dependabot-common 0.119.4 → 0.119.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c084a2dd6045074bdde8be081749cf0bb32dc4fcaa99b07bf6eea049cd798dd6
-  data.tar.gz: 3201d221483932d06cadd03304dcb8b65561bc1778d3aefca45416fc260e94cf
+  metadata.gz: ac20c5d159264edb3113a4e495d02e6c32f5e6aadb5cda883587aeabae475dde
+  data.tar.gz: d5086bb6a7669add859859632b19b2d4e8ddddc9d637f63a2fb101bcb30d92ef
 SHA512:
-  metadata.gz: 68a073b8397b7128e2f63076267e1f3efb4b7c3501674e7e657ac4ee3a6cd8e5d8f55e7cb368758045dddbb179289ec7a6a45f1eeca2d8376c9b9758d8ca8577
-  data.tar.gz: bc1cddb30b8d543019e3434963b224f3feb58cf50abe19b9a360606db3ba4340fcb8d007716302b29a9e25a79e305590b060285e19aa139a6c186203b81ca534
+  metadata.gz: 5c1cfdfdba4439500593adc35ca3bca20f32d55c0cf4e7436f09caa1b443cca135eee7607ef8c7dc7e5d385b66556d8f1698b80568f2e6068888faa8a76acc79
+  data.tar.gz: bb518e222b1fd04d0bccd69951ac5d7b58220ef1ed6ed8c7ad29825138f39632b4f605ec314776b14bce59e51025048cdd965aebf33445a9e0419f32b399d2d2

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -10,6 +10,7 @@ require "dependabot/pull_request_creator"
 module Dependabot
   class PullRequestCreator
     class MessageBuilder
+      require_relative "message_builder/metadata_presenter"
       require_relative "message_builder/issue_linker"
       require_relative "message_builder/link_and_mention_sanitizer"
       require_relative "pr_name_prefixer"
@@ -312,242 +313,20 @@ module Dependabot
         end.join
       end
 
-      def metadata_cascades_for_dep(dep)
-        break_tag = source_provider_supports_html? ? "\n<br />" : "\n\n"
-
-        msg = ""
-        msg += vulnerabilities_cascade(dep)
-        msg += release_cascade(dep)
-        msg += changelog_cascade(dep)
-        msg += upgrade_guide_cascade(dep)
-        msg += commits_cascade(dep)
-        msg += maintainer_changes_cascade(dep)
-        msg += break_tag unless msg == ""
-        "\n" + sanitize_links_and_mentions(msg, unsafe: true)
-      end
-
-      def vulnerabilities_cascade(dep)
-        fixed_vulns = vulnerabilities_fixed[dep.name]
-        return "" unless fixed_vulns&.any?
-
-        msg = ""
-        fixed_vulns.each { |v| msg += serialized_vulnerability_details(v) }
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Vulnerabilities fixed", body: msg)
-      end
-
-      def release_cascade(dep)
-        return "" unless releases_text(dep) && releases_url(dep)
-
-        msg = "*Sourced from [#{dep.display_name}'s releases]"\
-              "(#{releases_url(dep)}).*\n\n"
-        msg +=
-          begin
-            release_note_lines = releases_text(dep).split("\n").first(50)
-            release_note_lines = release_note_lines.map { |line| "> #{line}\n" }
-            if release_note_lines.count == 50
-              release_note_lines << truncated_line
-            end
-            release_note_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(
-          text: msg,
-          base_url: source_url(dep) + "/blob/HEAD/"
-        )
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Release notes", body: msg)
-      end
-
-      def changelog_cascade(dep)
-        return "" unless changelog_url(dep) && changelog_text(dep)
-
-        msg = "*Sourced from "\
-              "[#{dep.display_name}'s changelog](#{changelog_url(dep)}).*\n\n"
-        msg +=
-          begin
-            changelog_lines = changelog_text(dep).split("\n").first(50)
-            changelog_lines = changelog_lines.map { |line| "> #{line}\n" }
-            changelog_lines << truncated_line if changelog_lines.count == 50
-            changelog_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(text: msg, base_url: changelog_url(dep))
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Changelog", body: msg)
-      end
-
-      def upgrade_guide_cascade(dep)
-        return "" unless upgrade_url(dep) && upgrade_text(dep)
-
-        msg = "*Sourced from "\
-              "[#{dep.display_name}'s upgrade guide]"\
-              "(#{upgrade_url(dep)}).*\n\n"
-        msg +=
-          begin
-            upgrade_lines = upgrade_text(dep).split("\n").first(50)
-            upgrade_lines = upgrade_lines.map { |line| "> #{line}\n" }
-            upgrade_lines << truncated_line if upgrade_lines.count == 50
-            upgrade_lines.join
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = fix_relative_links(text: msg, base_url: upgrade_url(dep))
-        msg = sanitize_template_tags(msg)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Upgrade guide", body: msg)
-      end
-
-      def commits_cascade(dep)
-        return "" unless commits_url(dep) && commits(dep)
-
-        msg = ""
-
-        commits(dep).reverse.first(10).each do |commit|
-          title = commit[:message].strip.split("\n").first
-          title = title.slice(0..76) + "..." if title && title.length > 80
-          title = title&.gsub(/(?<=[^\w.-])([_*`~])/, '\\1')
-          sha = commit[:sha][0, 7]
-          msg += "- [`#{sha}`](#{commit[:html_url]}) #{title}\n"
-        end
-
-        msg = msg.gsub(/\<.*?\>/) { |tag| "\\#{tag}" }
-
-        msg +=
-          if commits(dep).count > 10
-            "- Additional commits viewable in "\
-            "[compare view](#{commits_url(dep)})\n"
-          else
-            "- See full diff in [compare view](#{commits_url(dep)})\n"
-          end
-        msg = link_issues(text: msg, dependency: dep)
-        msg = sanitize_links_and_mentions(msg)
-
-        build_details_tag(summary: "Commits", body: msg)
-      end
-
-      def maintainer_changes_cascade(dep)
-        return "" unless maintainer_changes(dep)
-
-        build_details_tag(
-          summary: "Maintainer changes",
-          body: sanitize_links_and_mentions(maintainer_changes(dep)) + "\n"
-        )
-      end
-
-      def build_details_tag(summary:, body:)
-        # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
-        # CodeCommit does not support the <details> tag (no url available)
-        if source_provider_supports_html?
-          msg = "<details>\n<summary>#{summary}</summary>\n\n"
-          msg += body
-          msg + "</details>\n"
-        else
-          "\n\##{summary}\n\n#{body}"
-        end
-      end
-
-      def source_provider_supports_html?
-        !%w(azure codecommit).include?(source.provider)
-      end
-
-      def serialized_vulnerability_details(details)
-        msg = vulnerability_source_line(details)
-
-        if details["title"]
-          msg += "> **#{details['title'].lines.map(&:strip).join(' ')}**\n"
-        end
-
-        if (description = details["description"])
-          description.strip.lines.first(20).each { |line| msg += "> #{line}" }
-          msg += truncated_line if description.strip.lines.count > 20
-        end
-
-        msg += "\n" unless msg.end_with?("\n")
-        msg += "> \n"
-        msg += vulnerability_version_range_lines(details)
-        msg + "\n"
-      end
-
-      def vulnerability_source_line(details)
-        if details["source_url"] && details["source_name"]
-          "*Sourced from [#{details['source_name']}]"\
-          "(#{details['source_url']}).*\n\n"
-        elsif details["source_name"]
-          "*Sourced from #{details['source_name']}.*\n\n"
-        else
-          ""
-        end
-      end
-
-      def vulnerability_version_range_lines(details)
-        msg = ""
-        %w(patched_versions unaffected_versions affected_versions).each do |tp|
-          type = tp.split("_").first.capitalize
-          next unless details[tp]
-
-          versions_string = details[tp].any? ? details[tp].join("; ") : "none"
-          versions_string = versions_string.gsub(/(?<!\\)~/, '\~')
-          msg += "> #{type} versions: #{versions_string}\n"
-        end
-        msg
-      end
-
-      def truncated_line
-        # Tables can spill out of truncated details, so we close them
-        "></tr></table> ... (truncated)\n"
-      end
-
-      def releases_url(dependency)
-        metadata_finder(dependency).releases_url
-      end
-
-      def releases_text(dependency)
-        metadata_finder(dependency).releases_text
-      end
-
-      def changelog_url(dependency)
-        metadata_finder(dependency).changelog_url
-      end
-
-      def changelog_text(dependency)
-        metadata_finder(dependency).changelog_text
-      end
-
-      def upgrade_url(dependency)
-        metadata_finder(dependency).upgrade_guide_url
-      end
-
-      def upgrade_text(dependency)
-        metadata_finder(dependency).upgrade_guide_text
-      end
-
-      def commits_url(dependency)
-        metadata_finder(dependency).commits_url
-      end
-
-      def commits(dependency)
-        metadata_finder(dependency).commits
-      end
-
-      def maintainer_changes(dependency)
-        metadata_finder(dependency).maintainer_changes
+      def metadata_cascades_for_dep(dependency)
+        MetadataPresenter.new(
+          dependency: dependency,
+          source: source,
+          metadata_finder: metadata_finder(dependency),
+          vulnerabilities_fixed: vulnerabilities_fixed[dependency.name],
+          github_redirection_service: github_redirection_service
+        ).to_s
       end
 
       def source_url(dependency)
         metadata_finder(dependency).source_url
       end
 
-      def homepage_url(dependency)
-        metadata_finder(dependency).homepage_url
-      end
-
       def metadata_finder(dependency)
         @metadata_finder ||= {}
         @metadata_finder[dependency.name] ||=
@@ -656,48 +435,6 @@ module Dependabot
         raise "No new requirement!"
       end
 
-      def link_issues(text:, dependency:)
-        IssueLinker.
-          new(source_url: source_url(dependency)).
-          link_issues(text: text)
-      end
-
-      def fix_relative_links(text:, base_url:)
-        text.gsub(/\[.*?\]\([^)]+\)/) do |link|
-          next link if link.include?("://")
-
-          relative_path = link.match(/\((.*?)\)/).captures.last
-          base = base_url.split("://").last.gsub(%r{[^/]*$}, "")
-          path = File.join(base, relative_path)
-          absolute_path =
-            base_url.sub(
-              %r{(?<=://).*$},
-              Pathname.new(path).cleanpath.to_s
-            )
-          link.gsub(relative_path, absolute_path)
-        end
-      end
-
-      def sanitize_links_and_mentions(text, unsafe: false)
-        return text unless source.provider == "github"
-
-        LinkAndMentionSanitizer.
-          new(github_redirection_service: github_redirection_service).
-          sanitize_links_and_mentions(text: text, unsafe: unsafe)
-      end
-
-      def sanitize_template_tags(text)
-        text.gsub(/\<.*?\>/) do |tag|
-          tag_contents = tag.match(/\<(.*?)\>/).captures.first.strip
-
-          # Unclosed calls to template overflow out of the blockquote block,
-          # wrecking the rest of our PRs. Other tags don't share this problem.
-          next "\\#{tag}" if tag_contents.start_with?("template")
-
-          tag
-        end
-      end
-
       def ref_changed?(dependency)
         previous_ref(dependency) != new_ref(dependency)
       end

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -0,0 +1,283 @@
+# frozen_string_literal: true
+
+require "dependabot/pull_request_creator/message_builder"
+
+module Dependabot
+  class PullRequestCreator
+    class MessageBuilder
+      class MetadataPresenter
+        extend Forwardable
+
+        attr_reader :dependency, :source, :metadata_finder,
+                    :vulnerabilities_fixed, :github_redirection_service
+
+        def_delegators :metadata_finder,
+                       :changelog_url,
+                       :changelog_text,
+                       :commits_url,
+                       :commits,
+                       :maintainer_changes,
+                       :releases_url,
+                       :releases_text,
+                       :source_url,
+                       :upgrade_guide_url,
+                       :upgrade_guide_text
+
+        def initialize(dependency:, source:, metadata_finder:,
+                       vulnerabilities_fixed:, github_redirection_service:)
+          @dependency = dependency
+          @source = source
+          @metadata_finder = metadata_finder
+          @vulnerabilities_fixed = vulnerabilities_fixed
+          @github_redirection_service = github_redirection_service
+        end
+
+        def to_s
+          msg = ""
+          msg += vulnerabilities_cascade
+          msg += release_cascade
+          msg += changelog_cascade
+          msg += upgrade_guide_cascade
+          msg += commits_cascade
+          msg += maintainer_changes_cascade
+          msg += break_tag unless msg == ""
+          "\n" + sanitize_links_and_mentions(msg, unsafe: true)
+        end
+
+        private
+
+        def vulnerabilities_cascade
+          return "" unless vulnerabilities_fixed&.any?
+
+          msg = ""
+          vulnerabilities_fixed.each do |v|
+            msg += serialized_vulnerability_details(v)
+          end
+
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Vulnerabilities fixed", body: msg)
+        end
+
+        def release_cascade
+          return "" unless releases_text && releases_url
+
+          msg = "*Sourced from [#{dependency.display_name}'s releases]"\
+                "(#{releases_url}).*\n\n"
+          msg +=
+            begin
+              release_note_lines = releases_text.split("\n").first(50)
+              release_note_lines =
+                release_note_lines.map { |line| "> #{line}\n" }
+              if release_note_lines.count == 50
+                release_note_lines << truncated_line
+              end
+              release_note_lines.join
+            end
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(
+            text: msg,
+            base_url: source_url + "/blob/HEAD/"
+          )
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Release notes", body: msg)
+        end
+
+        def changelog_cascade
+          return "" unless changelog_url && changelog_text
+
+          msg = "*Sourced from "\
+                "[#{dependency.display_name}'s changelog]"\
+                "(#{changelog_url}).*\n\n"
+          msg +=
+            begin
+              changelog_lines = changelog_text.split("\n").first(50)
+              changelog_lines = changelog_lines.map { |line| "> #{line}\n" }
+              changelog_lines << truncated_line if changelog_lines.count == 50
+              changelog_lines.join
+            end
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(text: msg, base_url: changelog_url)
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Changelog", body: msg)
+        end
+
+        def upgrade_guide_cascade
+          return "" unless upgrade_guide_url && upgrade_guide_text
+
+          msg = "*Sourced from "\
+                "[#{dependency.display_name}'s upgrade guide]"\
+                "(#{upgrade_guide_url}).*\n\n"
+          msg +=
+            begin
+              upgrade_lines = upgrade_guide_text.split("\n").first(50)
+              upgrade_lines = upgrade_lines.map { |line| "> #{line}\n" }
+              upgrade_lines << truncated_line if upgrade_lines.count == 50
+              upgrade_lines.join
+            end
+          msg = link_issues(text: msg)
+          msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
+          msg = sanitize_template_tags(msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Upgrade guide", body: msg)
+        end
+
+        def commits_cascade
+          return "" unless commits_url && commits
+
+          msg = ""
+
+          commits.reverse.first(10).each do |commit|
+            title = commit[:message].strip.split("\n").first
+            title = title.slice(0..76) + "..." if title && title.length > 80
+            title = title&.gsub(/(?<=[^\w.-])([_*`~])/, '\\1')
+            sha = commit[:sha][0, 7]
+            msg += "- [`#{sha}`](#{commit[:html_url]}) #{title}\n"
+          end
+
+          msg = msg.gsub(/\<.*?\>/) { |tag| "\\#{tag}" }
+
+          msg +=
+            if commits.count > 10
+              "- Additional commits viewable in "\
+              "[compare view](#{commits_url})\n"
+            else
+              "- See full diff in [compare view](#{commits_url})\n"
+            end
+          msg = link_issues(text: msg)
+          msg = sanitize_links_and_mentions(msg)
+
+          build_details_tag(summary: "Commits", body: msg)
+        end
+
+        def maintainer_changes_cascade
+          return "" unless maintainer_changes
+
+          build_details_tag(
+            summary: "Maintainer changes",
+            body: sanitize_links_and_mentions(maintainer_changes) + "\n"
+          )
+        end
+
+        def build_details_tag(summary:, body:)
+          # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
+          # CodeCommit does not support the <details> tag (no url available)
+          if source_provider_supports_html?
+            msg = "<details>\n<summary>#{summary}</summary>\n\n"
+            msg += body
+            msg + "</details>\n"
+          else
+            "\n\##{summary}\n\n#{body}"
+          end
+        end
+
+        def serialized_vulnerability_details(details)
+          msg = vulnerability_source_line(details)
+
+          if details["title"]
+            msg += "> **#{details['title'].lines.map(&:strip).join(' ')}**\n"
+          end
+
+          if (description = details["description"])
+            description.strip.lines.first(20).each { |line| msg += "> #{line}" }
+            msg += truncated_line if description.strip.lines.count > 20
+          end
+
+          msg += "\n" unless msg.end_with?("\n")
+          msg += "> \n"
+          msg += vulnerability_version_range_lines(details)
+          msg + "\n"
+        end
+
+        def vulnerability_source_line(details)
+          if details["source_url"] && details["source_name"]
+            "*Sourced from [#{details['source_name']}]"\
+            "(#{details['source_url']}).*\n\n"
+          elsif details["source_name"]
+            "*Sourced from #{details['source_name']}.*\n\n"
+          else
+            ""
+          end
+        end
+
+        def vulnerability_version_range_lines(details)
+          msg = ""
+          %w(
+            patched_versions
+            unaffected_versions
+            affected_versions
+          ).each do |tp|
+            type = tp.split("_").first.capitalize
+            next unless details[tp]
+
+            versions_string = details[tp].any? ? details[tp].join("; ") : "none"
+            versions_string = versions_string.gsub(/(?<!\\)~/, '\~')
+            msg += "> #{type} versions: #{versions_string}\n"
+          end
+          msg
+        end
+
+        def link_issues(text:)
+          IssueLinker.
+            new(source_url: source_url).
+            link_issues(text: text)
+        end
+
+        def fix_relative_links(text:, base_url:)
+          text.gsub(/\[.*?\]\([^)]+\)/) do |link|
+            next link if link.include?("://")
+
+            relative_path = link.match(/\((.*?)\)/).captures.last
+            base = base_url.split("://").last.gsub(%r{[^/]*$}, "")
+            path = File.join(base, relative_path)
+            absolute_path =
+              base_url.sub(
+                %r{(?<=://).*$},
+                Pathname.new(path).cleanpath.to_s
+              )
+            link.gsub(relative_path, absolute_path)
+          end
+        end
+
+        def truncated_line
+          # Tables can spill out of truncated details, so we close them
+          "></tr></table> \n ... (truncated)\n"
+        end
+
+        def break_tag
+          source_provider_supports_html? ? "\n<br />" : "\n\n"
+        end
+
+        def source_provider_supports_html?
+          !%w(azure codecommit).include?(source.provider)
+        end
+
+        def sanitize_links_and_mentions(text, unsafe: false)
+          return text unless source.provider == "github"
+
+          LinkAndMentionSanitizer.
+            new(github_redirection_service: github_redirection_service).
+            sanitize_links_and_mentions(text: text, unsafe: unsafe)
+        end
+
+        def sanitize_template_tags(text)
+          text.gsub(/\<.*?\>/) do |tag|
+            tag_contents = tag.match(/\<(.*?)\>/).captures.first.strip
+
+            # Unclosed calls to template overflow out of the blockquote block,
+            # wrecking the rest of our PRs. Other tags don't share this problem.
+            next "\\#{tag}" if tag_contents.start_with?("template")
+
+            tag
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.119.4"
+  VERSION = "0.119.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.119.4
+  version: 0.119.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-15 00:00:00.000000000 Z
+date: 2020-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -376,6 +376,7 @@ files:
 - lib/dependabot/pull_request_creator/message_builder.rb
 - lib/dependabot/pull_request_creator/message_builder/issue_linker.rb
 - lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb
+- lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb
 - lib/dependabot/pull_request_creator/pr_name_prefixer.rb
 - lib/dependabot/pull_request_updater.rb
 - lib/dependabot/pull_request_updater/github.rb