dependabot-common 0.393.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a99920113509c66688f9ff8e4c3da84a054c3ce8d0f6c1d137cbdbc936ab4e9
-  data.tar.gz: 5c4de02216c87431010c69387a5ade5f4f296423e3b5e7f3e889e293743ee666
+  metadata.gz: d9566b1a9930f4b53e02d88a9eda5893f794bcd80b37c0a82870dab926432fba
+  data.tar.gz: 77aa3094407df4ef7627a53cb584abd0cf1b14a16e690b3ee178c8600dad2dd7
 SHA512:
-  metadata.gz: c84ada814badfb9efc4e7a60d67fa5a26154c9c110337bf77c0963bbb08393ffd13247508d2db349750fb26590f81dfdded077aaf74ad54bf0b4f01b769453cb
-  data.tar.gz: 1dc8a19ec787541adb136602ee00d101d7919b86c6d903c6d33ae4dedd65afd6fe677b83f4574e5c370a9e2e379093f4e5e7bf630cf95868e9bf91f0db66eccc
+  metadata.gz: f994b68adbb197b61dfa48006b35b8cd39058d5b482393aa2c56993b86958c32364d7e6869b31b068a8fbc85375883eb33110abd9f5fdc254aff940ae4d98c51
+  data.tar.gz: f5bba21d3f012e715c1918f161ce077d1d9f2a0b2ca681e90fd87d9b321d096b710f98902f1ece9e1814c2cdb16d8b89fb68f0d7670aab3b7630e68acaa0cd9c

data/lib/dependabot/clients/azure.rb

@@ -8,7 +8,7 @@ require "sorbet-runtime"
 
 module Dependabot
   module Clients
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Azure
       extend T::Sig
       include JsonResponseParser
@@ -550,6 +550,5 @@ module Dependabot
       sig { returns(Dependabot::Source) }
       attr_reader :source
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/command_helpers.rb

@@ -11,7 +11,7 @@ module Dependabot
 
     module TIMEOUTS
       NO_TIME_OUT = -1 # No timeout
-      GRARECFULLY_STOP = 5 # 5 seconds for graceful termination
+      GRACEFULLY_STOP = 5 # 5 seconds for graceful termination
       LOCAL = 30 # 30 seconds
       NETWORK = 120 # 2 minutes
       LONG_RUNNING = 300 # 5 minutes
@@ -185,8 +185,8 @@ module Dependabot
               if observation&.dig(:gracefully_stop)
                 message = observation[:reason] || "Terminated by output_observer"
                 # If the observer indicates a graceful stop, terminate the process
-                # by adjusting the remaining timeout 5 seconds
-                timeout = [timeout, ((Time.now - last_output_time) + 5).to_i].min
+                # by adjusting the remaining timeout
+                timeout = [timeout, ((Time.now - last_output_time) + TIMEOUTS::GRACEFULLY_STOP).to_i].min
                 Dependabot.logger.warn("Terminating process due to observer signal: #{message}")
               end
             rescue EOFError

data/lib/dependabot/errors.rb

@@ -5,7 +5,7 @@ require "sorbet-runtime"
 require "dependabot/error_details"
 require "dependabot/utils"
 
-# rubocop:disable Metrics/ModuleLength
+# rubocop:disable-next Metrics/ModuleLength
 module Dependabot
   extend T::Sig
 
@@ -580,7 +580,10 @@ module Dependabot
     end
     def initialize(tool_name, tool_message)
       @tool_name = tool_name
-      @tool_message = tool_message
+      # Sanitize here as well as via `super`: the raw `tool_message` attribute is read
+      # directly during error serialization (see `updater_error_details`), so it must not
+      # carry credentials (e.g. basic-auth URLs) that the base message sanitization strips.
+      @tool_message = T.let(filter_sensitive_data(tool_message), String)
 
       msg = "Dependabot detected that #{tool_name} is misconfigured in this repository. " \
             "Running `#{tool_name.downcase}` results in the following error: #{tool_message}"
@@ -1007,4 +1010,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ModuleLength

data/lib/dependabot/file_fetchers/base.rb

@@ -16,7 +16,7 @@ require "dependabot/clients/bitbucket_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module FileFetchers
     class RepositoryContent < T::ImmutableStruct
@@ -503,7 +503,7 @@ module Dependabot
         params(path: String, fetch_submodules: T::Boolean, raise_errors: T::Boolean)
           .returns(T::Array[RepositoryContent])
       end
-      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true) # rubocop:disable Metrics/PerceivedComplexity
+      def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true)
         path = path.gsub(" ", "%20")
         specification = _full_specification_for(path, fetch_submodules: fetch_submodules)
         provider = specification.provider
@@ -512,11 +512,7 @@ module Dependabot
         commit = specification.commit
 
         entries = _fetch_repo_contents_fully_specified(provider, repo, tmp_path, commit)
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        filter_excluded(entries)
       rescue *CLIENT_NOT_FOUND_ERRORS
         raise Dependabot::DirectoryNotFound, directory if path == directory.gsub(%r{^/*}, "")
 
@@ -597,11 +593,7 @@ module Dependabot
             size: 0 # NOTE: added for parity with github contents API
           )
         end
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-          filter_excluded(entries)
-        else
-          entries
-        end
+        filter_excluded(entries)
       end
 
       # Filters out any entries whose paths match one of the exclude_paths globs.
@@ -1038,4 +1030,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/file_filtering.rb

@@ -90,8 +90,6 @@ module Dependabot
       ).returns(T::Boolean)
     end
     def self.should_exclude_path?(path, context, exclude_paths)
-      return false unless Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files)
-
       return false if exclude_paths.nil? || exclude_paths.empty?
 
       should_exclude = exclude_path?(path, exclude_paths)

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -36,9 +36,8 @@ module Dependabot
         return [] unless repo_contents_path && target_directory
 
         Dir.chdir(T.must(repo_contents_path)) do
-          # rubocop:disable Performance/DeletePrefix
+          # rubocop:disable-next Performance/DeletePrefix
           relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(T.must(target_directory))
-          # rubocop:enable Performance/DeletePrefix
 
           status = T.let(
             SharedHelpers.run_shell_command(

data/lib/dependabot/git_commit_checker.rb

@@ -23,7 +23,7 @@ require "dependabot/package/release_cooldown_options"
 require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/git_cooldown_date_resolver"
 module Dependabot
-  # rubocop:disable Metrics/ClassLength
+  # rubocop:disable-next Metrics/ClassLength
   class GitCommitChecker
     extend T::Sig
     include Dependabot::GitCooldownDateResolver
@@ -265,6 +265,7 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def local_tag_for_pinned_sha
+      return @local_tag_for_pinned_sha if defined?(@local_tag_for_pinned_sha)
       return unless pinned_ref_looks_like_commit_sha?
 
       @local_tag_for_pinned_sha = T.let(
@@ -957,5 +958,4 @@ module Dependabot
       SourceDetails.from_hash(details) if details
     end
   end
-  # rubocop:enable Metrics/ClassLength
 end

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -24,7 +24,7 @@ module Dependabot
         const :api_url, T.nilable(String), default: nil
       end
 
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class ChangelogFinder
         extend T::Sig
 
@@ -653,7 +653,6 @@ module Dependabot
             )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/package/npm_package_manager_config.rb

@@ -0,0 +1,72 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmPackageManagerConfig < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      const :package_manager, T.nilable(String), default: nil
+      const :engines, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(package_json: T.nilable(Object)).returns(NpmPackageManagerConfig) }
+      def self.from_package_json(package_json)
+        return new if package_json.nil?
+
+        manifest = object_hash(package_json, "package.json")
+
+        new(
+          package_manager: optional_string(manifest["packageManager"], "packageManager"),
+          engines: parse_engines(manifest)
+        )
+      end
+
+      sig { params(manifest: ObjectHash).returns(T.nilable(T::Hash[String, String])) }
+      def self.parse_engines(manifest)
+        return unless manifest.key?("engines")
+
+        raw_engines = manifest["engines"]
+        return if raw_engines.nil?
+
+        engines = T.let({}, T::Hash[String, String])
+        object_hash(raw_engines, "engines").each do |name, raw_requirement|
+          next if raw_requirement.nil?
+
+          raise TypeError, "engines.#{name} must be a string" unless raw_requirement.is_a?(String)
+
+          engines[name] = raw_requirement
+        end
+        engines
+      end
+      private_class_method :parse_engines
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/package/npm_registry_package.rb

@@ -0,0 +1,195 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+
+module Dependabot
+  module Package
+    class NpmRegistryPackage < T::ImmutableStruct
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+      VersionFilter = T.type_alias { T.proc.params(version: String).returns(T::Boolean) }
+
+      class Repository < T::ImmutableStruct
+        extend T::Sig
+
+        const :git, T::Boolean
+        const :url, T.nilable(String), default: nil
+        const :type, T.nilable(String), default: nil
+
+        sig { returns(T::Boolean) }
+        def git?
+          git
+        end
+      end
+
+      class Release < T::ImmutableStruct
+        extend T::Sig
+
+        const :version, String
+        const :released_at, T.nilable(Time), default: nil
+        const :node_requirement, T.nilable(String), default: nil
+        const :repository, T.nilable(Repository), default: nil
+        const :details, ObjectHash
+
+        sig { returns(String) }
+        def package_type
+          repository&.git? ? "git" : "npm"
+        end
+      end
+
+      const :releases, T::Hash[String, Release]
+      const :dist_tags, T.nilable(T::Hash[String, String]), default: nil
+
+      sig { params(json: String, version_filter: VersionFilter).returns(NpmRegistryPackage) }
+      def self.from_json(json, &version_filter)
+        parsed = T.cast(JSON.parse(json), Object)
+        package = object_hash(parsed, "npm registry package")
+
+        versions = package["versions"]
+        times = package["time"]
+        dist_tags = package["dist-tags"]
+
+        release_details = versions.nil? ? {} : object_hash(versions, "versions")
+        accepted_versions = T.let({}, T::Hash[String, T::Boolean])
+        release_details.each_key do |version|
+          accepted_versions[version] = true if yield(version)
+        end
+
+        release_times = if times.nil?
+                          {}
+                        else
+                          string_map(times, "time", included_keys: accepted_versions)
+                        end
+
+        releases = T.let({}, T::Hash[String, Release])
+        release_details.each do |version, details|
+          next unless accepted_versions.key?(version)
+
+          releases[version] = parse_release(
+            version: version,
+            details: details,
+            released_at: release_times[version]
+          )
+        end
+
+        new(
+          releases: releases,
+          dist_tags: dist_tags.nil? ? nil : string_map(dist_tags, "dist-tags")
+        )
+      end
+
+      sig do
+        params(
+          version: String,
+          details: Object,
+          released_at: T.nilable(String)
+        ).returns(Release)
+      end
+      def self.parse_release(version:, details:, released_at:)
+        details_hash = object_hash(details, "version #{version} details")
+
+        Release.new(
+          version: version,
+          released_at: released_at && Time.parse(released_at),
+          node_requirement: parse_node_requirement(details_hash, version),
+          repository: parse_repository(details_hash["repository"], version),
+          details: details_hash
+        )
+      end
+      private_class_method :parse_release
+
+      sig { params(details: ObjectHash, version: String).returns(T.nilable(String)) }
+      def self.parse_node_requirement(details, version)
+        engines = details["engines"]
+        return unless engines.is_a?(Hash)
+
+        engines_hash = object_hash(engines, "version #{version} engines")
+        optional_string(
+          engines_hash["node"],
+          "version #{version} engines.node"
+        )
+      end
+      private_class_method :parse_node_requirement
+
+      sig { params(value: T.nilable(Object), version: String).returns(T.nilable(Repository)) }
+      def self.parse_repository(value, version)
+        case value
+        when nil
+          nil
+        when String
+          Repository.new(url: value, git: value.start_with?("git+"))
+        when Hash
+          repository = object_hash(value, "version #{version} repository")
+          url = optional_string(repository["url"], "version #{version} repository.url")
+          type = optional_string(repository["type"], "version #{version} repository.type")
+
+          Repository.new(
+            url: url,
+            type: type,
+            git: type == "git"
+          )
+        when Array
+          repositories = T.let([], T::Array[Repository])
+          value.each do |raw_repository|
+            repository_value = T.cast(raw_repository, Object)
+            parsed_repository = parse_repository(repository_value, version)
+            repositories << parsed_repository if parsed_repository
+          end
+
+          repositories.find(&:git?) || repositories.first
+        else
+          raise TypeError, "version #{version} repository must be a string, object, or array"
+        end
+      end
+      private_class_method :parse_repository
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+      private_class_method :object_hash
+
+      sig do
+        params(
+          value: Object,
+          context: String,
+          included_keys: T.nilable(T::Hash[String, T::Boolean])
+        ).returns(T::Hash[String, String])
+      end
+      def self.string_map(value, context, included_keys: nil)
+        result = T.let({}, T::Hash[String, String])
+        object_hash(value, context).each do |key, raw_value|
+          next if included_keys && !included_keys.key?(key)
+
+          raise TypeError, "#{context} values must be strings" unless raw_value.is_a?(String)
+
+          result[key] = raw_value
+        end
+        result
+      end
+      private_class_method :string_map
+
+      sig { params(value: T.nilable(Object), context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/github.rb

@@ -12,7 +12,7 @@ require "dependabot/pull_request_creator/commit_signer"
 
 module Dependabot
   class PullRequestCreator
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Github
       extend T::Sig
       include Dependabot::Clients::GithubResourceParser
@@ -634,6 +634,5 @@ module Dependabot
         end
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -9,7 +9,7 @@ require "dependabot/credential"
 
 module Dependabot
   class PullRequestCreator
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Labeler
       extend T::Sig
 
@@ -155,9 +155,8 @@ module Dependabot
             new_version_parts = T.must(version(dep)).split(/[.+]/)
             old_version_parts = previous_version(dep)&.split(/[.+]/) || []
             all_parts = new_version_parts.first(3) + old_version_parts.first(3)
-            # rubocop:disable Performance/RedundantEqualityComparisonBlock
+            # rubocop:disable-next Performance/RedundantEqualityComparisonBlock
             next 0 unless all_parts.all? { |part| part.to_i.to_s == part }
-            # rubocop:enable Performance/RedundantEqualityComparisonBlock
             next 1 if new_version_parts[0] != old_version_parts[0]
             next 2 if new_version_parts[1] != old_version_parts[1]
 
@@ -556,6 +555,5 @@ module Dependabot
         Utils.version_class_for_package_manager(package_manager)
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -14,7 +14,7 @@ require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/message"
 require "dependabot/notices"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   class PullRequestCreator
     # MessageBuilder builds PR message for a dependency update
@@ -976,4 +976,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.393.0"
+  VERSION = "0.395.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -147,14 +147,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.20'
+        version: '2.22'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.20'
+        version: '2.22'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -441,28 +441,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -572,6 +572,8 @@ files:
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
+- lib/dependabot/package/npm_package_manager_config.rb
+- lib/dependabot/package/npm_registry_package.rb
 - lib/dependabot/package/package_details.rb
 - lib/dependabot/package/package_language.rb
 - lib/dependabot/package/package_latest_version_finder.rb
@@ -629,7 +631,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib