca22437b802ffe69591bd5e82804ec1b517bc47e
+  data.tar.gz: 8bc3dbb798980775b4fa8f091d00bd4687ae323d41d766ee887bae09b0d995e2
 SHA512:
-  metadata.gz: fabe157df4a763173a2b476cc964ce5fe722e5dc57906e34be3bfda68d149b4622184aa697e55f32583c16092d09d83a5795e0302719040029c6a50331dcd484
-  data.tar.gz: 6a17a4f25bf5c75a3f4c7c737fc486810afc537d50f26c342481c1c2a27b4557e42514c3cef869c641bcb12e0261e11a9c5fde24a3d83a74c44777974d650e13
+  metadata.gz: 91d44bfa9b54c64c11509458bc3414052308ac9ed527c3f15dbc3da25bb314ce9f04712195ebe0cd9116d390f29fa53cfabac0f35a1d5c844362ca1e3f6802bf
+  data.tar.gz: 9309be975505a43f6d2182b1cb992367b1d79d4e4fcc1a9eb1458442d8c6749e65e8f71b24efa09c23faba4300dc818053d35e5724ca8c7e5adb6383eeabffe4

data/lib/dependabot/ecosystem.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/requirement"
 
 module Dependabot
   class Ecosystem
@@ -12,32 +13,35 @@ module Dependabot
       extend T::Helpers
 
       abstract!
-      # Initialize version information with optional requirement
-      # @param name [String] the name for the package manager (e.g., "bundler", "npm").
+      # Initialize version information for a package manager or language.
+      # @param name [String] the name of the package manager or language (e.g., "bundler", "ruby").
       # @param version [Dependabot::Version] the parsed current version.
       # @param deprecated_versions [Array<Dependabot::Version>] an array of deprecated versions.
       # @param supported_versions [Array<Dependabot::Version>] an array of supported versions.
+      # @param requirement [Dependabot::Requirement] an array of requirements.
       # @example
-      #   VersionManager.new("bundler", "2.1.4", Dependabot::Version.new("2.1.4"), nil)
+      #   VersionManager.new("bundler", "2.1.4", nil)
       sig do
         params(
           name: String,
           version: Dependabot::Version,
           deprecated_versions: T::Array[Dependabot::Version],
-          supported_versions: T::Array[Dependabot::Version]
+          supported_versions: T::Array[Dependabot::Version],
+          requirement: T.nilable(Dependabot::Requirement)
         ).void
       end
       def initialize(
         name,
         version,
         deprecated_versions = [],
-        supported_versions = []
+        supported_versions = [],
+        requirement = nil
       )
         @name = T.let(name, String)
         @version = T.let(version, Dependabot::Version)
-
         @deprecated_versions = T.let(deprecated_versions, T::Array[Dependabot::Version])
         @supported_versions = T.let(supported_versions, T::Array[Dependabot::Version])
+        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
       end
 
       # The name of the package manager (e.g., "bundler", "npm").
@@ -46,7 +50,7 @@ module Dependabot
       sig { returns(String) }
       attr_reader :name
 
-      # The current version of the package manager.
+      # The current version of the package manager or language.
       # @example
       #   version #=> Dependabot::Version.new("2.1.4")
       sig { returns(Dependabot::Version) }
@@ -62,12 +66,21 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Version]) }
       attr_reader :supported_versions
 
+      # The current requirement of the package manager or language.
+      # @example
+      #  requirement #=> nil
+      #  requirement #=> Dependabot::Requirement.new(">= 2.1.4")
+      #  requirement #=> Dependabot::Requirement.new(">= 2.1.4, < 3.0")
+      sig { returns(T.nilable(Dependabot::Requirement)) }
+      attr_reader :requirement
+
       # Checks if the current version is deprecated.
       # Returns true if the version is in the deprecated_versions array; false otherwise.
       # @example
       #   deprecated? #=> true
       sig { returns(T::Boolean) }
       def deprecated?
+        # If the version is unsupported, the unsupported error is getting raised separately.
         return false if unsupported?
 
         deprecated_versions.include?(version)
@@ -112,19 +125,23 @@ module Dependabot
 
     # Initialize with mandatory name and optional language information.
     # @param name [String] the name of the ecosystem (e.g., "bundler", "npm_and_yarn").
-    # @param package_manager [VersionManager] the package manager.
+    # @param package_manager [VersionManager] the package manager (mandatory).
+    # @param language [VersionManager] the language (optional).
     sig do
       params(
         name: String,
-        package_manager: VersionManager
+        package_manager: VersionManager,
+        language: T.nilable(VersionManager)
       ).void
     end
     def initialize(
       name:,
-      package_manager:
+      package_manager:,
+      language: nil
     )
       @name = T.let(name, String)
       @package_manager = T.let(package_manager, VersionManager)
+      @language = T.let(language, T.nilable(VersionManager))
     end
 
     # The name of the ecosystem (mandatory).
@@ -135,10 +152,16 @@ module Dependabot
 
     # The information related to the package manager (mandatory).
     # @example
-    #  package_manager #=> VersionManager.new("bundler", "2.1.4", Version.new("2.1.4"), nil)
+    #  package_manager #=> VersionManager.new("bundler", "2.1.4", deprecated_versions, supported_versions)
     sig { returns(VersionManager) }
     attr_reader :package_manager
 
+    # The information related to the language (optional).
+    # @example
+    #  language #=> VersionManager.new("ruby", "3.9", deprecated_versions, supported_versions)
+    sig { returns(T.nilable(VersionManager)) }
+    attr_reader :language
+
     # Checks if the current version is deprecated.
     # Returns true if the version is in the deprecated_versions array; false otherwise.
     sig { returns(T::Boolean) }

data/lib/dependabot/pull_request_creator/github.rb

@@ -110,6 +110,10 @@ module Dependabot
 
       sig { returns(T.untyped) }
       def create
+        Dependabot.logger.info(
+          "Initiating Github pull request."
+        )
+
         if experiment_duplicate_branch? && branch_exists?(branch_name)
           Dependabot.logger.info(
             "Existing branch \"#{branch_name}\" found. Pull request not created."
@@ -139,9 +143,8 @@ module Dependabot
       # rubocop:disable Metrics/PerceivedComplexity
       sig { params(name: String).returns(T::Boolean) }
       def branch_exists?(name)
-        Dependabot.logger.debug(
-          "Dependabot::PullRequestCreator::Github:branch_exists?. " \
-          "Name : #{name}. IsDuplicate: #{git_metadata_fetcher.ref_names.include?(name)}"
+        Dependabot.logger.info(
+          "Checking if branch #{name} already exists."
         )
 
         git_metadata_fetcher.ref_names.include?(name)

data/lib/dependabot/requirement.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -8,13 +8,67 @@ module Dependabot
     extend T::Sig
     extend T::Helpers
 
+    # Constants for operator groups
+    MINIMUM_OPERATORS = %w(>= > ~>).freeze
+    MAXIMUM_OPERATORS = %w(<= < ~>).freeze
+
     abstract!
 
+    # Parses requirement strings and returns an array of requirement objects.
     sig do
       abstract
         .params(requirement_string: T.nilable(String))
         .returns(T::Array[Requirement])
     end
     def self.requirements_array(requirement_string); end
+
+    # Returns all requirement constraints as an array of strings
+    sig { returns(T::Array[String]) }
+    def constraints
+      requirements.map { |op, version| "#{op} #{version}" }
+    end
+
+    # Returns the highest lower limit among all minimum constraints.
+    sig { returns(T.nilable(Gem::Version)) }
+    def min_version
+      # Select constraints with minimum operators
+      min_constraints = requirements.select { |op, _| MINIMUM_OPERATORS.include?(op) }
+
+      # Choose the maximum version among the minimum constraints
+      max_min_constraint = min_constraints.max_by { |_, version| version }
+
+      # Return the version part of the max constraint, if it exists
+      Dependabot::Version.new(max_min_constraint&.last) if max_min_constraint&.last
+    end
+
+    # Returns the lowest upper limit among all maximum constraints.
+    sig { returns(T.nilable(Dependabot::Version)) }
+    def max_version
+      # Select constraints with maximum operators
+      max_constraints = requirements.select { |op, _| MAXIMUM_OPERATORS.include?(op) }
+
+      # Process each maximum constraint, handling "~>" constraints based on length
+      effective_max_versions = max_constraints.map do |op, version|
+        if op == "~>"
+          # If "~>" constraint, bump based on the specificity of the version
+          case version.segments.length
+          when 1
+            # Bump major version (e.g., 2 -> 3.0.0)
+            Dependabot::Version.new((version.segments[0].to_i + 1).to_s + ".0.0")
+          when 2
+            # Bump minor version (e.g., 2.5 -> 2.6.0)
+            Dependabot::Version.new("#{version.segments[0]}.#{version.segments[1] + 1}.0")
+          else
+            # For three or more segments, use version.bump
+            version.bump # e.g., "~> 2.9.9" becomes upper bound 3.0.0
+          end
+        else
+          version
+        end
+      end
+
+      # Return the smallest among the effective maximum constraints
+      Dependabot::Version.new(effective_max_versions.min) if effective_max_versions.min
+    end
   end
 end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.284.0"
+  VERSION = "0.285.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.284.0
+  version: 0.285.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-05 00:00:00.000000000 Z
+date: 2024-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -614,7 +614,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.284.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.285.0
 post_install_message: 
 rdoc_options: []
 require_paths: