dependabot-common 0.401.0 → 0.403.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7c9b0f34b253c6689d4cdd2d2bb85af222a8d65e336201471f374d51cca42c3
-  data.tar.gz: 65ec188d41768539a3bc7b17480dcc2babfaeb0189318aea7ae5a7a3fee6bae3
+  metadata.gz: 4a258c6dc5f27617a53546bc62d7cc32fd79e45537f4f3faeab967c9e94641b8
+  data.tar.gz: f1e203208a54733408e4b94c793185108349db7a493a0be78e2103754fabcfc5
 SHA512:
-  metadata.gz: 35db428ec5f1c2f7f4f45c6b8d4c28a6b8a8e44cc08aa1330c283df92837ee08b62bacbb69027ff3ca4a57be1d00eadc5762e0b640849f66f9a5b788a90ae256
-  data.tar.gz: 82b376c4f531f0b4a8e03128a6d942ba80b236b58d21d568c8604561281abaca6448e75ac1f4fee8ef55fce77f5f6c26db10138c5fa6c5cdc43395d3ba13ba92
+  metadata.gz: 2fb50fc39f60920d8889db4720c138a13c3de8737527c0c1426934789635a9a531d2ae9436a0974dc1744d6d4955c68c5d4ff2b8f08b6431c62fda38d207bbdf
+  data.tar.gz: 720e7093f19d80501c4bdac6819aff9e86ff61b9725df3f874729f8726437cf1ed7712e5c12bf8fab3e1ec6bb6beb115329fcd1654eec52372ccb9d92df3c5c4

data/lib/dependabot/errors.rb

@@ -256,6 +256,13 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    # TODO: switch to a dedicated error type once dependabot-api accepts one.
+    # Until then, reuse a type whose message is shown to users.
+    when Dependabot::DependencyChecksumMismatch
+      {
+        "error-type": "dependency_file_not_resolvable",
+        "error-detail": { message: error.message }
+      }
     when Dependabot::BranchNameFormattingError
       {
         "error-type": "branch_name_formatting_error",
@@ -720,6 +727,27 @@ module Dependabot
 
   class DependencyFileContentNotChanged < DependabotError; end
 
+  # Raised when the package manager refuses to continue because two sources
+  # (e.g. a lockfile and a registry) report different checksums for the same
+  # dependency version. It deliberately does not inherit from
+  # DependencyFileNotResolvable: callers that treat "not resolvable" as "no
+  # update available" must not hide this error.
+  class DependencyChecksumMismatch < DependabotError
+    extend T::Sig
+
+    # The dependency as the package manager names it, including any platform
+    # suffix (e.g. "nokogiri (1.16.0-x86_64-linux)"). Nil when it can't be
+    # determined.
+    sig { returns(T.nilable(String)) }
+    attr_reader :dependency_name
+
+    sig { params(message: String, dependency_name: T.nilable(String)).void }
+    def initialize(message, dependency_name: nil)
+      @dependency_name = dependency_name
+      super(message)
+    end
+  end
+
   class BadRequirementError < Gem::Requirement::BadRequirementError; end
 
   #######################

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -39,15 +39,18 @@ module Dependabot
           # rubocop:disable-next Performance/DeletePrefix
           relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(T.must(target_directory))
 
+          # Pass the path as a single argument and use NUL-separated output so
+          # paths containing whitespace are preserved. Keep stderr separate so
+          # warnings (e.g. a missing target directory) aren't parsed as entries
           status = T.let(
             SharedHelpers.run_shell_command(
-              "git status --untracked-files all --porcelain v1 #{relative_dir}",
-              fingerprint: "git status --untracked-files all --porcelain v1 <relative_dir>"
+              ["git", "status", "--untracked-files=all", "--porcelain=v1", "-z", "--", relative_dir.to_s],
+              fingerprint: "git status --untracked-files=all --porcelain=v1 -z -- <relative_dir>",
+              stderr_to_stdout: false
             ),
             String
           )
-          changed_paths = status.split("\n").map(&:split)
-          changed_paths.filter_map do |type, path|
+          parse_status(status).filter_map do |type, path|
             project_root = Pathname.new(File.expand_path(File.join(Dir.pwd, base_directory)))
             file_path = Pathname.new(path).expand_path.relative_path_from(project_root)
 
@@ -62,7 +65,7 @@ module Dependabot
             operation = Dependabot::DependencyFile::Operation::DELETE if type == "D"
             operation = Dependabot::DependencyFile::Operation::CREATE if type == "??"
 
-            encoded_content, encoding = get_encoded_file_contents(T.must(path), operation)
+            encoded_content, encoding = get_encoded_file_contents(path, operation)
 
             create_dependency_file(
               name: file_path.to_s,
@@ -82,6 +85,26 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path
 
+      # Parses `git status --porcelain=v1 -z` output into [type, path] pairs.
+      # Each entry is "XY <path>"; renames and copies are followed by an extra
+      # entry holding the original path, which we skip.
+      sig { params(status: String).returns(T::Array[[String, String]]) }
+      def parse_status(status)
+        entries = status.split("\0")
+        changes = T.let([], T::Array[[String, String]])
+
+        until entries.empty?
+          entry = T.must(entries.shift)
+          next if entry.empty?
+
+          code = T.must(entry[0, 2])
+          changes << [code.strip, T.must(entry[3..])]
+          entries.shift if code.match?(/[RC]/)
+        end
+
+        changes
+      end
+
       sig { returns(T.nilable(String)) }
       attr_reader :target_directory
 
@@ -111,8 +134,11 @@ module Dependabot
       def binary_file?(path)
         return false unless File.exist?(path)
 
-        command = SharedHelpers.escape_command("file -b --mime-encoding #{path}")
-        encoding = `#{command}`.strip
+        encoding = SharedHelpers.run_shell_command(
+          ["file", "-b", "--mime-encoding", "--", path],
+          fingerprint: "file -b --mime-encoding -- <path>",
+          stderr_to_stdout: false
+        ).strip
 
         !TEXT_ENCODINGS.include?(encoding)
       end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.401.0"
+  VERSION = "0.403.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.401.0
+  version: 0.403.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
 rdoc_options: []
 require_paths:
 - lib