dependabot-common 0.299.1 → 0.301.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b3d1f5344de1095bf812f3f4c45c42b0e7820ebd3f560911e3c83ed5db8b0cc
-  data.tar.gz: 9fd396e05f663104aa8af87bb1d72147474986d4bbb83c2e761cc75f3f5fa50f
+  metadata.gz: 6e5ad8afb5c78de76b83fc7c242fbbe9a473c9648b71324b54d47aeb31e3a701
+  data.tar.gz: f608054fbeca4427bbe80ce83d71f8b30ec2e411704a9b465c21f82d0eb09529
 SHA512:
-  metadata.gz: e57b416955fbc286b2567659fe431aaf4826c990d39719c500adf66aa101c843c5f234bbf4e11c70cc1f94e9db49e369933075c10bf334398e61591ba4625946
-  data.tar.gz: bcd0d2e2e5290c70f4605411a43e64b22e410c33ba0fe8e2f8509476df3856c5d3ea741b54d341bc7f736fdacdc4ce8757a6bd5c36b2ef4deaf2f69fcfd05d5d
+  metadata.gz: 45eebb6b045a77cb8c34a707e726de39193fc63b8f6f5d056717417b44fbdd308f319c610fc9675c745d856bb7797c5125863d9c88877a78785dd7964865262d
+  data.tar.gz: 7a04d8d2038ec11faaa0e3353b20e01b0d47cff8fbf8d7688a4540b08fc7904f113ffd55e0e3d4ea7eb36b69110902bd558d9e0d66a0897f97efafe81a30cce2

data/lib/dependabot/dependency_file.rb

@@ -52,10 +52,17 @@ module Dependabot
     end
 
     class Mode
+      EXECUTABLE = "100755"
       FILE = "100644"
+      TREE = "040000"
       SUBMODULE = "160000"
+      SYMLINK = "120000"
     end
 
+    # See https://github.com/git/git/blob/a36e024e989f4d35f35987a60e3af8022cac3420/object.h#L144-L153
+    VALID_MODES = T.let([Mode::FILE, Mode::EXECUTABLE, Mode::TREE, Mode::SUBMODULE, Mode::SYMLINK].freeze,
+                        T::Array[String])
+
     sig do
       params(
         name: String,
@@ -84,6 +91,8 @@ module Dependabot
       @vendored_file = vendored_file
       @content_encoding = content_encoding
       @operation = operation
+      @mode = mode
+      raise ArgumentError, "Invalid Git mode: #{mode}" if mode && !VALID_MODES.include?(mode)
 
       # Make deleted override the operation. Deleted is kept when operation
       # was introduced to keep compatibility with downstream dependants.
@@ -96,12 +105,6 @@ module Dependabot
       # support_file flag instead)
       @type = type
 
-      begin
-        @mode = T.let(File.stat(realpath).mode.to_s(8), T.nilable(String))
-      rescue StandardError
-        @mode = mode
-      end
-
       return unless (type == "symlink") ^ symlink_target
 
       raise "Symlinks must specify a target!" unless symlink_target
@@ -118,9 +121,9 @@ module Dependabot
         "support_file" => support_file,
         "content_encoding" => content_encoding,
         "deleted" => deleted,
-        "operation" => operation,
-        "mode" => mode
+        "operation" => operation
       }
+      details["mode"] = mode if mode
 
       details["symlink_target"] = symlink_target if symlink_target
       details

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -12,6 +12,7 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/registry_client"
 require "dependabot/bundler"
 require "dependabot/package/package_details"
+require "dependabot/package/release_cooldown_options"
 
 module Dependabot
   module Package
@@ -24,10 +25,10 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       attr_reader :dependency
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       attr_reader :dependency_files
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
       sig { returns(T::Array[String]) }
@@ -36,6 +37,9 @@ module Dependabot
       sig { returns(T::Array[SecurityAdvisory]) }
       attr_reader :security_advisories
 
+      sig { returns(T.nilable(ReleaseCooldownOptions)) }
+      attr_reader :cooldown_options
+
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
@@ -46,6 +50,7 @@ module Dependabot
           credentials: T::Array[Dependabot::Credential],
           ignored_versions: T::Array[String],
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          cooldown_options: T.nilable(ReleaseCooldownOptions),
           raise_on_ignored: T::Boolean,
           options: T::Hash[Symbol, T.untyped]
         ).void
@@ -56,6 +61,7 @@ module Dependabot
         credentials:,
         ignored_versions:,
         security_advisories:,
+        cooldown_options: nil,
         raise_on_ignored: false,
         options: {}
       )
@@ -64,6 +70,7 @@ module Dependabot
         @credentials         = credentials
         @ignored_versions    = ignored_versions
         @security_advisories = security_advisories
+        @cooldown_options = cooldown_options
         @raise_on_ignored    = raise_on_ignored
         # It can be used by sub classes to pass options to the registry client
         @options             = options
@@ -119,6 +126,7 @@ module Dependabot
         return unless version_hashes
 
         version_hashes = filter_yanked_versions(version_hashes)
+        version_hashes = filter_by_cooldown(version_hashes)
         versions = filter_unsupported_versions(version_hashes, language_version)
         versions = filter_prerelease_versions(versions)
         versions = filter_ignored_versions(versions)
@@ -135,6 +143,7 @@ module Dependabot
         return unless version_hashes
 
         version_hashes = filter_yanked_versions(version_hashes)
+        version_hashes = filter_by_cooldown(version_hashes)
         versions = filter_unsupported_versions(version_hashes, language_version)
         versions = filter_prerelease_versions(versions)
         versions = filter_ignored_versions(versions)
@@ -152,6 +161,7 @@ module Dependabot
         return unless version_hashes
 
         version_hashes = filter_yanked_versions(version_hashes)
+        version_hashes = filter_by_cooldown(version_hashes)
         versions = filter_unsupported_versions(version_hashes, language_version)
         # versions = filter_prerelease_versions(versions)
         versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
@@ -176,6 +186,29 @@ module Dependabot
         filtered
       end
 
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter_by_cooldown(releases)
+        return releases unless cooldown_enabled?
+        return releases unless cooldown_options
+
+        current_version = dependency.version ? version_class.new(dependency.version) : nil
+
+        filtered = releases.reject do |release|
+          next false unless release.released_at
+
+          days = cooldown_days_for(current_version, release.version)
+          (Time.now.to_i - release.released_at.to_i) < (days * 24 * 60 * 60)
+        end
+
+        if releases.count > filtered.count
+          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} versions due to cooldown")
+        end
+        filtered
+      end
+
       sig do
         params(
           releases: T::Array[Dependabot::Package::PackageRelease],
@@ -257,6 +290,41 @@ module Dependabot
           .select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
       end
 
+      sig { returns(T::Boolean) }
+      def cooldown_enabled?
+        false
+      end
+
+      sig do
+        params(
+          current_version: T.nilable(Dependabot::Version),
+          new_version: Dependabot::Version
+        ).returns(Integer)
+      end
+      def cooldown_days_for(current_version, new_version)
+        cooldown = @cooldown_options
+        return 0 if cooldown.nil?
+        return 0 unless cooldown_enabled?
+        return 0 unless cooldown.included?(dependency.name)
+        return cooldown.default_days if current_version.nil?
+
+        current_version_semver = current_version.semver_parts
+        new_version_semver = new_version.semver_parts
+
+        # If semver_parts is nil for either, return default cooldown
+        return cooldown.default_days if current_version_semver.nil? || new_version_semver.nil?
+
+        # Ensure values are always integers
+        current_major, current_minor, current_patch = current_version_semver
+        new_major, new_minor, new_patch = new_version_semver
+
+        # Determine cooldown based on version difference
+        return cooldown.semver_major_days if new_major > current_major
+        return cooldown.semver_minor_days if new_minor > current_minor
+        return cooldown.semver_patch_days if new_patch > current_patch
+
+        cooldown.default_days
+      end
       sig { returns(T::Boolean) }
       def wants_prerelease?
         return version_class.new(dependency.version).prerelease? if dependency.version

data/lib/dependabot/package/release_cooldown_options.rb

@@ -0,0 +1,61 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class ReleaseCooldownOptions
+      extend T::Sig
+
+      sig do
+        params(
+          default_days: T.nilable(Integer),
+          semver_major_days: T.nilable(Integer),
+          semver_minor_days: T.nilable(Integer),
+          semver_patch_days: T.nilable(Integer),
+          include: T.nilable(T::Array[String]),
+          exclude: T.nilable(T::Array[String])
+        ).void
+      end
+      def initialize(
+        default_days: 0, semver_major_days: 0, semver_minor_days: 0, semver_patch_days: 0,
+        include: [], exclude: []
+      )
+        default_days ||= 0
+        semver_major_days ||= 0
+        semver_minor_days ||= 0
+        semver_patch_days ||= 0
+        include ||= []
+        exclude ||= []
+
+        @default_days = T.let(default_days, Integer)
+        @semver_major_days = T.let(semver_major_days.positive? ? semver_major_days : default_days, Integer)
+        @semver_minor_days = T.let(semver_minor_days.positive? ? semver_minor_days : default_days, Integer)
+        @semver_patch_days = T.let(semver_patch_days.positive? ? semver_patch_days : default_days, Integer)
+        @include = T.let(include.to_set, T::Set[String])
+        @exclude = T.let(exclude.to_set, T::Set[String])
+      end
+
+      sig { returns(Integer) }
+      attr_reader :default_days, :semver_major_days, :semver_minor_days, :semver_patch_days
+
+      sig { returns(T::Set[String]) }
+      attr_reader :include, :exclude
+
+      sig { params(dependency_name: String).returns(T::Boolean) }
+      def included?(dependency_name)
+        return false if dependency_name.empty? || excluded?(dependency_name)
+
+        @include.empty? || @include.any? { |pattern| File.fnmatch?(pattern, dependency_name) }
+      end
+
+      private
+
+      sig { params(dependency_name: String).returns(T::Boolean) }
+      def excluded?(dependency_name)
+        @exclude.any? { |pattern| File.fnmatch?(pattern, dependency_name) }
+      end
+    end
+  end
+end

data/lib/dependabot/shared_helpers.rb

@@ -9,6 +9,7 @@ require "json"
 require "open3"
 require "sorbet-runtime"
 require "tmpdir"
+require "securerandom"
 
 require "dependabot/credential"
 require "dependabot/simple_instrumentor"
@@ -22,7 +23,6 @@ module Dependabot
   module SharedHelpers # rubocop:disable Metrics/ModuleLength
     extend T::Sig
 
-    GIT_CONFIG_GLOBAL_PATH = T.let(File.expand_path(".gitconfig", Utils::BUMP_TMP_DIR_PATH), String)
     USER_AGENT = T.let(
       "dependabot-core/#{Dependabot::VERSION} " \
       "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} " \
@@ -290,12 +290,15 @@ module Dependabot
       FileUtils.mkdir_p(Utils::BUMP_TMP_DIR_PATH)
 
       previous_config = ENV.fetch("GIT_CONFIG_GLOBAL", nil)
+      # adding a random suffix to avoid conflicts when running in parallel
+      # some package managers like bundler will modify the global git config
+      git_config_global_path = File.expand_path("#{SecureRandom.hex(16)}.gitconfig", Utils::BUMP_TMP_DIR_PATH)
       previous_terminal_prompt = ENV.fetch("GIT_TERMINAL_PROMPT", nil)
 
       begin
-        ENV["GIT_CONFIG_GLOBAL"] = GIT_CONFIG_GLOBAL_PATH
+        ENV["GIT_CONFIG_GLOBAL"] = git_config_global_path
         ENV["GIT_TERMINAL_PROMPT"] = "false"
-        configure_git_to_use_https_with_credentials(credentials, safe_directories)
+        configure_git_to_use_https_with_credentials(credentials, safe_directories, git_config_global_path)
         yield
       ensure
         ENV["GIT_CONFIG_GLOBAL"] = previous_config
@@ -304,7 +307,7 @@ module Dependabot
     rescue Errno::ENOSPC => e
       raise Dependabot::OutOfDisk, e.message
     ensure
-      FileUtils.rm_f(GIT_CONFIG_GLOBAL_PATH)
+      FileUtils.rm_f(T.must(git_config_global_path))
     end
 
     # Handle SCP-style git URIs
@@ -321,9 +324,12 @@ module Dependabot
     end
 
     # rubocop:disable Metrics/PerceivedComplexity
-    sig { params(credentials: T::Array[Dependabot::Credential], safe_directories: T::Array[String]).void }
-    def self.configure_git_to_use_https_with_credentials(credentials, safe_directories)
-      File.open(GIT_CONFIG_GLOBAL_PATH, "w") do |file|
+    sig do
+      params(credentials: T::Array[Dependabot::Credential], safe_directories: T::Array[String],
+             git_config_global_path: String).void
+    end
+    def self.configure_git_to_use_https_with_credentials(credentials, safe_directories, git_config_global_path)
+      File.open(git_config_global_path, "w") do |file|
         file << "# Generated by dependabot/dependabot-core"
       end
 

data/lib/dependabot/update_checkers/base.rb

@@ -7,6 +7,7 @@ require "sorbet-runtime"
 require "dependabot/requirements_update_strategy"
 require "dependabot/security_advisory"
 require "dependabot/utils"
+require "dependabot/package/release_cooldown_options"
 
 module Dependabot
   module UpdateCheckers
@@ -41,6 +42,9 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::DependencyGroup)) }
       attr_reader :dependency_group
 
+      sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+      attr_reader :update_cooldown
+
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
@@ -55,6 +59,7 @@ module Dependabot
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
+          update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
           options: T::Hash[Symbol, T.untyped]
         )
           .void
@@ -63,7 +68,7 @@ module Dependabot
                      repo_contents_path: nil, ignored_versions: [],
                      raise_on_ignored: false, security_advisories: [],
                      requirements_update_strategy: nil, dependency_group: nil,
-                     options: {})
+                     update_cooldown: nil, options: {})
         @dependency = dependency
         @dependency_files = dependency_files
         @repo_contents_path = repo_contents_path
@@ -73,6 +78,7 @@ module Dependabot
         @raise_on_ignored = raise_on_ignored
         @security_advisories = security_advisories
         @dependency_group = dependency_group
+        @update_cooldown = update_cooldown
         @options = options
       end
 

data/lib/dependabot/version.rb

@@ -73,5 +73,18 @@ module Dependabot
     def lowest_prerelease_suffix
       "a"
     end
+
+    sig { returns(T.nilable([Integer, Integer, Integer])) }
+    def semver_parts
+      # Extracts only the numeric major.minor.patch part of the version, ensuring it starts with a number
+      match = to_semver.match(/^\d+(?:\.\d+)?(?:\.\d+)?(?=[^\d]|$)/)
+      return nil unless match
+
+      first_match = match[0]
+      return nil unless first_match
+
+      major, minor, patch = first_match.split(".").map(&:to_i)
+      [major || 0, minor || 0, patch || 0]
+    end
   end
 end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.299.1"
+  VERSION = "0.301.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.299.1
+  version: 0.301.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-28 00:00:00.000000000 Z
+date: 2025-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -293,9 +293,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.1.2
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -303,9 +300,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.1.2
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -572,6 +566,7 @@ files:
 - lib/dependabot/package/package_language.rb
 - lib/dependabot/package/package_latest_version_finder.rb
 - lib/dependabot/package/package_release.rb
+- lib/dependabot/package/release_cooldown_options.rb
 - lib/dependabot/pull_request_creator.rb
 - lib/dependabot/pull_request_creator/azure.rb
 - lib/dependabot/pull_request_creator/bitbucket.rb
@@ -619,7 +614,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.299.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.301.0
 post_install_message:
 rdoc_options: []
 require_paths: