dependabot-common 0.331.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 368060e7dedf182e8c8b2ddf50b4db02fa3e5376af51f9e67c1463447afd34dc
-  data.tar.gz: b803b274fb307a702c06f8b84a97c461c9616c5513c344d75a089f35ceb08af7
+  metadata.gz: 96e4e83c7cdbf12714aa4542b6dae8a9c71b4c5f89f696f0da5a9b5edb3ef9d4
+  data.tar.gz: 9ed849c328be46ed3372c220b4d40d34ac3f66ed1d458ab6e30dd9df870d3fff
 SHA512:
-  metadata.gz: 583a5880a5600a7a358971da32c0ec6c50c26221239180daef53139c2d34f9307cc8bb8ef068f13644b01454077708a061a7425d557482e883deacb8c394f8fe
-  data.tar.gz: ed79678548ca61683a7f65860b7901ab7af465263e047cec0ffd6b44e74c4bbea7a0f2e1baf404fa530579e57ddc1e9952e40de089658052f98ed2b14df65cb2
+  metadata.gz: 2130d48ea935228392ce811fb9e91a4d6322dfee13296df1b66247169fccc7279f4213f01b8a716b91317cf31574647719b28ec4bda35ab86ff26f8a112c930f
+  data.tar.gz: 301db4be228ea9ddb8a40b55a1f1649bf1c9af444f3bf7f0d107c005ca01a76640016d61144a389baf1b2404648c0393f1da2efd1f023153bce3a715d5291a23

data/lib/dependabot/config/file_fetcher.rb

@@ -27,8 +27,6 @@ module Dependabot
         @config_file ||= T.let(files.first, T.nilable(Dependabot::DependencyFile))
       end
 
-      private
-
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_files
         fetched_files = T.let([], T::Array[Dependabot::DependencyFile])

data/lib/dependabot/dependency.rb

@@ -119,14 +119,12 @@ module Dependabot
         subdependency_metadata: T.nilable(T::Array[T::Hash[T.any(Symbol, String), String]]),
         removed: T::Boolean,
         metadata: T.nilable(T::Hash[T.any(Symbol, String), String]),
-        direct_relationship: T::Boolean,
         origin_files: T::Array[String]
       ).void
     end
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil, directory: nil,
-                   subdependency_metadata: [], removed: false, metadata: {}, direct_relationship: false,
-                   origin_files: [])
+                   subdependency_metadata: [], removed: false, metadata: {}, origin_files: [])
       @name = name
       @version = T.let(
         case version
@@ -153,7 +151,6 @@ module Dependabot
       end
       @removed = removed
       @metadata = T.let(symbolize_keys(metadata || {}), T::Hash[Symbol, T.untyped])
-      @direct_relationship = direct_relationship
       @origin_files = origin_files
       check_values
     end
@@ -165,12 +162,6 @@ module Dependabot
       requirements.any?
     end
 
-    # used to support lockfile parsing/DependencySubmission
-    sig { returns(T::Boolean) }
-    def direct?
-      top_level? || @direct_relationship
-    end
-
     sig { returns(T::Boolean) }
     def removed?
       @removed

data/lib/dependabot/dependency_file.rb

@@ -28,14 +28,6 @@ module Dependabot
     sig { returns(T::Boolean) }
     attr_accessor :vendored_file
 
-    # Dependency file priority is used to determine which files are relevant when generating a dependency graph for the
-    # project - only the highest priority files will be graphed for each directory.
-    #
-    # This allows us to default to treating all dependency files as relevant unless the ecosystem's file parser tells
-    # us otherwise, for example indicating that a Gemfile.lock fully supersedes its peered Gemfile.
-    sig { returns(Integer) }
-    attr_accessor :priority
-
     sig { returns(T.nilable(String)) }
     attr_accessor :symlink_target
 
@@ -48,9 +40,6 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_accessor :mode
 
-    sig { returns(T::Set[T.untyped]) }
-    attr_accessor :dependencies
-
     class ContentEncoding
       UTF_8 = "utf-8"
       BASE64 = "base64"
@@ -86,15 +75,14 @@ module Dependabot
         content_encoding: String,
         deleted: T::Boolean,
         operation: String,
-        mode: T.nilable(String),
-        priority: Integer
+        mode: T.nilable(String)
       )
         .void
     end
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, vendored_file: false, symlink_target: nil,
                    content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil, priority: 0)
+                   operation: Operation::UPDATE, mode: nil)
       @name = name
       @content = content
       @directory = T.let(clean_directory(directory), String)
@@ -104,8 +92,6 @@ module Dependabot
       @content_encoding = content_encoding
       @operation = operation
       @mode = mode
-      @dependencies = T.let(Set.new, T::Set[T.untyped])
-      @priority = priority
       raise ArgumentError, "Invalid Git mode: #{mode}" if mode && !VALID_MODES.include?(mode)
 
       # Make deleted override the operation. Deleted is kept when operation

data/lib/dependabot/file_fetchers/base.rb

@@ -158,9 +158,6 @@ module Dependabot
         @files = files
       end
 
-      sig { abstract.returns(T::Array[DependencyFile]) }
-      def fetch_files; end
-
       sig { returns(T.nilable(String)) }
       def commit
         return T.must(cloned_commit) if cloned_commit
@@ -195,6 +192,9 @@ module Dependabot
       sig { overridable.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def ecosystem_versions; end
 
+      sig { abstract.returns(T::Array[DependencyFile]) }
+      def fetch_files; end
+
       private
 
       sig { params(name: String).returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -106,9 +106,6 @@ module Dependabot
         @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
       end
 
-      sig { abstract.returns(T.nilable(Dependabot::Package::PackageDetails)) }
-      def package_details; end
-
       sig do
         returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
       end
@@ -118,23 +115,6 @@ module Dependabot
 
       protected
 
-      sig do
-        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-          .returns(T.nilable(Dependabot::Version))
-      end
-      def fetch_latest_version(language_version: nil)
-        releases = available_versions
-        return unless releases
-
-        releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
-        releases.max_by(&:version)&.version
-      end
-
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -153,45 +133,6 @@ module Dependabot
         releases.max_by(&:version)&.version
       end
 
-      sig do
-        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-          .returns(T.nilable(Dependabot::Version))
-      end
-      def fetch_lowest_security_fix_version(language_version: nil)
-        releases = available_versions
-        return unless releases
-
-        releases = filter_yanked_versions(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        # versions = filter_prerelease_versions(versions)
-        releases = Dependabot::UpdateCheckers::VersionFilters
-                   .filter_vulnerable_versions(
-                     releases,
-                     security_advisories
-                   )
-        releases = filter_ignored_versions(releases)
-        releases = filter_lower_versions(releases)
-        releases = apply_post_fetch_lowest_security_fix_versions_filter(releases)
-
-        releases.min_by(&:version)&.version
-      end
-
-      sig do
-        params(releases: T::Array[Dependabot::Package::PackageRelease])
-          .returns(T::Array[Dependabot::Package::PackageRelease])
-      end
-      def apply_post_fetch_latest_versions_filter(releases)
-        releases
-      end
-
-      sig do
-        params(releases: T::Array[Dependabot::Package::PackageRelease])
-          .returns(T::Array[Dependabot::Package::PackageRelease])
-      end
-      def apply_post_fetch_lowest_security_fix_versions_filter(releases)
-        releases
-      end
-
       sig do
         params(releases: T::Array[Dependabot::Package::PackageRelease])
           .returns(T::Array[Dependabot::Package::PackageRelease])
@@ -322,11 +263,6 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Boolean) }
-      def cooldown_enabled?
-        false
-      end
-
       sig do
         params(
           current_version: T.nilable(Dependabot::Version),
@@ -382,6 +318,72 @@ module Dependabot
       def requirement_class
         dependency.requirement_class
       end
+
+      private
+
+      sig { abstract.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+      def package_details; end
+
+      sig { returns(T::Boolean) }
+      def cooldown_enabled?
+        false
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_latest_version(language_version: nil)
+        releases = available_versions
+        return unless releases
+
+        releases = filter_yanked_versions(releases)
+        releases = filter_by_cooldown(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        releases = filter_prerelease_versions(releases)
+        releases = filter_ignored_versions(releases)
+        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases.max_by(&:version)&.version
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_lowest_security_fix_version(language_version: nil)
+        releases = available_versions
+        return unless releases
+
+        releases = filter_yanked_versions(releases)
+        releases = filter_unsupported_versions(releases, language_version)
+        # versions = filter_prerelease_versions(versions)
+        releases = Dependabot::UpdateCheckers::VersionFilters
+                   .filter_vulnerable_versions(
+                     releases,
+                     security_advisories
+                   )
+        releases = filter_ignored_versions(releases)
+        releases = filter_lower_versions(releases)
+        releases = apply_post_fetch_lowest_security_fix_versions_filter(releases)
+
+        releases.min_by(&:version)&.version
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_latest_versions_filter(releases)
+        releases
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def apply_post_fetch_lowest_security_fix_versions_filter(releases)
+        releases
+      end
     end
   end
 end

data/lib/dependabot/requirements_updater/base.rb

@@ -18,6 +18,8 @@ module Dependabot
       sig { abstract.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements; end
 
+      private
+
       sig { abstract.returns(T::Class[Version]) }
       def version_class; end
 

data/lib/dependabot/workspace/base.rb

@@ -75,6 +75,8 @@ module Dependabot
       end
       def capture_failed_change_attempt(memo = nil, error = nil); end
 
+      private
+
       sig { abstract.returns(String) }
       def clean; end
     end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.331.0"
+  VERSION = "0.332.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.331.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -626,7 +626,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.331.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib