dependabot-common 0.366.0 → 0.368.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 529bf7a45add2fc21513cd3d675f30765d1e825575b3943d6cf1083d7a79c32f
-  data.tar.gz: 663ccc80e66d27a8dae94870a3aa8193d616ed1813d3a52f9777a368ad2e6896
+  metadata.gz: 3c25acad8cb0f120b8d120817720c6ce88f8706d7f01a90d6866aa1040c0d7f6
+  data.tar.gz: 16f00b502775dcd9138151c7c897fd4515818606e2786a648e00fdb05514e3ad
 SHA512:
-  metadata.gz: dac187f0aeb0c108d62c5e5c6bfdc79c3b1f7b9188dedd12c2d23a2bb96becda721913829277e5955d5d7c0e812a800763157f8a5d3a33f79e3980987fed2d82
-  data.tar.gz: e4a63902610b5455297d9c1d26df762cfdcdb62bb0eb4dfdd984dbc5d7f77fcc67da109d1954f1dd1756fd7a36528f7c94363e34430a13b686fa64ba5461e4e0
+  metadata.gz: 1898c4f3c9a12977bbfd56734074d4924db3b7d5e225784e4e159a9d1005fcd8fee8d285fb879709b2c26c1492d1541958bcbb730da338e6dcb57a5ca26d1542
+  data.tar.gz: ec18e45926c7d9a1e3fab40a4834de013d23dc7f43600c8060d44be6c50501d1e4d5b3f2d0cf6c9b0011140f378a569cc76171ec18bbe2536ea5141520751fb8

data/lib/dependabot/config/file.rb

@@ -79,6 +79,7 @@ module Dependabot
           "julia" => "julia",
           "maven" => "maven",
           "mix" => "hex",
+          "nix" => "nix",
           "npm" => "npm_and_yarn",
           "nuget" => "nuget",
           "opentofu" => "opentofu",

data/lib/dependabot/git_commit_checker.rb

@@ -277,6 +277,11 @@ module Dependabot
       to_local_tag(max_version_tag)
     end
 
+    sig { returns(T::Array[Dependabot::GitRef]) }
+    def all_version_tags
+      allowed_versions(local_tags, filter_by_prefix: false)
+    end
+
     private
 
     sig { returns(Dependabot::Dependency) }
@@ -335,11 +340,16 @@ module Dependabot
       version.split(".").length
     end
 
-    sig { params(local_tags: T::Array[Dependabot::GitRef]).returns(T::Array[Dependabot::GitRef]) }
-    def allowed_versions(local_tags)
+    sig do
+      params(
+        local_tags: T::Array[Dependabot::GitRef],
+        filter_by_prefix: T::Boolean
+      ).returns(T::Array[Dependabot::GitRef])
+    end
+    def allowed_versions(local_tags, filter_by_prefix: true)
       tags =
         local_tags
-        .select { |t| version_tag?(t.name) && matches_existing_prefix?(t.name) }
+        .select { |t| version_tag?(t.name) && (filter_by_prefix ? matches_existing_prefix?(t.name) : true) }
       filtered = tags
                  .reject { |t| tag_included_in_ignore_requirements?(t) }
       if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(tags).any?
@@ -515,8 +525,30 @@ module Dependabot
 
     sig { params(tag: String, other_tag: String).returns(T::Boolean) }
     def same_prefix?(tag, other_tag)
-      tag.gsub(VERSION_REGEX, "").gsub(/v$/i, "") ==
-        other_tag.gsub(VERSION_REGEX, "").gsub(/v$/i, "")
+      tag_prefix = tag.gsub(VERSION_REGEX, "")
+      other_tag_prefix = other_tag.gsub(VERSION_REGEX, "")
+
+      return true if tag_prefix == other_tag_prefix
+
+      if semver_like?(tag) && semver_like?(other_tag)
+        normalize_v_prefix(tag_prefix) == normalize_v_prefix(other_tag_prefix)
+      else
+        false
+      end
+    end
+
+    # Returns true if the tag's version has 3+ segments (standard semver like "1.2.3")
+    sig { params(tag: String).returns(T::Boolean) }
+    def semver_like?(tag)
+      version = scan_version(tag)
+      version.split(".").length >= 3
+    rescue StandardError
+      false
+    end
+
+    sig { params(prefix: String).returns(String) }
+    def normalize_v_prefix(prefix)
+      prefix.length > 1 ? prefix.gsub(/v$/i, "") : prefix.gsub(/^v$/i, "")
     end
 
     sig { params(tag: T.nilable(Dependabot::GitRef)).returns(T.nilable(T::Hash[Symbol, T.untyped])) }

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -77,6 +77,7 @@ module Dependabot
         @options             = options
 
         @latest_version = T.let(nil, T.nilable(Dependabot::Version))
+        @latest_release = T.let(nil, T.nilable(Dependabot::Package::PackageRelease))
         @latest_version_with_no_unlock = T.let(nil, T.nilable(Dependabot::Version))
         @lowest_security_fix_version = T.let(nil, T.nilable(Dependabot::Version))
         @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
@@ -90,6 +91,22 @@ module Dependabot
         @latest_version ||= fetch_latest_version(language_version: language_version)
       end
 
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(String))
+      end
+      def latest_tag(language_version: nil)
+        latest_release(language_version: language_version)&.tag
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Package::PackageRelease))
+      end
+      def latest_release(language_version: nil)
+        @latest_release ||= fetch_latest_release(language_version: language_version)
+      end
+
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -354,6 +371,14 @@ module Dependabot
           .returns(T.nilable(Dependabot::Version))
       end
       def fetch_latest_version(language_version: nil)
+        latest_release(language_version: language_version)&.version
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+          .returns(T.nilable(Dependabot::Package::PackageRelease))
+      end
+      def fetch_latest_release(language_version: nil)
         releases = available_versions
         return unless releases
 
@@ -363,7 +388,7 @@ module Dependabot
         releases = filter_prerelease_versions(releases)
         releases = filter_ignored_versions(releases)
         releases = apply_post_fetch_latest_versions_filter(releases)
-        releases.max_by(&:version)&.version
+        releases.max_by(&:version)
       end
 
       sig do

data/lib/dependabot/registry_client.rb

@@ -14,7 +14,9 @@ module Dependabot
   class RegistryClient
     extend T::Sig
 
-    @cached_errors = T.let({}, T::Hash[T.nilable(String), Excon::Error::Timeout])
+    CachedErrorType = T.type_alias { T.any(Excon::Error::Timeout, Excon::Error::Socket) }
+
+    @cached_errors = T.let({}, T::Hash[T.nilable(String), CachedErrorType])
 
     sig do
       params(
@@ -33,7 +35,7 @@ module Dependabot
         **SharedHelpers.excon_defaults({ headers: headers }.merge(options)),
         retry_interval: 5
       )
-    rescue Excon::Error::Timeout => e
+    rescue Excon::Error::Timeout, Excon::Error::Socket => e
       cache_error(url, e)
       raise e
     end
@@ -54,7 +56,7 @@ module Dependabot
         idempotent: true,
         **SharedHelpers.excon_defaults({ headers: headers }.merge(options))
       )
-    rescue Excon::Error::Timeout => e
+    rescue Excon::Error::Timeout, Excon::Error::Socket => e
       cache_error(url, e)
       raise e
     end
@@ -64,13 +66,13 @@ module Dependabot
       @cached_errors = {}
     end
 
-    sig { params(url: String, error: Excon::Error::Timeout).void }
+    sig { params(url: String, error: CachedErrorType).void }
     private_class_method def self.cache_error(url, error)
       host = URI(url).host
       @cached_errors[host] = error
     end
 
-    sig { params(url: String).returns(T.nilable(Excon::Error::Timeout)) }
+    sig { params(url: String).returns(T.nilable(CachedErrorType)) }
     private_class_method def self.cached_error_for(url)
       host = URI(url).host
       @cached_errors.fetch(host, nil)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.366.0"
+  VERSION = "0.368.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.366.0
+  version: 0.368.0
 platform: ruby
 authors:
 - Dependabot
@@ -616,7 +616,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
 rdoc_options: []
 require_paths:
 - lib