dependabot-common 0.319.0 → 0.320.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dadae528496bde0e27a338af42b48f57263395c51413da85de8cee747f291588
-  data.tar.gz: c317409e7dade84ceb6dcb283bfa849c1cff8e3ed017e73bdbb163044592bffc
+  metadata.gz: b74b681bdbccdcff5aa8da67d0b700ea41b486357e739ed66c8649bc7232c048
+  data.tar.gz: 836bbac6d11db5f90edfe90a233e953a9e40c8ae1aa21c8bb56142dcd84911bb
 SHA512:
-  metadata.gz: 91096591c27749bac950a03d207c240013b201f99cfbc15d2d370c091cb5c37c39e14eca34d10d9aa981d2e476ebe29c11e07e72fe780883f504912e0591ef12
-  data.tar.gz: cf8f0144d3049cee124ec7863637c5e1ec56ee36c775969a86aa0a45a931263734548e5046e80c09eead0104da8aa1b1972fe7b1e1b218e4acd91dd168be7e5f
+  metadata.gz: 30dbd2a618772b5b629f11d6a6ef9050734be9c6934d9691567e12889f3446be564581184a1f56dd5f1961fccaaf7ddb72fc86336cd676ab92d373750d959cc9
+  data.tar.gz: 434e9960903d572af76a6a1e84d61c194000c313040e5fa61631683eb938557aa668811a1f629de7afe81a39261225abdbe63fcaeb927eea17afdb6f1059c410

data/lib/dependabot/command_helpers.rb

@@ -12,12 +12,17 @@ module Dependabot
 
     module TIMEOUTS
       NO_TIME_OUT = -1 # No timeout
+      GRARECFULLY_STOP = 5 # 5 seconds for graceful termination
       LOCAL = 30 # 30 seconds
       NETWORK = 120 # 2 minutes
       LONG_RUNNING = 300 # 5 minutes
       DEFAULT = 900 # 15 minutes
     end
 
+    OutputObserver = T.type_alias do
+      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
+    end
+
     class ProcessStatus
       extend T::Sig
 
@@ -70,14 +75,16 @@ module Dependabot
         env_cmd: T::Array[T.any(T::Hash[String, String], String)],
         stdin_data: T.nilable(String),
         stderr_to_stdout: T::Boolean,
-        timeout: Integer
+        timeout: Integer,
+        output_observer: OutputObserver
       ).returns([T.nilable(String), T.nilable(String), T.nilable(ProcessStatus), Float])
     end
     def self.capture3_with_timeout(
       env_cmd,
       stdin_data: nil,
       stderr_to_stdout: false,
-      timeout: TIMEOUTS::DEFAULT
+      timeout: TIMEOUTS::DEFAULT,
+      output_observer: nil
     )
 
       stdout = T.let("", String)
@@ -142,12 +149,24 @@ module Dependabot
                 stderr += data unless stderr_to_stdout
                 stdout += data if stderr_to_stdout
               end
-                                                    rescue EOFError
-                                                      # Remove the stream when EOF is reached
-                                                      ios.delete(io)
-                                                    rescue IO::WaitReadable
-                                                      # Continue when IO is not ready yet
-                                                      next
+
+              # Observe the output if an observer is provided.
+              # This allows for custom handling of process output, including early termination.
+              observation = output_observer&.call(data)
+
+              if observation&.dig(:gracefully_stop)
+                message = observation[:reason] || "Terminated by output_observer"
+                # If the observer indicates a graceful stop, terminate the process
+                # by adjusting the remaining timeout 5 seconds
+                timeout = [timeout, ((Time.now - last_output_time) + 5).to_i].min
+                Dependabot.logger.warn("Terminating process due to observer signal: #{message}")
+              end
+            rescue EOFError
+              # Remove the stream when EOF is reached
+              ios.delete(io)
+            rescue IO::WaitReadable
+              # Continue when IO is not ready yet
+              next
             end
           end
 

data/lib/dependabot/config/file.rb

@@ -78,9 +78,11 @@ module Dependabot
         "nuget" => "nuget",
         "pip" => "pip",
         "pub" => "pub",
+        "rust-toolchain" => "rust_toolchain",
         "swift" => "swift",
         "terraform" => "terraform",
-        "uv" => "uv"
+        "uv" => "uv",
+        "vcpkg" => "vcpkg"
       }.freeze, T::Hash[String, String])
 
       sig { params(cfg: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Array[IgnoreCondition]) }

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -88,8 +88,10 @@ module Dependabot
           T.must(dependencies.first).package_manager
         end
 
-        sig { returns(String) }
+        sig { returns(T.nilable(String)) }
         def directory
+          return if files.empty?
+
           T.must(files.first).directory.tr(" ", "-")
         end
       end

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "commonmarker"
@@ -30,12 +30,20 @@ module Dependabot
         MARKDOWN_REGEX = /\[(.+?)\]\(([^)]+)\)|\[(.+?)\]|\A#+\s+([^\s].*)/
 
         COMMONMARKER_OPTIONS = T.let(
-          %i(GITHUB_PRE_LANG FULL_INFO_STRING).freeze,
-          T::Array[Symbol]
+          { escaped_char_spans: false, github_pre_lang: true, full_info_string: true, width: 120 }.freeze,
+          T::Hash[Symbol, T.any(T::Boolean, Integer)]
         )
         COMMONMARKER_EXTENSIONS = T.let(
-          %i(table tasklist strikethrough autolink tagfilter).freeze,
-          T::Array[Symbol]
+          {
+            autolink: true,
+            header_ids: nil,
+            shortcodes: false,
+            strikethrough: true,
+            table: true,
+            tagfilter: true,
+            tasklist: true
+          }.freeze,
+          T::Hash[Symbol, T.nilable(T::Boolean)]
         )
 
         sig { returns(T.nilable(String)) }
@@ -48,30 +56,37 @@ module Dependabot
 
         sig { params(text: String, unsafe: T::Boolean, format_html: T::Boolean).returns(String) }
         def sanitize_links_and_mentions(text:, unsafe: false, format_html: true)
-          doc = CommonMarker.render_doc(
-            text, :LIBERAL_HTML_TAG, COMMONMARKER_EXTENSIONS
-          )
+          doc = Commonmarker.parse(text, options: { extension: COMMONMARKER_EXTENSIONS, render: COMMONMARKER_OPTIONS })
 
           sanitize_team_mentions(doc)
           sanitize_mentions(doc)
           sanitize_links(doc)
           sanitize_nwo_text(doc)
 
-          render_options = if text.match?(MARKDOWN_REGEX)
-                             COMMONMARKER_OPTIONS
-                           else
-                             COMMONMARKER_OPTIONS + [:HARDBREAKS]
-                           end
-
-          mode = unsafe ? :UNSAFE : :DEFAULT
-          return doc.to_commonmark([mode] + render_options) unless format_html
+          render_options = COMMONMARKER_OPTIONS.dup
+          render_options[:hardbreaks] = false if text.match?(MARKDOWN_REGEX)
+          render_options[:unsafe] = true if unsafe
+          unless format_html
+            return doc.to_commonmark(
+              options: {
+                extension: COMMONMARKER_EXTENSIONS,
+                render: render_options
+              }
+            )
+          end
 
-          doc.to_html(([mode] + render_options), COMMONMARKER_EXTENSIONS)
+          doc.to_html(
+            options: {
+              extension: COMMONMARKER_EXTENSIONS,
+              render: render_options
+            },
+            plugins: { syntax_highlighter: nil }
+          )
         end
 
         private
 
-        sig { params(doc: CommonMarker::Node).void }
+        sig { params(doc: Commonmarker::Node).void }
         def sanitize_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
@@ -96,7 +111,7 @@ module Dependabot
         # This is because there are ecosystems that have packages that follow the same pattern
         # (e.g. @angular/angular-cli), and we don't want to create an invalid link, since
         # team mentions link to `https://github.com/org/:organization_name/teams/:team_name`.
-        sig { params(doc: CommonMarker::Node).void }
+        sig { params(doc: Commonmarker::Node).void }
         def sanitize_team_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
@@ -112,7 +127,7 @@ module Dependabot
           end
         end
 
-        sig { params(doc: CommonMarker::Node).void }
+        sig { params(doc: Commonmarker::Node).void }
         def sanitize_links(doc)
           doc.walk do |node|
             if node.type == :link && node.url.match?(GITHUB_REF_REGEX)
@@ -122,7 +137,7 @@ module Dependabot
                   next
                 end
 
-                last_match = T.must(subnode.string_content.match(GITHUB_REF_REGEX))
+                last_match = subnode.string_content.match(GITHUB_REF_REGEX)
                 number = last_match.named_captures.fetch("number")
                 repo = last_match.named_captures.fetch("repo")
                 subnode.string_content = "#{repo}##{number}"
@@ -136,7 +151,7 @@ module Dependabot
           end
         end
 
-        sig { params(doc: CommonMarker::Node).void }
+        sig { params(doc: Commonmarker::Node).void }
         def sanitize_nwo_text(doc)
           doc.walk do |node|
             if node.type == :text &&
@@ -147,9 +162,9 @@ module Dependabot
           end
         end
 
-        sig { params(node: CommonMarker::Node).void }
+        sig { params(node: Commonmarker::Node).void }
         def replace_nwo_node(node)
-          match = T.must(node.string_content.match(GITHUB_NWO_REGEX))
+          match = node.string_content.match(GITHUB_NWO_REGEX)
           repo = match.named_captures.fetch("repo")
           number = match.named_captures.fetch("number")
           new_node = build_nwo_text_node("#{repo}##{number}")
@@ -166,9 +181,9 @@ module Dependabot
           )
         end
 
-        sig { params(text: String).returns(T::Array[CommonMarker::Node]) }
+        sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_mention_nodes(text)
-          nodes = T.let([], T::Array[CommonMarker::Node])
+          nodes = T.let([], T::Array[Commonmarker::Node])
           scan = StringScanner.new(text)
 
           until scan.eos?
@@ -176,7 +191,7 @@ module Dependabot
                    scan.scan_until(EOS_REGEX)
             line_match = T.must(line).match(MENTION_REGEX)
             mention = line_match&.to_s
-            text_node = CommonMarker::Node.new(:text)
+            text_node = Commonmarker::Node.new(:text)
 
             if mention && !mention.end_with?("/")
               text_node.string_content = line_match.pre_match
@@ -193,9 +208,9 @@ module Dependabot
           nodes
         end
 
-        sig { params(text: String).returns(T::Array[CommonMarker::Node]) }
+        sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_team_mention_nodes(text)
-          nodes = T.let([], T::Array[CommonMarker::Node])
+          nodes = T.let([], T::Array[Commonmarker::Node])
 
           scan = StringScanner.new(text)
           until scan.eos?
@@ -203,7 +218,7 @@ module Dependabot
                    scan.scan_until(EOS_REGEX)
             line_match = T.must(line).match(TEAM_MENTION_REGEX)
             mention = line_match&.to_s
-            text_node = CommonMarker::Node.new(:text)
+            text_node = Commonmarker::Node.new(:text)
 
             if mention
               text_node.string_content = line_match.pre_match
@@ -218,25 +233,24 @@ module Dependabot
           nodes
         end
 
-        sig { params(text: String).returns(T::Array[CommonMarker::Node]) }
+        sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_mention_link_text_nodes(text)
-          code_node = CommonMarker::Node.new(:code)
+          code_node = Commonmarker::Node.new(:code)
           code_node.string_content = insert_zero_width_space_in_mention(text)
           [code_node]
         end
 
-        sig { params(text: String).returns(CommonMarker::Node) }
+        sig { params(text: String).returns(Commonmarker::Node) }
         def build_nwo_text_node(text)
-          code_node = CommonMarker::Node.new(:code)
+          code_node = Commonmarker::Node.new(:code)
           code_node.string_content = text
           code_node
         end
 
-        sig { params(url: String, text: String).returns(CommonMarker::Node) }
+        sig { params(url: String, text: String).returns(Commonmarker::Node) }
         def create_link_node(url, text)
-          link_node = CommonMarker::Node.new(:link)
-          code_node = CommonMarker::Node.new(:code)
-          link_node.url = url
+          link_node = Commonmarker::Node.new(:link, url: url)
+          code_node = Commonmarker::Node.new(:code)
           code_node.string_content = insert_zero_width_space_in_mention(text)
           link_node.append_child(code_node)
           link_node
@@ -251,9 +265,9 @@ module Dependabot
           mention.sub("@", "@\u200B").encode("utf-8")
         end
 
-        sig { params(node: CommonMarker::Node).returns(T::Boolean) }
+        sig { params(node: Commonmarker::Node).returns(T::Boolean) }
         def parent_node_link?(node)
-          node.type == :link || (!node.parent.nil? && parent_node_link?(T.must(node.parent)))
+          node.type == :link || (!node.parent.nil? && parent_node_link?(node.parent))
         end
       end
     end

data/lib/dependabot/shared_helpers.rb

@@ -439,7 +439,8 @@ module Dependabot
         env: T.nilable(T::Hash[String, String]),
         fingerprint: T.nilable(String),
         stderr_to_stdout: T::Boolean,
-        timeout: Integer
+        timeout: Integer,
+        output_observer: CommandHelpers::OutputObserver
       ).returns(String)
     end
     def self.run_shell_command(command,
@@ -448,7 +449,8 @@ module Dependabot
                                env: {},
                                fingerprint: nil,
                                stderr_to_stdout: true,
-                               timeout: CommandHelpers::TIMEOUTS::DEFAULT)
+                               timeout: CommandHelpers::TIMEOUTS::DEFAULT,
+                               output_observer: nil)
       start = Time.now
       cmd = allow_unsafe_shell_command ? command : escape_command(command)
 
@@ -459,10 +461,15 @@ module Dependabot
 
       env_cmd = [env || {}, cmd, opts].compact
       if Experiments.enabled?(:enable_shared_helpers_command_timeout)
-        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
-          env_cmd,
+        kwargs = {
           stderr_to_stdout: stderr_to_stdout,
           timeout: timeout
+        }
+        kwargs[:output_observer] = output_observer if output_observer
+
+        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
+          env_cmd,
+          **kwargs
         )
       elsif stderr_to_stdout
         stdout, process = Open3.capture2e(env || {}, cmd, opts)

data/lib/dependabot/source.rb

@@ -194,7 +194,13 @@ module Dependabot
 
     sig { returns(String) }
     def organization
-      T.must(repo.split("/").first)
+      case provider
+      when "azure"
+        parts = repo.split("/_git/")
+        T.must(T.must(parts.first).split("/").last(2).first)
+      else
+        T.must(repo.split("/").first)
+      end
     end
 
     sig { returns(String) }
@@ -202,7 +208,7 @@ module Dependabot
       raise "Project is an Azure DevOps concept only" unless provider == "azure"
 
       parts = repo.split("/_git/")
-      return T.must(T.must(parts.first).split("/").last) if parts.first&.split("/")&.count == 2
+      return T.must(T.must(parts.first).split("/").last) if parts.first&.split("/")&.count&.>=(2)
 
       T.must(parts.last)
     end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.319.0"
+  VERSION = "0.320.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.319.0
+  version: 0.320.0
 platform: ruby
 authors:
 - Dependabot
@@ -63,14 +63,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.23'
+        version: '2.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.23'
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: docker_registry2
   requirement: !ruby/object:Gem::Requirement
@@ -625,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.319.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.320.0
 rdoc_options: []
 require_paths:
 - lib