dependabot-common 0.371.0 → 0.373.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 451bcdd11eb4d7fbf86f58780fe91da878ec68966bb805c6fd14d4c4a03ac2dc
-  data.tar.gz: b284d0c3ae60ccf1619f61900476016c126b73c8d7593712b3385148e67e87f3
+  metadata.gz: 3813dcd4d0293e11d9da8b1425d9c800f4c94552e38bf8765d912b51b7c2643c
+  data.tar.gz: bb7a4005a51cbb9ecb432a1cd25c67f664cea48dad9f900de65de30f99d9dbcd
 SHA512:
-  metadata.gz: c1363650a998b94c3328eecd5ef82d15055f3e00e958765566fe2ae9c5cadcfce7a33cd8ea2eb04b3e922aa7facbed5992e45a2505cd7cfd8e99e7dffbd0d40b
-  data.tar.gz: d9ea1856d8bf83312b9801e92019b0983579f497d4f8b66f58e3046b0db1f425d358017df74f7113452635e7629d57955e2475781e46c83366e488034234f47e
+  metadata.gz: 3cb91b2676a6722670b020f805de186af35e79f73640771927070b103549a74b40fc3696890a4062b5a0045e9ad3f4ab43ddff89a46357f0113b2bd8861f4935
+  data.tar.gz: d70c62d66ea75085d88834d51d01504c412e6cd4676aba9c05e779d031ca916e614acacf021f9d71e593c7f976748096878d8aa00aa1c5a9b885c6da9165d1f4

data/lib/dependabot/command_helpers.rb

@@ -23,6 +23,13 @@ module Dependabot
       T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
     end
 
+    EnvCmdItem = T.type_alias do
+      T.any(
+        String,
+        T::Hash[T.any(String, Symbol), T.untyped]
+      )
+    end
+
     class ProcessStatus
       extend T::Sig
 
@@ -72,7 +79,7 @@ module Dependabot
     # rubocop:disable Metrics/CyclomaticComplexity
     sig do
       params(
-        env_cmd: T::Array[T.any(T::Hash[String, String], String)],
+        env_cmd: T::Array[EnvCmdItem],
         stdin_data: T.nilable(String),
         stderr_to_stdout: T::Boolean,
         timeout: Integer,
@@ -95,12 +102,15 @@ module Dependabot
       begin
         T.unsafe(Open3).popen3(*env_cmd) do |stdin, stdout_io, stderr_io, wait_thr| # rubocop:disable Metrics/BlockLength
           pid = wait_thr.pid
+          command_string = command_string_for_logging(env_cmd)
+          log_level = short_git_config_command?(command_string) ? :debug : :info
           sanitized_env_cmd = if env_cmd.first.is_a?(Hash)
                                 [SharedHelpers.send(:sanitize_env_for_logging, env_cmd.first), *env_cmd[1..]]
                               else
                                 env_cmd
                               end
-          Dependabot.logger.info("Started process PID: #{pid} with command: #{sanitized_env_cmd.join(' ')}")
+          command_for_log = sanitized_env_cmd.join(" ")
+          Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
           begin
@@ -179,7 +189,7 @@ module Dependabot
           end
 
           status = ProcessStatus.new(wait_thr.value)
-          Dependabot.logger.info("Process PID: #{pid} completed with status: #{status}")
+          Dependabot.logger.public_send(log_level, "Process PID: #{pid} completed with status: #{status}")
         end
       rescue Timeout::Error => e
         Dependabot.logger.error("Process PID: #{pid} failed due to timeout: #{e.message}")
@@ -195,7 +205,8 @@ module Dependabot
       end
 
       elapsed_time = Time.now - start_time
-      Dependabot.logger.info("Total execution time: #{elapsed_time.round(2)} seconds")
+      log_level = short_git_config_command?(command_string_for_logging(env_cmd)) ? :debug : :info
+      Dependabot.logger.public_send(log_level, "Total execution time: #{elapsed_time.round(2)} seconds")
       [stdout, stderr, status, elapsed_time]
     end
     # rubocop:enable Metrics/AbcSize
@@ -249,5 +260,19 @@ module Dependabot
       command_parts = command.split.map(&:strip).reject(&:empty?)
       Shellwords.join(command_parts)
     end
+
+    sig { params(env_cmd: T::Array[EnvCmdItem]).returns(T.nilable(String)) }
+    def self.command_string_for_logging(env_cmd)
+      T.cast(env_cmd.find { |item| item.is_a?(String) }, T.nilable(String))
+    end
+    private_class_method :command_string_for_logging
+
+    sig { params(command: T.nilable(String)).returns(T::Boolean) }
+    def self.short_git_config_command?(command)
+      return false if command.nil?
+
+      command.start_with?("git config --global ")
+    end
+    private_class_method :short_git_config_command?
   end
 end

data/lib/dependabot/config/file.rb

@@ -87,6 +87,7 @@ module Dependabot
           "pre-commit" => "pre_commit",
           "pub" => "pub",
           "rust-toolchain" => "rust_toolchain",
+          "sbt" => "sbt",
           "swift" => "swift",
           "terraform" => "terraform",
           "uv" => "uv",

data/lib/dependabot/dependency_graphers/base.rb

@@ -100,18 +100,37 @@ module Dependabot
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Dependency]) }
       def safe_fetch_subdependencies(dependency)
-        return [] if @errored_fetching_subdependencies
+        return [] if errored_fetching_subdependencies
 
         fetch_subdependencies(dependency).filter_map do |dependency_name|
           dependencies_by_name[dependency_name]
         end
       rescue StandardError => e
-        @errored_fetching_subdependencies = true
+        errored_fetching_subdependencies!
         @subdependency_error = T.let(e, T.nilable(StandardError))
         Dependabot.logger.error("Error fetching subdependencies: #{e.message}")
         []
       end
 
+      # TODO(brrygrdn): Replace this with a `degraded` flag and a `reason` string/enum
+      #
+      # Nearly all failure modes we have so far amount to 'we couldn't get the full tree for some reason' which is
+      # semantically the same as failing to fetch subdependencies, but it is elides some specific information we
+      # could use to improve user-facing errors in future, e.g.
+      # - Auth failure doing a necessary operation; fix your auth please
+      # - Auth failure generating an ephemeral lockfile; fix your auth -or- check in your lockfile
+      #
+      # The reason this isn't precise enough is that in some ecosystems, the degradation from an ephemeral lockfile
+      # goes further and we cannot actually tell versions of top-level dependencies either.
+      #
+      # To reflect this properly as we expand our ecosystems, setting a generic degraded flag along with user
+      # guidance from the ecosystem-specific implementation will allow us to be clearer on remediation in UIs
+      # in addition to the job logs.
+      sig { void }
+      def errored_fetching_subdependencies!
+        @errored_fetching_subdependencies = true
+      end
+
       # Each grapher is expected to implement a method to look up the parents of a given dependency.
       #
       # The strategy that should be used is highly dependent on the ecosystem, in some cases the parser

data/lib/dependabot/file_fetchers/base.rb

@@ -196,7 +196,8 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def commit
-        return T.must(cloned_commit) if cloned_commit
+        resolved_cloned_commit = cloned_commit
+        return resolved_cloned_commit if resolved_cloned_commit
         return T.must(source.commit) if source.commit
 
         branch = target_branch || default_branch_for_repo

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -214,6 +214,7 @@ module Dependabot
       sig { returns(String) }
       def solo_pr_name
         name = library? ? library_pr_name : application_pr_name
+        name += " (via audit fix)" if dependencies.any? { |dep| dep.metadata[:audit_fix_used] }
         "#{name}#{pr_name_directory}"
       end
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -200,10 +200,12 @@ module Dependabot
         return unless (msg = last_dependabot_commit_title)
 
         return :gitmoji if msg.start_with?("⬆️")
-        return :conventional_prefix if msg.match?(/\A(chore|build|upgrade):/i)
-        return unless msg.match?(/\A(chore|build|upgrade)\(/i)
 
-        :conventional_prefix_with_scope
+        prefixes = (ANGULAR_PREFIXES + ESLINT_PREFIXES).uniq(&:downcase).join("|")
+        return :conventional_prefix if msg.match?(/\A(#{prefixes}):/i)
+        return :conventional_prefix_with_scope if msg.match?(/\A(#{prefixes})\(/i)
+
+        nil
       end
 
       sig { returns(T.nilable(String)) }

data/lib/dependabot/pull_request_updater/github.rb

@@ -46,7 +46,8 @@ module Dependabot
           credentials: T::Array[Dependabot::Credential],
           pull_request_number: Integer,
           author_details: T.nilable(T::Hash[Symbol, T.untyped]),
-          signature_key: T.nilable(String)
+          signature_key: T.nilable(String),
+          commit_message: T.nilable(String)
         )
           .void
       end
@@ -58,7 +59,8 @@ module Dependabot
         credentials:,
         pull_request_number:,
         author_details: nil,
-        signature_key: nil
+        signature_key: nil,
+        commit_message: nil
       )
         @source              = source
         @base_commit         = base_commit
@@ -68,6 +70,7 @@ module Dependabot
         @pull_request_number = pull_request_number
         @author_details      = author_details
         @signature_key       = signature_key
+        @commit_message      = T.let(commit_message, T.nilable(String))
       end
 
       sig { returns(T.nilable(Sawyer::Resource)) }
@@ -255,6 +258,9 @@ module Dependabot
 
       sig { returns(String) }
       def commit_message
+        msg = @commit_message
+        return msg unless msg.nil? || msg.empty?
+
         fallback_message =
           "#{pull_request.title}" \
           "\n\n" \

data/lib/dependabot/pull_request_updater.rb

@@ -37,6 +37,9 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :signature_key
 
+    sig { returns(T.nilable(String)) }
+    attr_reader :commit_message
+
     sig { returns(T::Hash[Symbol, T.untyped]) }
     attr_reader :provider_metadata
 
@@ -50,6 +53,7 @@ module Dependabot
         pull_request_number: Integer,
         author_details: T.nilable(T::Hash[Symbol, String]),
         signature_key: T.nilable(String),
+        commit_message: T.nilable(String),
         provider_metadata: T::Hash[Symbol, T.untyped]
       )
         .void
@@ -63,6 +67,7 @@ module Dependabot
       pull_request_number:,
       author_details: nil,
       signature_key: nil,
+      commit_message: nil,
       provider_metadata: {}
     )
       @source              = source
@@ -73,6 +78,7 @@ module Dependabot
       @pull_request_number = pull_request_number
       @author_details      = author_details
       @signature_key       = signature_key
+      @commit_message      = commit_message
       @provider_metadata   = provider_metadata
     end
 
@@ -100,7 +106,8 @@ module Dependabot
         credentials: credentials,
         pull_request_number: pull_request_number,
         author_details: author_details,
-        signature_key: signature_key
+        signature_key: signature_key,
+        commit_message: commit_message
       )
     end
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.371.0"
+  VERSION = "0.373.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.371.0
+  version: 0.373.0
 platform: ruby
 authors:
 - Dependabot
@@ -617,7 +617,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.371.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.373.0
 rdoc_options: []
 require_paths:
 - lib