dependabot-common 0.362.0 → 0.364.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e954f8150ee22e565d732b1d6144a2d6bb8ff66ea574264721f27d243ed5ab05
-  data.tar.gz: e6e93fd3f2acd820f9b8e2479dd60869ea2f4141d0a0cf5a05d6ef9262ac8951
+  metadata.gz: 6da1e661120cc32753f744c61f71c22ea49fc6f2fdcbbfd3a137631acf3103e4
+  data.tar.gz: 1c3c5a19b497c29ac3fa2853202918f514cc2c702c091b8dd4af352b186ad61f
 SHA512:
-  metadata.gz: 36a4b41db9cd89b1e82424525594e489992c8a58a56de02e2bfadc425a90abbe2610725c79f888e11bcb6a0d2ad9a1ce6260b6367f4d4679aac885fb53a2fa0c
-  data.tar.gz: 95dd669d3d28b2cc8edb23922eb59e580c561ed8021cd84cf067d8d74f1c22aa2b00fdcb299ba57b89e59d7d32528d3401cfb7f39e03806763f164074163019b
+  metadata.gz: fd97c8d6b0978058bf3204aee949f1082fda7d8724ac366a7684d35c3d82d867e1d26ce0bf24e3dd97e94b08b689d3276b681cdfa86782525dfa09aeae892af5
+  data.tar.gz: 13d846c8ab332fa64643df2bdc4aa95a47250efdbf10a382a77df4e63312bf773a1f01fdaaa72390d715cd4132f1798d5a4ceec70910dca43ee271abaeca5a29

data/lib/dependabot/clients/codecommit.rb

@@ -296,9 +296,9 @@ module Dependabot
           title: pr_name,
           description: pr_description,
           targets: [
-            repository_name: source.unscoped_repo,
-            source_reference: target_branch,
-            destination_reference: source_branch
+            { repository_name: source.unscoped_repo,
+              source_reference: target_branch,
+              destination_reference: source_branch }
           ]
         )
       end

data/lib/dependabot/command_helpers.rb

@@ -103,7 +103,11 @@ module Dependabot
           Dependabot.logger.info("Started process PID: #{pid} with command: #{sanitized_env_cmd.join(' ')}")
 
           # Write to stdin if input data is provided
-          stdin&.write(stdin_data) if stdin_data
+          begin
+            stdin&.write(stdin_data) if stdin_data
+          rescue Errno::EPIPE
+            # Process exited before reading stdin - continue to collect output
+          end
           stdin&.close
 
           stdout_io.sync = true

data/lib/dependabot/config/ignore_condition.rb

@@ -27,8 +27,8 @@ module Dependabot
       sig do
         params(
           dependency_name: String,
-          versions: T.any(NilClass, T::Array[String]),
-          update_types: T.any(NilClass, T::Array[String])
+          versions: T.nilable(T::Array[String]),
+          update_types: T.nilable(T::Array[String])
         ).void
       end
       def initialize(dependency_name:, versions: nil, update_types: nil)

data/lib/dependabot/dependency_graphers/base.rb

@@ -91,8 +91,8 @@ module Dependabot
       sig { returns(T::Hash[String, Dependabot::Dependency]) }
       def dependencies_by_name
         @dependencies_by_name ||= T.let(
-          @dependencies.each_with_object({}) do |dep, hash|
-            hash[dep.name] = dep
+          @dependencies.to_h do |dep|
+            [dep.name, dep]
           end,
           T.nilable(T::Hash[String, Dependabot::Dependency])
         )

data/lib/dependabot/dependency_group.rb

@@ -55,8 +55,6 @@ module Dependabot
 
     sig { returns(T::Boolean) }
     def group_by_dependency_name?
-      return false unless Dependabot::Experiments.enabled?(:group_by_dependency_name)
-
       @group_by == "dependency-name"
     end
 

data/lib/dependabot/errors.rb

@@ -52,6 +52,13 @@ module Dependabot
           message: error.message
         }
       }
+    when Dependabot::RefNamespaceConflictError
+      {
+        "error-type": "file_fetcher_error",
+        "error-detail": {
+          message: error.message
+        }
+      }
     when Dependabot::DirectoryNotFound
       {
         "error-type": "directory_not_found",
@@ -469,6 +476,8 @@ module Dependabot
 
   class InvalidGitAuthToken < DependabotError; end
 
+  class RefNamespaceConflictError < DependabotError; end
+
   #####################
   # Repo level errors #
   #####################

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -210,6 +210,8 @@ module Dependabot
             dependency_file_list(ref)
             .select { |f| f.type == "file" }
             .reject { |f| f.name.end_with?(".sh") }
+            # JSON files are machine-readable, not useful as changelogs
+            .reject { |f| f.name.end_with?(".json") }
             .reject { |f| f.size > 1_000_000 }
             .reject { |f| f.size < 100 }
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -263,6 +263,8 @@ module Dependabot
 
       sig { returns(String) }
       def group_pr_name
+        return dependency_name_group_pr_name if dependency_group&.group_by_dependency_name?
+
         if source.directories
           grouped_directory_name
         else
@@ -270,6 +272,20 @@ module Dependabot
         end
       end
 
+      sig { returns(String) }
+      def dependency_name_group_pr_name
+        dep = T.must(dependencies.first)
+        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+
+        if directories.count > 1
+          "bump #{dep.name} across #{directories.count} directories"
+        elsif directories.one?
+          "bump #{dep.name} in #{directories.first}"
+        else
+          "bump #{dep.name}"
+        end
+      end
+
       sig { returns(String) }
       def grouped_name
         updates = dependencies.map(&:name).uniq.count
@@ -411,6 +427,8 @@ module Dependabot
       # rubocop:disable Metrics/AbcSize
       sig { returns(String) }
       def version_commit_message_intro
+        return dependency_name_group_intro if dependency_group&.group_by_dependency_name? && source.directories
+
         return multi_directory_group_intro if dependency_group && source.directories
 
         return group_intro if dependency_group
@@ -546,6 +564,33 @@ module Dependabot
       end
       # rubocop:enable Metrics/AbcSize
 
+      sig { returns(String) }
+      def dependency_name_group_intro
+        dep = T.must(dependencies.first)
+        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+
+        msg = "Bumps #{dependency_links.first}"
+
+        if directories.count > 1
+          msg += " across #{directories.count} directories:\n\n"
+          msg += directories.map do |dir|
+            prev_version = dep.humanized_previous_version || "unknown"
+            new_version = dep.humanized_version || "unknown"
+            "- `#{dir}`: #{prev_version} → #{new_version}"
+          end.join("\n")
+        elsif directories.one?
+          msg += " in `#{directories.first}`"
+          msg += " #{from_version_msg(dep.humanized_previous_version)}"
+          msg += "to #{dep.humanized_version}."
+        else
+          msg += " #{from_version_msg(dep.humanized_previous_version)}"
+          msg += "to #{dep.humanized_version}."
+        end
+
+        msg += "\n"
+        msg
+      end
+
       sig { returns(String) }
       def group_intro
         # Ensure dependencies are unique by name, from and to versions

data/lib/dependabot/shared_helpers.rb

@@ -163,15 +163,13 @@ module Dependabot
       end
 
       env_cmd = [env, cmd].compact
-      if Experiments.enabled?(:enable_shared_helpers_command_timeout)
-        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
-          env_cmd,
-          stdin_data: stdin_data,
-          timeout: timeout
-        )
-      else
-        stdout, stderr, process = T.unsafe(Open3).capture3(*env_cmd, stdin_data: stdin_data)
-      end
+      raw_stdout, raw_stderr, process = CommandHelpers.capture3_with_timeout(
+        env_cmd,
+        stdin_data: stdin_data,
+        timeout: timeout
+      )
+      stdout = T.let(raw_stdout || "", String)
+      stderr = T.let(raw_stderr || "", String)
       time_taken = Time.now - start
 
       if ENV["DEBUG_HELPERS"] == "true"
@@ -480,22 +478,16 @@ module Dependabot
       opts[:chdir] = cwd if cwd
 
       env_cmd = [env || {}, cmd, opts].compact
-      if Experiments.enabled?(:enable_shared_helpers_command_timeout)
-        kwargs = {
-          stderr_to_stdout: stderr_to_stdout,
-          timeout: timeout
-        }
-        kwargs[:output_observer] = output_observer if output_observer
-
-        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
-          env_cmd,
-          **kwargs
-        )
-      elsif stderr_to_stdout
-        stdout, process = Open3.capture2e(env || {}, cmd, opts)
-      else
-        stdout, stderr, process = Open3.capture3(env || {}, cmd, opts)
-      end
+      kwargs = {
+        stderr_to_stdout: stderr_to_stdout,
+        timeout: timeout
+      }
+      kwargs[:output_observer] = output_observer if output_observer
+
+      stdout, stderr, process = CommandHelpers.capture3_with_timeout(
+        env_cmd,
+        **kwargs
+      )
 
       time_taken = Time.now - start
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.362.0"
+  VERSION = "0.364.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.362.0
+  version: 0.364.0
 platform: ruby
 authors:
 - Dependabot
@@ -133,28 +133,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.12'
+        version: '2.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.12'
+        version: '2.19'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -175,14 +175,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '10.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '10.0'
 - !ruby/object:Gem::Dependency
   name: opentelemetry-api
   requirement: !ruby/object:Gem::Requirement
@@ -357,14 +357,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rspec-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -615,7 +615,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.362.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.364.0
 rdoc_options: []
 require_paths:
 - lib