dependabot-common 0.291.0 → 0.293.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cebae8e92439e403f480e7ffdcdb009582b7d5e196322fbdab8005048e77b05b
-  data.tar.gz: 724f55170bf99cb90ef277776daed5415e6bdb6ed3dd30bde35e849711e7b68f
+  metadata.gz: 0b4d27736af7c39344d1d7b96954789a59840fc8babfb779a4b88e267170f1db
+  data.tar.gz: d61444a31fafe63b7704284f8c0d67b3ac1a8cac53284221c21fa32bdd1dc799
 SHA512:
-  metadata.gz: 127292cb53f8677d645cd9a51e89d16babcdacf8d5455c89e442c3022e728597142426ec88362e81082dbe8825ab5e4639f0f98600c644a7294ab9551d329931
-  data.tar.gz: ff5478b081ce3e05babd84dbc2f6730260dd73e676c093655d7c5577f6e45c0b9db9d9da328c6fef5b485e4446f8e2da6d21db7d270692ac6f57e11051c8bd02
+  metadata.gz: 49f0a7dd758a5329ead57e18df49bf954fa2220582695cc9fed271d60eb9642fe72bc9154663454533c7703436733a6622635c43f54b0578736c17e4a20e5631
+  data.tar.gz: 6e43c31f3902f35f53e2edaec282519c8c97fba6a0db1e36a2e39513d16d5882d9fb33d4a66f7515280c957309593b69af6d12624a23c399e71ca90c1a67ffbd

data/lib/dependabot/config/update_config.rb

@@ -32,6 +32,10 @@ module Dependabot
         normalizer = name_normaliser_for(dependency)
         dep_name = T.must(normalizer).call(dependency.name)
 
+        if dependency.version.nil? && dependency.requirements.any?
+          dependency = extract_base_version_from_requirement(dependency)
+        end
+
         @ignore_conditions
           .select { |ic| self.class.wildcard_match?(T.must(normalizer).call(ic.dependency_name), dep_name) }
           .map { |ic| ic.ignored_versions(dependency, security_updates_only) }
@@ -40,6 +44,19 @@ module Dependabot
           .uniq
       end
 
+      sig { params(dependency: Dependency).returns(Dependency) }
+      def extract_base_version_from_requirement(dependency)
+        requirements = dependency.requirements
+        requirement = T.must(requirements.first)[:requirement]
+        version = requirement&.match(/\d+\.\d+\.\d+/)&.to_s
+        Dependabot::Dependency.new(
+          name: dependency.name,
+          version: version,
+          requirements: dependency.requirements,
+          package_manager: dependency.package_manager
+        )
+      end
+
       sig { params(wildcard_string: T.nilable(String), candidate_string: T.nilable(String)).returns(T::Boolean) }
       def self.wildcard_match?(wildcard_string, candidate_string)
         return false unless wildcard_string && candidate_string

data/lib/dependabot/ecosystem.rb

@@ -17,30 +17,38 @@ module Dependabot
       abstract!
       # Initialize version information for a package manager or language.
       # @param name [String] the name of the package manager or language (e.g., "bundler", "ruby").
-      # @param version [Dependabot::Version] the parsed current version.
+      # @param detected_version [Dependabot::Version] the detected version of the package manager or language.
+      # @param version [Dependabot::Version] the version dependabots run on.
       # @param deprecated_versions [Array<Dependabot::Version>] an array of deprecated versions.
       # @param supported_versions [Array<Dependabot::Version>] an array of supported versions.
       # @param requirement [Dependabot::Requirement] an array of requirements.
       # @example
-      #   VersionManager.new("bundler", "2.1.4", nil)
+      #   VersionManager.new(
+      #   name: "bundler",
+      #   version: Version.new("2.1.4"),
+      #   requirement: nil
+      # )
       sig do
         params(
           name: String,
-          version: Dependabot::Version,
+          detected_version: T.nilable(Dependabot::Version),
+          version: T.nilable(Dependabot::Version),
           deprecated_versions: T::Array[Dependabot::Version],
           supported_versions: T::Array[Dependabot::Version],
           requirement: T.nilable(Dependabot::Requirement)
         ).void
       end
       def initialize(
-        name,
-        version,
-        deprecated_versions = [],
-        supported_versions = [],
-        requirement = nil
+        name:,
+        detected_version: nil,
+        version: nil,
+        deprecated_versions: [],
+        supported_versions: [],
+        requirement: nil
       )
         @name = T.let(name, String)
-        @version = T.let(version, Dependabot::Version)
+        @detected_version = T.let(detected_version || version, T.nilable(Dependabot::Version))
+        @version = T.let(version, T.nilable(Dependabot::Version))
         @deprecated_versions = T.let(deprecated_versions, T::Array[Dependabot::Version])
         @supported_versions = T.let(supported_versions, T::Array[Dependabot::Version])
         @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
@@ -52,10 +60,16 @@ module Dependabot
       sig { returns(String) }
       attr_reader :name
 
+      # The current version of the package manager or language.
+      # @example
+      #   detected_version #=> Dependabot::Version.new("2")
+      sig { returns(T.nilable(Dependabot::Version)) }
+      attr_reader :detected_version
+
       # The current version of the package manager or language.
       # @example
       #   version #=> Dependabot::Version.new("2.1.4")
-      sig { returns(Dependabot::Version) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       attr_reader :version
 
       # Returns an array of deprecated versions of the package manager.
@@ -76,16 +90,34 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Requirement)) }
       attr_reader :requirement
 
+      # The version of the package manager or language as a string.
+      # @example
+      # version_to_s #=> "2.1"
+      sig { returns(String) }
+      def version_to_s
+        version.to_s
+      end
+
+      # The raw version of the package manager or language.
+      # @example
+      #  raw_version #=> "2.1.4"
+      sig { returns(String) }
+      def version_to_raw_s
+        version&.to_semver.to_s
+      end
+
       # Checks if the current version is deprecated.
       # Returns true if the version is in the deprecated_versions array; false otherwise.
       # @example
       #   deprecated? #=> true
       sig { returns(T::Boolean) }
       def deprecated?
+        return false unless detected_version
+
         # If the version is unsupported, the unsupported error is getting raised separately.
         return false if unsupported?
 
-        deprecated_versions.include?(version)
+        deprecated_versions.include?(detected_version)
       end
 
       # Checks if the current version is unsupported.
@@ -93,16 +125,20 @@ module Dependabot
       #   unsupported? #=> false
       sig { returns(T::Boolean) }
       def unsupported?
+        return false unless detected_version
+
         return false if supported_versions.empty?
 
         # Check if the version is not supported
-        supported_versions.all? { |supported| supported > version }
+        supported_versions.all? { |supported| supported > detected_version }
       end
 
       # Raises an error if the current package manager or language version is unsupported.
       # If the version is unsupported, it raises a ToolVersionNotSupported error.
       sig { void }
       def raise_if_unsupported!
+        return unless detected_version
+
         return unless unsupported?
 
         # Example: v2.*, v3.*
@@ -110,7 +146,7 @@ module Dependabot
 
         raise ToolVersionNotSupported.new(
           name,
-          version.to_s,
+          detected_version.to_s,
           supported_versions_message
         )
       end

data/lib/dependabot/errors.rb

@@ -83,6 +83,11 @@ module Dependabot
       # and responsibility for fixing it is on them, not us. As a result we
       # quietly log these as errors
       { "error-type": "server_error" }
+    when BadRequirementError
+      {
+        "error-type": "illformed_requirement",
+        "error-detail": { message: error.message }
+      }
     when *Octokit::RATE_LIMITED_ERRORS
       # If we get a rate-limited error we let dependabot-api handle the
       # retry by re-enqueing the update job after the reset
@@ -144,11 +149,6 @@ module Dependabot
         "error-type": "git_dependencies_not_reachable",
         "error-detail": { "dependency-urls": error.dependency_urls }
       }
-    when Dependabot::UnresolvableVersionError
-      {
-        "error-type": "unresolvable_version",
-        "error-detail": { dependencies: error.dependencies }
-      }
     when Dependabot::NotImplemented
       {
         "error-type": "not_implemented",
@@ -166,6 +166,7 @@ module Dependabot
 
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
+  # rubocop:disable Metrics/AbcSize
   sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.updater_error_details(error)
     case error
@@ -179,6 +180,14 @@ module Dependabot
         "error-type": "dependency_file_not_evaluatable",
         "error-detail": { message: error.message }
       }
+    when Dependabot::DependencyFileNotParseable
+      {
+        "error-type": "dependency_file_not_parseable",
+        "error-detail": {
+          message: error.message,
+          "file-path": error.file_path
+        }
+      }
     when Dependabot::GitDependenciesNotReachable
       {
         "error-type": "git_dependencies_not_reachable",
@@ -294,6 +303,7 @@ module Dependabot
   # rubocop:enable Metrics/MethodLength
   # rubocop:enable Metrics/CyclomaticComplexity
   # rubocop:enable Lint/RedundantCopDisableDirective
+  # rubocop:enable Metrics/AbcSize
 
   class DependabotError < StandardError
     extend T::Sig
@@ -666,23 +676,6 @@ module Dependabot
     end
   end
 
-  class UnresolvableVersionError < DependabotError
-    extend T::Sig
-
-    sig { returns(T::Array[String]) }
-    attr_reader :dependencies
-
-    sig { params(dependencies: T::Array[String]).void }
-    def initialize(dependencies)
-      @dependencies = dependencies
-
-      msg = "Unable to determine semantic version from tags or commits for dependencies. " \
-            "Dependencies must have a tag or commit that references a semantic version. " \
-            "Affected dependencies: #{@dependencies.join(', ')}"
-      super(msg)
-    end
-  end
-
   class GitDependenciesNotReachable < DependabotError
     extend T::Sig
 

data/lib/dependabot/file_fetchers/base.rb

@@ -311,7 +311,7 @@ module Dependabot
 
         SharedHelpers.with_git_configured(credentials: credentials) do
           Dir.chdir(T.must(repo_contents_path)) do
-            return SharedHelpers.run_shell_command("git rev-parse HEAD").strip
+            return SharedHelpers.run_shell_command("git rev-parse HEAD", stderr_to_stdout: false).strip
           end
         end
       end

data/lib/dependabot/notices.rb

@@ -71,15 +71,20 @@ module Dependabot
     # Generates a description for supported versions.
     # @param supported_versions [Array<Dependabot::Version>, nil] The supported versions of the package manager.
     # @param support_later_versions [Boolean] Whether later versions are supported.
+    # @param version_manager_type [Symbol] The type of entity being deprecated i.e. :language or :package_manager
     # @return [String, nil] The generated description or nil if no supported versions are provided.
     sig do
       params(
         supported_versions: T.nilable(T::Array[Dependabot::Version]),
-        support_later_versions: T::Boolean
+        support_later_versions: T::Boolean,
+        version_manager_type: Symbol
       ).returns(String)
     end
-    def self.generate_supported_versions_description(supported_versions, support_later_versions)
-      return "Please upgrade your package manager version" unless supported_versions&.any?
+    def self.generate_supported_versions_description(
+      supported_versions, support_later_versions, version_manager_type = :package_manager
+    )
+      entity_text = version_manager_type == :language ? "language" : "package manager"
+      return "Please upgrade your #{entity_text} version" unless supported_versions&.any?
 
       versions_string = supported_versions.map { |version| "`v#{version}`" }
 
@@ -94,25 +99,28 @@ module Dependabot
       "Please upgrade to one of the following versions: #{versions_string}#{later_description}."
     end
 
-    # Generates a deprecation notice for the given package manager.
-    # @param package_manager [VersionManager] The package manager object.
-    # @return [Notice, nil] The generated deprecation notice or nil if the package manager is not deprecated.
+    # Generates a deprecation notice for the given version manager.
+    # @param version_manager [VersionManager] The version manager object.
+    # @param version_manager_type [Symbol] The version manager type e.g. :language or :package_manager
+    # @return [Notice, nil] The generated deprecation notice or nil if the version manager is not deprecated.
     sig do
       params(
-        package_manager: Ecosystem::VersionManager
+        version_manager: Ecosystem::VersionManager,
+        version_manager_type: Symbol
       ).returns(T.nilable(Notice))
     end
-    def self.generate_pm_deprecation_notice(package_manager)
-      return nil unless package_manager.deprecated?
+    def self.generate_deprecation_notice(version_manager, version_manager_type = :package_manager)
+      return nil unless version_manager.deprecated?
 
       mode = NoticeMode::WARN
       supported_versions_description = generate_supported_versions_description(
-        package_manager.supported_versions,
-        package_manager.support_later_versions?
+        version_manager.supported_versions,
+        version_manager.support_later_versions?,
+        version_manager_type
       )
-      notice_type = "#{package_manager.name}_deprecated_warn"
-      title = "Package manager deprecation notice"
-      description = "Dependabot will stop supporting `#{package_manager.name} v#{package_manager.version}`!"
+      notice_type = "#{version_manager.name}_deprecated_warn"
+      title = version_manager_type == :language ? "Language deprecation notice" : "Package manager deprecation notice"
+      description = "Dependabot will stop supporting `#{version_manager.name} v#{version_manager.detected_version}`!"
 
       ## Add the supported versions to the description
       description += "\n\n#{supported_versions_description}\n" unless supported_versions_description.empty?
@@ -120,7 +128,7 @@ module Dependabot
       Notice.new(
         mode: mode,
         type: notice_type,
-        package_manager_name: package_manager.name,
+        package_manager_name: version_manager.name,
         title: title,
         description: description,
         show_in_pr: true,

data/lib/dependabot/workspace/change_attempt.rb

@@ -8,9 +8,6 @@ module Dependabot
     class ChangeAttempt
       extend T::Sig
 
-      sig { returns(T.nilable(String)) }
-      attr_reader :diff
-
       sig { returns(T.nilable(StandardError)) }
       attr_reader :error
 
@@ -28,15 +25,13 @@ module Dependabot
           workspace: Dependabot::Workspace::Base,
           id: String,
           memo: T.nilable(String),
-          diff: T.nilable(String),
           error: T.nilable(StandardError)
         ).void
       end
-      def initialize(workspace, id:, memo:, diff: nil, error: nil)
+      def initialize(workspace, id:, memo:, error: nil)
         @workspace = workspace
         @id = id
         @memo = memo
-        @diff = diff
         @error = error
       end
 

data/lib/dependabot/workspace/git.rb

@@ -56,9 +56,9 @@ module Dependabot
         return nil if changed_files(ignored_mode: "no").empty?
 
         debug("store_change - before: #{current_commit}")
-        sha, diff = commit(memo)
+        sha = commit(memo)
 
-        change_attempts << ChangeAttempt.new(self, id: sha, memo: memo, diff: diff)
+        change_attempts << ChangeAttempt.new(self, id: sha, memo: memo)
       ensure
         debug("store_change - after: #{current_commit}")
       end
@@ -73,8 +73,8 @@ module Dependabot
       def capture_failed_change_attempt(memo = nil, error = nil)
         return nil if changed_files(ignored_mode: "matching").empty? && error.nil?
 
-        sha, diff = stash(memo)
-        change_attempts << ChangeAttempt.new(self, id: sha, memo: memo, diff: diff, error: error)
+        sha = stash(memo)
+        change_attempts << ChangeAttempt.new(self, id: sha, memo: memo, error: error)
       end
 
       private
@@ -87,7 +87,7 @@ module Dependabot
 
       sig { returns(String) }
       def head_sha
-        run_shell_command("git rev-parse HEAD").strip
+        run_shell_command("git rev-parse HEAD", stderr_to_stdout: false).strip
       end
 
       sig { returns(String) }
@@ -112,7 +112,7 @@ module Dependabot
         ).strip
       end
 
-      sig { params(memo: T.nilable(String)).returns([String, String]) }
+      sig { params(memo: T.nilable(String)).returns(String) }
       def stash(memo = nil)
         msg = memo || "workspace change attempt"
         run_shell_command("git add --all --force .")
@@ -122,19 +122,12 @@ module Dependabot
           allow_unsafe_shell_command: true
         )
 
-        sha = last_stash_sha
-        diff = run_shell_command(
-          "git stash show --patch #{sha}",
-          fingerprint: "git stash show --patch <sha>"
-        )
-
-        [sha, diff]
+        last_stash_sha
       end
 
-      sig { params(memo: T.nilable(String)).returns([String, String]) }
+      sig { params(memo: T.nilable(String)).returns(String) }
       def commit(memo = nil)
         run_shell_command("git add #{path}")
-        diff = run_shell_command("git diff --cached .")
 
         msg = memo || "workspace change"
         run_shell_command(
@@ -143,7 +136,7 @@ module Dependabot
           allow_unsafe_shell_command: true
         )
 
-        [head_sha, diff]
+        head_sha
       end
 
       sig { params(sha: String).returns(String) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.291.0"
+  VERSION = "0.293.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.291.0
+  version: 0.293.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-19 00:00:00.000000000 Z
+date: 2025-01-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -615,7 +615,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.291.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.293.0
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -631,7 +631,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.7
 requirements: []
-rubygems_version: 3.5.9
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Shared code used across Dependabot Core