dependabot-common 0.334.0 → 0.335.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee93438c876862c61851530f9d8e55f6af355f36539a7bcb7f0e5eb904eba415
-  data.tar.gz: e7197bf4af0d0d52a16eaaedf801cabcd91044855bcd7106fd3e6fd5d78cbf12
+  metadata.gz: ca29ec928a5e569aa377708755f29f998ca87ddb68ed2722a5171386427e3f87
+  data.tar.gz: 206f507ef450d40f3a002187a7890dc5b5abc88c7d8df5e53a87a27a14aa9f71
 SHA512:
-  metadata.gz: 781140e985ee854dcf324bacadbd59aaba905fe08d99f579b80b0c1180c7e02072536470819e337510a3d162f00a54413f6a1b6c4e7d46406ce6c676b20912f5
-  data.tar.gz: e6ad900c810e060b21e96bef859b941b4a689e97bc019d4669d1026076804ccf62416502928ffa38a72eafa73882f6648b81edf66ea801313755b6c14ef582bb
+  metadata.gz: 3a3baf81472a1b7528fb6f95f9c5ed76f79186fd4aa442e073b2f0bc60e676186f592ab16a18f1f6bb747e652e522d0f1af2a7ac077a3dbce0d89001c001fc93
+  data.tar.gz: 26a4aaa04570ec094267b7e2739a394fe4d279807ad03453ac6cec8c766d18cb3b13e73665923cf8e58ca64ab6fad7b8b8a20656a0feaa93b80bcdaed6119503

data/lib/dependabot/clients/azure.rb

@@ -65,10 +65,12 @@ module Dependabot
 
       sig { params(_repo: T.nilable(String), branch: String).returns(String) }
       def fetch_commit(_repo, branch)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/stats/branches?name=" + branch)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/stats/branches?name=" + branch
+        )
 
         raise NotFound if response.status == 400
 
@@ -77,9 +79,11 @@ module Dependabot
 
       sig { params(_repo: String).returns(String) }
       def fetch_default_branch(_repo)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo
+        )
 
         JSON.parse(response.body).fetch("defaultBranch").gsub("refs/heads/", "")
       end
@@ -94,10 +98,12 @@ module Dependabot
       def fetch_repo_contents(commit = nil, path = nil)
         tree = fetch_repo_contents_treeroot(commit, path)
 
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/trees/" + tree + "?recursive=false")
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/trees/" + tree + "?recursive=false"
+        )
 
         JSON.parse(response.body).fetch("treeEntries")
       end
@@ -124,12 +130,14 @@ module Dependabot
 
       sig { params(commit: String, path: String).returns(String) }
       def fetch_file_contents(commit, path)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/items?path=" + path +
-          "&versionDescriptor.versionType=commit" \
-          "&versionDescriptor.version=" + commit)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/items?path=" + path +
+                    "&versionDescriptor.versionType=commit" \
+                    "&versionDescriptor.version=" + commit
+        )
 
         response.body
       end
@@ -150,22 +158,26 @@ module Dependabot
 
       sig { params(branch_name: String).returns(T.nilable(T::Hash[String, T.untyped])) }
       def branch(branch_name)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/refs?filter=heads/" + branch_name)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/refs?filter=heads/" + branch_name
+        )
 
         JSON.parse(response.body).fetch("value").first
       end
 
       sig { params(source_branch: String, target_branch: String).returns(T::Array[T::Hash[String, T.untyped]]) }
       def pull_requests(source_branch, target_branch)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/pullrequests?searchCriteria.status=all" \
-          "&searchCriteria.sourceRefName=refs/heads/" + source_branch +
-          "&searchCriteria.targetRefName=refs/heads/" + target_branch)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/pullrequests?searchCriteria.status=all" \
+                    "&searchCriteria.sourceRefName=refs/heads/" + source_branch +
+                    "&searchCriteria.targetRefName=refs/heads/" + target_branch
+        )
 
         JSON.parse(response.body).fetch("value")
       end
@@ -180,8 +192,13 @@ module Dependabot
         )
           .returns(T.untyped)
       end
-      def create_commit(branch_name, base_commit, commit_message, files,
-                        author_details)
+      def create_commit(
+        branch_name,
+        base_commit,
+        commit_message,
+        files,
+        author_details
+      )
         content = {
           refUpdates: [
             { name: "refs/heads/" + branch_name, oldObjectId: base_commit }
@@ -204,9 +221,12 @@ module Dependabot
           ]
         }
 
-        post(T.must(source.api_endpoint) + source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/pushes?api-version=5.0", content.to_json)
+        post(
+          T.must(source.api_endpoint) + source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/pushes?api-version=5.0",
+          content.to_json
+        )
       end
 
       # rubocop:disable Metrics/ParameterLists
@@ -223,9 +243,16 @@ module Dependabot
         )
           .returns(T.untyped)
       end
-      def create_pull_request(pr_name, source_branch, target_branch,
-                              pr_description, labels,
-                              reviewers = nil, assignees = nil, work_item = nil)
+      def create_pull_request(
+        pr_name,
+        source_branch,
+        target_branch,
+        pr_description,
+        labels,
+        reviewers = nil,
+        assignees = nil,
+        work_item = nil
+      )
         content = {
           sourceRefName: "refs/heads/" + source_branch,
           targetRefName: "refs/heads/" + target_branch,
@@ -236,10 +263,13 @@ module Dependabot
           workItemRefs: [{ id: work_item }]
         }
 
-        post(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/repositories/" + source.unscoped_repo +
-          "/pullrequests?api-version=5.0", content.to_json)
+        post(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/repositories/" + source.unscoped_repo +
+                    "/pullrequests?api-version=5.0",
+          content.to_json
+        )
       end
 
       sig do
@@ -255,9 +285,16 @@ module Dependabot
         )
           .returns(T.untyped)
       end
-      def autocomplete_pull_request(pull_request_id, auto_complete_set_by, merge_commit_message,
-                                    delete_source_branch = true, squash_merge = true, merge_strategy = "squash",
-                                    trans_work_items = true, ignore_config_ids = [])
+      def autocomplete_pull_request(
+        pull_request_id,
+        auto_complete_set_by,
+        merge_commit_message,
+        delete_source_branch = true,
+        squash_merge = true,
+        merge_strategy = "squash",
+        trans_work_items = true,
+        ignore_config_ids = []
+      )
         content = {
           autoCompleteSetBy: {
             id: auto_complete_set_by
@@ -272,19 +309,24 @@ module Dependabot
           }
         }
 
-        response = patch(T.must(source.api_endpoint) +
-                           source.organization + "/" + source.project +
-                           "/_apis/git/repositories/" + source.unscoped_repo +
-                           "/pullrequests/" + pull_request_id.to_s + "?api-version=5.1", content.to_json)
+        response = patch(
+          T.must(source.api_endpoint) +
+                                     source.organization + "/" + source.project +
+                                     "/_apis/git/repositories/" + source.unscoped_repo +
+                                     "/pullrequests/" + pull_request_id.to_s + "?api-version=5.1",
+          content.to_json
+        )
 
         JSON.parse(response.body)
       end
 
       sig { params(pull_request_id: String).returns(T::Hash[String, T.untyped]) }
       def pull_request(pull_request_id)
-        response = get(T.must(source.api_endpoint) +
-          source.organization + "/" + source.project +
-          "/_apis/git/pullrequests/" + pull_request_id)
+        response = get(
+          T.must(source.api_endpoint) +
+                    source.organization + "/" + source.project +
+                    "/_apis/git/pullrequests/" + pull_request_id
+        )
 
         JSON.parse(response.body)
       end
@@ -299,9 +341,12 @@ module Dependabot
           }
         ]
 
-        response = post(T.must(source.api_endpoint) + source.organization + "/" + source.project +
-                        "/_apis/git/repositories/" + source.unscoped_repo +
-                        "/refs?api-version=5.0", content.to_json)
+        response = post(
+          T.must(source.api_endpoint) + source.organization + "/" + source.project +
+                                  "/_apis/git/repositories/" + source.unscoped_repo +
+                                  "/refs?api-version=5.0",
+          content.to_json
+        )
 
         JSON.parse(response.body).fetch("value").first
       end
@@ -309,19 +354,22 @@ module Dependabot
 
       sig do
         params(
-          previous_tag: T.nilable(String), new_tag: T.nilable(String),
+          previous_tag: T.nilable(String),
+          new_tag: T.nilable(String),
           type: String
         )
           .returns(T::Array[T::Hash[String, T.untyped]])
       end
       def compare(previous_tag, new_tag, type)
-        response = get(T.must(source.api_endpoint) +
-                         source.organization + "/" + source.project +
-                         "/_apis/git/repositories/" + source.unscoped_repo +
-                         "/commits?searchCriteria.itemVersion.versionType=#{type}" \
-                         "&searchCriteria.itemVersion.version=#{previous_tag}" \
-                         "&searchCriteria.compareVersion.versionType=#{type}" \
-                         "&searchCriteria.compareVersion.version=#{new_tag}")
+        response = get(
+          T.must(source.api_endpoint) +
+                                   source.organization + "/" + source.project +
+                                   "/_apis/git/repositories/" + source.unscoped_repo +
+                                   "/commits?searchCriteria.itemVersion.versionType=#{type}" \
+                                   "&searchCriteria.itemVersion.version=#{previous_tag}" \
+                                   "&searchCriteria.compareVersion.versionType=#{type}" \
+                                   "&searchCriteria.compareVersion.version=#{new_tag}"
+        )
 
         JSON.parse(response.body).fetch("value")
       end

data/lib/dependabot/clients/bitbucket.rb

@@ -168,8 +168,14 @@ module Dependabot
         )
           .void
       end
-      def create_commit(repo, branch_name, base_commit, commit_message, files,
-                        author_details)
+      def create_commit(
+        repo,
+        branch_name,
+        base_commit,
+        commit_message,
+        files,
+        author_details
+      )
         parameters = {
           message: commit_message, # TODO: Format markup in commit message
           author: "#{author_details.fetch(:name)} <#{author_details.fetch(:email)}>",
@@ -201,8 +207,15 @@ module Dependabot
         )
           .void
       end
-      def create_pull_request(repo, pr_name, source_branch, target_branch,
-                              pr_description, _labels, _work_item = nil)
+      def create_pull_request(
+        repo,
+        pr_name,
+        source_branch,
+        target_branch,
+        pr_description,
+        _labels,
+        _work_item = nil
+      )
         reviewers = default_reviewers(repo)
 
         content = {

data/lib/dependabot/clients/codecommit.rb

@@ -79,7 +79,8 @@ module Dependabot
 
       sig do
         params(
-          repo: String, commit: T.nilable(String),
+          repo: String,
+          commit: T.nilable(String),
           path: T.nilable(String)
         )
           # See PR 9344: should .returns(Seahorse::Client::Response)
@@ -112,8 +113,8 @@ module Dependabot
           commit_specifier: commit,
           file_path: path
         ).file_content
-        rescue Aws::CodeCommit::Errors::FileDoesNotExistException
-          raise NotFound
+      rescue Aws::CodeCommit::Errors::FileDoesNotExistException
+        raise NotFound
       end
 
       sig do
@@ -253,8 +254,13 @@ module Dependabot
         )
           .returns(Aws::CodeCommit::Types::CreateCommitOutput)
       end
-      def create_commit(branch_name, author_name, base_commit, commit_message,
-                        files)
+      def create_commit(
+        branch_name,
+        author_name,
+        base_commit,
+        commit_message,
+        files
+      )
         cc_client.create_commit(
           repository_name: source.unscoped_repo,
           branch_name: branch_name,
@@ -280,8 +286,12 @@ module Dependabot
         )
           .returns(T.nilable(Aws::CodeCommit::Types::CreatePullRequestOutput))
       end
-      def create_pull_request(pr_name, target_branch, source_branch,
-                              pr_description)
+      def create_pull_request(
+        pr_name,
+        target_branch,
+        source_branch,
+        pr_description
+      )
         cc_client.create_pull_request(
           title: pr_name,
           description: pr_description,

data/lib/dependabot/config/file.rb

@@ -58,34 +58,37 @@ module Dependabot
 
       private
 
-      PACKAGE_MANAGER_LOOKUP = T.let({
-        "bun" => "bun",
-        "bundler" => "bundler",
-        "cargo" => "cargo",
-        "composer" => "composer",
-        "conda" => "conda",
-        "devcontainer" => "devcontainers",
-        "docker-compose" => "docker_compose",
-        "docker" => "docker",
-        "dotnet-sdk" => "dotnet_sdk",
-        "elm" => "elm",
-        "github-actions" => "github_actions",
-        "gitsubmodule" => "submodules",
-        "gomod" => "go_modules",
-        "gradle" => "gradle",
-        "helm" => "helm",
-        "maven" => "maven",
-        "mix" => "hex",
-        "npm" => "npm_and_yarn",
-        "nuget" => "nuget",
-        "pip" => "pip",
-        "pub" => "pub",
-        "rust-toolchain" => "rust_toolchain",
-        "swift" => "swift",
-        "terraform" => "terraform",
-        "uv" => "uv",
-        "vcpkg" => "vcpkg"
-      }.freeze, T::Hash[String, String])
+      PACKAGE_MANAGER_LOOKUP = T.let(
+        {
+          "bun" => "bun",
+          "bundler" => "bundler",
+          "cargo" => "cargo",
+          "composer" => "composer",
+          "conda" => "conda",
+          "devcontainer" => "devcontainers",
+          "docker-compose" => "docker_compose",
+          "docker" => "docker",
+          "dotnet-sdk" => "dotnet_sdk",
+          "elm" => "elm",
+          "github-actions" => "github_actions",
+          "gitsubmodule" => "submodules",
+          "gomod" => "go_modules",
+          "gradle" => "gradle",
+          "helm" => "helm",
+          "maven" => "maven",
+          "mix" => "hex",
+          "npm" => "npm_and_yarn",
+          "nuget" => "nuget",
+          "pip" => "pip",
+          "pub" => "pub",
+          "rust-toolchain" => "rust_toolchain",
+          "swift" => "swift",
+          "terraform" => "terraform",
+          "uv" => "uv",
+          "vcpkg" => "vcpkg"
+        }.freeze,
+        T::Hash[String, String]
+      )
 
       REVERSE_PACKAGE_MANAGER_LOOKUP = T.let(
         PACKAGE_MANAGER_LOOKUP.invert.freeze,

data/lib/dependabot/dependency.rb

@@ -118,9 +118,18 @@ module Dependabot
         metadata: T.nilable(T::Hash[T.any(Symbol, String), String])
       ).void
     end
-    def initialize(name:, requirements:, package_manager:, version: nil,
-                   previous_version: nil, previous_requirements: nil, directory: nil,
-                   subdependency_metadata: [], removed: false, metadata: {})
+    def initialize(
+      name:,
+      requirements:,
+      package_manager:,
+      version: nil,
+      previous_version: nil,
+      previous_requirements: nil,
+      directory: nil,
+      subdependency_metadata: [],
+      removed: false,
+      metadata: {}
+    )
       @name = name
       @version = T.let(
         case version
@@ -239,6 +248,7 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     def humanized_version
       return "removed" if removed?
+      return nil if version.nil?
 
       if T.must(version).match?(/^[0-9a-f]{40}/)
         return new_ref if ref_changed? && new_ref
@@ -399,10 +409,11 @@ module Dependabot
       optional_keys = %i(metadata)
       unless requirement_fields.flatten
                                .all? { |r| required_keys.sort == (r.keys - optional_keys).sort }
-        raise ArgumentError, "each requirement must have the following " \
-                             "required keys: #{required_keys.join(', ')}." \
-                             "Optionally, it may have the following keys: " \
-                             "#{optional_keys.join(', ')}."
+        raise ArgumentError,
+              "each requirement must have the following " \
+              "required keys: #{required_keys.join(', ')}." \
+              "Optionally, it may have the following keys: " \
+              "#{optional_keys.join(', ')}."
       end
 
       return if requirement_fields.flatten.none? { |r| r[:requirement] == "" }

data/lib/dependabot/dependency_file.rb

@@ -60,8 +60,10 @@ module Dependabot
     end
 
     # See https://github.com/git/git/blob/a36e024e989f4d35f35987a60e3af8022cac3420/object.h#L144-L153
-    VALID_MODES = T.let([Mode::FILE, Mode::EXECUTABLE, Mode::TREE, Mode::SUBMODULE, Mode::SYMLINK].freeze,
-                        T::Array[String])
+    VALID_MODES = T.let(
+      [Mode::FILE, Mode::EXECUTABLE, Mode::TREE, Mode::SUBMODULE, Mode::SYMLINK].freeze,
+      T::Array[String]
+    )
 
     sig do
       params(
@@ -79,10 +81,19 @@ module Dependabot
       )
         .void
     end
-    def initialize(name:, content:, directory: "/", type: "file",
-                   support_file: false, vendored_file: false, symlink_target: nil,
-                   content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil)
+    def initialize(
+      name:,
+      content:,
+      directory: "/",
+      type: "file",
+      support_file: false,
+      vendored_file: false,
+      symlink_target: nil,
+      content_encoding: ContentEncoding::UTF_8,
+      deleted: false,
+      operation: Operation::UPDATE,
+      mode: nil
+    )
       @name = name
       @content = content
       @directory = T.let(clean_directory(directory), String)

data/lib/dependabot/dependency_graphers/README.md

@@ -0,0 +1,54 @@
+# Dependency Graphers
+
+Dependency graphers are used to convert a set of parsed dependencies into a data structure we can use to output the dependency graph of a project in a generic data structure based on GitHub's [Dependency submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission).
+
+We will expect each language Dependabot supports to implement a `Dependabot::DependencyGraphers` class in future, but for now any modules that do not implement a specific class fail over to a 'best effort' generic implementation that works in most cases.
+
+## Public API
+
+Each `Dependabot::DependencyGraphers` class implements the following methods:
+
+| Method                      | Description                                                                                   |
+|-----------------------------|-----------------------------------------------------------------------------------------------|
+| `.relevant_dependency_file` | Checks the list of `Dependabot::DependencyFile` objects assigned and determines which one the dependency list should be reported against. In most languages this will be the lockfile, if present, and the manifest otherwise. |
+| `.resolved_dependencies`    | Processes the assigned `Dependabot::Dependency` objects into an informational hash |
+
+An example of a `.resolved_dependencies` hash for a Bundler project:
+
+```ruby
+"addressable": {
+  "package_url": "pkg:gem/addressable@2.8.6",
+  "relationship": "indirect",
+  "scope": "runtime",
+  "dependencies": [],
+  "metadata": {}
+},
+"ast": {
+  "package_url": "pkg:gem/ast@2.4.2",
+  "relationship": "indirect",
+  "scope": "runtime",
+  "dependencies": [],
+  "metadata": {}
+},
+"aws-eventstream": {
+  "package_url": "pkg:gem/aws-eventstream@1.3.0",
+  "relationship": "indirect",
+  "scope": "runtime",
+  "dependencies": [],
+  "metadata": {}
+}
+```
+
+## Writing a file fetcher for a new language
+
+All new file fetchers should inherit from `Dependabot::DependencyGraphers::Base` and
+implement the following methods:
+
+| Method                           | Description                                                                                   |
+|----------------------------------|-----------------------------------------------------------------------------------------------|
+| `.relevant_dependency_file`      | See Public API section. |
+| `.fetch_subdependencies`         | Private method to fetch a list of package names, or PURLs, that are subdependencies of a given `Dependabot::Dependency`. It is expected that some languages will need to perform additional native commands to obtain this data. |
+| `.purl_pkg_for`                  | Private method to map the given `Dependabot::Dependency` to the correct [Package-URL type](https://github.com/package-url/purl-spec/blob/main/PURL-TYPES.rst) for the package manager involved. |
+
+> [!WARNING]
+> While PURLs are preferred in all languages for `.fetch_subdependencies`, for languages where multiple versions of a single dependency are permitted they _must_ be provided to be precise.