dependabot-common 0.394.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56fd73092967bcc3c61c5380d818f4802319503d4ef71fe825cc0433e928e6a9
-  data.tar.gz: c2d55c57dc9a06af239f6f2797c65df21837495afa5c00da8435a0810fd8af30
+  metadata.gz: 38e1442399b4db684997304709cfd914195b3a067d6195989cebead9c1c5d188
+  data.tar.gz: 5a949d0992ee5bddd0ce5f0641ddcc9fe7e70ca32ce21dafbd7504e07e293069
 SHA512:
-  metadata.gz: 9051406a2bb191fc74abe230325d756939a54c84588c78c55ddc44e2a03452e2c57952cb8791f1b2f5f3cdfe9317fbabb01aa4ac00da1be8a30d2274bae835eb
-  data.tar.gz: e11299a8ef1eea997446cc50ea216a0615c54875a7a34ce5482f001be1bf038e0700fba9b5e3425aa6d931da753fac54c48f782365755006310651487cfff192
+  metadata.gz: 7fcf1078fd4be3cfbd95be9b1529f6ee5c159f0891ad0baebbd42931a21fd2f2b6c02172614c6c537f72115d414aee3feede98296ae5a52c65fe6abafcd9dd82
+  data.tar.gz: 5304d03eb4968bd94732bee2f81e02405e1714c14258aae73735d68f07705c4a80f2c7c7ff96cfc2b65bc1814fbd01aa44b75fbe9cd5e7450304bcee3e3d5fb0

data/lib/dependabot/clients/azure.rb

@@ -8,7 +8,7 @@ require "sorbet-runtime"
 
 module Dependabot
   module Clients
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Azure
       extend T::Sig
       include JsonResponseParser
@@ -550,6 +550,5 @@ module Dependabot
       sig { returns(Dependabot::Source) }
       attr_reader :source
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/command_helpers.rb

@@ -11,7 +11,7 @@ module Dependabot
 
     module TIMEOUTS
       NO_TIME_OUT = -1 # No timeout
-      GRARECFULLY_STOP = 5 # 5 seconds for graceful termination
+      GRACEFULLY_STOP = 5 # 5 seconds for graceful termination
       LOCAL = 30 # 30 seconds
       NETWORK = 120 # 2 minutes
       LONG_RUNNING = 300 # 5 minutes
@@ -185,8 +185,8 @@ module Dependabot
               if observation&.dig(:gracefully_stop)
                 message = observation[:reason] || "Terminated by output_observer"
                 # If the observer indicates a graceful stop, terminate the process
-                # by adjusting the remaining timeout 5 seconds
-                timeout = [timeout, ((Time.now - last_output_time) + 5).to_i].min
+                # by adjusting the remaining timeout
+                timeout = [timeout, ((Time.now - last_output_time) + TIMEOUTS::GRACEFULLY_STOP).to_i].min
                 Dependabot.logger.warn("Terminating process due to observer signal: #{message}")
               end
             rescue EOFError

data/lib/dependabot/errors.rb

@@ -5,7 +5,7 @@ require "sorbet-runtime"
 require "dependabot/error_details"
 require "dependabot/utils"
 
-# rubocop:disable Metrics/ModuleLength
+# rubocop:disable-next Metrics/ModuleLength
 module Dependabot
   extend T::Sig
 
@@ -1010,4 +1010,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ModuleLength

data/lib/dependabot/file_fetchers/base.rb

@@ -16,7 +16,7 @@ require "dependabot/clients/bitbucket_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/shared_helpers"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   module FileFetchers
     class RepositoryContent < T::ImmutableStruct
@@ -1030,4 +1030,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -36,9 +36,8 @@ module Dependabot
         return [] unless repo_contents_path && target_directory
 
         Dir.chdir(T.must(repo_contents_path)) do
-          # rubocop:disable Performance/DeletePrefix
+          # rubocop:disable-next Performance/DeletePrefix
           relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(T.must(target_directory))
-          # rubocop:enable Performance/DeletePrefix
 
           status = T.let(
             SharedHelpers.run_shell_command(

data/lib/dependabot/git_commit_checker.rb

@@ -23,7 +23,7 @@ require "dependabot/package/release_cooldown_options"
 require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/git_cooldown_date_resolver"
 module Dependabot
-  # rubocop:disable Metrics/ClassLength
+  # rubocop:disable-next Metrics/ClassLength
   class GitCommitChecker
     extend T::Sig
     include Dependabot::GitCooldownDateResolver
@@ -265,6 +265,7 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def local_tag_for_pinned_sha
+      return @local_tag_for_pinned_sha if defined?(@local_tag_for_pinned_sha)
       return unless pinned_ref_looks_like_commit_sha?
 
       @local_tag_for_pinned_sha = T.let(
@@ -957,5 +958,4 @@ module Dependabot
       SourceDetails.from_hash(details) if details
     end
   end
-  # rubocop:enable Metrics/ClassLength
 end

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -24,7 +24,7 @@ module Dependabot
         const :api_url, T.nilable(String), default: nil
       end
 
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class ChangelogFinder
         extend T::Sig
 
@@ -653,7 +653,6 @@ module Dependabot
             )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/package/cooldown_date_tracker.rb

@@ -0,0 +1,168 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/dependency"
+require "dependabot/package/package_release"
+require "dependabot/update_checkers/cooldown_calculation"
+
+module Dependabot
+  module Package
+    class CooldownDateTracker
+      extend T::Sig
+
+      sig { params(dependency: Dependabot::Dependency, ignored_versions: T::Array[String]).void }
+      def initialize(dependency:, ignored_versions:)
+        @dependency = dependency
+        @ignored_versions = ignored_versions
+        @active = T.let(false, T::Boolean)
+        @language_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
+        @enforce_requirements = T.let(false, T::Boolean)
+        @prefiltered = T.let(false, T::Boolean)
+        @releases = T.let({}, T::Hash[Dependabot::Package::PackageRelease, Integer])
+      end
+
+      sig { returns(T::Boolean) }
+      attr_reader :active
+
+      sig do
+        params(
+          language_version: T.nilable(T.any(String, Dependabot::Version)),
+          requirements: T::Boolean,
+          block: T.proc.returns(T::Array[Dependabot::Package::PackageRelease])
+        ).returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter(language_version:, requirements:, &block)
+        @active = true
+        @language_version = language_version
+        @enforce_requirements = requirements
+
+        filtered = yield
+        mark_for_selected_release(filtered)
+        filtered
+      ensure
+        @active = false
+        @language_version = nil
+        @enforce_requirements = false
+        @releases.clear
+      end
+
+      sig do
+        params(block: T.proc.returns(T::Array[Dependabot::Package::PackageRelease]))
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter_prefiltered(&block)
+        @prefiltered = true
+        filter(language_version: nil, requirements: false, &block)
+      ensure
+        @prefiltered = false
+      end
+
+      sig do
+        params(
+          release: Dependabot::Package::PackageRelease,
+          current_version: T.nilable(Dependabot::Version),
+          days: Integer
+        ).void
+      end
+      def record(release:, current_version:, days:)
+        return unless active
+        return unless @prefiltered || relevant?(release, current_version)
+
+        @releases[release] = days
+      end
+
+      private
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
+
+      sig { returns(T::Array[String]) }
+      attr_reader :ignored_versions
+
+      sig do
+        params(
+          release: Dependabot::Package::PackageRelease,
+          current_version: T.nilable(Dependabot::Version)
+        ).returns(T::Boolean)
+      end
+      def relevant?(release, current_version)
+        return false if release.yanked?
+        return false if current_version && release.version <= current_version
+        return false if unwanted_prerelease?(release)
+        return false if ignored?(release)
+        return false unless language_supported?(release)
+
+        requirements_allow?(release)
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def unwanted_prerelease?(release)
+        release.version.prerelease? && !wants_prerelease?
+      end
+
+      sig { returns(T::Boolean) }
+      def wants_prerelease?
+        return true if dependency.numeric_version&.prerelease?
+
+        dependency.requirements.any? do |requirement|
+          requirement_string = requirement.requirement_string || ""
+          requirement_string.split(",").map(&:strip).any? do |part|
+            version_string = part.gsub(/^\s*[!<>=~^]+\s*/, "").strip
+            next false unless dependency.version_class.correct?(version_string)
+
+            dependency.version_class.new(version_string).prerelease?
+          end
+        end
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def ignored?(release)
+        requirements = ignored_versions.flat_map do |requirement|
+          dependency.requirement_class.requirements_array(requirement)
+        end
+        requirements.any? { |requirement| requirement.satisfied_by?(release.version) }
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def language_supported?(release)
+        requirement = release.language&.requirement
+        !@language_version || !requirement || requirement.satisfied_by?(@language_version)
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def requirements_allow?(release)
+        return true unless @enforce_requirements
+
+        dependency.requirements.filter_map(&:requirement_string).all? do |requirement_string|
+          dependency.requirement_class.requirements_array(requirement_string).any? do |requirement|
+            requirement.satisfied_by?(release.version)
+          end
+        end
+      end
+
+      sig { params(filtered: T::Array[Dependabot::Package::PackageRelease]).void }
+      def mark_for_selected_release(filtered)
+        return if @releases.empty?
+
+        current_version = dependency.numeric_version
+        eligible = if @prefiltered
+                     filtered
+                   else
+                     filtered.select { |release| relevant?(release, current_version) }
+                   end
+        selected = (eligible + @releases.keys).max_by(&:version)
+        return unless selected
+
+        days = @releases[selected]
+        return unless days
+
+        Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+          dependency,
+          cooldown_days: days
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/package/npm_lockfile_details.rb

@@ -0,0 +1,37 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/errors"
+
+module Dependabot
+  module Package
+    class NpmLockfileDetails < T::ImmutableStruct
+      extend T::Sig
+
+      const :version, T.nilable(String), default: nil
+      const :resolved, T.nilable(String), default: nil
+      const :resolution, T.nilable(String), default: nil
+
+      sig { params(value: Object, path: String, context: String).returns(NpmLockfileDetails) }
+      def self.from_object(value, path:, context:)
+        raise DependencyFileNotParseable.new(path, "#{context} must be an object") unless value.is_a?(Hash)
+
+        new(
+          version: optional_string(T.cast(value["version"], Object), path, "#{context}.version"),
+          resolved: optional_string(T.cast(value["resolved"], Object), path, "#{context}.resolved"),
+          resolution: optional_string(T.cast(value["resolution"], Object), path, "#{context}.resolution")
+        )
+      end
+
+      sig { params(value: Object, path: String, field: String).returns(T.nilable(String)) }
+      def self.optional_string(value, path, field)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise DependencyFileNotParseable.new(path, "#{field} must be a string or nil")
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/package/npm_package_json.rb

@@ -0,0 +1,83 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/package/npm_package_manager_config"
+
+module Dependabot
+  module Package
+    class NpmPackageJson
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+      DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+
+      sig { params(file: DependencyFile).returns(NpmPackageJson) }
+      def self.from_file(file)
+        new(T.cast(JSON.parse(T.must(file.content)), Object), file.path)
+      end
+
+      sig { params(data: Object, path: String).void }
+      def initialize(data, path)
+        @path = path
+        @data = T.let(object_hash(data, "root"), ObjectHash)
+      end
+
+      sig do
+        params(_block: T.proc.params(name: String, requirement: String, type: String).void).void
+      end
+      def each_dependency(&_block)
+        DEPENDENCY_TYPES.each do |type|
+          dependencies = @data[type]
+          next unless dependencies
+
+          object_hash(dependencies, type).each do |name, requirement|
+            next unless requirement.is_a?(String)
+
+            yield name, requirement, type
+          end
+        end
+      end
+
+      sig { returns(T.nilable(String)) }
+      def name
+        value = @data["name"]
+        value if value.is_a?(String)
+      end
+
+      sig { returns(T::Boolean) }
+      def flat?
+        !!@data["flat"]
+      end
+
+      sig { returns(T::Boolean) }
+      def workspaces?
+        !!@data["workspaces"]
+      end
+
+      sig { returns(NpmPackageManagerConfig) }
+      def package_manager_config
+        NpmPackageManagerConfig.from_package_json(@data)
+      end
+
+      private
+
+      sig { params(value: Object, field: String).returns(ObjectHash) }
+      def object_hash(value, field)
+        raise TypeError, "#{@path}: #{field} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{@path}: #{field} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+    end
+  end
+end

data/lib/dependabot/package/npm_registry_package.rb

@@ -132,8 +132,17 @@ module Dependabot
             type: type,
             git: type == "git"
           )
+        when Array
+          repositories = T.let([], T::Array[Repository])
+          value.each do |raw_repository|
+            repository_value = T.cast(raw_repository, Object)
+            parsed_repository = parse_repository(repository_value, version)
+            repositories << parsed_repository if parsed_repository
+          end
+
+          repositories.find(&:git?) || repositories.first
         else
-          raise TypeError, "version #{version} repository must be a string or object"
+          raise TypeError, "version #{version} repository must be a string, object, or array"
         end
       end
       private_class_method :parse_repository

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -12,10 +12,11 @@ require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/registry_client"
 require "dependabot/package/package_details"
 require "dependabot/package/release_cooldown_options"
+require "dependabot/package/cooldown_date_tracker"
 
 module Dependabot
   module Package
-    class PackageLatestVersionFinder
+    class PackageLatestVersionFinder # rubocop:disable Metrics/ClassLength
       extend T::Sig
       extend T::Helpers
 
@@ -79,6 +80,8 @@ module Dependabot
         @latest_version_with_no_unlock = T.let(nil, T.nilable(Dependabot::Version))
         @lowest_security_fix_version = T.let(nil, T.nilable(Dependabot::Version))
         @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+        cooldown_tracker = CooldownDateTracker.new(dependency: dependency, ignored_versions: ignored_versions)
+        @cooldown_tracker = T.let(cooldown_tracker, CooldownDateTracker)
       end
 
       sig do
@@ -121,15 +124,16 @@ module Dependabot
         @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
       end
 
-      sig do
-        returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
-      end
+      sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
       def available_versions
         package_details&.releases
       end
 
       protected
 
+      sig { returns(CooldownDateTracker) }
+      attr_reader :cooldown_tracker
+
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -139,12 +143,13 @@ module Dependabot
         return unless releases
 
         releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = filter_out_of_range_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases = @cooldown_tracker.filter(language_version:, requirements: true) do
+          filtered = filter_by_cooldown(releases)
+          filtered = filter_prerelease_versions(filter_unsupported_versions(filtered, language_version))
+          filtered = filter_ignored_versions(filtered)
+          filtered = filter_out_of_range_versions(filtered)
+          apply_post_fetch_latest_versions_filter(filtered)
+        end
         releases.max_by(&:version)&.version
       end
 
@@ -154,9 +159,8 @@ module Dependabot
       end
       def filter_yanked_versions(releases)
         filtered = releases.reject(&:yanked?)
-        if releases.count > filtered.count
-          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} yanked versions")
-        end
+        removed_count = releases.count - filtered.count
+        Dependabot.logger.info("Filtered out #{removed_count} yanked versions") if removed_count.positive?
         filtered
       end
 
@@ -165,8 +169,13 @@ module Dependabot
           .returns(T::Array[Dependabot::Package::PackageRelease])
       end
       def filter_by_cooldown(releases)
-        return releases unless cooldown_enabled?
-        return releases unless cooldown_options
+        unless @cooldown_tracker.active
+          return @cooldown_tracker.filter(language_version: nil, requirements: false) do
+            filter_by_cooldown(releases)
+          end
+        end
+
+        return releases unless cooldown_enabled? && cooldown_options
 
         filtered = releases.reject { |release| in_cooldown_period?(release) }
 
@@ -176,21 +185,11 @@ module Dependabot
 
         # If all releases were filtered out due to cooldown and we have a current version, use it as fallback
         if filtered.empty? && !releases.empty? && dependency.version
-          current_version_str = dependency.version
-
           Dependabot.logger.info(
             "All versions filtered by cooldown for #{dependency.name}, " \
-            "falling back to current version #{current_version_str}"
-          )
-
-          # Create a PackageRelease for the current version
-          current_version = version_class.new(current_version_str)
-          current_release = Dependabot::Package::PackageRelease.new(
-            version: current_version,
-            released_at: nil,
-            tag: nil
+            "falling back to current version #{dependency.version}"
           )
-          return [current_release]
+          return [cooldown_fallback_release]
         end
 
         filtered
@@ -198,20 +197,17 @@ module Dependabot
 
       sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
       def in_cooldown_period?(release)
-        return false unless release.released_at
+        current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+        days = cooldown_days_for(current_version, release.version)
+        return false unless days.positive?
 
-        cooldown = @cooldown_options
-        return false if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(
-          cooldown, dependency.name, cooldown_enabled: cooldown_enabled?
-        )
+        released_at = released_at_for(release)
+        unless released_at
+          @cooldown_tracker.record(release: release, current_version: current_version, days: days)
+          return missing_release_date_blocks_update?(release)
+        end
 
-        current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
-        days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
-          T.must(cooldown), current_version, release.version
-        )
-        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(
-          T.must(release.released_at), days
-        )
+        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(released_at, days)
       end
 
       sig do
@@ -223,10 +219,20 @@ module Dependabot
       end
       def filter_unsupported_versions(releases, language_version)
         filtered = releases.filter_map do |release|
-          language_requirement = release.language&.requirement
-          next release unless language_version
+          language = release.language
+          next release unless language_version && language
+
+          language_requirement = language.requirement
           next release unless language_requirement
-          next unless language_requirement.satisfied_by?(language_version)
+
+          unless language_requirement.satisfied_by?(language_version)
+            Dependabot.logger.info(
+              "Filtered out #{dependency.name} #{release.version} because " \
+              "#{language.name} requirement #{language_requirement} is not satisfied by " \
+              "#{language.name} #{language_version}"
+            )
+            next
+          end
 
           release
         end
@@ -361,6 +367,20 @@ module Dependabot
         true
       end
 
+      # Registries that only expose a publication date through a second request resolve it here.
+      sig { overridable.params(release: Dependabot::Package::PackageRelease).returns(T.nilable(Time)) }
+      def released_at_for(release)
+        release.released_at
+      end
+
+      sig { overridable.params(_release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def missing_release_date_blocks_update?(_release)
+        false
+      end
+
+      sig { overridable.returns(Dependabot::Package::PackageRelease) }
+      def cooldown_fallback_release = PackageRelease.new(version: version_class.new(T.must(dependency.version)))
+
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -378,11 +398,12 @@ module Dependabot
         return unless releases
 
         releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases = @cooldown_tracker.filter(language_version:, requirements: false) do
+          filtered = filter_by_cooldown(releases)
+          filtered = filter_prerelease_versions(filter_unsupported_versions(filtered, language_version))
+          filtered = filter_ignored_versions(filtered)
+          apply_post_fetch_latest_versions_filter(filtered)
+        end
         releases.max_by(&:version)
       end
 

data/lib/dependabot/pull_request_creator/github.rb

@@ -12,7 +12,7 @@ require "dependabot/pull_request_creator/commit_signer"
 
 module Dependabot
   class PullRequestCreator
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Github
       extend T::Sig
       include Dependabot::Clients::GithubResourceParser
@@ -634,6 +634,5 @@ module Dependabot
         end
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -9,7 +9,7 @@ require "dependabot/credential"
 
 module Dependabot
   class PullRequestCreator
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class Labeler
       extend T::Sig
 
@@ -155,9 +155,8 @@ module Dependabot
             new_version_parts = T.must(version(dep)).split(/[.+]/)
             old_version_parts = previous_version(dep)&.split(/[.+]/) || []
             all_parts = new_version_parts.first(3) + old_version_parts.first(3)
-            # rubocop:disable Performance/RedundantEqualityComparisonBlock
+            # rubocop:disable-next Performance/RedundantEqualityComparisonBlock
             next 0 unless all_parts.all? { |part| part.to_i.to_s == part }
-            # rubocop:enable Performance/RedundantEqualityComparisonBlock
             next 1 if new_version_parts[0] != old_version_parts[0]
             next 2 if new_version_parts[1] != old_version_parts[1]
 
@@ -556,6 +555,5 @@ module Dependabot
         Utils.version_class_for_package_manager(package_manager)
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -14,7 +14,7 @@ require "dependabot/pull_request_creator"
 require "dependabot/pull_request_creator/message"
 require "dependabot/notices"
 
-# rubocop:disable Metrics/ClassLength
+# rubocop:disable-next Metrics/ClassLength
 module Dependabot
   class PullRequestCreator
     # MessageBuilder builds PR message for a dependency update
@@ -976,4 +976,3 @@ module Dependabot
     end
   end
 end
-# rubocop:enable Metrics/ClassLength

data/lib/dependabot/update_checkers/cooldown_calculation.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency"
 require "dependabot/package/release_cooldown_options"
 require "dependabot/version"
 
@@ -16,6 +17,14 @@ module Dependabot
       extend T::Sig
 
       DAY_IN_SECONDS = T.let(24 * 60 * 60, Integer)
+      DATE_UNAVAILABLE_METADATA_KEY = :cooldown_date_unavailable
+
+      # Shared by the pull request notice and the job-level warning so both channels
+      # report the same diagnostic, whether or not the update produced a pull request.
+      DATE_UNAVAILABLE_NOTICE_TYPE = "cooldown_date_unavailable"
+      DATE_UNAVAILABLE_TITLE = "Cooldown was not applied"
+      DATE_UNAVAILABLE_DESCRIPTION =
+        "Cooldown could not be applied because no publication date was available from the registry."
 
       sig { params(release_date: Time, cooldown_days: Integer).returns(T::Boolean) }
       def self.within_cooldown_window?(release_date, cooldown_days)
@@ -50,6 +59,18 @@ module Dependabot
       def self.skip_cooldown?(cooldown, dependency_name, cooldown_enabled: true)
         cooldown.nil? || !cooldown_enabled || !cooldown.included?(dependency_name)
       end
+
+      sig { params(dependency: Dependabot::Dependency, cooldown_days: Integer).void }
+      def self.mark_cooldown_date_unavailable(dependency, cooldown_days:)
+        return unless cooldown_days.positive?
+
+        dependency.metadata[DATE_UNAVAILABLE_METADATA_KEY] = true
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def self.cooldown_date_unavailable?(dependency)
+        dependency.metadata[DATE_UNAVAILABLE_METADATA_KEY] == true
+      end
     end
   end
 end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.394.0"
+  VERSION = "0.396.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -147,14 +147,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.20'
+        version: '2.22'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.20'
+        version: '2.22'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -450,19 +450,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -572,6 +572,9 @@ files:
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
+- lib/dependabot/package/cooldown_date_tracker.rb
+- lib/dependabot/package/npm_lockfile_details.rb
+- lib/dependabot/package/npm_package_json.rb
 - lib/dependabot/package/npm_package_manager_config.rb
 - lib/dependabot/package/npm_registry_package.rb
 - lib/dependabot/package/package_details.rb
@@ -631,7 +634,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib