dependabot-common 0.330.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e75354fcd97069450a7897bc3f0c4788fc502b6b7541c7bb1ef01f14779aaec3
-  data.tar.gz: c71e3cf39d50d4510f12d137e17ba63204aacedce829eb66f48c7da672cece39
+  metadata.gz: 96e4e83c7cdbf12714aa4542b6dae8a9c71b4c5f89f696f0da5a9b5edb3ef9d4
+  data.tar.gz: 9ed849c328be46ed3372c220b4d40d34ac3f66ed1d458ab6e30dd9df870d3fff
 SHA512:
-  metadata.gz: 844f8f4ad3fb9b201791b0499fa8c733667ed792701d19fe0791aaad172170b1dfa399244b32477e440ba97d8f2f2862a882c41eb9ab40e029b96affc8c75a9a
-  data.tar.gz: dd31e1be979b0a984c896be9ba4bc5060175deb1feea9ac0278e03666034dbdc5b711314603c8b56089bd7e2aa93e2e8cbbaa9e552deb75e565d26a3e49129ae
+  metadata.gz: 2130d48ea935228392ce811fb9e91a4d6322dfee13296df1b66247169fccc7279f4213f01b8a716b91317cf31574647719b28ec4bda35ab86ff26f8a112c930f
+  data.tar.gz: 301db4be228ea9ddb8a40b55a1f1649bf1c9af444f3bf7f0d107c005ca01a76640016d61144a389baf1b2404648c0393f1da2efd1f023153bce3a715d5291a23

data/lib/dependabot/config/file_fetcher.rb

@@ -27,8 +27,6 @@ module Dependabot
         @config_file ||= T.let(files.first, T.nilable(Dependabot::DependencyFile))
       end
 
-      private
-
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_files
         fetched_files = T.let([], T::Array[Dependabot::DependencyFile])

data/lib/dependabot/dependency.rb

@@ -101,6 +101,9 @@ module Dependabot
     sig { returns(T.nilable(Time)) }
     attr_accessor :attribution_timestamp
 
+    sig { returns(T::Array[String]) }
+    attr_reader :origin_files
+
     # rubocop:disable Metrics/AbcSize
     # rubocop:disable Metrics/PerceivedComplexity
     sig do
@@ -116,12 +119,12 @@ module Dependabot
         subdependency_metadata: T.nilable(T::Array[T::Hash[T.any(Symbol, String), String]]),
         removed: T::Boolean,
         metadata: T.nilable(T::Hash[T.any(Symbol, String), String]),
-        direct_relationship: T::Boolean
+        origin_files: T::Array[String]
       ).void
     end
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil, directory: nil,
-                   subdependency_metadata: [], removed: false, metadata: {}, direct_relationship: false)
+                   subdependency_metadata: [], removed: false, metadata: {}, origin_files: [])
       @name = name
       @version = T.let(
         case version
@@ -148,8 +151,7 @@ module Dependabot
       end
       @removed = removed
       @metadata = T.let(symbolize_keys(metadata || {}), T::Hash[Symbol, T.untyped])
-      @direct_relationship = direct_relationship
-
+      @origin_files = origin_files
       check_values
     end
     # rubocop:enable Metrics/AbcSize
@@ -160,12 +162,6 @@ module Dependabot
       requirements.any?
     end
 
-    # used to support lockfile parsing/DependencySubmission
-    sig { returns(T::Boolean) }
-    def direct?
-      top_level? || @direct_relationship
-    end
-
     sig { returns(T::Boolean) }
     def removed?
       @removed

data/lib/dependabot/dependency_file.rb

@@ -28,14 +28,6 @@ module Dependabot
     sig { returns(T::Boolean) }
     attr_accessor :vendored_file
 
-    # Dependency file priority is used to determine which files are relevant when generating a dependency graph for the
-    # project - only the highest priority files will be graphed for each directory.
-    #
-    # This allows us to default to treating all dependency files as relevant unless the ecosystem's file parser tells
-    # us otherwise, for example indicating that a Gemfile.lock fully supersedes its peered Gemfile.
-    sig { returns(Integer) }
-    attr_accessor :priority
-
     sig { returns(T.nilable(String)) }
     attr_accessor :symlink_target
 
@@ -48,9 +40,6 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_accessor :mode
 
-    sig { returns(T::Set[T.untyped]) }
-    attr_accessor :dependencies
-
     class ContentEncoding
       UTF_8 = "utf-8"
       BASE64 = "base64"
@@ -86,15 +75,14 @@ module Dependabot
         content_encoding: String,
         deleted: T::Boolean,
         operation: String,
-        mode: T.nilable(String),
-        priority: Integer
+        mode: T.nilable(String)
       )
         .void
     end
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, vendored_file: false, symlink_target: nil,
                    content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil, priority: 0)
+                   operation: Operation::UPDATE, mode: nil)
       @name = name
       @content = content
       @directory = T.let(clean_directory(directory), String)
@@ -104,8 +92,6 @@ module Dependabot
       @content_encoding = content_encoding
       @operation = operation
       @mode = mode
-      @dependencies = T.let(Set.new, T::Set[T.untyped])
-      @priority = priority
       raise ArgumentError, "Invalid Git mode: #{mode}" if mode && !VALID_MODES.include?(mode)
 
       # Make deleted override the operation. Deleted is kept when operation

data/lib/dependabot/file_fetchers/base.rb

@@ -158,9 +158,6 @@ module Dependabot
         @files = files
       end
 
-      sig { abstract.returns(T::Array[DependencyFile]) }
-      def fetch_files; end
-
       sig { returns(T.nilable(String)) }
       def commit
         return T.must(cloned_commit) if cloned_commit
@@ -195,6 +192,9 @@ module Dependabot
       sig { overridable.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def ecosystem_versions; end
 
+      sig { abstract.returns(T::Array[DependencyFile]) }
+      def fetch_files; end
+
       private
 
       sig { params(name: String).returns(T.nilable(Dependabot::DependencyFile)) }
@@ -462,18 +462,14 @@ module Dependabot
         params(path: String, fetch_submodules: T::Boolean, raise_errors: T::Boolean)
           .returns(T::Array[OpenStruct])
       end
-      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true) # rubocop:disable Metrics/PerceivedComplexity
+      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true)
         path = path.gsub(" ", "%20")
         provider, repo, tmp_path, commit =
           _full_specification_for(path, fetch_submodules: fetch_submodules)
           .values_at(:provider, :repo, :path, :commit)
 
         entries = _fetch_repo_contents_fully_specified(provider, repo, tmp_path, commit)
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        entries
       rescue *CLIENT_NOT_FOUND_ERRORS
         raise Dependabot::DirectoryNotFound, directory if path == directory.gsub(%r{^/*}, "")
 
@@ -554,11 +550,7 @@ module Dependabot
             size: 0 # NOTE: added for parity with github contents API
           )
         end
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        entries
       end
 
       # Filters out any entries whose paths match one of the exclude_paths globs.

data/lib/dependabot/file_filtering.rb

@@ -0,0 +1,70 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  module FileFiltering
+    extend T::Sig
+
+    # Returns true if the given path matches any of the exclude patterns
+    sig { params(path: String, exclude_patterns: T.nilable(T::Array[String])).returns(T::Boolean) }
+    def self.exclude_path?(path, exclude_patterns) # rubocop:disable Metrics/PerceivedComplexity
+      return false if exclude_patterns.nil? || exclude_patterns.empty?
+
+      # Normalize the path by removing leading slashes and resolving relative paths
+      normalized_path = normalize_path(path)
+
+      exclude_patterns.any? do |pattern|
+        normalized_pattern = normalize_path(pattern.chomp("/"))
+
+        # case 1: exact match
+        exclude_exact = normalized_path == pattern || normalized_path == normalized_pattern
+
+        # case 2: Directory prefix matching: check if path is inside an excluded directory
+        exclude_deeper = normalized_path.start_with?("#{pattern}#{File::SEPARATOR}",
+                                                     "#{normalized_pattern}#{File::SEPARATOR}")
+
+        # case 3: Explicit recursive (patterns that end with /**)
+        exclude_recursive = false
+        if pattern.end_with?("/**")
+          base_pattern_str = pattern[0...-3]
+          base_pattern = normalize_path(base_pattern_str) if base_pattern_str
+          exclude_recursive = base_pattern && (
+            normalized_path == base_pattern ||
+            normalized_path.start_with?("#{base_pattern}/") ||
+            normalized_path.start_with?("#{base_pattern}#{File::SEPARATOR}")
+          )
+        end
+
+        # case 4: Glob pattern matching with enhanced flags
+        # Use multiple fnmatch attempts with different flag combinations
+        fnmatch_flags = [
+          File::FNM_EXTGLOB,
+          File::FNM_EXTGLOB | File::FNM_PATHNAME,
+          File::FNM_EXTGLOB | File::FNM_PATHNAME | File::FNM_DOTMATCH,
+          File::FNM_PATHNAME
+        ]
+        exclude_fnmatch_paths = fnmatch_flags.any? do |flag|
+          File.fnmatch?(pattern, normalized_path, flag) || File.fnmatch?(normalized_pattern, normalized_path, flag)
+        end
+
+        result = exclude_exact || exclude_deeper || exclude_recursive || exclude_fnmatch_paths
+        result
+      end
+    end
+
+    # Normalize a file path for consistent comparison
+    # - Removes leading slashes
+    # - Resolves relative path components (., ..)
+    sig { params(path: String).returns(String) }
+    def self.normalize_path(path)
+      return path if path.empty?
+
+      pathname = Pathname.new(path)
+      normalized = pathname.cleanpath.to_s
+
+      # Remove leading slash for relative comparison
+      normalized = normalized.sub(%r{^/+}, "")
+      normalized
+    end
+  end
+end

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -150,6 +150,10 @@ module Dependabot
               (old_dep.subdependency_metadata || []) +
               (new_dep.subdependency_metadata || [])
             ).uniq
+            origin_files = (
+              old_dep.origin_files +
+              new_dep.origin_files
+            ).uniq
 
             Dependency.new(
               name: old_dep.name,
@@ -157,7 +161,8 @@ module Dependabot
               requirements: requirements,
               package_manager: old_dep.package_manager,
               metadata: old_dep.metadata,
-              subdependency_metadata: subdependency_metadata
+              subdependency_metadata: subdependency_metadata,
+              origin_files: origin_files
             )
           end
 

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -106,9 +106,6 @@ module Dependabot
         @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
       end
 
-      sig { abstract.returns(T.nilable(Dependabot::Package::PackageDetails)) }
-      def package_details; end
-
       sig do
         returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
       end
@@ -118,23 +115,6 @@ module Dependabot
 
       protected
 
-      sig do
-        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-          .returns(T.nilable(Dependabot::Version))
-      end
-      def fetch_latest_version(language_version: nil)
-        releases = available_versions
-        return unless releases
-
-        releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
-        releases.max_by(&:version)&.version
-      end
-
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -153,45 +133,6 @@ module Dependabot
         releases.max_by(&:version)&.version
       end
 
-      sig do
-        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-          .returns(T.nilable(Dependabot::Version))
-      end
-      def fetch_lowest_security_fix_version(language_version: nil)
-        releases = available_versions
-        return unless releases
-
-        releases = filter_yanked_versions(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        # versions = filter_prerelease_versions(versions)
-        releases = Dependabot::UpdateCheckers::VersionFilters
-                   .filter_vulnerable_versions(
-                     releases,
-                     security_advisories
-                   )
-        releases = filter_ignored_versions(releases)
-        releases = filter_lower_versions(releases)
-        releases = apply_post_fetch_lowest_security_fix_versions_filter(releases)
-
-        releases.min_by(&:version)&.version
-      end
-
-      sig do
-        params(releases: T::Array[Dependabot::Package::PackageRelease])
-          .returns(T::Array[Dependabot::Package::PackageRelease])
-      end
-      def apply_post_fetch_latest_versions_filter(releases)
-        releases
-      end
-
-      sig do
-        params(releases: T::Array[Dependabot::Package::PackageRelease])
-          .returns(T::Array[Dependabot::Package::PackageRelease])
-      end
-      def apply_post_fetch_lowest_security_fix_versions_filter(releases)
-        releases
-      end
-
       sig do
         params(releases: T::Array[Dependabot::Package::PackageRelease])
           .returns(T::Array[Dependabot::Package::PackageRelease])
@@ -322,11 +263,6 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Boolean) }
-      def cooldown_enabled?
-        false
-      end
-
       sig do
         params(
           current_version: T.nilable(Dependabot::Version),
@@ -382,6 +318,72 @@ module Dependabot
       def requirement_class
         dependency.requirement_class
       end
+
+      private
+
+      sig { abstract.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+      def package_details; end
+
+      sig { returns(T::Boolean) }
+      def cooldown_enabled?
+        false
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_latest_version(language_version: nil)
+        releases = available_versions
+        return unless releases
+
+        releases = filter_yanked_versions(releases)
+        releases = filter_by_cooldown(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        releases = filter_prerelease_versions(releases)
+        releases = filter_ignored_versions(releases)
+        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases.max_by(&:version)&.version
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_lowest_security_fix_version(language_version: nil)
+        releases = available_versions
+        return unless releases
+
+        releases = filter_yanked_versions(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        # versions = filter_prerelease_versions(versions)
+        releases = Dependabot::UpdateCheckers::VersionFilters
+                   .filter_vulnerable_versions(
+                     releases,
+                     security_advisories
+                   )
+        releases = filter_ignored_versions(releases)
+        releases = filter_lower_versions(releases)
+        releases = apply_post_fetch_lowest_security_fix_versions_filter(releases)
+
+        releases.min_by(&:version)&.version
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_latest_versions_filter(releases)
+        releases
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_lowest_security_fix_versions_filter(releases)
+        releases
+      end
     end
   end
 end

data/lib/dependabot/requirements_updater/base.rb

@@ -18,6 +18,8 @@ module Dependabot
       sig { abstract.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements; end
 
+      private
+
       sig { abstract.returns(T::Class[Version]) }
       def version_class; end
 

data/lib/dependabot/update_checkers/base.rb

@@ -8,6 +8,7 @@ require "dependabot/requirements_update_strategy"
 require "dependabot/security_advisory"
 require "dependabot/utils"
 require "dependabot/package/release_cooldown_options"
+require "dependabot/file_filtering"
 
 module Dependabot
   module UpdateCheckers
@@ -45,6 +46,9 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
       attr_reader :update_cooldown
 
+      sig { returns(T.nilable(T::Array[String])) }
+      attr_reader :exclude_paths
+
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
@@ -60,6 +64,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          exclude_paths: T.nilable(T::Array[String]),
           options: T::Hash[Symbol, T.untyped]
         )
           .void
@@ -68,7 +73,7 @@ module Dependabot
                      repo_contents_path: nil, ignored_versions: [],
                      raise_on_ignored: false, security_advisories: [],
                      requirements_update_strategy: nil, dependency_group: nil,
-                     update_cooldown: nil, options: {})
+                     update_cooldown: nil, exclude_paths: [], options: {})
         @dependency = dependency
         @dependency_files = dependency_files
         @repo_contents_path = repo_contents_path
@@ -79,6 +84,7 @@ module Dependabot
         @security_advisories = security_advisories
         @dependency_group = dependency_group
         @update_cooldown = update_cooldown
+        @exclude_paths = exclude_paths
         @options = options
       end
 
@@ -106,6 +112,37 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Boolean) }
+      def excluded? # rubocop:disable Metrics/PerceivedComplexity
+        return false unless Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
+
+        return false if exclude_paths.nil? || exclude_paths&.empty?
+
+        origin_files = @dependency.origin_files
+        if origin_files.length.positive?
+          excluded_files = []
+          non_excluded_files = []
+
+          origin_files.each do |origin_file|
+            if Dependabot::FileFiltering.exclude_path?(origin_file, exclude_paths)
+              excluded_files << origin_file
+            else
+              non_excluded_files << origin_file
+            end
+          end
+
+          # Only exclude if the dependency appears ONLY in excluded paths
+          # If it appears in any non-excluded path, we should process it
+          if non_excluded_files.empty? && excluded_files.any?
+            Dependabot.logger.info("Excluding dependency #{dependency.name} - only found in excluded paths " \
+                                   "#{excluded_files.join(', ')}")
+            return true
+          end
+        end
+
+        false
+      end
+
       sig { params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies(requirements_to_unlock:)
         return [] unless can_update?(requirements_to_unlock: requirements_to_unlock)

data/lib/dependabot/workspace/base.rb

@@ -75,6 +75,8 @@ module Dependabot
       end
       def capture_failed_change_attempt(memo = nil, error = nil); end
 
+      private
+
       sig { abstract.returns(String) }
       def clean; end
     end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.330.0"
+  VERSION = "0.332.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.330.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -550,6 +550,7 @@ files:
 - lib/dependabot/file_fetchers.rb
 - lib/dependabot/file_fetchers/README.md
 - lib/dependabot/file_fetchers/base.rb
+- lib/dependabot/file_filtering.rb
 - lib/dependabot/file_parsers.rb
 - lib/dependabot/file_parsers/README.md
 - lib/dependabot/file_parsers/base.rb
@@ -625,7 +626,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.330.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib