dependabot-common 0.291.0 → 0.292.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cebae8e92439e403f480e7ffdcdb009582b7d5e196322fbdab8005048e77b05b
-  data.tar.gz: 724f55170bf99cb90ef277776daed5415e6bdb6ed3dd30bde35e849711e7b68f
+  metadata.gz: bc0d7a7acc0f4dcb2e25a622e816fd82a11a1553eecf85e6ae1e442ce5750ffb
+  data.tar.gz: 29e3f86968cb122e49a26f2866ee3554cb07ddbbda305e17d02ee4cb10099282
 SHA512:
-  metadata.gz: 127292cb53f8677d645cd9a51e89d16babcdacf8d5455c89e442c3022e728597142426ec88362e81082dbe8825ab5e4639f0f98600c644a7294ab9551d329931
-  data.tar.gz: ff5478b081ce3e05babd84dbc2f6730260dd73e676c093655d7c5577f6e45c0b9db9d9da328c6fef5b485e4446f8e2da6d21db7d270692ac6f57e11051c8bd02
+  metadata.gz: 14e6659eaa880f07f1d2562d89ba71a5f581bcf431edcc49983bf7b6819be8567e0bd252606daa744e0c7d3523d2fd1970e22699b1053179f648009517ca332f
+  data.tar.gz: 47e39f274165302b4a2da440f242ffb7fd2e635c535666d3c09dc968090fbf7187c614ce1ed642f3ea472093820918675bb7ae465d4cad48a8c644d7ef5d6db8

data/lib/dependabot/config/update_config.rb

@@ -32,6 +32,10 @@ module Dependabot
         normalizer = name_normaliser_for(dependency)
         dep_name = T.must(normalizer).call(dependency.name)
 
+        if dependency.version.nil? && dependency.requirements.any?
+          dependency = extract_base_version_from_requirement(dependency)
+        end
+
         @ignore_conditions
           .select { |ic| self.class.wildcard_match?(T.must(normalizer).call(ic.dependency_name), dep_name) }
           .map { |ic| ic.ignored_versions(dependency, security_updates_only) }
@@ -40,6 +44,19 @@ module Dependabot
           .uniq
       end
 
+      sig { params(dependency: Dependency).returns(Dependency) }
+      def extract_base_version_from_requirement(dependency)
+        requirements = dependency.requirements
+        requirement = T.must(requirements.first)[:requirement]
+        version = requirement&.match(/\d+\.\d+\.\d+/)&.to_s
+        Dependabot::Dependency.new(
+          name: dependency.name,
+          version: version,
+          requirements: dependency.requirements,
+          package_manager: dependency.package_manager
+        )
+      end
+
       sig { params(wildcard_string: T.nilable(String), candidate_string: T.nilable(String)).returns(T::Boolean) }
       def self.wildcard_match?(wildcard_string, candidate_string)
         return false unless wildcard_string && candidate_string

data/lib/dependabot/ecosystem.rb

@@ -17,30 +17,38 @@ module Dependabot
       abstract!
       # Initialize version information for a package manager or language.
       # @param name [String] the name of the package manager or language (e.g., "bundler", "ruby").
-      # @param version [Dependabot::Version] the parsed current version.
+      # @param detected_version [Dependabot::Version] the detected version of the package manager or language.
+      # @param version [Dependabot::Version] the version dependabots run on.
       # @param deprecated_versions [Array<Dependabot::Version>] an array of deprecated versions.
       # @param supported_versions [Array<Dependabot::Version>] an array of supported versions.
       # @param requirement [Dependabot::Requirement] an array of requirements.
       # @example
-      #   VersionManager.new("bundler", "2.1.4", nil)
+      #   VersionManager.new(
+      #   name: "bundler",
+      #   version: Version.new("2.1.4"),
+      #   requirement: nil
+      # )
       sig do
         params(
           name: String,
-          version: Dependabot::Version,
+          detected_version: T.nilable(Dependabot::Version),
+          version: T.nilable(Dependabot::Version),
           deprecated_versions: T::Array[Dependabot::Version],
           supported_versions: T::Array[Dependabot::Version],
           requirement: T.nilable(Dependabot::Requirement)
         ).void
       end
       def initialize(
-        name,
-        version,
-        deprecated_versions = [],
-        supported_versions = [],
-        requirement = nil
+        name:,
+        detected_version: nil,
+        version: nil,
+        deprecated_versions: [],
+        supported_versions: [],
+        requirement: nil
       )
         @name = T.let(name, String)
-        @version = T.let(version, Dependabot::Version)
+        @detected_version = T.let(detected_version || version, T.nilable(Dependabot::Version))
+        @version = T.let(version, T.nilable(Dependabot::Version))
         @deprecated_versions = T.let(deprecated_versions, T::Array[Dependabot::Version])
         @supported_versions = T.let(supported_versions, T::Array[Dependabot::Version])
         @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
@@ -52,10 +60,16 @@ module Dependabot
       sig { returns(String) }
       attr_reader :name
 
+      # The current version of the package manager or language.
+      # @example
+      #   detected_version #=> Dependabot::Version.new("2")
+      sig { returns(T.nilable(Dependabot::Version)) }
+      attr_reader :detected_version
+
       # The current version of the package manager or language.
       # @example
       #   version #=> Dependabot::Version.new("2.1.4")
-      sig { returns(Dependabot::Version) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       attr_reader :version
 
       # Returns an array of deprecated versions of the package manager.
@@ -76,16 +90,34 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Requirement)) }
       attr_reader :requirement
 
+      # The version of the package manager or language as a string.
+      # @example
+      # version_to_s #=> "2.1"
+      sig { returns(String) }
+      def version_to_s
+        version.to_s
+      end
+
+      # The raw version of the package manager or language.
+      # @example
+      #  raw_version #=> "2.1.4"
+      sig { returns(String) }
+      def version_to_raw_s
+        version&.to_semver.to_s
+      end
+
       # Checks if the current version is deprecated.
       # Returns true if the version is in the deprecated_versions array; false otherwise.
       # @example
       #   deprecated? #=> true
       sig { returns(T::Boolean) }
       def deprecated?
+        return false unless detected_version
+
         # If the version is unsupported, the unsupported error is getting raised separately.
         return false if unsupported?
 
-        deprecated_versions.include?(version)
+        deprecated_versions.include?(detected_version)
       end
 
       # Checks if the current version is unsupported.
@@ -93,16 +125,20 @@ module Dependabot
       #   unsupported? #=> false
       sig { returns(T::Boolean) }
       def unsupported?
+        return false unless detected_version
+
         return false if supported_versions.empty?
 
         # Check if the version is not supported
-        supported_versions.all? { |supported| supported > version }
+        supported_versions.all? { |supported| supported > detected_version }
       end
 
       # Raises an error if the current package manager or language version is unsupported.
       # If the version is unsupported, it raises a ToolVersionNotSupported error.
       sig { void }
       def raise_if_unsupported!
+        return unless detected_version
+
         return unless unsupported?
 
         # Example: v2.*, v3.*
@@ -110,7 +146,7 @@ module Dependabot
 
         raise ToolVersionNotSupported.new(
           name,
-          version.to_s,
+          detected_version.to_s,
           supported_versions_message
         )
       end

data/lib/dependabot/errors.rb

@@ -83,6 +83,11 @@ module Dependabot
       # and responsibility for fixing it is on them, not us. As a result we
       # quietly log these as errors
       { "error-type": "server_error" }
+    when BadRequirementError
+      {
+        "error-type": "illformed_requirement",
+        "error-detail": { message: error.message }
+      }
     when *Octokit::RATE_LIMITED_ERRORS
       # If we get a rate-limited error we let dependabot-api handle the
       # retry by re-enqueing the update job after the reset

data/lib/dependabot/file_fetchers/base.rb

@@ -311,7 +311,7 @@ module Dependabot
 
         SharedHelpers.with_git_configured(credentials: credentials) do
           Dir.chdir(T.must(repo_contents_path)) do
-            return SharedHelpers.run_shell_command("git rev-parse HEAD").strip
+            return SharedHelpers.run_shell_command("git rev-parse HEAD", stderr_to_stdout: false).strip
           end
         end
       end

data/lib/dependabot/notices.rb

@@ -71,15 +71,20 @@ module Dependabot
     # Generates a description for supported versions.
     # @param supported_versions [Array<Dependabot::Version>, nil] The supported versions of the package manager.
     # @param support_later_versions [Boolean] Whether later versions are supported.
+    # @param version_manager_type [Symbol] The type of entity being deprecated i.e. :language or :package_manager
     # @return [String, nil] The generated description or nil if no supported versions are provided.
     sig do
       params(
         supported_versions: T.nilable(T::Array[Dependabot::Version]),
-        support_later_versions: T::Boolean
+        support_later_versions: T::Boolean,
+        version_manager_type: Symbol
       ).returns(String)
     end
-    def self.generate_supported_versions_description(supported_versions, support_later_versions)
-      return "Please upgrade your package manager version" unless supported_versions&.any?
+    def self.generate_supported_versions_description(
+      supported_versions, support_later_versions, version_manager_type = :package_manager
+    )
+      entity_text = version_manager_type == :language ? "language" : "package manager"
+      return "Please upgrade your #{entity_text} version" unless supported_versions&.any?
 
       versions_string = supported_versions.map { |version| "`v#{version}`" }
 
@@ -94,25 +99,28 @@ module Dependabot
       "Please upgrade to one of the following versions: #{versions_string}#{later_description}."
     end
 
-    # Generates a deprecation notice for the given package manager.
-    # @param package_manager [VersionManager] The package manager object.
-    # @return [Notice, nil] The generated deprecation notice or nil if the package manager is not deprecated.
+    # Generates a deprecation notice for the given version manager.
+    # @param version_manager [VersionManager] The version manager object.
+    # @param version_manager_type [Symbol] The version manager type e.g. :language or :package_manager
+    # @return [Notice, nil] The generated deprecation notice or nil if the version manager is not deprecated.
     sig do
       params(
-        package_manager: Ecosystem::VersionManager
+        version_manager: Ecosystem::VersionManager,
+        version_manager_type: Symbol
       ).returns(T.nilable(Notice))
     end
-    def self.generate_pm_deprecation_notice(package_manager)
-      return nil unless package_manager.deprecated?
+    def self.generate_deprecation_notice(version_manager, version_manager_type = :package_manager)
+      return nil unless version_manager.deprecated?
 
       mode = NoticeMode::WARN
       supported_versions_description = generate_supported_versions_description(
-        package_manager.supported_versions,
-        package_manager.support_later_versions?
+        version_manager.supported_versions,
+        version_manager.support_later_versions?,
+        version_manager_type
       )
-      notice_type = "#{package_manager.name}_deprecated_warn"
-      title = "Package manager deprecation notice"
-      description = "Dependabot will stop supporting `#{package_manager.name} v#{package_manager.version}`!"
+      notice_type = "#{version_manager.name}_deprecated_warn"
+      title = version_manager_type == :language ? "Language deprecation notice" : "Package manager deprecation notice"
+      description = "Dependabot will stop supporting `#{version_manager.name} v#{version_manager.detected_version}`!"
 
       ## Add the supported versions to the description
       description += "\n\n#{supported_versions_description}\n" unless supported_versions_description.empty?
@@ -120,7 +128,7 @@ module Dependabot
       Notice.new(
         mode: mode,
         type: notice_type,
-        package_manager_name: package_manager.name,
+        package_manager_name: version_manager.name,
         title: title,
         description: description,
         show_in_pr: true,

data/lib/dependabot/workspace/git.rb

@@ -87,7 +87,7 @@ module Dependabot
 
       sig { returns(String) }
       def head_sha
-        run_shell_command("git rev-parse HEAD").strip
+        run_shell_command("git rev-parse HEAD", stderr_to_stdout: false).strip
       end
 
       sig { returns(String) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.291.0"
+  VERSION = "0.292.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.291.0
+  version: 0.292.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-19 00:00:00.000000000 Z
+date: 2025-01-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -615,7 +615,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.291.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.292.0
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -631,7 +631,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.7
 requirements: []
-rubygems_version: 3.5.9
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Shared code used across Dependabot Core