dependabot-common 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca5d9fe2c8d7aed67f4d924ed8ccbe5ebe3c943ede793a6839d9d56f3451f042
-  data.tar.gz: ccfff2df64d29f5aadc3da412298efd882fd871cce94a84cba03f80e2f8540d0
+  metadata.gz: fc220d7e1f8b9cec96db4b1c7370be208280362af746d10f95b870dc5b8ea157
+  data.tar.gz: 28408b1720f78b67fffca107bc3ddc8ba53a44db8d54558de1c66b741f470d90
 SHA512:
-  metadata.gz: 315d65c2835be9e73dde08b837325d7091542e02035192f96e866ec84d521eedb18707da905e84c1c7a5ac9ec38e1660c1241eb607ed0eddbe0120be78a9c7ce
-  data.tar.gz: 5978d638b88f6fc39395421fb3f96c341205f80d9ecec77faaddb53adc9b28f2c719f7c0062987a26d6820baec24c40f28d8412fc94f6250d63cc11c32770e00
+  metadata.gz: b87cf3edd3ac55c71a51357328b8ed27ff692112fa005db0df5c99c5321031294a8f393a5ef9c98a1c51e99a91d97ca85bc966819b1fffeae4e5eab96f1845f2
+  data.tar.gz: dd31e7780197c72eb73c3cca592cc71c6868db3d65e111d9217e3f8afa7823f277efec547c9abb39b3e201f25ddc148739cebb237c2ca065f8b4c3b46504d81a

data/lib/dependabot/errors.rb

@@ -256,6 +256,13 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    # TODO: switch to a dedicated error type once dependabot-api accepts one.
+    # Until then, reuse a type whose message is shown to users.
+    when Dependabot::DependencyChecksumMismatch
+      {
+        "error-type": "dependency_file_not_resolvable",
+        "error-detail": { message: error.message }
+      }
     when Dependabot::BranchNameFormattingError
       {
         "error-type": "branch_name_formatting_error",
@@ -720,6 +727,27 @@ module Dependabot
 
   class DependencyFileContentNotChanged < DependabotError; end
 
+  # Raised when the package manager refuses to continue because two sources
+  # (e.g. a lockfile and a registry) report different checksums for the same
+  # dependency version. It deliberately does not inherit from
+  # DependencyFileNotResolvable: callers that treat "not resolvable" as "no
+  # update available" must not hide this error.
+  class DependencyChecksumMismatch < DependabotError
+    extend T::Sig
+
+    # The dependency as the package manager names it, including any platform
+    # suffix (e.g. "nokogiri (1.16.0-x86_64-linux)"). Nil when it can't be
+    # determined.
+    sig { returns(T.nilable(String)) }
+    attr_reader :dependency_name
+
+    sig { params(message: String, dependency_name: T.nilable(String)).void }
+    def initialize(message, dependency_name: nil)
+      @dependency_name = dependency_name
+      super(message)
+    end
+  end
+
   class BadRequirementError < Gem::Requirement::BadRequirementError; end
 
   #######################

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -39,15 +39,18 @@ module Dependabot
           # rubocop:disable-next Performance/DeletePrefix
           relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(T.must(target_directory))
 
+          # Pass the path as a single argument and use NUL-separated output so
+          # paths containing whitespace are preserved. Keep stderr separate so
+          # warnings (e.g. a missing target directory) aren't parsed as entries
           status = T.let(
             SharedHelpers.run_shell_command(
-              "git status --untracked-files all --porcelain v1 #{relative_dir}",
-              fingerprint: "git status --untracked-files all --porcelain v1 <relative_dir>"
+              ["git", "status", "--untracked-files=all", "--porcelain=v1", "-z", "--", relative_dir.to_s],
+              fingerprint: "git status --untracked-files=all --porcelain=v1 -z -- <relative_dir>",
+              stderr_to_stdout: false
             ),
             String
           )
-          changed_paths = status.split("\n").map(&:split)
-          changed_paths.filter_map do |type, path|
+          parse_status(status).filter_map do |type, path|
             project_root = Pathname.new(File.expand_path(File.join(Dir.pwd, base_directory)))
             file_path = Pathname.new(path).expand_path.relative_path_from(project_root)
 
@@ -62,7 +65,7 @@ module Dependabot
             operation = Dependabot::DependencyFile::Operation::DELETE if type == "D"
             operation = Dependabot::DependencyFile::Operation::CREATE if type == "??"
 
-            encoded_content, encoding = get_encoded_file_contents(T.must(path), operation)
+            encoded_content, encoding = get_encoded_file_contents(path, operation)
 
             create_dependency_file(
               name: file_path.to_s,
@@ -82,6 +85,26 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path
 
+      # Parses `git status --porcelain=v1 -z` output into [type, path] pairs.
+      # Each entry is "XY <path>"; renames and copies are followed by an extra
+      # entry holding the original path, which we skip.
+      sig { params(status: String).returns(T::Array[[String, String]]) }
+      def parse_status(status)
+        entries = status.split("\0")
+        changes = T.let([], T::Array[[String, String]])
+
+        until entries.empty?
+          entry = T.must(entries.shift)
+          next if entry.empty?
+
+          code = T.must(entry[0, 2])
+          changes << [code.strip, T.must(entry[3..])]
+          entries.shift if code.match?(/[RC]/)
+        end
+
+        changes
+      end
+
       sig { returns(T.nilable(String)) }
       attr_reader :target_directory
 
@@ -111,8 +134,11 @@ module Dependabot
       def binary_file?(path)
         return false unless File.exist?(path)
 
-        command = SharedHelpers.escape_command("file -b --mime-encoding #{path}")
-        encoding = `#{command}`.strip
+        encoding = SharedHelpers.run_shell_command(
+          ["file", "-b", "--mime-encoding", "--", path],
+          fingerprint: "file -b --mime-encoding -- <path>",
+          stderr_to_stdout: false
+        ).strip
 
         !TEXT_ENCODINGS.include?(encoding)
       end

data/lib/dependabot/package/npm_package_json.rb

@@ -13,7 +13,9 @@ module Dependabot
       extend T::Sig
 
       ObjectHash = T.type_alias { T::Hash[String, Object] }
+      CatalogEntries = T.type_alias { T::Hash[String, String] }
       DEPENDENCY_TYPES = %w(dependencies devDependencies optionalDependencies).freeze
+      CATALOG_FIELDS = %w(catalog catalogs).freeze
 
       sig { params(file: DependencyFile).returns(NpmPackageJson) }
       def self.from_file(file)
@@ -63,8 +65,62 @@ module Dependabot
         NpmPackageManagerConfig.from_package_json(@data)
       end
 
+      # The default catalog that `catalog:` requirements resolve against.
+      sig { returns(CatalogEntries) }
+      def catalog
+        prefix, fields = catalog_fields
+        value = fields["catalog"]
+        return {} unless value
+
+        catalog_entries(value, "#{prefix}catalog")
+      end
+
+      # Named catalogs that `catalog:<name>` requirements resolve against,
+      # keyed by catalog name. `default` extends the default catalog.
+      sig { returns(T::Hash[String, CatalogEntries]) }
+      def catalogs
+        prefix, fields = catalog_fields
+        value = fields["catalogs"]
+        return {} unless value
+
+        field = "#{prefix}catalogs"
+        result = T.let({}, T::Hash[String, CatalogEntries])
+        object_hash(value, field).each do |name, entries|
+          result[name] = catalog_entries(entries, "#{field}.#{name}")
+        end
+        result
+      end
+
+      # The key of the object Bun reads both catalog fields from, or nil for
+      # the root. Bun reads them from `workspaces` when it declares either of
+      # them, and ignores the root fields in that case.
+      sig { returns(T.nilable(String)) }
+      def catalog_container
+        workspaces = @data["workspaces"]
+        return unless workspaces.is_a?(Hash)
+
+        "workspaces" if CATALOG_FIELDS.any? { |field| object_hash(workspaces, "workspaces").key?(field) }
+      end
+
       private
 
+      sig { returns([String, ObjectHash]) }
+      def catalog_fields
+        container = catalog_container
+        return ["", @data] unless container
+
+        ["#{container}.", object_hash(@data[container], container)]
+      end
+
+      sig { params(value: Object, field: String).returns(CatalogEntries) }
+      def catalog_entries(value, field)
+        entries = T.let({}, CatalogEntries)
+        object_hash(value, field).each do |name, requirement|
+          entries[name] = requirement if requirement.is_a?(String)
+        end
+        entries
+      end
+
       sig { params(value: Object, field: String).returns(ObjectHash) }
       def object_hash(value, field)
         raise TypeError, "#{@path}: #{field} must be an object" unless value.is_a?(Hash)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.400.0"
+  VERSION = "0.402.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib