dependabot-common 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17a33f7a58c72db0519e97a6cafbcc82635b05e63990cc99ce0bef74aab095a5
-  data.tar.gz: 1cc7c71d06814db8fd53594b566e4f3b52ca89ec2429d8c7d6ba9824097865e6
+  metadata.gz: 6a574e02b5e7a33f7f245c56ae3df5942505a73cee3c1f32b8a07c1b36ba13a2
+  data.tar.gz: 4ee0767b57e78681464704b7e41557692d57cf240f40f2577d0313a87f78d371
 SHA512:
-  metadata.gz: d6fca56d5653cdbe70271dec38e5d43d225fe637ddd22c33afd015da340502bac20a41b69d244943c6dc05a6ecfc3ad0cad61220c1abf7c33dbafb4ebbd387fe
-  data.tar.gz: 6de41d80907590ec688ef8e178a5efb1575af696a7a88e8cf1ec482b5763c8846c792a6f88c78e45a00f574a987f1d3df13755e370edebdf043c008204fe3918
+  metadata.gz: b63a271847067f6adf096dcbbd9e97e0e986defc09125f55afa8be96cb820660c76551982b46d7c613e29ff93093d87bb1c1849d99c6e7bd75fab3f9abcc3a28
+  data.tar.gz: 28753fa5c276536d7cb8e16cc7bf183796bdd968e31c0efcb92ded66fd8b07a6e05304d0da3eba70a64fc1bd990f9167a073a072791655bdeb47cfb2f8c01d14

data/lib/dependabot/command_helpers.rb

@@ -26,6 +26,7 @@ module Dependabot
     EnvCmdItem = T.type_alias do
       T.any(
         String,
+        T::Array[String],
         T::Hash[T.any(String, Symbol), T.anything]
       )
     end
@@ -109,7 +110,7 @@ module Dependabot
                               else
                                 env_cmd
                               end
-          command_for_log = sanitized_env_cmd.join(" ")
+          command_for_log = sanitized_env_cmd.map { |item| item.is_a?(Array) ? item.first : item }.join(" ")
           Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
@@ -263,7 +264,14 @@ module Dependabot
 
     sig { params(env_cmd: T::Array[EnvCmdItem]).returns(T.nilable(String)) }
     def self.command_string_for_logging(env_cmd)
-      T.cast(env_cmd.find { |item| item.is_a?(String) }, T.nilable(String))
+      command_parts = env_cmd.filter_map do |item|
+        case item
+        when Array then item.first
+        when String then item
+        end
+      end
+
+      command_parts.join(" ") unless command_parts.empty?
     end
     private_class_method :command_string_for_logging
 

data/lib/dependabot/dependency_requirement.rb

@@ -16,7 +16,7 @@ module Dependabot
   #
   # Subclasses Hash so it is a drop-in replacement at call sites (and in
   # type annotations) that treat requirement entries as
-  # T::Hash[Symbol, T.untyped], while exposing typed readers for the
+  # T::Hash[Symbol, Object], while exposing typed readers for the
   # well-known keys. New code should prefer the typed readers; hash-style
   # access remains supported while call sites are migrated gradually.
   #
@@ -37,15 +37,11 @@ module Dependabot
     ObjectHash = T.type_alias { T::Hash[T.any(Symbol, String), Object] }
     Requirement = T.type_alias { T.any(String, Symbol) }
     Source = T.type_alias { T.any(String, ObjectHash) }
-    Input = T.type_alias { T.any(DependencyRequirement, ObjectHash) }
+    Input = T.type_alias { T::Hash[T.any(Symbol, String), T.anything] }
 
     K = type_member { { fixed: Symbol } }
-    # Hash-style access remains dynamic until ecosystem callers migrate to the
-    # typed readers. Keeping that compatibility here avoids a flag-day change.
-    # rubocop:disable Sorbet/ForbidTUntyped
-    V = type_member { { fixed: T.untyped } }
-    Elem = type_member { { fixed: [Symbol, T.untyped] } }
-    # rubocop:enable Sorbet/ForbidTUntyped
+    V = type_member { { fixed: Object } }
+    Elem = type_member { { fixed: [Symbol, Object] } }
 
     # Builds a DependencyRequirement from a requirement hash, symbolising
     # top-level keys. Accepts both plain hashes and existing
@@ -53,7 +49,12 @@ module Dependabot
     sig { params(hash: Input).returns(DependencyRequirement) }
     def self.create(hash)
       requirement = new
-      requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
+      hash.each do |key, value|
+        case value
+        when Object then requirement[key.to_sym] = value
+        else raise TypeError, "requirement values must inherit Object"
+        end
+      end
       requirement
     end
 
@@ -62,7 +63,7 @@ module Dependabot
     # or :unfixable when no valid updated requirement can be generated.
     sig { returns(T.nilable(Requirement)) }
     def requirement
-      value = T.cast(self[:requirement], T.nilable(Object))
+      value = self[:requirement]
       return if value.nil?
       return value if value.is_a?(String) || value == :unfixable
 
@@ -82,7 +83,7 @@ module Dependabot
     # the underlying hash access under sorbet-runtime.
     sig { returns(T.nilable(T::Array[Group])) }
     def groups
-      value = T.cast(self[:groups], T.nilable(Object))
+      value = self[:groups]
       return if value.nil?
       raise TypeError, "groups must be an array of strings or symbols, or nil" unless value.is_a?(Array)
 
@@ -101,7 +102,7 @@ module Dependabot
     # parser or deserialised from a job definition.
     sig { returns(T.nilable(Source)) }
     def source
-      value = T.cast(self[:source], T.nilable(Object))
+      value = self[:source]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -175,6 +176,16 @@ module Dependabot
       raise TypeError, "metadata #{key} must be a symbol or nil"
     end
 
+    # Reads a boolean metadata field such as "include_debug_script".
+    sig { params(key: String).returns(T.nilable(T::Boolean)) }
+    def metadata_boolean(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value == true || value == false
+
+      raise TypeError, "metadata #{key} must be a boolean or nil"
+    end
+
     # Reads a nested metadata hash whose values are all strings, such as
     # "dependency_set" (`{ group: "my.group", version: "1.4.0" }`). Keys are
     # symbolised so callers can read them with symbols regardless of how the
@@ -205,12 +216,14 @@ module Dependabot
       details = metadata
       return if details.nil?
 
-      details[key.to_sym] || details[key]
+      return details[key.to_sym] if details.key?(key.to_sym)
+
+      details[key]
     end
 
     sig { params(key: Symbol).returns(T.nilable(String)) }
     def optional_string(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -219,7 +232,7 @@ module Dependabot
 
     sig { params(key: Symbol).returns(T.nilable(ObjectHash)) }
     def optional_object_hash(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
 
       object_hash(value, key)

data/lib/dependabot/errors.rb

@@ -246,6 +246,11 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    when Dependabot::BranchNameFormattingError
+      {
+        "error-type": "branch_name_formatting_error",
+        "error-detail": { message: error.message }
+      }
     when Dependabot::BlockedDependencyVersion
       {
         "error-type": "blocked_dependency_version",
@@ -509,6 +514,8 @@ module Dependabot
 
   class RefNamespaceConflictError < DependabotError; end
 
+  class BranchNameFormattingError < DependabotError; end
+
   #####################
   # Repo level errors #
   #####################

data/lib/dependabot/pull_request_creator/branch_name_template.rb

@@ -11,7 +11,7 @@ module Dependabot
     class BranchNameTemplate
       extend T::Sig
 
-      class Error < Dependabot::DependabotError; end
+      class Error < Dependabot::BranchNameFormattingError; end
 
       SOLO_PLACEHOLDERS = %w(prefix package_manager directory target_branch dependency version name).freeze
       GROUP_PLACEHOLDERS = %w(prefix package_manager directory target_branch group_name name).freeze

data/lib/dependabot/pull_request_creator/message_builder/issue_linker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -53,19 +54,37 @@ module Dependabot
                      &.fetch("repo", nil)
 
               source = if repo
-                         "https://github.com/#{repo}"
+                         "#{qualified_reference_base_url}/#{repo}"
                        elsif source_url
                          source_url
                        end
 
               if source
-                "[#{repo ? (repo + tag) : tag}](#{source}/issues/#{number})"
+                "[#{repo ? (repo + tag) : tag}](#{source}#{issue_path(source)}/#{number})"
               else
                 issue_link
               end
             end
           end
         end
+
+        private
+
+        sig { params(source: String).returns(String) }
+        def issue_path(source)
+          URI.parse(source).host&.downcase == "gitlab.com" ? "/-/work_items" : "/issues"
+        rescue URI::InvalidURIError
+          "/issues"
+        end
+
+        sig { returns(String) }
+        def qualified_reference_base_url
+          return "https://github.com" unless source_url
+
+          URI.parse(T.must(source_url)).host&.downcase == "gitlab.com" ? "https://gitlab.com" : "https://github.com"
+        rescue URI::InvalidURIError
+          "https://github.com"
+        end
       end
     end
   end

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -4,6 +4,7 @@
 require "commonmarker"
 require "sorbet-runtime"
 require "strscan"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -13,6 +14,9 @@ module Dependabot
         extend T::Sig
 
         GITHUB_USERNAME = /[a-z0-9]+(-[a-z0-9]+)*/i
+        GITLAB_USERNAME = /[a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?/i
+        GITHUB_HOST = "github.com"
+        GITLAB_HOST = "gitlab.com"
         GITHUB_REF_REGEX = %r{
           (?:https?://)?
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
@@ -20,9 +24,6 @@ module Dependabot
         }x
         # [^/\s#]+ means one or more characters not matching (^) the class /, whitespace (\s), or #
         GITHUB_NWO_REGEX = %r{(?<repo>#{GITHUB_USERNAME}/[^/\s#]+)#(?<number>\d+)}
-        MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}
-        # regex to match a team mention on github
-        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}
         # End of string
         EOS_REGEX = /\z/
 
@@ -49,9 +50,18 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :github_redirection_service
 
-        sig { params(github_redirection_service: T.nilable(String)).void }
-        def initialize(github_redirection_service:)
+        sig { returns(T.nilable(String)) }
+        attr_reader :metadata_source_url
+
+        sig do
+          params(
+            github_redirection_service: T.nilable(String),
+            metadata_source_url: T.nilable(String)
+          ).void
+        end
+        def initialize(github_redirection_service:, metadata_source_url: nil)
           @github_redirection_service = github_redirection_service
+          @metadata_source_url = metadata_source_url
         end
 
         sig { params(text: String, unsafe: T::Boolean, format_html: T::Boolean).returns(String) }
@@ -90,7 +100,7 @@ module Dependabot
         def sanitize_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(MENTION_REGEX)
+               node.string_content.match?(mention_regex)
               nodes = if parent_node_link?(node)
                         build_mention_link_text_nodes(node.string_content)
                       else
@@ -111,10 +121,10 @@ module Dependabot
         def sanitize_team_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(TEAM_MENTION_REGEX)
+               node.string_content.match?(team_mention_regex)
               if parent_node_link?(node)
                 # Preserve text node formatting while preventing notifications with zero-width space
-                node.string_content = node.string_content.gsub(TEAM_MENTION_REGEX) do |match|
+                node.string_content = node.string_content.gsub(team_mention_regex) do |match|
                   insert_zero_width_space_in_mention(match)
                 end
               else
@@ -189,9 +199,9 @@ module Dependabot
           scan = StringScanner.new(text)
 
           until scan.eos?
-            line = scan.scan_until(MENTION_REGEX) ||
+            line = scan.scan_until(mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(MENTION_REGEX)
+            line_match = T.must(line).match(mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -199,7 +209,7 @@ module Dependabot
               text_node.string_content = line_match.pre_match
               nodes << text_node
               nodes << create_link_node(
-                "https://github.com/#{mention.tr('@', '')}", mention.to_s
+                "#{mention_profile_base_url}/#{mention.delete_prefix('@')}", mention.to_s
               )
             else
               text_node.string_content = line
@@ -216,9 +226,9 @@ module Dependabot
 
           scan = StringScanner.new(text)
           until scan.eos?
-            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+            line = scan.scan_until(team_mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(TEAM_MENTION_REGEX)
+            line_match = T.must(line).match(team_mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -235,6 +245,36 @@ module Dependabot
           nodes
         end
 
+        sig { returns(Regexp) }
+        def mention_regex
+          %r{(?<![A-Za-z0-9`~])@#{mention_username_regex}/?}
+        end
+
+        sig { returns(Regexp) }
+        def team_mention_regex
+          username_regex = mention_username_regex
+          %r{(?<![A-Za-z0-9`~])@(?<org>#{username_regex})/(?<team>#{username_regex})/?}
+        end
+
+        sig { returns(Regexp) }
+        def mention_username_regex
+          metadata_source_host == GITLAB_HOST ? GITLAB_USERNAME : GITHUB_USERNAME
+        end
+
+        sig { returns(String) }
+        def mention_profile_base_url
+          "https://#{metadata_source_host == GITLAB_HOST ? GITLAB_HOST : GITHUB_HOST}"
+        end
+
+        sig { returns(T.nilable(String)) }
+        def metadata_source_host
+          return unless metadata_source_url
+
+          URI.parse(T.must(metadata_source_url)).host&.downcase
+        rescue URI::InvalidURIError
+          nil
+        end
+
         sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_mention_link_text_nodes(text)
           code_node = Commonmarker::Node.new(:code)

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -85,13 +85,11 @@ module Dependabot
         def vulnerabilities_cascade
           return "" unless vulnerabilities_fixed&.any?
 
-          msg = ""
-          T.must(vulnerabilities_fixed).each do |v|
-            msg += serialized_vulnerability_details(v)
+          msg = T.must(vulnerabilities_fixed).map do |vulnerability|
+            details = sanitize_template_tags(serialized_vulnerability_details(vulnerability))
+            sanitize_links_and_mentions(details, metadata_source_url: vulnerability["source_url"])
           end
-
-          msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = msg.join
 
           build_details_tag(summary: "Vulnerabilities fixed", body: msg)
         end
@@ -109,7 +107,7 @@ module Dependabot
             base_url: source_url + "/blob/HEAD/"
           )
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: releases_url)
 
           build_details_tag(summary: "Release notes", body: msg)
         end
@@ -125,7 +123,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: changelog_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: changelog_url)
 
           build_details_tag(summary: "Changelog", body: msg)
         end
@@ -141,7 +139,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: upgrade_guide_url)
 
           build_details_tag(summary: "Upgrade guide", body: msg)
         end
@@ -170,7 +168,7 @@ module Dependabot
               "- See full diff in [compare view](#{commits_url})\n"
             end
           msg = link_issues(text: msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: commits_url)
 
           build_details_tag(summary: "Commits", body: msg)
         end
@@ -317,10 +315,19 @@ module Dependabot
           !%w(bitbucket codecommit).include?(source.provider)
         end
 
-        sig { params(text: String, unsafe: T::Boolean).returns(String) }
-        def sanitize_links_and_mentions(text, unsafe: false)
+        sig do
+          params(
+            text: String,
+            unsafe: T::Boolean,
+            metadata_source_url: T.nilable(String)
+          ).returns(String)
+        end
+        def sanitize_links_and_mentions(text, unsafe: false, metadata_source_url: source_url)
           LinkAndMentionSanitizer
-            .new(github_redirection_service: github_redirection_service)
+            .new(
+              github_redirection_service: github_redirection_service,
+              metadata_source_url: metadata_source_url
+            )
             .sanitize_links_and_mentions(text: text, unsafe: unsafe, format_html: source_provider_supports_html?)
         end
 

data/lib/dependabot/shared_helpers.rb

@@ -23,6 +23,8 @@ module Dependabot
   module SharedHelpers # rubocop:disable Metrics/ModuleLength
     extend T::Sig
 
+    Command = T.type_alias { T.any(String, T::Array[String]) }
+    CommandArguments = T.type_alias { T::Array[T.any(String, T::Array[String])] }
     USER_AGENT = T.let(
       "dependabot-core/#{Dependabot::VERSION} " \
       "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} " \
@@ -125,6 +127,26 @@ module Dependabot
       CommandHelpers.escape_command(command)
     end
 
+    sig do
+      params(command: Command, allow_unsafe_shell_command: T::Boolean)
+        .returns([CommandArguments, String])
+    end
+    def self.prepare_command(command, allow_unsafe_shell_command:)
+      unless command.is_a?(Array)
+        prepared_command = allow_unsafe_shell_command ? command : escape_command(command)
+        return [[prepared_command], prepared_command]
+      end
+
+      raise ArgumentError, "command must not be empty" if command.empty?
+      if allow_unsafe_shell_command
+        raise ArgumentError, "allow_unsafe_shell_command cannot be used with an argument vector"
+      end
+
+      executable = T.must(command.first)
+      [[[executable, executable], *command.drop(1)], Shellwords.join(command)]
+    end
+    private_class_method :prepare_command
+
     # rubocop:disable Metrics/MethodLength
     # rubocop:disable Metrics/AbcSize
     sig do
@@ -461,10 +483,9 @@ module Dependabot
       safe_directories
     end
 
-    # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
-        command: String,
+        command: Command,
         allow_unsafe_shell_command: T::Boolean,
         cwd: T.nilable(String),
         env: T.nilable(T::Hash[String, String]),
@@ -485,14 +506,17 @@ module Dependabot
       output_observer: nil
     )
       start = Time.now
-      cmd = allow_unsafe_shell_command ? command : escape_command(command)
+      command_args, command_for_output = prepare_command(
+        command,
+        allow_unsafe_shell_command: allow_unsafe_shell_command
+      )
 
-      puts cmd if ENV["DEBUG_HELPERS"] == "true"
+      puts command_for_output if ENV["DEBUG_HELPERS"] == "true"
 
       opts = {}
       opts[:chdir] = cwd if cwd
 
-      env_cmd = [env || {}, cmd, opts].compact
+      env_cmd = [env || {}, *command_args, opts].compact
       kwargs = {
         stderr_to_stdout: stderr_to_stdout,
         timeout: timeout
@@ -511,7 +535,7 @@ module Dependabot
       return stdout || "" if process&.success?
 
       error_context = {
-        command: cmd,
+        command: command_for_output,
         fingerprint: fingerprint,
         time_taken: time_taken,
         process_exit_value: process.to_s
@@ -524,7 +548,6 @@ module Dependabot
         error_context: error_context
       )
     end
-    # rubocop:enable Metrics/PerceivedComplexity
 
     sig { params(stderr: T.nilable(String), error_context: T::Hash[Symbol, String]).void }
     def self.check_out_of_disk_memory_error(stderr, error_context)

data/lib/dependabot/workspace/git.rb

@@ -127,7 +127,7 @@ module Dependabot
 
       sig { params(memo: T.nilable(String)).returns(String) }
       def commit(memo = nil)
-        run_shell_command("git add #{path}")
+        run_shell_command(["git", "add", "--", path.to_s])
 
         msg = memo || "workspace change"
         run_shell_command(
@@ -152,7 +152,7 @@ module Dependabot
         run_shell_command("git clean -fx .")
       end
 
-      sig { params(args: String, kwargs: T.any(T::Boolean, String)).returns(String) }
+      sig { params(args: SharedHelpers::Command, kwargs: T.any(T::Boolean, String)).returns(String) }
       def run_shell_command(*args, **kwargs)
         Dir.chdir(path) { T.unsafe(SharedHelpers).run_shell_command(*args, **kwargs) }
       end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.391.0"
+  VERSION = "0.392.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -625,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib