dependabot-common 0.395.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9566b1a9930f4b53e02d88a9eda5893f794bcd80b37c0a82870dab926432fba
-  data.tar.gz: 77aa3094407df4ef7627a53cb584abd0cf1b14a16e690b3ee178c8600dad2dd7
+  metadata.gz: 38e1442399b4db684997304709cfd914195b3a067d6195989cebead9c1c5d188
+  data.tar.gz: 5a949d0992ee5bddd0ce5f0641ddcc9fe7e70ca32ce21dafbd7504e07e293069
 SHA512:
-  metadata.gz: f994b68adbb197b61dfa48006b35b8cd39058d5b482393aa2c56993b86958c32364d7e6869b31b068a8fbc85375883eb33110abd9f5fdc254aff940ae4d98c51
-  data.tar.gz: f5bba21d3f012e715c1918f161ce077d1d9f2a0b2ca681e90fd87d9b321d096b710f98902f1ece9e1814c2cdb16d8b89fb68f0d7670aab3b7630e68acaa0cd9c
+  metadata.gz: 7fcf1078fd4be3cfbd95be9b1529f6ee5c159f0891ad0baebbd42931a21fd2f2b6c02172614c6c537f72115d414aee3feede98296ae5a52c65fe6abafcd9dd82
+  data.tar.gz: 5304d03eb4968bd94732bee2f81e02405e1714c14258aae73735d68f07705c4a80f2c7c7ff96cfc2b65bc1814fbd01aa44b75fbe9cd5e7450304bcee3e3d5fb0

data/lib/dependabot/package/cooldown_date_tracker.rb

@@ -0,0 +1,168 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/dependency"
+require "dependabot/package/package_release"
+require "dependabot/update_checkers/cooldown_calculation"
+
+module Dependabot
+  module Package
+    class CooldownDateTracker
+      extend T::Sig
+
+      sig { params(dependency: Dependabot::Dependency, ignored_versions: T::Array[String]).void }
+      def initialize(dependency:, ignored_versions:)
+        @dependency = dependency
+        @ignored_versions = ignored_versions
+        @active = T.let(false, T::Boolean)
+        @language_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
+        @enforce_requirements = T.let(false, T::Boolean)
+        @prefiltered = T.let(false, T::Boolean)
+        @releases = T.let({}, T::Hash[Dependabot::Package::PackageRelease, Integer])
+      end
+
+      sig { returns(T::Boolean) }
+      attr_reader :active
+
+      sig do
+        params(
+          language_version: T.nilable(T.any(String, Dependabot::Version)),
+          requirements: T::Boolean,
+          block: T.proc.returns(T::Array[Dependabot::Package::PackageRelease])
+        ).returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter(language_version:, requirements:, &block)
+        @active = true
+        @language_version = language_version
+        @enforce_requirements = requirements
+
+        filtered = yield
+        mark_for_selected_release(filtered)
+        filtered
+      ensure
+        @active = false
+        @language_version = nil
+        @enforce_requirements = false
+        @releases.clear
+      end
+
+      sig do
+        params(block: T.proc.returns(T::Array[Dependabot::Package::PackageRelease]))
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter_prefiltered(&block)
+        @prefiltered = true
+        filter(language_version: nil, requirements: false, &block)
+      ensure
+        @prefiltered = false
+      end
+
+      sig do
+        params(
+          release: Dependabot::Package::PackageRelease,
+          current_version: T.nilable(Dependabot::Version),
+          days: Integer
+        ).void
+      end
+      def record(release:, current_version:, days:)
+        return unless active
+        return unless @prefiltered || relevant?(release, current_version)
+
+        @releases[release] = days
+      end
+
+      private
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
+
+      sig { returns(T::Array[String]) }
+      attr_reader :ignored_versions
+
+      sig do
+        params(
+          release: Dependabot::Package::PackageRelease,
+          current_version: T.nilable(Dependabot::Version)
+        ).returns(T::Boolean)
+      end
+      def relevant?(release, current_version)
+        return false if release.yanked?
+        return false if current_version && release.version <= current_version
+        return false if unwanted_prerelease?(release)
+        return false if ignored?(release)
+        return false unless language_supported?(release)
+
+        requirements_allow?(release)
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def unwanted_prerelease?(release)
+        release.version.prerelease? && !wants_prerelease?
+      end
+
+      sig { returns(T::Boolean) }
+      def wants_prerelease?
+        return true if dependency.numeric_version&.prerelease?
+
+        dependency.requirements.any? do |requirement|
+          requirement_string = requirement.requirement_string || ""
+          requirement_string.split(",").map(&:strip).any? do |part|
+            version_string = part.gsub(/^\s*[!<>=~^]+\s*/, "").strip
+            next false unless dependency.version_class.correct?(version_string)
+
+            dependency.version_class.new(version_string).prerelease?
+          end
+        end
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def ignored?(release)
+        requirements = ignored_versions.flat_map do |requirement|
+          dependency.requirement_class.requirements_array(requirement)
+        end
+        requirements.any? { |requirement| requirement.satisfied_by?(release.version) }
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def language_supported?(release)
+        requirement = release.language&.requirement
+        !@language_version || !requirement || requirement.satisfied_by?(@language_version)
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def requirements_allow?(release)
+        return true unless @enforce_requirements
+
+        dependency.requirements.filter_map(&:requirement_string).all? do |requirement_string|
+          dependency.requirement_class.requirements_array(requirement_string).any? do |requirement|
+            requirement.satisfied_by?(release.version)
+          end
+        end
+      end
+
+      sig { params(filtered: T::Array[Dependabot::Package::PackageRelease]).void }
+      def mark_for_selected_release(filtered)
+        return if @releases.empty?
+
+        current_version = dependency.numeric_version
+        eligible = if @prefiltered
+                     filtered
+                   else
+                     filtered.select { |release| relevant?(release, current_version) }
+                   end
+        selected = (eligible + @releases.keys).max_by(&:version)
+        return unless selected
+
+        days = @releases[selected]
+        return unless days
+
+        Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+          dependency,
+          cooldown_days: days
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/package/npm_lockfile_details.rb

@@ -0,0 +1,37 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/errors"
+
+module Dependabot
+  module Package
+    class NpmLockfileDetails < T::ImmutableStruct
+      extend T::Sig
+
+      const :version, T.nilable(String), default: nil
+      const :resolved, T.nilable(String), default: nil
+      const :resolution, T.nilable(String), default: nil
+
+      sig { params(value: Object, path: String, context: String).returns(NpmLockfileDetails) }
+      def self.from_object(value, path:, context:)
+        raise DependencyFileNotParseable.new(path, "#{context} must be an object") unless value.is_a?(Hash)
+
+        new(
+          version: optional_string(T.cast(value["version"], Object), path, "#{context}.version"),
+          resolved: optional_string(T.cast(value["resolved"], Object), path, "#{context}.resolved"),
+          resolution: optional_string(T.cast(value["resolution"], Object), path, "#{context}.resolution")
+        )
+      end
+
+      sig { params(value: Object, path: String, field: String).returns(T.nilable(String)) }
+      def self.optional_string(value, path, field)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise DependencyFileNotParseable.new(path, "#{field} must be a string or nil")
+      end
+      private_class_method :optional_string
+    end
+  end
+end

data/lib/dependabot/package/npm_package_json.rb

@@ -0,0 +1,83 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/package/npm_package_manager_config"
+
+module Dependabot
+  module Package
+    class NpmPackageJson
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+      DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+
+      sig { params(file: DependencyFile).returns(NpmPackageJson) }
+      def self.from_file(file)
+        new(T.cast(JSON.parse(T.must(file.content)), Object), file.path)
+      end
+
+      sig { params(data: Object, path: String).void }
+      def initialize(data, path)
+        @path = path
+        @data = T.let(object_hash(data, "root"), ObjectHash)
+      end
+
+      sig do
+        params(_block: T.proc.params(name: String, requirement: String, type: String).void).void
+      end
+      def each_dependency(&_block)
+        DEPENDENCY_TYPES.each do |type|
+          dependencies = @data[type]
+          next unless dependencies
+
+          object_hash(dependencies, type).each do |name, requirement|
+            next unless requirement.is_a?(String)
+
+            yield name, requirement, type
+          end
+        end
+      end
+
+      sig { returns(T.nilable(String)) }
+      def name
+        value = @data["name"]
+        value if value.is_a?(String)
+      end
+
+      sig { returns(T::Boolean) }
+      def flat?
+        !!@data["flat"]
+      end
+
+      sig { returns(T::Boolean) }
+      def workspaces?
+        !!@data["workspaces"]
+      end
+
+      sig { returns(NpmPackageManagerConfig) }
+      def package_manager_config
+        NpmPackageManagerConfig.from_package_json(@data)
+      end
+
+      private
+
+      sig { params(value: Object, field: String).returns(ObjectHash) }
+      def object_hash(value, field)
+        raise TypeError, "#{@path}: #{field} must be an object" unless value.is_a?(Hash)
+
+        result = T.let({}, ObjectHash)
+        value.each do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{@path}: #{field} keys must be strings" unless key.is_a?(String)
+
+          result[key] = T.cast(raw_value, Object)
+        end
+        result
+      end
+    end
+  end
+end

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -12,10 +12,11 @@ require "dependabot/update_checkers/cooldown_calculation"
 require "dependabot/registry_client"
 require "dependabot/package/package_details"
 require "dependabot/package/release_cooldown_options"
+require "dependabot/package/cooldown_date_tracker"
 
 module Dependabot
   module Package
-    class PackageLatestVersionFinder
+    class PackageLatestVersionFinder # rubocop:disable Metrics/ClassLength
       extend T::Sig
       extend T::Helpers
 
@@ -79,6 +80,8 @@ module Dependabot
         @latest_version_with_no_unlock = T.let(nil, T.nilable(Dependabot::Version))
         @lowest_security_fix_version = T.let(nil, T.nilable(Dependabot::Version))
         @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+        cooldown_tracker = CooldownDateTracker.new(dependency: dependency, ignored_versions: ignored_versions)
+        @cooldown_tracker = T.let(cooldown_tracker, CooldownDateTracker)
       end
 
       sig do
@@ -121,15 +124,16 @@ module Dependabot
         @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
       end
 
-      sig do
-        returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
-      end
+      sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
       def available_versions
         package_details&.releases
       end
 
       protected
 
+      sig { returns(CooldownDateTracker) }
+      attr_reader :cooldown_tracker
+
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -139,12 +143,13 @@ module Dependabot
         return unless releases
 
         releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = filter_out_of_range_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases = @cooldown_tracker.filter(language_version:, requirements: true) do
+          filtered = filter_by_cooldown(releases)
+          filtered = filter_prerelease_versions(filter_unsupported_versions(filtered, language_version))
+          filtered = filter_ignored_versions(filtered)
+          filtered = filter_out_of_range_versions(filtered)
+          apply_post_fetch_latest_versions_filter(filtered)
+        end
         releases.max_by(&:version)&.version
       end
 
@@ -154,9 +159,8 @@ module Dependabot
       end
       def filter_yanked_versions(releases)
         filtered = releases.reject(&:yanked?)
-        if releases.count > filtered.count
-          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} yanked versions")
-        end
+        removed_count = releases.count - filtered.count
+        Dependabot.logger.info("Filtered out #{removed_count} yanked versions") if removed_count.positive?
         filtered
       end
 
@@ -165,8 +169,13 @@ module Dependabot
           .returns(T::Array[Dependabot::Package::PackageRelease])
       end
       def filter_by_cooldown(releases)
-        return releases unless cooldown_enabled?
-        return releases unless cooldown_options
+        unless @cooldown_tracker.active
+          return @cooldown_tracker.filter(language_version: nil, requirements: false) do
+            filter_by_cooldown(releases)
+          end
+        end
+
+        return releases unless cooldown_enabled? && cooldown_options
 
         filtered = releases.reject { |release| in_cooldown_period?(release) }
 
@@ -176,21 +185,11 @@ module Dependabot
 
         # If all releases were filtered out due to cooldown and we have a current version, use it as fallback
         if filtered.empty? && !releases.empty? && dependency.version
-          current_version_str = dependency.version
-
           Dependabot.logger.info(
             "All versions filtered by cooldown for #{dependency.name}, " \
-            "falling back to current version #{current_version_str}"
-          )
-
-          # Create a PackageRelease for the current version
-          current_version = version_class.new(current_version_str)
-          current_release = Dependabot::Package::PackageRelease.new(
-            version: current_version,
-            released_at: nil,
-            tag: nil
+            "falling back to current version #{dependency.version}"
           )
-          return [current_release]
+          return [cooldown_fallback_release]
         end
 
         filtered
@@ -198,20 +197,17 @@ module Dependabot
 
       sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
       def in_cooldown_period?(release)
-        return false unless release.released_at
+        current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+        days = cooldown_days_for(current_version, release.version)
+        return false unless days.positive?
 
-        cooldown = @cooldown_options
-        return false if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(
-          cooldown, dependency.name, cooldown_enabled: cooldown_enabled?
-        )
+        released_at = released_at_for(release)
+        unless released_at
+          @cooldown_tracker.record(release: release, current_version: current_version, days: days)
+          return missing_release_date_blocks_update?(release)
+        end
 
-        current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
-        days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
-          T.must(cooldown), current_version, release.version
-        )
-        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(
-          T.must(release.released_at), days
-        )
+        Dependabot::UpdateCheckers::CooldownCalculation.within_cooldown_window?(released_at, days)
       end
 
       sig do
@@ -223,10 +219,20 @@ module Dependabot
       end
       def filter_unsupported_versions(releases, language_version)
         filtered = releases.filter_map do |release|
-          language_requirement = release.language&.requirement
-          next release unless language_version
+          language = release.language
+          next release unless language_version && language
+
+          language_requirement = language.requirement
           next release unless language_requirement
-          next unless language_requirement.satisfied_by?(language_version)
+
+          unless language_requirement.satisfied_by?(language_version)
+            Dependabot.logger.info(
+              "Filtered out #{dependency.name} #{release.version} because " \
+              "#{language.name} requirement #{language_requirement} is not satisfied by " \
+              "#{language.name} #{language_version}"
+            )
+            next
+          end
 
           release
         end
@@ -361,6 +367,20 @@ module Dependabot
         true
       end
 
+      # Registries that only expose a publication date through a second request resolve it here.
+      sig { overridable.params(release: Dependabot::Package::PackageRelease).returns(T.nilable(Time)) }
+      def released_at_for(release)
+        release.released_at
+      end
+
+      sig { overridable.params(_release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def missing_release_date_blocks_update?(_release)
+        false
+      end
+
+      sig { overridable.returns(Dependabot::Package::PackageRelease) }
+      def cooldown_fallback_release = PackageRelease.new(version: version_class.new(T.must(dependency.version)))
+
       sig do
         params(language_version: T.nilable(T.any(String, Dependabot::Version)))
           .returns(T.nilable(Dependabot::Version))
@@ -378,11 +398,12 @@ module Dependabot
         return unless releases
 
         releases = filter_yanked_versions(releases)
-        releases = filter_by_cooldown(releases)
-        releases = filter_unsupported_versions(releases, language_version)
-        releases = filter_prerelease_versions(releases)
-        releases = filter_ignored_versions(releases)
-        releases = apply_post_fetch_latest_versions_filter(releases)
+        releases = @cooldown_tracker.filter(language_version:, requirements: false) do
+          filtered = filter_by_cooldown(releases)
+          filtered = filter_prerelease_versions(filter_unsupported_versions(filtered, language_version))
+          filtered = filter_ignored_versions(filtered)
+          apply_post_fetch_latest_versions_filter(filtered)
+        end
         releases.max_by(&:version)
       end
 

data/lib/dependabot/update_checkers/cooldown_calculation.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency"
 require "dependabot/package/release_cooldown_options"
 require "dependabot/version"
 
@@ -16,6 +17,14 @@ module Dependabot
       extend T::Sig
 
       DAY_IN_SECONDS = T.let(24 * 60 * 60, Integer)
+      DATE_UNAVAILABLE_METADATA_KEY = :cooldown_date_unavailable
+
+      # Shared by the pull request notice and the job-level warning so both channels
+      # report the same diagnostic, whether or not the update produced a pull request.
+      DATE_UNAVAILABLE_NOTICE_TYPE = "cooldown_date_unavailable"
+      DATE_UNAVAILABLE_TITLE = "Cooldown was not applied"
+      DATE_UNAVAILABLE_DESCRIPTION =
+        "Cooldown could not be applied because no publication date was available from the registry."
 
       sig { params(release_date: Time, cooldown_days: Integer).returns(T::Boolean) }
       def self.within_cooldown_window?(release_date, cooldown_days)
@@ -50,6 +59,18 @@ module Dependabot
       def self.skip_cooldown?(cooldown, dependency_name, cooldown_enabled: true)
         cooldown.nil? || !cooldown_enabled || !cooldown.included?(dependency_name)
       end
+
+      sig { params(dependency: Dependabot::Dependency, cooldown_days: Integer).void }
+      def self.mark_cooldown_date_unavailable(dependency, cooldown_days:)
+        return unless cooldown_days.positive?
+
+        dependency.metadata[DATE_UNAVAILABLE_METADATA_KEY] = true
+      end
+
+      sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
+      def self.cooldown_date_unavailable?(dependency)
+        dependency.metadata[DATE_UNAVAILABLE_METADATA_KEY] == true
+      end
     end
   end
 end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.395.0"
+  VERSION = "0.396.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -572,6 +572,9 @@ files:
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
+- lib/dependabot/package/cooldown_date_tracker.rb
+- lib/dependabot/package/npm_lockfile_details.rb
+- lib/dependabot/package/npm_package_json.rb
 - lib/dependabot/package/npm_package_manager_config.rb
 - lib/dependabot/package/npm_registry_package.rb
 - lib/dependabot/package/package_details.rb
@@ -631,7 +634,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib