dependabot-common 0.359.0 → 0.360.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 863349d14c5c5c824a05216a25a095f3933ccd1ed20a25be6a4914df8ee78def
-  data.tar.gz: '09e4df619889b23f0870e098f75d717878622dff605d9c3030cb7e857ee22b6e'
+  metadata.gz: 34df974274ecd87dcbd7843dd8fa57029f45161682bab2fdd09f8b81098dace0
+  data.tar.gz: 0bf86b911c383b18f1b8cbf000da70ab0179a55666bd417b4488290018179730
 SHA512:
-  metadata.gz: 689f110d26cfc94b36ddc3208c49a9a051e9e98e8d2c16158240b6fc65d54e8d82106bf8c5f5917617059666c9782208ee77db2db24624a65b80bbecd90adb76
-  data.tar.gz: d56e9fda4c5a4e3bc255341287f5aed210dac8b8c549102f433cde5c17758f105fe6201099f1d81945ef1228e97b8a4f5c53c11bcd60e99b38284cb4c39c993c
+  metadata.gz: 828fc1f64c41ffdb5a78a963ee7e0fb1f5bfa1433dc158b0282c93903d9cc2564fe87d9cea2e6e467542974c7f1a1051dc4ca7a4652098f726f379181fcc9b97
+  data.tar.gz: c35eff140ac36d74992546af35512a17c96563fa67354da374f9bebc8fc36eaed681d50dc06e04e97ece1ebf78a83ac46c6e6c761d004c497b5a7cc493cbd64b

data/lib/dependabot/file_fetchers/base.rb

@@ -1,7 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "ostruct"
 require "sorbet-runtime"
 require "stringio"
 
@@ -20,6 +19,42 @@ require "dependabot/shared_helpers"
 # rubocop:disable Metrics/ClassLength
 module Dependabot
   module FileFetchers
+    class RepositoryContent
+      extend T::Sig
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :name
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :path
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :type
+
+      sig { returns(T.nilable(Integer)) }
+      attr_reader :size
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :sha
+
+      sig do
+        params(
+          name: T.nilable(String),
+          path: T.nilable(String),
+          type: T.nilable(String),
+          size: T.nilable(Integer),
+          sha: T.nilable(String)
+        ).void
+      end
+      def initialize(name: nil, path: nil, type: nil, size: nil, sha: nil)
+        @name = name
+        @path = path
+        @type = type
+        @size = size
+        @sha = sha
+      end
+    end
+
     class Base
       extend T::Sig
       extend T::Helpers
@@ -468,7 +503,7 @@ module Dependabot
 
       sig do
         params(path: String, fetch_submodules: T::Boolean, raise_errors: T::Boolean)
-          .returns(T::Array[OpenStruct])
+          .returns(T::Array[RepositoryContent])
       end
       def _fetch_repo_contents(path, fetch_submodules: false, raise_errors: true) # rubocop:disable Metrics/PerceivedComplexity
         path = path.gsub(" ", "%20")
@@ -507,7 +542,7 @@ module Dependabot
 
       sig do
         params(provider: String, repo: String, path: String, commit: String)
-          .returns(T::Array[OpenStruct])
+          .returns(T::Array[RepositoryContent])
       end
       def _fetch_repo_contents_fully_specified(provider, repo, path, commit)
         case provider
@@ -525,7 +560,7 @@ module Dependabot
         end
       end
 
-      sig { params(repo: String, path: String, commit: String).returns(T::Array[OpenStruct]) }
+      sig { params(repo: String, path: String, commit: String).returns(T::Array[RepositoryContent]) }
       def _github_repo_contents(repo, path, commit)
         path = path.gsub(" ", "%20")
         github_response = T.unsafe(github_client).contents(repo, path: path, ref: commit)
@@ -538,7 +573,7 @@ module Dependabot
         github_response.map { |f| _build_github_file_struct(f) }
       end
 
-      sig { params(relative_path: String).returns(T::Array[OpenStruct]) }
+      sig { params(relative_path: String).returns(T::Array[RepositoryContent]) }
       def _cloned_repo_contents(relative_path)
         repo_path = File.join(clone_repo_contents, relative_path)
         return [] unless Dir.exist?(repo_path)
@@ -555,7 +590,7 @@ module Dependabot
                    "file"
                  end
 
-          OpenStruct.new(
+          RepositoryContent.new(
             name: name,
             path: Pathname.new(File.join(relative_path, name)).cleanpath.to_path,
             type: type,
@@ -590,9 +625,9 @@ module Dependabot
         entries
       end
 
-      sig { params(file: Sawyer::Resource).returns(OpenStruct) }
+      sig { params(file: Sawyer::Resource).returns(RepositoryContent) }
       def _build_github_file_struct(file)
-        OpenStruct.new(
+        RepositoryContent.new(
           name: T.unsafe(file).name,
           path: T.unsafe(file).path,
           type: T.unsafe(file).type,
@@ -601,7 +636,7 @@ module Dependabot
         )
       end
 
-      sig { params(repo: String, path: String, commit: String).returns(T::Array[OpenStruct]) }
+      sig { params(repo: String, path: String, commit: String).returns(T::Array[RepositoryContent]) }
       def _gitlab_repo_contents(repo, path, commit)
         T.unsafe(gitlab_client)
          .repo_tree(repo, path: path, ref: commit, per_page: 100)
@@ -614,7 +649,7 @@ module Dependabot
                  else file.fetch("type")
                  end
 
-          OpenStruct.new(
+          RepositoryContent.new(
             name: file.name,
             path: file.path,
             type: type,
@@ -623,7 +658,7 @@ module Dependabot
         end
       end
 
-      sig { params(path: String, commit: String).returns(T::Array[OpenStruct]) }
+      sig { params(path: String, commit: String).returns(T::Array[RepositoryContent]) }
       def _azure_repo_contents(path, commit)
         response = azure_client.fetch_repo_contents(commit, path)
 
@@ -634,7 +669,7 @@ module Dependabot
                  else entry.fetch("gitObjectType")
                  end
 
-          OpenStruct.new(
+          RepositoryContent.new(
             name: File.basename(entry.fetch("relativePath")),
             path: entry.fetch("relativePath"),
             type: type,
@@ -643,7 +678,7 @@ module Dependabot
         end
       end
 
-      sig { params(repo: String, path: String, commit: String).returns(T::Array[OpenStruct]) }
+      sig { params(repo: String, path: String, commit: String).returns(T::Array[RepositoryContent]) }
       def _bitbucket_repo_contents(repo, path, commit)
         response = T.unsafe(bitbucket_client)
                     .fetch_repo_contents(
@@ -659,7 +694,7 @@ module Dependabot
                  else file.fetch("type")
                  end
 
-          OpenStruct.new(
+          RepositoryContent.new(
             name: File.basename(file.fetch("path")),
             path: file.fetch("path"),
             type: type,
@@ -668,7 +703,7 @@ module Dependabot
         end
       end
 
-      sig { params(repo: String, path: String, commit: String).returns(T::Array[OpenStruct]) }
+      sig { params(repo: String, path: String, commit: String).returns(T::Array[RepositoryContent]) }
       def _codecommit_repo_contents(repo, path, commit)
         response = codecommit_client.fetch_repo_contents(
           repo,
@@ -677,7 +712,7 @@ module Dependabot
         )
 
         response.files.map do |file|
-          OpenStruct.new(
+          RepositoryContent.new(
             name: File.basename(file.relative_path),
             path: file.relative_path,
             type: "file",

data/lib/dependabot/git_commit_checker.rb

@@ -246,13 +246,17 @@ module Dependabot
 
     sig { params(commit_sha: T.nilable(String)).returns(T.nilable(String)) }
     def most_specific_version_tag_for_sha(commit_sha)
-      tags = local_tags.select { |t| t.commit_sha == commit_sha && version_class.correct?(t.name) }
-                       .sort_by { |t| version_class.new(t.name) }
+      tags = local_tags_matching_sha(commit_sha)
       return if tags.empty?
 
       tags[-1]&.name
     end
 
+    sig { params(commit_sha: T.nilable(String)).returns(T::Array[String]) }
+    def most_specific_version_tags_for_sha(commit_sha)
+      local_tags_matching_sha(commit_sha).map(&:name)
+    end
+
     sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
     def max_local_tag(tags)
       max_version_tag = tags.max_by { |t| version_from_tag(t) }
@@ -333,6 +337,12 @@ module Dependabot
         .reject { |t| tag_is_prerelease?(t) && !wants_prerelease? }
     end
 
+    sig { params(commit_sha: T.nilable(String)).returns(T::Array[Dependabot::GitRef]) }
+    def local_tags_matching_sha(commit_sha)
+      local_tags.select { |t| t.commit_sha == commit_sha && version_class.correct?(t.name) }
+                .sort_by { |t| version_class.new(t.name) }
+    end
+
     sig { params(version: T.any(String, Gem::Version)).returns(T::Boolean) }
     def pinned_ref_in_release?(version)
       raise "Not a git dependency!" unless git_dependency?

data/lib/dependabot/git_metadata_fetcher.rb

@@ -3,7 +3,6 @@
 
 require "excon"
 require "open3"
-require "ostruct"
 require "sorbet-runtime"
 require "tmpdir"
 require "dependabot/errors"
@@ -15,6 +14,22 @@ module Dependabot
   class GitMetadataFetcher
     extend T::Sig
 
+    class GitResponse
+      extend T::Sig
+
+      sig { returns(String) }
+      attr_reader :body
+
+      sig { returns(Integer) }
+      attr_reader :status
+
+      sig { params(body: String, status: Integer).void }
+      def initialize(body:, status:)
+        @body = body
+        @status = status
+      end
+    end
+
     KNOWN_HOSTS = /github\.com|bitbucket\.org|gitlab.com/i
 
     sig do
@@ -210,12 +225,12 @@ module Dependabot
         stdout, stderr, process = Open3.capture3(env, command)
         # package the command response like a HTTP response so error handling remains unchanged
       rescue Errno::ENOENT => e # thrown when `git` isn't installed...
-        OpenStruct.new(body: e.message, status: 500)
+        GitResponse.new(body: e.message, status: 500)
       else
         if process.success?
-          OpenStruct.new(body: stdout, status: 200)
+          GitResponse.new(body: stdout, status: 200)
         else
-          OpenStruct.new(body: stderr, status: 500)
+          GitResponse.new(body: stderr, status: 500)
         end
       end
     end
@@ -340,7 +355,7 @@ module Dependabot
         clone_command = SharedHelpers.escape_command(clone_command)
 
         _stdout, stderr, process = Open3.capture3(env, clone_command)
-        return OpenStruct.new(body: stderr, status: 500) unless process.success?
+        return GitResponse.new(body: stderr, status: 500) unless process.success?
 
         # Change to the cloned repository directory
         Dir.chdir(dir) do
@@ -348,7 +363,7 @@ module Dependabot
           tags_command = 'git for-each-ref --format="%(refname:short) %(creatordate:short)" refs/tags'
           tags_stdout, stderr, process = Open3.capture3(env, tags_command)
 
-          return OpenStruct.new(body: stderr, status: 500) unless process.success?
+          return GitResponse.new(body: stderr, status: 500) unless process.success?
 
           # Parse and sort tags by creation date
           tags = tags_stdout.lines.map do |line|
@@ -359,11 +374,11 @@ module Dependabot
 
           # Format the output as a string
           formatted_output = sorted_tags.map { |tag| "#{tag[:tag]} #{tag[:date]}" }.join("\n")
-          return OpenStruct.new(body: formatted_output, status: 200)
+          return GitResponse.new(body: formatted_output, status: 200)
         end
       end
     rescue Errno::ENOENT => e # Thrown when `git` isn't installed
-      OpenStruct.new(body: e.message, status: 500)
+      GitResponse.new(body: e.message, status: 500)
     end
 
     sig do

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require "excon"
-require "ostruct"
 require "sorbet-runtime"
 
 require "dependabot/clients/github_with_retries"
@@ -14,6 +13,47 @@ require "dependabot/metadata_finders/base"
 module Dependabot
   module MetadataFinders
     class Base
+      class ChangelogFile
+        extend T::Sig
+
+        sig { returns(String) }
+        attr_reader :name
+
+        sig { returns(String) }
+        attr_reader :type
+
+        sig { returns(Integer) }
+        attr_reader :size
+
+        sig { returns(String) }
+        attr_reader :html_url
+
+        sig { returns(String) }
+        attr_reader :download_url
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :path
+
+        sig do
+          params(
+            name: String,
+            type: String,
+            size: Integer,
+            html_url: String,
+            download_url: String,
+            path: T.nilable(String)
+          ).void
+        end
+        def initialize(name:, type:, size:, html_url:, download_url:, path: nil)
+          @name = name
+          @type = type
+          @size = size
+          @html_url = html_url
+          @download_url = download_url
+          @path = path
+        end
+      end
+
       # rubocop:disable Metrics/ClassLength
       class ChangelogFinder
         extend T::Sig
@@ -141,18 +181,18 @@ module Dependabot
           @changelog_from_suggested_url = nil
         end
 
-        sig { returns(T.nilable(T.any(OpenStruct, Sawyer::Resource))) }
+        sig { returns(T.nilable(T.any(ChangelogFile, Sawyer::Resource))) }
         def default_branch_changelog
           return unless source
 
           @default_branch_changelog ||=
             T.let(
               changelog_from_ref(nil),
-              T.nilable(T.any(OpenStruct, Sawyer::Resource))
+              T.nilable(T.any(ChangelogFile, Sawyer::Resource))
             )
         end
 
-        sig { returns(T.nilable(T.any(OpenStruct, Sawyer::Resource))) }
+        sig { returns(T.nilable(T.any(ChangelogFile, Sawyer::Resource))) }
         def relevant_tag_changelog
           return unless source
           return unless tag_for_new_version
@@ -160,11 +200,11 @@ module Dependabot
           @relevant_tag_changelog ||=
             T.let(
               changelog_from_ref(tag_for_new_version),
-              T.nilable(T.any(OpenStruct, Sawyer::Resource))
+              T.nilable(T.any(ChangelogFile, Sawyer::Resource))
             )
         end
 
-        sig { params(ref: T.nilable(String)).returns(T.nilable(T.any(OpenStruct, Sawyer::Resource))) }
+        sig { params(ref: T.nilable(String)).returns(T.nilable(T.any(ChangelogFile, Sawyer::Resource))) }
         def changelog_from_ref(ref)
           files =
             dependency_file_list(ref)
@@ -343,7 +383,7 @@ module Dependabot
                    when "commit_directory" then "dir"
                    else file.fetch("type")
                    end
-            OpenStruct.new(
+            ChangelogFile.new(
               name: file.fetch("path").split("/").last,
               type: type,
               size: file.fetch("size", 100),
@@ -366,7 +406,7 @@ module Dependabot
                    when "tree" then "dir"
                    else file.fetch("type")
                    end
-            OpenStruct.new(
+            ChangelogFile.new(
               name: file.name,
               type: type,
               size: 100, # GitLab doesn't return file size
@@ -387,7 +427,7 @@ module Dependabot
                    else entry.fetch("gitObjectType")
                    end
 
-            OpenStruct.new(
+            ChangelogFile.new(
               name: File.basename(entry.fetch("relativePath")),
               type: type,
               size: entry.fetch("size"),

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -1,7 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "ostruct"
 require "sorbet-runtime"
 
 require "dependabot/credential"
@@ -13,6 +12,37 @@ require "dependabot/utils"
 module Dependabot
   module MetadataFinders
     class Base
+      class GitLabRelease
+        extend T::Sig
+
+        sig { returns(String) }
+        attr_reader :name
+
+        sig { returns(String) }
+        attr_reader :tag_name
+
+        sig { returns(String) }
+        attr_reader :body
+
+        sig { returns(String) }
+        attr_reader :html_url
+
+        sig do
+          params(
+            name: String,
+            tag_name: String,
+            body: String,
+            html_url: String
+          ).void
+        end
+        def initialize(name:, tag_name:, body:, html_url:)
+          @name = name
+          @tag_name = tag_name
+          @body = body
+          @html_url = html_url
+        end
+      end
+
       class ReleaseFinder
         extend T::Sig
 
@@ -281,7 +311,7 @@ module Dependabot
              .reverse
 
           releases.map do |tag|
-            OpenStruct.new(
+            GitLabRelease.new(
               name: tag.name,
               tag_name: tag.release.tag_name,
               body: tag.release.description,

data/lib/dependabot/pull_request_updater/github.rb

@@ -207,7 +207,7 @@ module Dependabot
 
             {
               path: file.realpath,
-              mode: Dependabot::DependencyFile::Mode::FILE,
+              mode: file.mode || Dependabot::DependencyFile::Mode::FILE,
               type: "blob"
             }.merge(content)
           end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.359.0"
+  VERSION = "0.360.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.359.0
+  version: 0.360.0
 platform: ruby
 authors:
 - Dependabot
@@ -225,20 +225,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.3'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: parser
   requirement: !ruby/object:Gem::Requirement
@@ -629,7 +615,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.359.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.360.0
 rdoc_options: []
 require_paths:
 - lib