dependabot-common 0.348.1 → 0.350.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c07b70848e86cb2c9d154be70cffa34a3181d686f5d678e622faeaab7d486f60
-  data.tar.gz: '081cfd5c47507c105d1e08e22f6287db8aad26935ba50465a15e303c0b8e0a61'
+  metadata.gz: e3e7d8b7801d11a969b187ac545af8c704d7883830afd5d8670463ff7c936df3
+  data.tar.gz: 23e68319bd675a9347b35ffedc107823f71c8de6054e18ecf2a91a4a1d3ce2e5
 SHA512:
-  metadata.gz: f4df13b325aae5519a61b492e98eb7d3b0a0c8b7994cbff9e6e27d3723e759d86f171316a3afc27fd8470308d726493b5bad3c3c8af047f9f7a02d93487491b4
-  data.tar.gz: 120504f01cd33f34dec8439b38ef0adeefdd612b4b853252b7374ad544e5cfa94d54f46c900bed488a0a6d6e21199c1186b6627b7ef8181251fd78c910bf5be8
+  metadata.gz: ecbec2eb7cbe4a37495a619f814e76401a49dadcc6abde2d412a5d2e8f1347361d957d44f3020a6ca73a2035850c241e345581674256393a3f2bed506fb643e9
+  data.tar.gz: db8dbaf3c46e4286aed04a7c1d39ba66b192696b4547beb875a35dae9cfa01ae4371c020d5a4128160daa57d147f2227c6a034cb1dedf3a12942dd4dd8ed7895

data/lib/dependabot/dependency_graphers/base.rb

@@ -65,11 +65,12 @@ module Dependabot
         prepare! unless prepared
 
         @dependencies.each_with_object({}) do |dep, resolved|
-          resolved[dep.name] = ResolvedDependency.new(
-            package_url: build_purl(dep),
+          purl = build_purl(dep)
+          resolved[purl] = ResolvedDependency.new(
+            package_url: purl,
             direct: dep.top_level?,
             runtime: dep.production?,
-            dependencies: safe_fetch_subdependencies(dep)
+            dependencies: safe_fetch_subdependencies(dep).map { |d| build_purl(d) }
           )
         end
       end
@@ -84,11 +85,23 @@ module Dependabot
         file_parser.dependency_files
       end
 
-      sig { params(dependency: Dependabot::Dependency).returns(T::Array[String]) }
+      sig { returns(T::Hash[String, Dependabot::Dependency]) }
+      def dependencies_by_name
+        @dependencies_by_name ||= T.let(
+          @dependencies.each_with_object({}) do |dep, hash|
+            hash[dep.name] = dep
+          end,
+          T.nilable(T::Hash[String, Dependabot::Dependency])
+        )
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Dependency]) }
       def safe_fetch_subdependencies(dependency)
         return [] if @errored_fetching_subdependencies
 
-        fetch_subdependencies(dependency)
+        fetch_subdependencies(dependency).filter_map do |dependency_name|
+          dependencies_by_name[dependency_name]
+        end
       rescue StandardError => e
         @errored_fetching_subdependencies = true
         Dependabot.logger.error("Error fetching subdependencies: #{e.message}")

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -180,7 +180,7 @@ module Dependabot
         sig { params(files: T::Array[T.untyped]).returns(T.untyped) }
         def select_best_changelog(files)
           CHANGELOG_NAMES.each do |name|
-            candidates = files.select { |f| f.name =~ /#{name}/i }
+            candidates = files.select { |f| f.name =~ /\A#{name}/i }
             file = candidates.first if candidates.one?
             file ||=
               candidates.find do |f|

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -158,6 +158,26 @@ module Dependabot
         if releases.count > filtered.count
           Dependabot.logger.info("Filtered out #{releases.count - filtered.count} versions due to cooldown")
         end
+
+        # If all releases were filtered out due to cooldown and we have a current version, use it as fallback
+        if filtered.empty? && !releases.empty? && dependency.version
+          current_version_str = dependency.version
+
+          Dependabot.logger.info(
+            "All versions filtered by cooldown for #{dependency.name}, " \
+            "falling back to current version #{current_version_str}"
+          )
+
+          # Create a PackageRelease for the current version
+          current_version = version_class.new(current_version_str)
+          current_release = Dependabot::Package::PackageRelease.new(
+            version: current_version,
+            released_at: nil,
+            tag: nil
+          )
+          return [current_release]
+        end
+
         filtered
       end
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.348.1"
+  VERSION = "0.350.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.348.1
+  version: 0.350.0
 platform: ruby
 authors:
 - Dependabot
@@ -629,7 +629,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.348.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.350.0
 rdoc_options: []
 require_paths:
 - lib