dependabot-common 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a99920113509c66688f9ff8e4c3da84a054c3ce8d0f6c1d137cbdbc936ab4e9
-  data.tar.gz: 5c4de02216c87431010c69387a5ade5f4f296423e3b5e7f3e889e293743ee666
+  metadata.gz: 56fd73092967bcc3c61c5380d818f4802319503d4ef71fe825cc0433e928e6a9
+  data.tar.gz: c2d55c57dc9a06af239f6f2797c65df21837495afa5c00da8435a0810fd8af30
 SHA512:
-  metadata.gz: c84ada814badfb9efc4e7a60d67fa5a26154c9c110337bf77c0963bbb08393ffd13247508d2db349750fb26590f81dfdded077aaf74ad54bf0b4f01b769453cb
-  data.tar.gz: 1dc8a19ec787541adb136602ee00d101d7919b86c6d903c6d33ae4dedd65afd6fe677b83f4574e5c370a9e2e379093f4e5e7bf630cf95868e9bf91f0db66eccc
+  metadata.gz: 9051406a2bb191fc74abe230325d756939a54c84588c78c55ddc44e2a03452e2c57952cb8791f1b2f5f3cdfe9317fbabb01aa4ac00da1be8a30d2274bae835eb
+  data.tar.gz: e11299a8ef1eea997446cc50ea216a0615c54875a7a34ce5482f001be1bf038e0700fba9b5e3425aa6d931da753fac54c48f782365755006310651487cfff192

data/lib/dependabot/errors.rb

@@ -580,7 +580,10 @@ module Dependabot
     end
     def initialize(tool_name, tool_message)
       @tool_name = tool_name
-      @tool_message = tool_message
+      # Sanitize here as well as via `super`: the raw `tool_message` attribute is read
+      # directly during error serialization (see `updater_error_details`), so it must not
+      # carry credentials (e.g. basic-auth URLs) that the base message sanitization strips.
+      @tool_message = T.let(filter_sensitive_data(tool_message), String)
 
       msg = "Dependabot detected that #{tool_name} is misconfigured in this repository. " \
             "Running `#{tool_name.downcase}` results in the following error: #{tool_message}"

data/lib/dependabot/file_fetchers/base.rb

@@ -503,7 +503,7 @@ module Dependabot
         params(path: String, fetch_submodules: T::Boolean, raise_errors: T::Boolean)
           .returns(T::Array[RepositoryContent])
       end
-      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true) # rubocop:disable Metrics/PerceivedComplexity
+      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true)
         path = path.gsub(" ", "%20")
         specification = _full_specification_for(path, fetch_submodules: fetch_submodules)
         provider = specification.provider
@@ -512,11 +512,7 @@ module Dependabot
         commit = specification.commit
 
         entries = _fetch_repo_contents_fully_specified(provider, repo, tmp_path, commit)
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        filter_excluded(entries)
       rescue *CLIENT_NOT_FOUND_ERRORS
         raise Dependabot::DirectoryNotFound, directory if path == directory.gsub(%r{^/*}, "")
 
@@ -597,11 +593,7 @@ module Dependabot
             size: 0 # NOTE: added for parity with github contents API
           )
         end
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        filter_excluded(entries)
       end
 
       # Filters out any entries whose paths match one of the exclude_paths globs.

data/lib/dependabot/file_filtering.rb

@@ -90,8 +90,6 @@ module Dependabot
       ).returns(T::Boolean)
     end
     def self.should_exclude_path?(path, context, exclude_paths)
-      return false unless Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-
       return false if exclude_paths.nil? || exclude_paths.empty?
 
       should_exclude = exclude_path?(path, exclude_paths)

data/lib/dependabot/package/npm_package_manager_config.rb

@@ -0,0 +1,72 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmPackageManagerConfig < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      const :package_manager, T.nilable(String), default: nil
+      const :engines, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(package_json: T.nilable(Object)).returns(NpmPackageManagerConfig) }
+      def self.from_package_json(package_json)
+        return new if package_json.nil?
+
+        manifest = object_hash(package_json, "package.json")
+
+        new(
+          package_manager: optional_string(manifest["packageManager"], "packageManager"),
+          engines: parse_engines(manifest)
+        )
+      end
+
+      sig { params(manifest: ObjectHash).returns(T.nilable(T::Hash[String, String])) }
+      def self.parse_engines(manifest)
+        return unless manifest.key?("engines")
+
+        raw_engines = manifest["engines"]
+        return if raw_engines.nil?
+
+        engines = T.let({}, T::Hash[String, String])
+        object_hash(raw_engines, "engines").each do |name, raw_requirement|
+          next if raw_requirement.nil?
+
+          raise TypeError, "engines.#{name} must be a string" unless raw_requirement.is_a?(String)
+
+          engines[name] = raw_requirement
+        end
+        engines
+      end
+      private_class_method :parse_engines
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/package/npm_registry_package.rb

@@ -0,0 +1,186 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmRegistryPackage < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+      VersionFilter = T.type_alias { T.proc.params(version: String).returns(T::Boolean) }
+
+      class Repository < T::ImmutableStruct
+        extend T::Sig
+
+        const :git, T::Boolean
+        const :url, T.nilable(String), default: nil
+        const :type, T.nilable(String), default: nil
+
+        sig { returns(T::Boolean) }
+        def git?
+          git
+        end
+      end
+
+      class Release < T::ImmutableStruct
+        extend T::Sig
+
+        const :version, String
+        const :released_at, T.nilable(Time), default: nil
+        const :node_requirement, T.nilable(String), default: nil
+        const :repository, T.nilable(Repository), default: nil
+        const :details, ObjectHash
+
+        sig { returns(String) }
+        def package_type
+          repository&.git? ? "git" : "npm"
+        end
+      end
+
+      const :releases, T::Hash[String, Release]
+      const :dist_tags, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(json: String, version_filter: VersionFilter).returns(NpmRegistryPackage) }
+      def self.from_json(json, &version_filter)
+        parsed = T.cast(JSON.parse(json), Object)
+        package = object_hash(parsed, "npm registry package")
+
+        versions = package["versions"]
+        times = package["time"]
+        dist_tags = package["dist-tags"]
+
+        release_details = versions.nil? ? {} : object_hash(versions, "versions")
+        accepted_versions = T.let({}, T::Hash[String, T::Boolean])
+        release_details.each_key do |version|
+          accepted_versions[version] = true if yield(version)
+        end
+
+        release_times = if times.nil?
+                          {}
+                        else
+                          string_map(times, "time", included_keys: accepted_versions)
+                        end
+
+        releases = T.let({}, T::Hash[String, Release])
+        release_details.each do |version, details|
+          next unless accepted_versions.key?(version)
+
+          releases[version] = parse_release(
+            version: version,
+            details: details,
+            released_at: release_times[version]
+          )
+        end
+
+        new(
+          releases: releases,
+          dist_tags: dist_tags.nil? ? nil : string_map(dist_tags, "dist-tags")
+        )
+      end
+
+      sig do
+        params(
+          version: String,
+          details: Object,
+          released_at: T.nilable(String)
+        ).returns(Release)
+      end
+      def self.parse_release(version:, details:, released_at:)
+        details_hash = object_hash(details, "version #{version} details")
+
+        Release.new(
+          version: version,
+          released_at: released_at && Time.parse(released_at),
+          node_requirement: parse_node_requirement(details_hash, version),
+          repository: parse_repository(details_hash["repository"], version),
+          details: details_hash
+        )
+      end
+      private_class_method :parse_release
+
+      sig { params(details: ObjectHash, version: String).returns(T.nilable(String)) }
+      def self.parse_node_requirement(details, version)
+        engines = details["engines"]
+        return unless engines.is_a?(Hash)
+
+        engines_hash = object_hash(engines, "version #{version} engines")
+        optional_string(
+          engines_hash["node"],
+          "version #{version} engines.node"
+        )
+      end
+      private_class_method :parse_node_requirement
+
+      sig { params(value: T.nilable(Object), version: String).returns(T.nilable(Repository)) }
+      def self.parse_repository(value, version)
+        case value
+        when nil
+          nil
+        when String
+          Repository.new(url: value, git: value.start_with?("git+"))
+        when Hash
+          repository = object_hash(value, "version #{version} repository")
+          url = optional_string(repository["url"], "version #{version} repository.url")
+          type = optional_string(repository["type"], "version #{version} repository.type")
+
+          Repository.new(
+            url: url,
+            type: type,
+            git: type == "git"
+          )
+        else
+          raise TypeError, "version #{version} repository must be a string or object"
+        end
+      end
+      private_class_method :parse_repository
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig do
+        params(
+          value: Object,
+          context: String,
+          included_keys: T.nilable(T::Hash[String, T::Boolean])
+        ).returns(T::Hash[String, String])
+      end
+      def self.string_map(value, context, included_keys: nil)
+        result = T.let({}, T::Hash[String, String])
+        object_hash(value, context).each do |key, raw_value|
+          next if included_keys && !included_keys.key?(key)
+
+          raise TypeError, "#{context} values must be strings" unless raw_value.is_a?(String)
+
+          result[key] = raw_value
+        end
+        result
+      end
+      private_class_method :string_map
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.393.0"
+  VERSION = "0.394.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -441,14 +441,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -572,6 +572,8 @@ files:
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
+- lib/dependabot/package/npm_package_manager_config.rb
+- lib/dependabot/package/npm_registry_package.rb
 - lib/dependabot/package/package_details.rb
 - lib/dependabot/package/package_language.rb
 - lib/dependabot/package/package_latest_version_finder.rb
@@ -629,7 +631,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib