dependabot-common 0.363.0 → 0.365.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b04a10a34f26b5eb05c6a7e6c789fdda3bde3d118ab31eb1862e725f81aa930e
-  data.tar.gz: d8877825b52d5f928171490bf935afc2cf2b8272d39bb5d47244b57d3c4c62f8
+  metadata.gz: f60295381915191cca0d05b7be5c04af89cbe52a0f3df889e8365503d9d23ab6
+  data.tar.gz: 6cce9d750a9d91859998a579d9701329ed3bfc40ce63edf21c4c7cd7659e2ca1
 SHA512:
-  metadata.gz: 66c72eb2bc6a5890de1573e828b0bf6f5f8c826c4e80d5d8c1eae0f49ac5803a2b5e1c3e8273ce9be624e32f78f854f661c03a0cea3da5423b558f69329553f3
-  data.tar.gz: 9a8004bb292cebee846bc91ba9fe96d1e0ab632d8bb73522377ec1b98c88a2d99e6408f46792e3b19940d62bffbd109dbae34c7ca1e4b359b90df05bb198942a
+  metadata.gz: 7b6a7a215197bbfc58f9652bb25c4e240d4ca82cb2cf693e9bba403546a26f97507b18c3456ccacf07ae140b85a975f44ccf3775ffd1747e7a2f943f88796076
+  data.tar.gz: 6da0b1e735407a95fb73d30588cdb9c4c31e84239cd049e91c5c3cbc70e8113525c5e56e3d70ccac910be6a43ebb8d425cc948c2da2e332483ba081faabd4442

data/lib/dependabot/command_helpers.rb

@@ -103,7 +103,11 @@ module Dependabot
           Dependabot.logger.info("Started process PID: #{pid} with command: #{sanitized_env_cmd.join(' ')}")
 
           # Write to stdin if input data is provided
-          stdin&.write(stdin_data) if stdin_data
+          begin
+            stdin&.write(stdin_data) if stdin_data
+          rescue Errno::EPIPE
+            # Process exited before reading stdin - continue to collect output
+          end
           stdin&.close
 
           stdout_io.sync = true

data/lib/dependabot/dependency.rb

@@ -14,6 +14,10 @@ module Dependabot
     )
     @display_name_builders = T.let({}, T::Hash[String, T.proc.params(arg0: String).returns(String)])
     @name_normalisers = T.let({}, T::Hash[String, T.proc.params(arg0: String).returns(String)])
+    @humanized_previous_version_builders = T.let(
+      {},
+      T::Hash[String, T.proc.params(arg0: Dependency).returns(T.nilable(String))]
+    )
 
     sig do
       params(package_manager: String).returns(T.proc.params(arg0: T::Array[T.untyped]).returns(T::Boolean))
@@ -61,6 +65,25 @@ module Dependabot
       @name_normalisers[package_manager] = name_builder
     end
 
+    sig do
+      params(
+        package_manager: String
+      ).returns(T.nilable(T.proc.params(arg0: Dependency).returns(T.nilable(String))))
+    end
+    def self.humanized_previous_version_builder_for_package_manager(package_manager)
+      @humanized_previous_version_builders[package_manager]
+    end
+
+    sig do
+      params(
+        package_manager: String,
+        builder: T.proc.params(arg0: Dependency).returns(T.nilable(String))
+      ).void
+    end
+    def self.register_humanized_previous_version_builder(package_manager, builder)
+      @humanized_previous_version_builders[package_manager] = builder
+    end
+
     sig { returns(String) }
     attr_reader :name
 
@@ -225,24 +248,10 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def humanized_previous_version
-      # If we don't have a previous version, we *may* still be able to figure
-      # one out if a ref was provided and has been changed (in which case the
-      # previous ref was essentially the version).
-      if previous_version.nil?
-        return ref_changed? ? previous_ref : nil
-      end
-
-      if T.must(previous_version).match?(/^[0-9a-f]{40}/)
-        return previous_ref if ref_changed? && previous_ref
+      custom_version = custom_humanized_previous_version
+      return custom_version if custom_version
 
-        "`#{T.must(previous_version)[0..6]}`"
-      elsif version == previous_version &&
-            package_manager == "docker"
-        digest = docker_digest_from_reqs(T.must(previous_requirements))
-        "`#{T.must(T.must(digest).split(':').last)[0..6]}`"
-      else
-        previous_version
-      end
+      default_humanized_previous_version
     end
 
     sig { returns(T.nilable(String)) }
@@ -391,6 +400,40 @@ module Dependabot
 
     private
 
+    sig { returns(T.nilable(String)) }
+    def custom_humanized_previous_version
+      builder = self.class.humanized_previous_version_builder_for_package_manager(package_manager)
+      return nil unless builder
+
+      builder.call(self)
+    end
+
+    sig { returns(T.nilable(String)) }
+    def default_humanized_previous_version
+      # If we don't have a previous version, we *may* still be able to figure
+      # one out if a ref was provided and has been changed (in which case the
+      # previous ref was essentially the version).
+      return (ref_changed? ? previous_ref : nil) if previous_version.nil?
+
+      return humanized_sha_previous_version if T.must(previous_version).match?(/^[0-9a-f]{40}/)
+      return humanized_docker_previous_version if version == previous_version && package_manager == "docker"
+
+      previous_version
+    end
+
+    sig { returns(T.nilable(String)) }
+    def humanized_sha_previous_version
+      return previous_ref if ref_changed? && previous_ref
+
+      "`#{T.must(previous_version)[0..6]}`"
+    end
+
+    sig { returns(String) }
+    def humanized_docker_previous_version
+      digest = docker_digest_from_reqs(T.must(previous_requirements))
+      "`#{T.must(T.must(digest).split(':').last)[0..6]}`"
+    end
+
     sig { void }
     def check_values
       check_requirement_fields

data/lib/dependabot/dependency_graphers/base.rb

@@ -91,8 +91,8 @@ module Dependabot
       sig { returns(T::Hash[String, Dependabot::Dependency]) }
       def dependencies_by_name
         @dependencies_by_name ||= T.let(
-          @dependencies.each_with_object({}) do |dep, hash|
-            hash[dep.name] = dep
+          @dependencies.to_h do |dep|
+            [dep.name, dep]
           end,
           T.nilable(T::Hash[String, Dependabot::Dependency])
         )

data/lib/dependabot/dependency_group.rb

@@ -55,8 +55,6 @@ module Dependabot
 
     sig { returns(T::Boolean) }
     def group_by_dependency_name?
-      return false unless Dependabot::Experiments.enabled?(:group_by_dependency_name)
-
       @group_by == "dependency-name"
     end
 

data/lib/dependabot/file_fetchers/base.rb

@@ -641,20 +641,20 @@ module Dependabot
         T.unsafe(gitlab_client)
          .repo_tree(repo, path: path, ref: commit, per_page: 100)
          .map do |file|
-           # GitLab API essentially returns the output from `git ls-tree`
-           type = case file.type
-                  when "blob" then "file"
-                  when "tree" then "dir"
-                  when "commit" then "submodule"
-                  else file.fetch("type")
-                  end
-
-           RepositoryContent.new(
-             name: file.name,
-             path: file.path,
-             type: type,
-             size: 0 # GitLab doesn't return file size
-           )
+          # GitLab API essentially returns the output from `git ls-tree`
+          type = case file.type
+                 when "blob" then "file"
+                 when "tree" then "dir"
+                 when "commit" then "submodule"
+                 else file.fetch("type")
+                 end
+
+          RepositoryContent.new(
+            name: file.name,
+            path: file.path,
+            type: type,
+            size: 0 # GitLab doesn't return file size
+          )
         end
       end
 

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -309,11 +309,11 @@ module Dependabot
           T.unsafe(bitbucket_client)
            .compare(T.must(source).repo, previous_tag, new_tag)
            .map do |commit|
-             {
-               message: commit.dig("summary", "raw"),
-               sha: commit["hash"],
-               html_url: commit.dig("links", "html", "href")
-             }
+            {
+              message: commit.dig("summary", "raw"),
+              sha: commit["hash"],
+              html_url: commit.dig("links", "html", "href")
+            }
           end
         rescue Dependabot::Clients::Bitbucket::NotFound,
                Dependabot::Clients::Bitbucket::Unauthorized,
@@ -330,11 +330,11 @@ module Dependabot
            .compare(T.must(source).repo, previous_tag, new_tag)
            .commits
            .map do |commit|
-             {
-               message: commit["message"],
-               sha: commit["id"],
-               html_url: "#{T.must(source).url}/commit/#{commit['id']}"
-             }
+            {
+              message: commit["message"],
+              sha: commit["id"],
+              html_url: "#{T.must(source).url}/commit/#{commit['id']}"
+            }
           end
         rescue Gitlab::Error::NotFound
           []
@@ -346,11 +346,11 @@ module Dependabot
           azure_client
             .compare(previous_tag, new_tag, type)
             .map do |commit|
-              {
-                message: commit["comment"],
-                sha: commit["commitId"],
-                html_url: commit["remoteUrl"]
-              }
+            {
+              message: commit["comment"],
+              sha: commit["commitId"],
+              html_url: commit["remoteUrl"]
+            }
           end
         rescue Dependabot::Clients::Azure::NotFound,
                Dependabot::Clients::Azure::Unauthorized,

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -240,9 +240,9 @@ module Dependabot
       def filter_ignored_versions(releases)
         filtered = releases
                    .reject do |release|
-                     ignore_requirements.any? do |r|
-                       r.satisfied_by?(release.version)
-                     end
+          ignore_requirements.any? do |r|
+            r.satisfied_by?(release.version)
+          end
         end
         if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(releases).any?
           raise Dependabot::AllVersionsIgnored
@@ -277,9 +277,9 @@ module Dependabot
 
         releases
           .select do |release|
-            reqs.all? do |r|
-              r.any? { |o| o.satisfied_by?(release.version) }
-            end
+          reqs.all? do |r|
+            r.any? { |o| o.satisfied_by?(release.version) }
+          end
         end
       end
 

data/lib/dependabot/pull_request_creator/message_builder/title_builder.rb

@@ -0,0 +1,126 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/logger"
+require "dependabot/pull_request_creator/pr_name_prefixer"
+
+module Dependabot
+  class PullRequestCreator
+    class MessageBuilder
+      # Composes a final PR title from a base title + prefix.
+      #
+      # Works in two modes:
+      # 1. With a full PrNamePrefixer (updater path — has source/credentials for
+      #    commit style auto-detection)
+      # 2. With just commit_message_options (API path — explicit prefix only,
+      #    no network calls needed)
+      class TitleBuilder
+        extend T::Sig
+
+        sig { returns(String) }
+        attr_reader :base_title
+
+        sig { returns(T.nilable(Dependabot::PullRequestCreator::PrNamePrefixer)) }
+        attr_reader :prefixer
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        attr_reader :commit_message_options
+
+        sig { returns(T.nilable(T::Array[Dependabot::Dependency])) }
+        attr_reader :dependencies
+
+        sig do
+          params(
+            base_title: String,
+            prefixer: T.nilable(Dependabot::PullRequestCreator::PrNamePrefixer),
+            commit_message_options: T.nilable(T::Hash[Symbol, T.untyped]),
+            dependencies: T.nilable(T::Array[Dependabot::Dependency])
+          ).void
+        end
+        def initialize(base_title:, prefixer: nil, commit_message_options: nil, dependencies: nil)
+          @base_title = base_title
+          @prefixer = prefixer
+          @commit_message_options = commit_message_options
+          @dependencies = dependencies
+        end
+
+        # Generates a base title for multi-ecosystem combined PR updates.
+        sig { params(group_name: String, update_count: Integer).returns(String) }
+        def self.multi_ecosystem_base_title(group_name:, update_count:)
+          "bump the \"#{group_name}\" group with " \
+            "#{update_count} update#{'s' unless update_count == 1} across multiple ecosystems"
+        end
+
+        sig { returns(String) }
+        def build
+          name = base_title.dup
+          name[0] = T.must(name[0]).capitalize if !name.empty? && capitalize?
+          "#{prefix}#{name}"
+        end
+
+        private
+
+        sig { returns(String) }
+        def prefix
+          return T.must(prefixer).pr_name_prefix if prefixer
+
+          build_explicit_prefix
+        rescue StandardError => e
+          Dependabot.logger.error("Error while generating PR name prefix: #{e.message}")
+          Dependabot.logger.error(e.backtrace&.join("\n"))
+          ""
+        end
+
+        sig { returns(T::Boolean) }
+        def capitalize?
+          return T.must(prefixer).capitalize_first_word? if prefixer
+
+          true
+        end
+
+        # Builds prefix from explicit commit_message_options only.
+        # Same logic as PrNamePrefixer#prefix_from_explicitly_provided_details
+        # but without requiring source/credentials.
+        sig { returns(String) }
+        def build_explicit_prefix
+          return "" unless commit_message_options&.key?(:prefix)
+
+          prefix = explicit_prefix_string
+          return "" if prefix.empty?
+
+          prefix += "(#{scope})" if commit_message_options&.dig(:include_scope)
+          # Append colon after alphanumeric or closing bracket to follow
+          # conventional commit format (e.g., "chore: ..." or "fix(deps): ...")
+          prefix += ":" if prefix.match?(/[A-Za-z0-9\)\]]\Z/)
+          prefix += " " unless prefix.end_with?(" ")
+          prefix
+        end
+
+        sig { returns(String) }
+        def explicit_prefix_string
+          if production_dependencies?
+            commit_message_options&.dig(:prefix).to_s
+          elsif commit_message_options&.key?(:prefix_development)
+            commit_message_options&.dig(:prefix_development).to_s
+          else
+            commit_message_options&.dig(:prefix).to_s
+          end
+        end
+
+        sig { returns(T::Boolean) }
+        def production_dependencies?
+          dependencies&.any?(&:production?) != false
+        rescue StandardError
+          true
+        end
+
+        sig { returns(String) }
+        def scope
+          production_dependencies? ? "deps" : "deps-dev"
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -24,6 +24,7 @@ module Dependabot
       require_relative "message_builder/metadata_presenter"
       require_relative "message_builder/issue_linker"
       require_relative "message_builder/link_and_mention_sanitizer"
+      require_relative "message_builder/title_builder"
       require_relative "pr_name_prefixer"
 
       sig { returns(Dependabot::Source) }
@@ -130,8 +131,10 @@ module Dependabot
       sig { returns(String) }
       def pr_name
         name = dependency_group ? group_pr_name : solo_pr_name
-        name[0] = T.must(name[0]).capitalize if pr_name_prefixer.capitalize_first_word?
-        "#{pr_name_prefix}#{name}"
+        MessageBuilder::TitleBuilder.new(
+          base_title: name,
+          prefixer: pr_name_prefixer
+        ).build
       end
 
       sig { returns(String) }
@@ -263,6 +266,8 @@ module Dependabot
 
       sig { returns(String) }
       def group_pr_name
+        return dependency_name_group_pr_name if dependency_group&.group_by_dependency_name?
+
         if source.directories
           grouped_directory_name
         else
@@ -270,6 +275,20 @@ module Dependabot
         end
       end
 
+      sig { returns(String) }
+      def dependency_name_group_pr_name
+        dep = T.must(dependencies.first)
+        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+
+        if directories.count > 1
+          "bump #{dep.name} across #{directories.count} directories"
+        elsif directories.one?
+          "bump #{dep.name} in #{directories.first}"
+        else
+          "bump #{dep.name}"
+        end
+      end
+
       sig { returns(String) }
       def grouped_name
         updates = dependencies.map(&:name).uniq.count
@@ -411,6 +430,8 @@ module Dependabot
       # rubocop:disable Metrics/AbcSize
       sig { returns(String) }
       def version_commit_message_intro
+        return dependency_name_group_intro if dependency_group&.group_by_dependency_name? && source.directories
+
         return multi_directory_group_intro if dependency_group && source.directories
 
         return group_intro if dependency_group
@@ -546,6 +567,33 @@ module Dependabot
       end
       # rubocop:enable Metrics/AbcSize
 
+      sig { returns(String) }
+      def dependency_name_group_intro
+        dep = T.must(dependencies.first)
+        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+
+        msg = "Bumps #{dependency_links.first}"
+
+        if directories.count > 1
+          msg += " across #{directories.count} directories:\n\n"
+          msg += directories.map do |dir|
+            prev_version = dep.humanized_previous_version || "unknown"
+            new_version = dep.humanized_version || "unknown"
+            "- `#{dir}`: #{prev_version} → #{new_version}"
+          end.join("\n")
+        elsif directories.one?
+          msg += " in `#{directories.first}`"
+          msg += " #{from_version_msg(dep.humanized_previous_version)}"
+          msg += "to #{dep.humanized_version}."
+        else
+          msg += " #{from_version_msg(dep.humanized_previous_version)}"
+          msg += "to #{dep.humanized_version}."
+        end
+
+        msg += "\n"
+        msg
+      end
+
       sig { returns(String) }
       def group_intro
         # Ensure dependencies are unique by name, from and to versions

data/lib/dependabot/shared_helpers.rb

@@ -163,15 +163,13 @@ module Dependabot
       end
 
       env_cmd = [env, cmd].compact
-      if Experiments.enabled?(:enable_shared_helpers_command_timeout)
-        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
-          env_cmd,
-          stdin_data: stdin_data,
-          timeout: timeout
-        )
-      else
-        stdout, stderr, process = T.unsafe(Open3).capture3(*env_cmd, stdin_data: stdin_data)
-      end
+      raw_stdout, raw_stderr, process = CommandHelpers.capture3_with_timeout(
+        env_cmd,
+        stdin_data: stdin_data,
+        timeout: timeout
+      )
+      stdout = T.let(raw_stdout || "", String)
+      stderr = T.let(raw_stderr || "", String)
       time_taken = Time.now - start
 
       if ENV["DEBUG_HELPERS"] == "true"
@@ -480,22 +478,16 @@ module Dependabot
       opts[:chdir] = cwd if cwd
 
       env_cmd = [env || {}, cmd, opts].compact
-      if Experiments.enabled?(:enable_shared_helpers_command_timeout)
-        kwargs = {
-          stderr_to_stdout: stderr_to_stdout,
-          timeout: timeout
-        }
-        kwargs[:output_observer] = output_observer if output_observer
-
-        stdout, stderr, process = CommandHelpers.capture3_with_timeout(
-          env_cmd,
-          **kwargs
-        )
-      elsif stderr_to_stdout
-        stdout, process = Open3.capture2e(env || {}, cmd, opts)
-      else
-        stdout, stderr, process = Open3.capture3(env || {}, cmd, opts)
-      end
+      kwargs = {
+        stderr_to_stdout: stderr_to_stdout,
+        timeout: timeout
+      }
+      kwargs[:output_observer] = output_observer if output_observer
+
+      stdout, stderr, process = CommandHelpers.capture3_with_timeout(
+        env_cmd,
+        **kwargs
+      )
 
       time_taken = Time.now - start
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.363.0"
+  VERSION = "0.365.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.363.0
+  version: 0.365.0
 platform: ruby
 authors:
 - Dependabot
@@ -133,14 +133,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -175,14 +175,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '10.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '10.0'
 - !ruby/object:Gem::Dependency
   name: opentelemetry-api
   requirement: !ruby/object:Gem::Requirement
@@ -586,6 +586,7 @@ files:
 - lib/dependabot/pull_request_creator/message_builder/issue_linker.rb
 - lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb
 - lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb
+- lib/dependabot/pull_request_creator/message_builder/title_builder.rb
 - lib/dependabot/pull_request_creator/pr_name_prefixer.rb
 - lib/dependabot/pull_request_updater.rb
 - lib/dependabot/pull_request_updater/azure.rb
@@ -615,7 +616,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.363.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.365.0
 rdoc_options: []
 require_paths:
 - lib