dependabot-common 0.403.0 → 0.404.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a258c6dc5f27617a53546bc62d7cc32fd79e45537f4f3faeab967c9e94641b8
-  data.tar.gz: f1e203208a54733408e4b94c793185108349db7a493a0be78e2103754fabcfc5
+  metadata.gz: 6ec6e0ecb3de7082a8de112f55736280cc9a51e2a9ec2303fec8750a2caa26c4
+  data.tar.gz: e29983ea289cc624336613747d36fc4553dc97da8304d211c944d22677740cab
 SHA512:
-  metadata.gz: 2fb50fc39f60920d8889db4720c138a13c3de8737527c0c1426934789635a9a531d2ae9436a0974dc1744d6d4955c68c5d4ff2b8f08b6431c62fda38d207bbdf
-  data.tar.gz: 720e7093f19d80501c4bdac6819aff9e86ff61b9725df3f874729f8726437cf1ed7712e5c12bf8fab3e1ec6bb6beb115329fcd1654eec52372ccb9d92df3c5c4
+  metadata.gz: 25a3383b36d13350554870237535aea892bc3ee8f51d1784256c154c4ee1ab985d8bf7fc51364abf0fa5b95fd6558c62f40c75094d34599fb201a329c23cf6fc
+  data.tar.gz: 1bfca8d6d91cc67b83457db323dd18e67f29eb7284fccc69c609d1f2d6350420cfd0a8ee46a8ea40f0da435864c3d964e60b16692fb3129083646406012297cd

data/lib/dependabot/git_commit_checker.rb

@@ -418,7 +418,7 @@ module Dependabot
     def allowed_versions(local_tags, filter_by_prefix: true)
       tags =
         local_tags
-        .select { |t| version_tag?(t.name) && (filter_by_prefix ? matches_existing_prefix?(t.name) : true) }
+        .select { |t| parsable_version_tag?(t.name) && (filter_by_prefix ? matches_existing_prefix?(t.name) : true) }
       filtered = tags
                  .reject { |t| tag_included_in_ignore_requirements?(t) }
       if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(tags).any?
@@ -594,6 +594,14 @@ module Dependabot
       tag.match?(VERSION_REGEX)
     end
 
+    # A tag can match VERSION_REGEX and still be rejected by the ecosystem's version class
+    # (e.g. `v1.2.2-python38` is not a valid PEP 440 version). Parsing such a tag raises,
+    # which would abort the update for the whole dependency, so treat it as a non-version tag.
+    sig { params(tag: String).returns(T::Boolean) }
+    def parsable_version_tag?(tag)
+      version_tag?(tag) && version_class.correct?(scan_version(tag))
+    end
+
     sig { params(tag: String).returns(T::Boolean) }
     def matches_existing_prefix?(tag)
       return true unless ref_or_branch

data/lib/dependabot/git_metadata_fetcher.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "fileutils"
 require "open3"
 require "sorbet-runtime"
 require "tmpdir"
@@ -9,6 +10,7 @@ require "dependabot/errors"
 require "dependabot/git_ref"
 require "dependabot/git_tag_with_detail"
 require "dependabot/credential"
+require "dependabot/logger"
 
 module Dependabot
   class GitMetadataFetcher
@@ -344,12 +346,10 @@ module Dependabot
       uri_ending_with_git += ".git" unless uri_ending_with_git.end_with?(".git") || skip_git_suffix(uri)
 
       Dir.mktmpdir do |dir|
-        # Clone the repository into a temporary directory
-        clone_command = "git clone --bare #{uri_ending_with_git} #{dir}"
         env = { "PATH" => ENV.fetch("PATH", nil), "GIT_TERMINAL_PROMPT" => "0" }
-        clone_command = SharedHelpers.escape_command(clone_command)
 
-        _stdout, stderr, process = Open3.capture3(env, clone_command)
+        # Clone the repository into a temporary directory
+        _stdout, stderr, process = clone_for_tag_details(env, uri_ending_with_git, dir)
         return GitResponse.new(body: stderr, status: 500) unless process.success?
 
         # Change to the cloned repository directory
@@ -376,6 +376,24 @@ module Dependabot
       GitResponse.new(body: e.message, status: 500)
     end
 
+    # Tag dates need only commits and tags, so skip trees and blobs: a full clone of a large
+    # repository can fill the disk or time out. Fall back to a full clone if the partial clone
+    # fails, so this never does worse than before.
+    sig do
+      params(env: T::Hash[String, T.nilable(String)], uri: String, dir: String)
+        .returns([String, String, Process::Status])
+    end
+    def clone_for_tag_details(env, uri, dir)
+      stdout, stderr, process = Open3.capture3(
+        env, SharedHelpers.escape_command("git clone --bare --filter=tree:0 #{uri} #{dir}")
+      )
+      return [stdout, stderr, process] if process.success?
+
+      Dependabot.logger.warn("Partial clone for tag dates failed, falling back to a full clone")
+      FileUtils.rm_rf(Dir.children(dir).map { |child| File.join(dir, child) })
+      Open3.capture3(env, SharedHelpers.escape_command("git clone --bare #{uri} #{dir}"))
+    end
+
     sig do
       params(ref: String).returns(String)
     end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -715,6 +715,9 @@ module Dependabot
         else
           dependency.display_name
         end
+      rescue StandardError => e
+        suppress_error("dependency link for #{dependency.name}", e)
+        dependency.display_name
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(String) }
@@ -746,6 +749,9 @@ module Dependabot
         msg += "\n- [Upgrade guide](#{upgrade_url(dep)})" if upgrade_url(dep)
         msg += "\n- [Commits](#{commits_url(dep)})" if commits_url(dep)
         msg
+      rescue StandardError => e
+        suppress_error("metadata links for #{dep.name}", e)
+        ""
       end
 
       sig { params(rows: T::Array[T::Array[String]]).returns(String) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.403.0"
+  VERSION = "0.404.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.403.0
+  version: 0.404.0
 platform: ruby
 authors:
 - Dependabot
@@ -635,7 +635,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.403.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.404.0
 rdoc_options: []
 require_paths:
 - lib