dependabot-common 0.224.0 → 0.225.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 967a29e273078457f5010415215784a3bf9bd8b9cd78e101ab8d7dc97ab42fba
-  data.tar.gz: c840404ceecf85c06defa6748f5075c1e336e3878f0f18c3d1c6282b986d86b4
+  metadata.gz: eff50d0047fd94f2b62e76e55d42561e17780c26da251ba55cd04f493bce0cb5
+  data.tar.gz: 34d2e201f6198e4478a2b13d8e2c12162ae1a2e74b6c66ebfd45e12518379155
 SHA512:
-  metadata.gz: 1bdead2177caa4c1c9cd90371bf07cb8def978492718809f3a67ee995f24c4da02424989d25f87298ad2ac04b371c63108a9520d58e33d0b6f925446dfc0d5be
-  data.tar.gz: 2e5f484acea22c05982c2840317f7f559171ca239b846da310ac2ae40b7006fe10df16d1e26f204d3ccee0e163e8c51af5e283635f929edb1fbeaa5d6986c2ad
+  metadata.gz: 97d3947770789948f293026af11c4a8f065831ebf4c5ee5f06c3e2fe147766b5d4615b2497fbd7dfbfb4589a07df52a91de9c7041fe49cd74795fd3fb6be6437
+  data.tar.gz: 640a7855071b6c94d1a8e91972bf4e34792e6ffcf02ac38d1bb6a42e985fdfc3479b994c645fdb24d77fe450f84e39aef0e6bef2ab41c0394989f9c63f792f19

data/lib/dependabot/dependency_group.rb

@@ -1,16 +1,42 @@
 # frozen_string_literal: true
 
+require "dependabot/experiments"
+require "dependabot/config/ignore_condition"
+require "dependabot/logger"
+
 require "wildcard_matcher"
 require "yaml"
 
 module Dependabot
   class DependencyGroup
+    ANY_DEPENDENCY_NAME = "*"
+    SECURITY_UPDATES_ONLY = false
+
+    DEFAULT_UPDATE_TYPES = [
+      SEMVER_MAJOR = "major",
+      SEMVER_MINOR = "minor",
+      SEMVER_PATCH = "patch"
+    ].freeze
+
+    IGNORE_CONDITION_TYPES = {
+      SEMVER_MAJOR => Dependabot::Config::IgnoreCondition::MAJOR_VERSION_TYPE,
+      SEMVER_MINOR => Dependabot::Config::IgnoreCondition::MINOR_VERSION_TYPE,
+      SEMVER_PATCH => Dependabot::Config::IgnoreCondition::PATCH_VERSION_TYPE
+    }.freeze
+
+    class NullIgnoreCondition
+      def ignored_versions(_dependency, _security_updates_only)
+        []
+      end
+    end
+
     attr_reader :name, :rules, :dependencies
 
     def initialize(name:, rules:)
       @name = name
       @rules = rules
       @dependencies = []
+      @ignore_condition = generate_ignore_condition!
     end
 
     def contains?(dependency)
@@ -20,6 +46,18 @@ module Dependabot
       matches_pattern?(dependency.name) && matches_dependency_type?(dependency)
     end
 
+    # This method generates ignored versions for the given Dependency based on
+    # the any update-types we have defined.
+    def ignored_versions_for(dependency)
+      @ignore_condition.ignored_versions(dependency, SECURITY_UPDATES_ONLY)
+    end
+
+    def targets_highest_versions_possible?
+      return true unless experimental_rules_enabled?
+
+      update_types.include?(SEMVER_MAJOR)
+    end
+
     def to_h
       { "name" => name }
     end
@@ -54,5 +92,49 @@ module Dependabot
                                     "development"
                                   end
     end
+
+    def pattern_rules?
+      rules.key?("patterns") && rules["patterns"]&.any?
+    end
+
+    def update_types
+      rules.fetch("update-types", DEFAULT_UPDATE_TYPES)
+    end
+
+    def generate_ignore_condition!
+      return NullIgnoreCondition.new unless experimental_rules_enabled?
+
+      ignored_update_types = ignored_update_types_for_rules
+
+      return NullIgnoreCondition.new unless ignored_update_types.any?
+
+      Dependabot.logger.debug("The #{name} group has set ignores for update-type(s): #{ignored_update_types}")
+
+      Dependabot::Config::IgnoreCondition.new(
+        dependency_name: ANY_DEPENDENCY_NAME,
+        update_types: ignored_update_types
+      )
+    end
+
+    def ignored_update_types_for_rules
+      unless update_types.is_a?(Array)
+        raise ArgumentError,
+              "The #{name} group has an unexpected value for update-types: '#{update_types}'"
+      end
+
+      unless update_types.any?
+        raise ArgumentError,
+              "The #{name} group has specified an empty array for update-types."
+      end
+
+      ignored_update_types = DEFAULT_UPDATE_TYPES - update_types
+      return [] if ignored_update_types.empty?
+
+      IGNORE_CONDITION_TYPES.fetch_values(*ignored_update_types)
+    end
+
+    def experimental_rules_enabled?
+      Dependabot::Experiments.enabled?(:grouped_updates_experimental_rules)
+    end
   end
 end

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -126,6 +126,7 @@ module Dependabot
               version: version,
               requirements: requirements,
               package_manager: old_dep.package_manager,
+              metadata: old_dep.metadata,
               subdependency_metadata: subdependency_metadata
             )
           end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -23,7 +23,7 @@ module Dependabot
                   :pr_message_header, :pr_message_footer,
                   :commit_message_options, :vulnerabilities_fixed,
                   :github_redirection_service, :dependency_group, :pr_message_max_length,
-                  :pr_message_encoding
+                  :pr_message_encoding, :ignore_conditions
 
       TRUNCATED_MSG = "...\n\n_Description has been truncated_"
 
@@ -31,7 +31,7 @@ module Dependabot
                      pr_message_header: nil, pr_message_footer: nil,
                      commit_message_options: {}, vulnerabilities_fixed: {},
                      github_redirection_service: DEFAULT_GITHUB_REDIRECTION_SERVICE,
-                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil)
+                     dependency_group: nil, pr_message_max_length: nil, pr_message_encoding: nil, ignore_conditions: [])
         @dependencies               = dependencies
         @files                      = files
         @source                     = source
@@ -44,6 +44,7 @@ module Dependabot
         @dependency_group           = dependency_group
         @pr_message_max_length      = pr_message_max_length
         @pr_message_encoding        = pr_message_encoding
+        @ignore_conditions          = ignore_conditions
       end
 
       attr_writer :pr_message_max_length
@@ -57,13 +58,31 @@ module Dependabot
       end
 
       def pr_message
-        msg = "#{suffixed_pr_message_header}#{commit_message_intro}#{metadata_cascades}#{prefixed_pr_message_footer}"
+        # TODO: Remove unignore_commands? feature flag once we are confident
+        # that it is working as expected
+        msg = if unignore_commands?
+                "#{suffixed_pr_message_header}" \
+                  "#{commit_message_intro}" \
+                  "#{metadata_cascades}" \
+                  "#{ignore_conditions_table}" \
+                  "#{prefixed_pr_message_footer}"
+              else
+                "#{suffixed_pr_message_header}" \
+                  "#{commit_message_intro}" \
+                  "#{metadata_cascades}" \
+                  "#{prefixed_pr_message_footer}"
+              end
+
         truncate_pr_message(msg)
       rescue StandardError => e
         Dependabot.logger.error("Error while generating PR message: #{e.message}")
         suffixed_pr_message_header + prefixed_pr_message_footer
       end
 
+      def unignore_commands?
+        Experiments.enabled?(:unignore_commands)
+      end
+
       # Truncate PR message as determined by the pr_message_max_length and pr_message_encoding instance variables
       # The encoding is used when calculating length, all messages are returned as ruby UTF_8 encoded string
       def truncate_pr_message(msg)
@@ -504,6 +523,46 @@ module Dependabot
         ).to_s
       end
 
+      def ignore_conditions_table
+        # Return an empty string if ignore_conditions is empty
+        return "" if @ignore_conditions.empty?
+
+        # Filter out the conditions where from_config_file is false and dependency is in @dependencies
+        valid_ignore_conditions = @ignore_conditions.select do |ic|
+          !ic[:from_config_file] && dependencies.any? { |dep| dep.name == ic[:dependency_name] }
+        end
+
+        # Return an empty string if no valid ignore conditions after filtering
+        return "" if valid_ignore_conditions.empty?
+
+        # Sort them by updated_at (or created_at if updated_at is nil), taking the latest 20
+        sorted_ignore_conditions = valid_ignore_conditions.sort_by { |ic| ic[:updated_at] || ic[:created_at] }.last(20)
+
+        # Map each condition to a row string
+        table_rows = sorted_ignore_conditions.map do |ic|
+          "| #{ic[:dependency_name]} | [#{ic[:version_requirement]}] |"
+        end
+
+        summary = "Most Recent Ignore Conditions Applied to This Pull Request"
+        build_table(summary, table_rows)
+      end
+
+      def build_table(summary, rows)
+        table_header = "| Dependency Name | Ignore Conditions |"
+        table_divider = "| --- | --- |"
+        table_body = rows.join("\n")
+        body = "\n#{[table_header, table_divider, table_body].join("\n")}\n"
+
+        if %w(azure bitbucket codecommit).include?(source.provider)
+          "\n##{summary}\n\n#{body}"
+        else
+          # Build the collapsible section
+          msg = "<details>\n<summary>#{summary}</summary>\n\n" \
+                "#{[table_header, table_divider, table_body].join("\n")}\n</details>"
+          "\n#{msg}\n"
+        end
+      end
+
       def changelog_url(dependency)
         metadata_finder(dependency).changelog_url
       end

data/lib/dependabot/update_checkers/base.rb

@@ -166,6 +166,7 @@ module Dependabot
           previous_version: previous_version,
           previous_requirements: dependency.requirements,
           package_manager: dependency.package_manager,
+          metadata: dependency.metadata,
           subdependency_metadata: dependency.subdependency_metadata
         )
       end
@@ -181,6 +182,7 @@ module Dependabot
           previous_version: previous_version,
           previous_requirements: dependency.requirements,
           package_manager: dependency.package_manager,
+          metadata: dependency.metadata,
           subdependency_metadata: dependency.subdependency_metadata
         )
       end

data/lib/dependabot.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.224.0"
+  VERSION = "0.225.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.224.0
+  version: 0.225.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-27 00:00:00.000000000 Z
+date: 2023-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -486,7 +486,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
 post_install_message: 
 rdoc_options: []
 require_paths: