dependabot-common 0.308.0 → 0.310.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee9db0fd53ccd502a29fa5d808c3ada11c9dd44d894950235385a09d47cc0b42
-  data.tar.gz: 6d6e9c2f1d2c868439780347ef0cc8f46af52483fc208060f3966345cf45ec5e
+  metadata.gz: 618d4098b2362e8af62f7c1c095ecdbd8a1ef607f2b9331fc89b955bbcd418ab
+  data.tar.gz: d879b882612d81c2d337ede1049a93d9e249cf52b2d2dd9ebc64396805ab548e
 SHA512:
-  metadata.gz: 9162c6137db121121788d26d6de7570e82670f6977786a99777a82a74fb3f1deedf0656b737fe70db043c811beb1ce2533836472f38f7ec225c81adbc37b66fb
-  data.tar.gz: b4cc1266fbee2bfc8739ad3e72eca1039352f66853c0e59edc5b02eb09df5ae29cbd436378b55afea2b1007133e1e3942f9f587b6a8f593540479ad91648f61f
+  metadata.gz: 02af645b7369f659fd475c4b09b218e24fde7aba983ef43965aaccc2f329265901b62d2ad15b62163e385a6cbfc450202ccfe29c32a23ca9c67c3430f63de474
+  data.tar.gz: f6ac8fedec46a75ec2c0416977824f3d8be509494b8a64ace5c51292015b13b4ea33411d5b35c4ad76fe94d57dd9f917629191f78d39dc56cd248c0f2aaf31b0

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -19,6 +19,8 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
+      DAY_IN_SECONDS = T.let(24 * 60 * 60, Integer)
+
       abstract!
 
       sig { returns(Dependabot::Dependency) }
@@ -81,24 +83,24 @@ module Dependabot
       end
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
-          .returns(T.nilable(Gem::Version))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
       end
       def latest_version(language_version: nil)
         @latest_version ||= fetch_latest_version(language_version: language_version)
       end
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
-          .returns(T.nilable(Gem::Version))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
       end
       def latest_version_with_no_unlock(language_version: nil)
         @latest_version_with_no_unlock ||= fetch_latest_version_with_no_unlock(language_version: language_version)
       end
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
-          .returns(T.nilable(Gem::Version))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
       end
       def lowest_security_fix_version(language_version: nil)
         @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
@@ -117,71 +119,77 @@ module Dependabot
       protected
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
       end
       def fetch_latest_version(language_version: nil)
-        version_hashes = available_versions
-        return unless version_hashes
-
-        version_hashes = filter_yanked_versions(version_hashes)
-        version_hashes = filter_by_cooldown(version_hashes)
-        versions = filter_unsupported_versions(version_hashes, language_version)
-        versions = filter_prerelease_versions(versions)
-        versions = filter_ignored_versions(versions)
-        versions = apply_post_fetch_latest_versions_filter(versions)
-        versions.max
-      end
+        releases = available_versions
+        return unless releases
 
-      sig { params(versions: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-      def apply_post_fetch_latest_versions_filter(versions)
-        versions
+        releases = filter_yanked_versions(releases)
+        releases = filter_by_cooldown(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        releases = filter_prerelease_versions(releases)
+        releases = filter_ignored_versions(releases)
+        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases.max_by(&:version)&.version
       end
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
       end
       def fetch_latest_version_with_no_unlock(language_version:)
-        version_hashes = available_versions
-        return unless version_hashes
+        releases = available_versions
+        return unless releases
 
-        version_hashes = filter_yanked_versions(version_hashes)
-        version_hashes = filter_by_cooldown(version_hashes)
-        versions = filter_unsupported_versions(version_hashes, language_version)
-        versions = filter_prerelease_versions(versions)
-        versions = filter_ignored_versions(versions)
-        versions = filter_out_of_range_versions(versions)
-        versions = apply_post_fetch_latest_versions_filter(versions)
-        versions.max
+        releases = filter_yanked_versions(releases)
+        releases = filter_by_cooldown(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        releases = filter_prerelease_versions(releases)
+        releases = filter_ignored_versions(releases)
+        releases = filter_out_of_range_versions(releases)
+        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases.max_by(&:version)&.version
       end
 
       sig do
-        params(language_version: T.nilable(T.any(String, Version)))
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
       end
-      def fetch_lowest_security_fix_version(language_version:)
-        version_hashes = available_versions
-        return unless version_hashes
+      def fetch_lowest_security_fix_version(language_version: nil)
+        releases = available_versions
+        return unless releases
 
-        version_hashes = filter_yanked_versions(version_hashes)
-        version_hashes = filter_by_cooldown(version_hashes)
-        versions = filter_unsupported_versions(version_hashes, language_version)
+        releases = filter_yanked_versions(releases)
+        releases = filter_unsupported_versions(releases, language_version)
         # versions = filter_prerelease_versions(versions)
-        versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
-          versions,
-          security_advisories
-        )
-        versions = filter_ignored_versions(versions)
-        versions = filter_lower_versions(versions)
-        versions = apply_post_fetch_lowest_security_fix_versions_filter(versions)
+        releases = Dependabot::UpdateCheckers::VersionFilters
+                   .filter_vulnerable_versions(
+                     releases,
+                     security_advisories
+                   )
+        releases = filter_ignored_versions(releases)
+        releases = filter_lower_versions(releases)
+        releases = apply_post_fetch_lowest_security_fix_versions_filter(releases)
 
-        versions.min
+        releases.min_by(&:version)&.version
       end
 
-      sig { params(versions: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-      def apply_post_fetch_lowest_security_fix_versions_filter(versions)
-        versions
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_latest_versions_filter(releases)
+        releases
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_lowest_security_fix_versions_filter(releases)
+        releases
       end
 
       sig do
@@ -204,14 +212,7 @@ module Dependabot
         return releases unless cooldown_enabled?
         return releases unless cooldown_options
 
-        current_version = dependency.version ? version_class.new(dependency.version) : nil
-
-        filtered = releases.reject do |release|
-          next false unless release.released_at
-
-          days = cooldown_days_for(current_version, release.version)
-          (Time.now.to_i - release.released_at.to_i) < (days * 24 * 60 * 60)
-        end
+        filtered = releases.reject { |release| in_cooldown_period?(release) }
 
         if releases.count > filtered.count
           Dependabot.logger.info("Filtered out #{releases.count - filtered.count} versions due to cooldown")
@@ -219,21 +220,34 @@ module Dependabot
         filtered
       end
 
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def in_cooldown_period?(release)
+        return false unless release.released_at
+
+        current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+        days = cooldown_days_for(current_version, release.version)
+
+        # Calculate the number of seconds passed since the release
+        passed_seconds = Time.now.to_i - release.released_at.to_i
+        # Check if the release is within the cooldown period
+        passed_seconds < days * DAY_IN_SECONDS
+      end
+
       sig do
         params(
           releases: T::Array[Dependabot::Package::PackageRelease],
-          language_version: T.nilable(T.any(String, Version))
+          language_version: T.nilable(T.any(String, Dependabot::Version))
         )
-          .returns(T::Array[Dependabot::Version])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
       end
       def filter_unsupported_versions(releases, language_version)
         filtered = releases.filter_map do |release|
           language_requirement = release.language&.requirement
-          next release.version unless language_version
-          next release.version unless language_requirement
+          next release unless language_version
+          next release unless language_requirement
           next unless language_requirement.satisfied_by?(language_version)
 
-          release.version
+          release
         end
         if releases.count > filtered.count
           delta = releases.count - filtered.count
@@ -243,61 +257,69 @@ module Dependabot
       end
 
       sig do
-        params(versions_array: T::Array[Dependabot::Version])
-          .returns(T::Array[Dependabot::Version])
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
       end
-      def filter_prerelease_versions(versions_array)
-        return versions_array if wants_prerelease?
+      def filter_prerelease_versions(releases)
+        return releases if wants_prerelease?
 
-        filtered = versions_array.reject(&:prerelease?)
+        filtered = releases.reject { |release| release.version.prerelease? }
 
-        if versions_array.count > filtered.count
-          Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
+        if releases.count > filtered.count
+          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} pre-release versions")
         end
 
         filtered
       end
 
       sig do
-        params(versions_array: T::Array[Dependabot::Version])
-          .returns(T::Array[Dependabot::Version])
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
       end
-      def filter_ignored_versions(versions_array)
-        filtered = versions_array
-                   .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
-        if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
+      def filter_ignored_versions(releases)
+        filtered = releases
+                   .reject do |release|
+          ignore_requirements.any? do |r|
+            r.satisfied_by?(release.version)
+          end
+        end
+        if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(releases).any?
           raise Dependabot::AllVersionsIgnored
         end
 
-        if versions_array.count > filtered.count
-          Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
+        if releases.count > filtered.count
+          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} ignored versions")
         end
         filtered
       end
 
       sig do
-        params(versions_array: T::Array[Dependabot::Version])
-          .returns(T::Array[Dependabot::Version])
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
       end
-      def filter_lower_versions(versions_array)
-        return versions_array unless dependency.numeric_version
+      def filter_lower_versions(releases)
+        return releases unless dependency.numeric_version
 
-        versions_array.select { |version| version > dependency.numeric_version }
+        releases.select { |release| release.version > dependency.numeric_version }
       end
 
       sig do
-        params(versions_array: T::Array[Dependabot::Version])
-          .returns(T::Array[Dependabot::Version])
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
       end
-      def filter_out_of_range_versions(versions_array)
+      def filter_out_of_range_versions(releases)
         reqs = dependency.requirements.filter_map do |r|
           next if r.fetch(:requirement).nil?
 
           requirement_class.requirements_array(r.fetch(:requirement))
         end
 
-        versions_array
-          .select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
+        releases
+          .select do |release|
+          reqs.all? do |r|
+            r.any? { |o| o.satisfied_by?(release.version) }
+          end
+        end
       end
 
       sig { returns(T::Boolean) }
@@ -335,6 +357,7 @@ module Dependabot
 
         cooldown.default_days
       end
+
       sig { returns(T::Boolean) }
       def wants_prerelease?
         return version_class.new(dependency.version).prerelease? if dependency.version

data/lib/dependabot/package/package_release.rb

@@ -84,6 +84,18 @@ module Dependabot
       def yanked?
         @yanked
       end
+
+      sig { params(other: Object).returns(T::Boolean) }
+      def ==(other)
+        return false unless other.is_a?(PackageRelease)
+
+        version == other.version
+      end
+
+      sig { returns(String) }
+      def to_s
+        version.to_s
+      end
     end
   end
 end

data/lib/dependabot/shared_helpers.rb

@@ -90,7 +90,7 @@ module Dependabot
       sig { returns(String) }
       attr_reader :error_class
 
-      sig { returns(T::Hash[Symbol, String]) }
+      sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :error_context
 
       sig { returns(T.nilable(T::Array[String])) }

data/lib/dependabot/update_checkers/version_filters.rb

@@ -1,6 +1,8 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "dependabot/security_advisory"
+require "dependabot/package/package_release"
 require "sorbet-runtime"
 
 module Dependabot
@@ -19,7 +21,8 @@ module Dependabot
             versions_array: T::Array[
               T.any(
                 T.all(T.type_parameter(:T), Gem::Version),
-                T.all(T.type_parameter(:T), T::Hash[Symbol, Gem::Version])
+                T.all(T.type_parameter(:T), T::Hash[Symbol, Gem::Version]),
+                T.all(T.type_parameter(:T), Dependabot::Package::PackageRelease)
               )],
             security_advisories: T::Array[SecurityAdvisory]
           )
@@ -30,6 +33,8 @@ module Dependabot
           security_advisories.any? do |a|
             if v.is_a?(Gem::Version)
               a.vulnerable?(v)
+            elsif v.is_a?(Dependabot::Package::PackageRelease)
+              a.vulnerable?(v.version)
             else
               a.vulnerable?(v.fetch(:version))
             end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.308.0"
+  VERSION = "0.310.0"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.308.0
+  version: 0.310.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-12 00:00:00.000000000 Z
+date: 2025-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -627,7 +627,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
 rdoc_options: []
 require_paths:
 - lib