dependabot-common 0.361.1 → 0.361.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35ed62539591d571bf0ecb592063ec4fcf06368c05d262e5fa6be3bb15d49439
-  data.tar.gz: 4a13da9f544585bae1b4356924b3e949e052a67b4bf4d465399a488865680430
+  metadata.gz: f2b211f0bd9932e35b316074d84e9bae276448f95244ec93184d2930332d9801
+  data.tar.gz: 713b02b21f48e873c663b77afdece7967394ea18e80a33c02c0ca536debbfa31
 SHA512:
-  metadata.gz: aad1210a076ab4044fb995c20389582378d114ccc24548495ad74c0cd825d4ca351cc78102bc13399f0ff9f319b2174519b61b89ea21a57462af09f67e0f3c56
-  data.tar.gz: 8bcbc4caa7d0c6fd7d86bcd7e304df4d2796cee4b9a1fa809e0bd8bfb57650a2d9323bd2405f2efa08a1a8e07fd4790f47de76f452cf96628d9275783a68389e
+  metadata.gz: d29c459b7b4538e3dbf806a5dbaf79fd4eb1042664fe5df05b462bf7f404550e5843e2f9f1d85dbe297fb143e9fb6b770e5341c2d23a3cbb44a045f1cb7cbc4d
+  data.tar.gz: c92e5ea8478f61ee4030ac7c4aa4ce3573e0a6a4870deb454a91d5a82c7b3b9ddd8e8ae1074b1db72cecbdb6e7781c83472a41939780c072e0292127a8ec5727

data/lib/dependabot/config/file.rb

@@ -83,6 +83,7 @@ module Dependabot
           "nuget" => "nuget",
           "opentofu" => "opentofu",
           "pip" => "pip",
+          "pre-commit" => "pre_commit",
           "pub" => "pub",
           "rust-toolchain" => "rust_toolchain",
           "swift" => "swift",

data/lib/dependabot/git_commit_checker.rb

@@ -106,19 +106,32 @@ module Dependabot
       local_repo_git_metadata_fetcher.head_commit_for_ref_sha(T.must(ref))
     end
 
-    sig { returns(Excon::Response) }
-    def ref_details_for_pinned_ref
+    sig { returns(T::Array[GitRef]) }
+    def tags
+      GitMetadataFetcher.new(
+        url: dependency.source_details&.fetch(:url, nil),
+        credentials: credentials
+      ).tags
+    end
+
+    sig { params(ref: String).returns(Excon::Response) }
+    def ref_details(ref)
       T.must(
         T.let(
           GitMetadataFetcher.new(
             url: dependency.source_details&.fetch(:url, nil),
             credentials: credentials
-          ).ref_details_for_pinned_ref(ref_pinned),
+          ).ref_details_for_pinned_ref(ref),
           T.nilable(Excon::Response)
         )
       )
     end
 
+    sig { returns(Excon::Response) }
+    def ref_details_for_pinned_ref
+      ref_details(ref_pinned)
+    end
+
     sig { params(ref: String).returns(T::Boolean) }
     def ref_looks_like_commit_sha?(ref)
       ref.match?(/^[0-9a-f]{6,40}$/)

data/lib/dependabot/git_metadata_fetcher.rb

@@ -31,6 +31,7 @@ module Dependabot
     end
 
     KNOWN_HOSTS = /github\.com|bitbucket\.org|gitlab.com/i
+    MAX_COMMITS_PER_PAGE = 100
 
     sig do
       params(
@@ -391,7 +392,7 @@ module Dependabot
         github: provider_url.gsub("github.com", "api.github.com/repos")
       }.freeze
 
-      "#{api_url[:github]}/commits?per_page=100&sha=#{ref}"
+      "#{api_url[:github]}/commits?per_page=#{MAX_COMMITS_PER_PAGE}&sha=#{ref}"
     end
   end
 end

data/lib/dependabot/metadata_finders/base.rb

@@ -162,6 +162,16 @@ module Dependabot
         nil
       end
 
+      sig { overridable.returns(T.nilable(String)) }
+      def install_script_changes
+        nil
+      end
+
+      sig { overridable.returns(T.nilable(String)) }
+      def attestation_changes
+        nil
+      end
+
       private
 
       sig { overridable.returns(T.nilable(String)) }

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -27,10 +27,12 @@ module Dependabot
         attr_reader :github_redirection_service
 
         def_delegators :metadata_finder,
+                       :attestation_changes,
                        :changelog_url,
                        :changelog_text,
                        :commits_url,
                        :commits,
+                       :install_script_changes,
                        :maintainer_changes,
                        :releases_url,
                        :releases_text,
@@ -71,6 +73,8 @@ module Dependabot
           msg += upgrade_guide_cascade
           msg += commits_cascade
           msg += maintainer_changes_cascade
+          msg += install_script_changes_cascade
+          msg += attestation_changes_cascade
           msg += break_tag unless msg == ""
           "\n" + sanitize_links_and_mentions(msg, unsafe: true)
         end
@@ -181,6 +185,26 @@ module Dependabot
           )
         end
 
+        sig { returns(String) }
+        def install_script_changes_cascade
+          return "" unless install_script_changes
+
+          build_details_tag(
+            summary: "Install script changes",
+            body: sanitize_links_and_mentions(install_script_changes) + "\n"
+          )
+        end
+
+        sig { returns(String) }
+        def attestation_changes_cascade
+          return "" unless attestation_changes
+
+          build_details_tag(
+            summary: "Attestation changes",
+            body: sanitize_links_and_mentions(attestation_changes) + "\n"
+          )
+        end
+
         sig { params(summary: String, body: String).returns(String) }
         def build_details_tag(summary:, body:)
           # Bitbucket does not support <details> tag (https://jira.atlassian.com/browse/BCLOUD-20231)

data/lib/dependabot/version.rb

@@ -74,6 +74,28 @@ module Dependabot
       "a"
     end
 
+    # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
+    SEMVER_REGEX = T.let(
+      /
+            # major.minor.patch
+            ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)
+            # pre-release
+            (?:-(
+              (?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)
+              (?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*
+            ))?
+            # build metadata
+            (?:\+(
+              [0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*
+            ))?$/x,
+      Regexp
+    )
+
+    sig { params(version: String).returns(T::Boolean) }
+    def self.valid_semver?(version)
+      !version.match(SEMVER_REGEX).nil?
+    end
+
     sig { returns(T.nilable([Integer, Integer, Integer])) }
     def semver_parts
       # Extracts only the numeric major.minor.patch part of the version, ensuring it starts with a number

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.361.1"
+  VERSION = "0.361.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.361.1
+  version: 0.361.2
 platform: ruby
 authors:
 - Dependabot
@@ -615,7 +615,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.2
 rdoc_options: []
 require_paths:
 - lib