dependabot-common 0.398.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99a1186f2c1d2774ac7b98d572c505e6265ed6a0d7726b5f791bf5c71fd0a00d
-  data.tar.gz: de30ef9e06bfb21e5b125a3ae6dbab67ac8becb8b8b98aa1f022dc590a8a939a
+  metadata.gz: ca5d9fe2c8d7aed67f4d924ed8ccbe5ebe3c943ede793a6839d9d56f3451f042
+  data.tar.gz: ccfff2df64d29f5aadc3da412298efd882fd871cce94a84cba03f80e2f8540d0
 SHA512:
-  metadata.gz: c5b31d2978062c533aa6e2ef0409467c89bfb6ca8f35a25ca44949beb8e3bd4ca6e1b46312f64642d8a81223dfbeb33863c650a34f11fe9699dc741a406666c5
-  data.tar.gz: e97d86d961bf7cbe2fb0b2198d9a0c75882ce0350f679425bc96acc4d2414d776ae1198bf0263402e92d2a9cb1ce07e2c4699a4702ed8fe3482655d662d2359d
+  metadata.gz: 315d65c2835be9e73dde08b837325d7091542e02035192f96e866ec84d521eedb18707da905e84c1c7a5ac9ec38e1660c1241eb607ed0eddbe0120be78a9c7ce
+  data.tar.gz: 5978d638b88f6fc39395421fb3f96c341205f80d9ecec77faaddb53adc9b28f2c719f7c0062987a26d6820baec24c40f28d8412fc94f6250d63cc11c32770e00

data/lib/dependabot/config/file.rb

@@ -60,6 +60,7 @@ module Dependabot
 
       PACKAGE_MANAGER_LOOKUP = T.let(
         {
+          "apm" => "apm",
           "bazel" => "bazel",
           "bun" => "bun",
           "bundler" => "bundler",

data/lib/dependabot/git_commit_checker.rb

@@ -315,7 +315,7 @@ module Dependabot
       local_tags_matching_sha(commit_sha).map(&:name)
     end
 
-    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
+    sig { overridable.params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
     def max_local_tag(tags)
       max_version_tag = tags.max_by { |t| version_from_tag(t) }
 
@@ -589,7 +589,7 @@ module Dependabot
       dependency_source_details&.ref
     end
 
-    sig { params(tag: String).returns(T::Boolean) }
+    sig { overridable.params(tag: String).returns(T::Boolean) }
     def version_tag?(tag)
       tag.match?(VERSION_REGEX)
     end
@@ -605,7 +605,7 @@ module Dependabot
       end
     end
 
-    sig { params(tag: String, other_tag: String).returns(T::Boolean) }
+    sig { overridable.params(tag: String, other_tag: String).returns(T::Boolean) }
     def same_prefix?(tag, other_tag)
       tag_prefix = tag.gsub(VERSION_REGEX, "")
       other_tag_prefix = other_tag.gsub(VERSION_REGEX, "")
@@ -796,7 +796,7 @@ module Dependabot
       version_class.new(scan_version(name))
     end
 
-    sig { params(name: String).returns(String) }
+    sig { overridable.params(name: String).returns(String) }
     def scan_version(name)
       T.must(T.must(name.match(VERSION_REGEX)).named_captures.fetch("version"))
     end

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -378,8 +378,9 @@ module Dependabot
         def new_version
           # New version looks like a git SHA and there's a new ref, guarding
           # against changes to a nil new_ref (not certain this can actually
-          # happen atm)
-          if T.must(dependency.version).match?(/^[0-9a-f]{40}$/) && ref_changed? &&
+          # happen atm). A requirement-only update, such as a Julia stdlib's
+          # compat entry, has no version at all.
+          if dependency.version&.match?(/^[0-9a-f]{40}$/) && ref_changed? &&
              new_ref
             return new_ref
           end

data/lib/dependabot/notices.rb

@@ -158,15 +158,16 @@ module Dependabot
 
     sig { params(mode: String).returns(String) }
     def self.markdown_mode(mode)
+      # GitHub has no INFO alert; it renders NOTE, TIP, IMPORTANT, WARNING and CAUTION
       case mode
       when NoticeMode::INFO
-        "INFO"
+        "NOTE"
       when NoticeMode::WARN
         "WARNING"
       when NoticeMode::ERROR
         "IMPORTANT"
       else
-        "INFO"
+        "NOTE"
       end
     end
   end

data/lib/dependabot/package/package_release.rb

@@ -59,6 +59,9 @@ module Dependabot
       sig { returns(T.nilable(Time)) }
       attr_reader :released_at
 
+      sig { params(released_at: T.nilable(Time)).returns(T.nilable(Time)) }
+      attr_writer :released_at
+
       sig { returns(T::Boolean) }
       attr_reader :latest
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -341,7 +341,9 @@ module Dependabot
         subject = pr_name.gsub("⬆️", ":arrow_up:").gsub("🔒", ":lock:")
         return subject unless subject.length > 72
 
-        subject = subject.gsub(/ from [^\s]*? to [^\s]*/, "")
+        # Requirements can contain spaces ("^0.20, ^0.21"), so match up to the
+        # suffixes solo_pr_name adds rather than to the next space
+        subject = subject.sub(%r{ from .+? to .+?(?= \(via audit fix\)| in /|\z)}, "")
         return subject unless subject.length > 72
 
         T.must(subject.split(" in ").first)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.398.0"
+  VERSION = "0.400.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.400.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
 rdoc_options: []
 require_paths:
 - lib