dependabot-common 0.340.0 → 0.341.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a42fa3649c95847180e885763acdb76be2d164445b50285c1f61c67bf393681d
-  data.tar.gz: d4f4f83a7463a702039d4c05342ac7a2a0c4fcc9dd6efe28c85e0601332ac9d7
+  metadata.gz: 258e743ccabcb1f78791965700ab1891705d53c161b25aa4bb88d7c60be56678
+  data.tar.gz: ee2a7d6fd7d626b18aa5dc1ba65b6bc07e37321e70a529a9ec27b8e8d32746e1
 SHA512:
-  metadata.gz: aad8110867da8be56ca052747ab4eda787232ef67f27e7735411f6fdba956ca08f2996d6213286f44367cc75e52be8f2d1658808feda994a93d9a3b235219ec7
-  data.tar.gz: 607952ee6921687caf9f80dd15f70d1ef1cc1da3aca65548a39abf2ab0de391636ba9ad01903999bb302ccc133cd473c101b0bbcb7ebd9e71d56a6c4497c6179
+  metadata.gz: df1d185f7b202dc912dd4558a9e39f0d5a3e689b9e3ed8103395948fd38f485f6bc879a06c71344b8f9efecadef428a09356520b8270c571317bfabaa5cd320b
+  data.tar.gz: 9aae1f9d5217c7146a74b49bf2da406a69cd550dca4abadf72b8acdecf09307f319ae56e8ccd59da3a94b894bd98e3e1c0e413fcf4f100dd1152ee0afef657f3

data/lib/dependabot/file_parsers/base.rb

@@ -65,6 +65,22 @@ module Dependabot
         nil
       end
 
+      # This is an optional public method that ecosystems can implement to allow collaborating classes, such as
+      # the ecosystem's DependencyGrapher to run native commands inside the parser's context.
+      #
+      # This is typically used to retrieve information about the relationships between dependencies that is not
+      # currently used as part of a Dependabot update to avoid adding latency to the parser's normal function.
+      #
+      # Any use of this method should be considered a candidate to become part of the parser's normal function
+      # when some of the following things have been addressed:
+      # - We have more broadly rolled out the Dependabot graph capability across ecosystems
+      # - We make the relationship information applicable to updates with new transitive update strategies
+      # - We work on ingesting pre-computed dependency snapshots
+      sig { params(_command: String).returns(String) }
+      def run_in_parsed_context(_command)
+        raise Dependabot::NotImplemented, "No run_parsed_context utility method is provided for this ecosystem."
+      end
+
       private
 
       sig { abstract.void }

data/lib/dependabot/file_updaters/README.md

@@ -12,7 +12,6 @@ Each `Dependabot::FileUpdaters` class implements the following methods:
 
 | Method                       | Description                                                                                   |
 |------------------------------|-----------------------------------------------------------------------------------------------|
-| `.updated_files_regex`       | An array of regular expressions matching the names of the files this class updates. Intended to be used by integrators when checking whether a commit may cause merge-conflicts with a dependency update pull request. |
 | `#updated_dependency_files`  | Returns an array of updated `Dependabot::DependencyFile` instances, with their content updated to include the updated dependency. |
 
 An integration might look as follows:
@@ -49,7 +48,6 @@ implement the following methods:
 
 | Method                      | Description             |
 |-----------------------------|-------------------------|
-| `.updated_files_regex`      | See Public API section. |
 | `#updated_dependency_files` | See Public API section. |
 
 To ensure the above are implemented, you should include

data/lib/dependabot/file_updaters/base.rb

@@ -28,11 +28,6 @@ module Dependabot
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
-      sig { overridable.returns(T::Array[Regexp]) }
-      def self.updated_files_regex
-        raise NotImplementedError
-      end
-
       sig do
         params(
           dependencies: T::Array[Dependabot::Dependency],

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.340.0"
+  VERSION = "0.341.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.340.0
+  version: 0.341.0
 platform: ruby
 authors:
 - Dependabot
@@ -610,7 +610,6 @@ files:
 - lib/dependabot/requirements_update_strategy.rb
 - lib/dependabot/requirements_updater/base.rb
 - lib/dependabot/security_advisory.rb
-- lib/dependabot/sem_version2.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
 - lib/dependabot/source.rb
@@ -630,7 +629,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.340.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.341.0
 rdoc_options: []
 require_paths:
 - lib

data/lib/dependabot/sem_version2.rb

@@ -1,131 +0,0 @@
-# typed: strong
-# frozen_string_literal: true
-
-require "sorbet-runtime"
-
-# See https://semver.org/spec/v2.0.0.html for semver 2 details
-#
-module Dependabot
-  class SemVersion2
-    extend T::Sig
-    extend T::Helpers
-    include Comparable
-
-    SEMVER2_REGEX = /^
-      (0|[1-9]\d*)\. # major
-      (0|[1-9]\d*)\. # minor
-      (0|[1-9]\d*)   # patch
-      (?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))? # pre release
-      (?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))? # build metadata
-    $/x
-
-    sig { returns(String) }
-    attr_accessor :major
-
-    sig { returns(String) }
-    attr_accessor :minor
-
-    sig { returns(String) }
-    attr_accessor :patch
-
-    sig { returns(T.nilable(String)) }
-    attr_accessor :build
-
-    sig { returns(T.nilable(String)) }
-    attr_accessor :prerelease
-
-    sig { params(version: String).void }
-    def initialize(version)
-      tokens = parse(version)
-      @major = T.let(T.must(tokens[:major]), String)
-      @minor = T.let(T.must(tokens[:minor]), String)
-      @patch = T.let(T.must(tokens[:patch]), String)
-      @build = T.let(tokens[:build], T.nilable(String))
-      @prerelease = T.let(tokens[:prerelease], T.nilable(String))
-    end
-
-    sig { returns(T::Boolean) }
-    def prerelease?
-      !!prerelease
-    end
-
-    sig { returns(String) }
-    def to_s
-      value = [major, minor, patch].join(".")
-      value += "-#{prerelease}" if prerelease
-      value += "+#{build}" if build
-      value
-    end
-
-    sig { returns(String) }
-    def inspect
-      "#<#{self.class} #{self}>"
-    end
-
-    sig { params(other: ::Dependabot::SemVersion2).returns(T::Boolean) }
-    def eql?(other)
-      other.is_a?(self.class) && to_s == other.to_s
-    end
-
-    sig { params(other: ::Dependabot::SemVersion2).returns(Integer) }
-    def <=>(other)
-      result = major.to_i <=> other.major.to_i
-      return result unless result.zero?
-
-      result = minor.to_i <=> other.minor.to_i
-      return result unless result.zero?
-
-      result = patch.to_i <=> other.patch.to_i
-      return result unless result.zero?
-
-      compare_prereleases(prerelease, other.prerelease)
-    end
-
-    sig { params(version: T.nilable(String)).returns(T::Boolean) }
-    def self.correct?(version)
-      return false if version.nil?
-
-      version.match?(SEMVER2_REGEX)
-    end
-
-    private
-
-    sig { params(version: String).returns(T::Hash[Symbol, T.nilable(String)]) }
-    def parse(version)
-      match = version.match(SEMVER2_REGEX)
-      raise ArgumentError, "Malformed version number string #{version}" unless match
-
-      major, minor, patch, prerelease, build = match.captures
-
-      { major: major, minor: minor, patch: patch, prerelease: prerelease, build: build }
-    end
-
-    sig { params(prerelease1: T.nilable(String), prerelease2: T.nilable(String)).returns(Integer) }
-    def compare_prereleases(prerelease1, prerelease2) # rubocop:disable Metrics/PerceivedComplexity
-      return 0 if prerelease1.nil? && prerelease2.nil?
-      return -1 if prerelease2.nil?
-      return 1 if prerelease1.nil?
-
-      prerelease1_tokens = prerelease1.split(".")
-      prerelease2_tokens = prerelease2.split(".")
-
-      prerelease1_tokens.zip(prerelease2_tokens) do |t1, t2|
-        return 1 if t2.nil? # t1 is more specific e.g. 1.0.0-rc1.1 vs 1.0.0-rc1
-
-        if t1 =~ /^\d+$/ && t2 =~ /^\d+$/
-          # t1 and t2 are both ints so compare them as such
-          a = t1.to_i
-          b = t2.to_i
-          compare = a <=> b
-          return compare unless compare.zero?
-        end
-
-        comp = t1 <=> t2
-        return T.must(comp) unless T.must(comp).zero?
-      end
-
-      # prereleases are equal or prerelease2 is more specific e.g. 1.0.0-rc1 vs 1.0.0-rc1.1
-      prerelease1_tokens.length == prerelease2_tokens.length ? 0 : -1
-    end
-  end
-end