dependabot-common 0.298.0 → 0.299.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a5293ae603f618b6ff03ca6bf931ff8ab7f4a8860477de00f54359ffb563952
-  data.tar.gz: 11ab4fd76cd68304297406047e1082155bd2addf4a09317780353b9cf32d34af
+  metadata.gz: 308edc0918501450c0bbf3e4e47ad300066c0af1aa9bb7c09048aa9482a1736a
+  data.tar.gz: 0b4374edc5cbda986cb5f0fab59853dac8fff8a9eb7f97b5759515c2aca7e25f
 SHA512:
-  metadata.gz: 8d5ad662a18cf9b6e883f2183120570371120d623e3d84111e5e57190f24f3bf1b56813d33d7dc8ac3a402cf79a72d1c74eab0f49c0a3fc7f8a4262f8352355b
-  data.tar.gz: 954c8dad52e75aaab8246b16ece65a889a07d8d66f479696996532403dbeda8ad868b3581944e3710c123f1baaa11a039a51b985afb3de10eafcedc33de5785f
+  metadata.gz: 0fb7b5d7bebf9e30e936cda11c42dd7b0ed0cd92df6da8cdb0a3363f744f26f8c7bdbcc293855f794694220606823aa1f4b6a8ac222d70624d8b25de65a03ec4
+  data.tar.gz: 1a61dc7795d49209fc3808a62da372f06167471c4405e6aca232cb593ecdb232dd8d7d5dd42acea097bbee2e0653c305c9d2da5618e4fce054ccf1d787290b57

data/lib/dependabot/package/package_details.rb

@@ -0,0 +1,36 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+require "dependabot/package/package_release"
+
+# Stores metadata for a package, including all its available versions
+module Dependabot
+  module Package
+    class PackageDetails
+      extend T::Sig
+
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          releases: T::Array[Dependabot::Package::PackageRelease]
+        ).void
+      end
+      def initialize(dependency:, releases: [])
+        @dependency = T.let(dependency, Dependabot::Dependency)
+        @releases = T.let(
+          releases.sort_by(&:version).reverse,
+          T::Array[Dependabot::Package::PackageRelease]
+        )
+      end
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
+
+      sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+      attr_reader :releases
+    end
+  end
+end

data/lib/dependabot/package/package_language.rb

@@ -0,0 +1,33 @@
+# typed: strong
+# frozen_string_literal: true
+
+# Represents a single package version
+module Dependabot
+  module Package
+    class PackageLanguage
+      extend T::Sig
+
+      sig do
+        params(
+          name: String,
+          version: T.nilable(Dependabot::Version),
+          requirement: T.nilable(Dependabot::Requirement)
+        ).void
+      end
+      def initialize(name:, version: nil, requirement: nil)
+        @name = T.let(name, String)
+        @version = T.let(version, T.nilable(Dependabot::Version))
+        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
+      end
+
+      sig { returns(String) }
+      attr_reader :name
+
+      sig { returns(T.nilable(Dependabot::Version)) }
+      attr_reader :version
+
+      sig { returns(T.nilable(Dependabot::Requirement)) }
+      attr_reader :requirement
+    end
+  end
+end

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -0,0 +1,286 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "cgi"
+require "excon"
+require "nokogiri"
+require "sorbet-runtime"
+
+require "dependabot/security_advisory"
+require "dependabot/dependency"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/registry_client"
+require "dependabot/bundler"
+require "dependabot/package/package_details"
+
+module Dependabot
+  module Package
+    class PackageLatestVersionFinder
+      extend T::Sig
+      extend T::Helpers
+
+      abstract!
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
+
+      sig { returns(T::Array[T.untyped]) }
+      attr_reader :dependency_files
+
+      sig { returns(T::Array[T.untyped]) }
+      attr_reader :credentials
+
+      sig { returns(T::Array[String]) }
+      attr_reader :ignored_versions
+
+      sig { returns(T::Array[SecurityAdvisory]) }
+      attr_reader :security_advisories
+
+      sig { returns(T::Hash[Symbol, T.untyped]) }
+      attr_reader :options
+
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          dependency_files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[Dependabot::Credential],
+          ignored_versions: T::Array[String],
+          security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          raise_on_ignored: T::Boolean,
+          options: T::Hash[Symbol, T.untyped]
+        ).void
+      end
+      def initialize(
+        dependency:,
+        dependency_files:,
+        credentials:,
+        ignored_versions:,
+        security_advisories:,
+        raise_on_ignored: false,
+        options: {}
+      )
+        @dependency          = dependency
+        @dependency_files    = dependency_files
+        @credentials         = credentials
+        @ignored_versions    = ignored_versions
+        @security_advisories = security_advisories
+        @raise_on_ignored    = raise_on_ignored
+        # It can be used by sub classes to pass options to the registry client
+        @options             = options
+
+        @latest_version = T.let(nil, T.nilable(Dependabot::Version))
+        @latest_version_with_no_unlock = T.let(nil, T.nilable(Dependabot::Version))
+        @lowest_security_fix_version = T.let(nil, T.nilable(Dependabot::Version))
+        @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Gem::Version))
+      end
+      def latest_version(language_version: nil)
+        @latest_version ||= fetch_latest_version(language_version: language_version)
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Gem::Version))
+      end
+      def latest_version_with_no_unlock(language_version: nil)
+        @latest_version_with_no_unlock ||= fetch_latest_version_with_no_unlock(language_version: language_version)
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Gem::Version))
+      end
+      def lowest_security_fix_version(language_version: nil)
+        @lowest_security_fix_version ||= fetch_lowest_security_fix_version(language_version: language_version)
+      end
+
+      sig { abstract.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+      def package_details; end
+
+      sig do
+        returns(T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+      end
+      def available_versions
+        package_details&.releases
+      end
+
+      protected
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_latest_version(language_version:)
+        version_hashes = available_versions
+        return unless version_hashes
+
+        version_hashes = filter_yanked_versions(version_hashes)
+        versions = filter_unsupported_versions(version_hashes, language_version)
+        versions = filter_prerelease_versions(versions)
+        versions = filter_ignored_versions(versions)
+
+        versions.max
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_latest_version_with_no_unlock(language_version:)
+        version_hashes = available_versions
+        return unless version_hashes
+
+        version_hashes = filter_yanked_versions(version_hashes)
+        versions = filter_unsupported_versions(version_hashes, language_version)
+        versions = filter_prerelease_versions(versions)
+        versions = filter_ignored_versions(versions)
+        versions = filter_out_of_range_versions(versions)
+
+        versions.max
+      end
+
+      sig do
+        params(language_version: T.nilable(T.any(String, Version)))
+          .returns(T.nilable(Dependabot::Version))
+      end
+      def fetch_lowest_security_fix_version(language_version:)
+        version_hashes = available_versions
+        return unless version_hashes
+
+        version_hashes = filter_yanked_versions(version_hashes)
+        versions = filter_unsupported_versions(version_hashes, language_version)
+        # versions = filter_prerelease_versions(versions)
+        versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+          versions,
+          security_advisories
+        )
+        versions = filter_ignored_versions(versions)
+        versions = filter_lower_versions(versions)
+
+        versions.min
+      end
+
+      sig do
+        params(releases: T::Array[Dependabot::Package::PackageRelease])
+          .returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter_yanked_versions(releases)
+        filtered = releases.reject(&:yanked?)
+        if releases.count > filtered.count
+          Dependabot.logger.info("Filtered out #{releases.count - filtered.count} yanked versions")
+        end
+        filtered
+      end
+
+      sig do
+        params(
+          releases: T::Array[Dependabot::Package::PackageRelease],
+          language_version: T.nilable(T.any(String, Version))
+        )
+          .returns(T::Array[Dependabot::Version])
+      end
+      def filter_unsupported_versions(releases, language_version)
+        filtered = releases.filter_map do |release|
+          language_requirement = release.language&.requirement
+          next release.version unless language_version
+          next release.version unless language_requirement
+          next unless language_requirement.satisfied_by?(language_version)
+
+          release.version
+        end
+        if releases.count > filtered.count
+          delta = releases.count - filtered.count
+          Dependabot.logger.info("Filtered out #{delta} unsupported Language #{language_version} versions")
+        end
+        filtered
+      end
+
+      sig do
+        params(versions_array: T::Array[Dependabot::Version])
+          .returns(T::Array[Dependabot::Version])
+      end
+      def filter_prerelease_versions(versions_array)
+        return versions_array if wants_prerelease?
+
+        filtered = versions_array.reject(&:prerelease?)
+
+        if versions_array.count > filtered.count
+          Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
+        end
+
+        filtered
+      end
+
+      sig do
+        params(versions_array: T::Array[Dependabot::Version])
+          .returns(T::Array[Dependabot::Version])
+      end
+      def filter_ignored_versions(versions_array)
+        filtered = versions_array
+                   .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
+        if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
+          raise Dependabot::AllVersionsIgnored
+        end
+
+        if versions_array.count > filtered.count
+          Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
+        end
+        filtered
+      end
+
+      sig do
+        params(versions_array: T::Array[Dependabot::Version])
+          .returns(T::Array[Dependabot::Version])
+      end
+      def filter_lower_versions(versions_array)
+        return versions_array unless dependency.numeric_version
+
+        versions_array.select { |version| version > dependency.numeric_version }
+      end
+
+      sig do
+        params(versions_array: T::Array[Dependabot::Version])
+          .returns(T::Array[Dependabot::Version])
+      end
+      def filter_out_of_range_versions(versions_array)
+        reqs = dependency.requirements.filter_map do |r|
+          next if r.fetch(:requirement).nil?
+
+          requirement_class.requirements_array(r.fetch(:requirement))
+        end
+
+        versions_array
+          .select { |v| reqs.all? { |r| r.any? { |o| o.satisfied_by?(v) } } }
+      end
+
+      sig { returns(T::Boolean) }
+      def wants_prerelease?
+        return version_class.new(dependency.version).prerelease? if dependency.version
+
+        dependency.requirements.any? do |req|
+          reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
+          reqs.any? { |r| r.match?(/[A-Za-z]/) }
+        end
+      end
+
+      sig { returns(T::Array[T.untyped]) }
+      def ignore_requirements
+        ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
+      end
+
+      sig { returns(T.class_of(Dependabot::Version)) }
+      def version_class
+        dependency.version_class
+      end
+
+      sig { returns(T.class_of(Dependabot::Requirement)) }
+      def requirement_class
+        dependency.requirement_class
+      end
+    end
+  end
+end

data/lib/dependabot/package/package_release.rb

@@ -0,0 +1,78 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+require "dependabot/package/package_language"
+
+# Represents a single package version
+module Dependabot
+  module Package
+    class PackageRelease
+      extend T::Sig
+
+      sig do
+        params(
+          version: Dependabot::Version,
+          released_at: T.nilable(Time),
+          yanked: T::Boolean,
+          yanked_reason: T.nilable(String),
+          downloads: T.nilable(Integer),
+          url: T.nilable(String),
+          package_type: T.nilable(String),
+          language: T.nilable(Dependabot::Package::PackageLanguage)
+        )
+          .void
+      end
+      def initialize(
+        version:,
+        released_at: nil,
+        yanked: false,
+        yanked_reason: nil,
+        downloads: nil,
+        url: nil,
+        package_type: nil,
+        language: nil
+      )
+        @version = T.let(version, Dependabot::Version)
+        @released_at = T.let(released_at, T.nilable(Time))
+        @yanked = T.let(yanked, T::Boolean)
+        @yanked_reason = T.let(yanked_reason, T.nilable(String))
+        @downloads = T.let(downloads, T.nilable(Integer))
+        @url = T.let(url, T.nilable(String))
+        @package_type = T.let(package_type, T.nilable(String))
+        @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
+      end
+
+      sig { returns(Dependabot::Version) }
+      attr_reader :version
+
+      sig { returns(T.nilable(Time)) }
+      attr_reader :released_at
+
+      sig { returns(T::Boolean) }
+      attr_reader :yanked
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :yanked_reason
+
+      sig { returns(T.nilable(Integer)) }
+      attr_reader :downloads
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :url
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :package_type
+
+      sig { returns(T.nilable(Dependabot::Package::PackageLanguage)) }
+      attr_reader :language
+
+      sig { returns(T::Boolean) }
+      def yanked?
+        @yanked
+      end
+    end
+  end
+end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.298.0"
+  VERSION = "0.299.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.298.0
+  version: 0.299.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-20 00:00:00.000000000 Z
+date: 2025-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -568,6 +568,10 @@ files:
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
+- lib/dependabot/package/package_details.rb
+- lib/dependabot/package/package_language.rb
+- lib/dependabot/package/package_latest_version_finder.rb
+- lib/dependabot/package/package_release.rb
 - lib/dependabot/pull_request_creator.rb
 - lib/dependabot/pull_request_creator/azure.rb
 - lib/dependabot/pull_request_creator/bitbucket.rb
@@ -615,7 +619,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.298.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.299.0
 post_install_message:
 rdoc_options: []
 require_paths: