dependabot-common 0.350.0 → 0.352.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3e7d8b7801d11a969b187ac545af8c704d7883830afd5d8670463ff7c936df3
-  data.tar.gz: 23e68319bd675a9347b35ffedc107823f71c8de6054e18ecf2a91a4a1d3ce2e5
+  metadata.gz: 92b9044de288db4045a52115b05b27eea9d915c5d9fc3b6cb9d564ff5dca5d4f
+  data.tar.gz: 59d891982e2d6ab76b873256e54d396f81bad88415d6b8b29050096dc3b924a2
 SHA512:
-  metadata.gz: ecbec2eb7cbe4a37495a619f814e76401a49dadcc6abde2d412a5d2e8f1347361d957d44f3020a6ca73a2035850c241e345581674256393a3f2bed506fb643e9
-  data.tar.gz: db8dbaf3c46e4286aed04a7c1d39ba66b192696b4547beb875a35dae9cfa01ae4371c020d5a4128160daa57d147f2227c6a034cb1dedf3a12942dd4dd8ed7895
+  metadata.gz: 1a5e6edfd96bf68b1d7f17e7c5316f531519f1dfe45505bbf610f9da519a89b9f4a4f14bd22b1cd35ba3cbac346c41daa6e4a3c94b5be79ff2d761dc50d7f816
+  data.tar.gz: cad5ff917ee9f6d3d5aa327d9d1e201b699bf613a1357ead29d692d79e89f4b0b53610056f6a75fcc42b84597403a10d8c5f745defae2fb9117ae60de125b1aa

data/lib/dependabot/dependency_graphers/base.rb

@@ -34,6 +34,9 @@ module Dependabot
       sig { returns(T::Boolean) }
       attr_reader :errored_fetching_subdependencies
 
+      sig { returns(T.nilable(StandardError)) }
+      attr_reader :subdependency_error
+
       sig do
         params(file_parser: Dependabot::FileParsers::Base).void
       end
@@ -104,6 +107,7 @@ module Dependabot
         end
       rescue StandardError => e
         @errored_fetching_subdependencies = true
+        @subdependency_error = T.let(e, T.nilable(StandardError))
         Dependabot.logger.error("Error fetching subdependencies: #{e.message}")
         []
       end

data/lib/dependabot/git_commit_checker.rb

@@ -596,7 +596,47 @@ module Dependabot
 
     sig { params(tag: Dependabot::GitRef).returns(T::Boolean) }
     def tag_is_prerelease?(tag)
-      version_from_tag(tag).prerelease?
+      return true if version_from_tag(tag).prerelease?
+
+      # Check if the tag is marked as a pre-release on GitHub
+      github_release_prerelease?(tag.name)
+    end
+
+    sig { params(tag_name: String).returns(T::Boolean) }
+    def github_release_prerelease?(tag_name)
+      return false unless listing_source_url
+
+      source = Source.from_url(listing_source_url)
+      return false unless source&.provider == "github"
+
+      release = github_releases.find { |r| r.tag_name == tag_name }
+      return false unless release
+
+      release.prerelease
+    rescue StandardError => e
+      Dependabot.logger.debug("Error checking GitHub release prerelease status: #{e.message}")
+      false
+    end
+
+    sig { returns(T::Array[T.untyped]) }
+    def github_releases
+      @github_releases ||= T.let(
+        begin
+          return [] unless listing_source_url
+
+          source = Source.from_url(listing_source_url)
+          return [] unless source&.provider == "github"
+
+          client = Dependabot::Clients::GithubWithRetries.for_source(
+            source: T.must(source),
+            credentials: credentials
+          )
+          T.unsafe(client).releases(T.must(source).repo, per_page: 100)
+        rescue Octokit::Error
+          []
+        end,
+        T.nilable(T::Array[T.untyped])
+      )
     end
 
     sig { params(tag: Dependabot::GitRef).returns(Gem::Version) }

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -113,14 +113,14 @@ module Dependabot
 
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { returns(String) }
+        sig { returns(T.nilable(String)) }
         def lowest_tag_satisfying_previous_requirements
           tags = dependency_tags
                  .select { |t| version_from_tag(t) }
                  .select { |t| satisfies_previous_reqs?(version_from_tag(t)) }
                  .sort_by { |t| [version_from_tag(t), t.length] }
 
-          tags.find { |t| t.include?(dependency.name) } || T.must(tags.first)
+          tags.find { |t| t.include?(dependency.name) } || tags.first
         end
 
         sig { params(tag: String).returns(T.nilable(Dependabot::Version)) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.350.0"
+  VERSION = "0.352.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.350.0
+  version: 0.352.0
 platform: ruby
 authors:
 - Dependabot
@@ -629,7 +629,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.350.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.352.0
 rdoc_options: []
 require_paths:
 - lib