dependabot-composer 0.129.5 → 0.131.0

data/lib/dependabot/composer/helpers.rb

@@ -7,14 +7,32 @@ module Dependabot
     module Helpers
       # From composers json-schema: https://getcomposer.org/schema.json
       COMPOSER_V2_NAME_REGEX = %r{^[a-z0-9]([_.-]?[a-z0-9]+)*/[a-z0-9](([_.]?|-{0,2})[a-z0-9]+)*$}.freeze
+      # From https://github.com/composer/composer/blob/b7d770659b4e3ef21423bd67ade935572913a4c1/src/Composer/Repository/PlatformRepository.php#L33
+      PLATFORM_PACKAGE_REGEX = /
+        ^(?:php(?:-64bit|-ipv6|-zts|-debug)?|hhvm|(?:ext|lib)-[a-z0-9](?:[_.-]?[a-z0-9]+)*
+        |composer-(?:plugin|runtime)-api)$
+      /x.freeze
 
       def self.composer_version(composer_json, parsed_lockfile = nil)
-        return "v1" if composer_json["name"] && composer_json["name"] !~ COMPOSER_V2_NAME_REGEX
-        return "v2" unless parsed_lockfile && parsed_lockfile["plugin-api-version"]
+        if parsed_lockfile && parsed_lockfile["plugin-api-version"]
+          version = Composer::Version.new(parsed_lockfile["plugin-api-version"])
+          return version.canonical_segments.first == 1 ? "v1" : "v2"
+        else
+          return "v1" if composer_json["name"] && composer_json["name"] !~ COMPOSER_V2_NAME_REGEX
+          return "v1" if invalid_v2_requirement?(composer_json)
+        end
 
-        version = Composer::Version.new(parsed_lockfile["plugin-api-version"])
-        version.canonical_segments.first == 1 ? "v1" : "v2"
+        "v2"
       end
+
+      def self.invalid_v2_requirement?(composer_json)
+        return false unless composer_json.key?("require")
+
+        composer_json["require"].keys.any? do |key|
+          key !~ PLATFORM_PACKAGE_REGEX && key !~ COMPOSER_V2_NAME_REGEX
+        end
+      end
+      private_class_method :invalid_v2_requirement?
     end
   end
 end

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -255,7 +255,8 @@ module Dependabot
               named_captures.fetch("url")
             raise Dependabot::GitDependenciesNotReachable, dependency_url
           elsif error.message.start_with?("Could not parse version") ||
-                error.message.include?("does not allow connections to http://")
+                error.message.include?("does not allow connections to http://") ||
+                error.message.match?(/The `url` supplied for the path .* does not exist/)
             raise Dependabot::DependencyFileNotResolvable, sanitized_message
           elsif error.message.match?(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
             # These errors occur when platform requirements declared explicitly

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.129.5
+  version: 0.131.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-07 00:00:00.000000000 Z
+date: 2021-02-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.129.5
+        version: 0.131.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.129.5
+        version: 0.131.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.9.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.7.0
+        version: 1.9.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.0
+        version: 0.9.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.0
+        version: 0.9.1
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -230,7 +230,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.3
 signing_key: 
 specification_version: 4
 summary: PHP (Composer) support for dependabot