dependabot-composer 0.287.0 → 0.289.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33efc3aae325bc2acdd965e6ec6904a390e1e69c730028acbf543ae50c7f853e
-  data.tar.gz: 3d70840ea14077b634287b459b5168ebcc991f341cc305e78cde0efbd0796694
+  metadata.gz: 90fd9742e112bda23efcab031a487985c2bc19431d081a25e53f23a915edbdc0
+  data.tar.gz: 18902e7c4b755fac1bd12fd6ba60a1b2e7baeb97355156120b9591d3b031cb41
 SHA512:
-  metadata.gz: b274ddd490c9d93fa441e06404df4bad8e172178a54963307d3b804865cd45e448caeb55d7446a9d13030c7a71637712a405e6a4311a1e539dfa04b21a4c3139
-  data.tar.gz: 7d06ec720c22e6e88602a76e987887aa1a927e3b031673b9773d61884ddb19272a02d9efe12d13aa4091e6a0c635a93f7340c533d4839e3a84eef8a93aba9a8d
+  metadata.gz: fcbf0ae77a0f37ae82e66a5fbfe6b040b881c3de3ac0b4be70ff8964bf2d7c0d1883ef4bf239548febec2d457a5d083bc01bb764a3a9cd0b23731c56dec17254
+  data.tar.gz: e799650f569f04c2ffb674199bba37a1eb9f2e121183ebd353701ae2b6df948080c45661b3ff7af830a090c771ea9fc60410d90cf94a05991ba60f545c29667d

data/lib/dependabot/composer/file_fetcher/path_dependency_builder.rb

@@ -17,7 +17,7 @@ module Dependabot
         end
 
         def dependency_file
-          filename = File.join(path, "composer.json")
+          filename = File.join(path, PackageManager::MANIFEST_FILENAME)
 
           # Current we just return `nil` if a path dependency can't be built.
           # In future we may wish to change that to a raise. (We'll get errors

data/lib/dependabot/composer/file_fetcher.rb

@@ -16,17 +16,17 @@ module Dependabot
       require_relative "helpers"
 
       def self.required_files_in?(filenames)
-        filenames.include?("composer.json")
+        filenames.include?(PackageManager::MANIFEST_FILENAME)
       end
 
       def self.required_files_message
-        "Repo must contain a composer.json."
+        "Repo must contain a #{PackageManager::MANIFEST_FILENAME}."
       end
 
       def ecosystem_versions
         {
           package_managers: {
-            "composer" => Helpers.composer_version(parsed_composer_json, parsed_lockfile)
+            PackageManager::NAME => Helpers.composer_version(parsed_composer_json, parsed_lockfile)
           }
         }
       end
@@ -45,20 +45,20 @@ module Dependabot
       private
 
       def composer_json
-        @composer_json ||= fetch_file_from_host("composer.json")
+        @composer_json ||= fetch_file_from_host(PackageManager::MANIFEST_FILENAME)
       end
 
       def composer_lock
         return @composer_lock if defined?(@composer_lock)
 
-        @composer_lock = fetch_file_if_present("composer.lock")
+        @composer_lock = fetch_file_if_present(PackageManager::LOCKFILE_FILENAME)
       end
 
       # NOTE: This is fetched but currently unused
       def auth_json
         return @auth_json if defined?(@auth_json)
 
-        @auth_json = fetch_support_file("auth.json")
+        @auth_json = fetch_support_file(PackageManager::AUTH_FILENAME)
       end
 
       def artifact_dependencies
@@ -106,7 +106,7 @@ module Dependabot
               directories = path.end_with?("*") ? expand_path(path) : [path]
 
               directories.each do |dir|
-                file = File.join(dir, "composer.json")
+                file = File.join(dir, PackageManager::MANIFEST_FILENAME)
 
                 begin
                   composer_json_files << fetch_file_with_root_fallback(file)

data/lib/dependabot/composer/file_parser.rb

@@ -11,6 +11,12 @@ require "dependabot/errors"
 
 module Dependabot
   module Composer
+    REQUIREMENT_SEPARATOR = /
+      (?<=\S|^)          # Positive lookbehind for a non-whitespace character or start of string
+      (?:[ \t,]*\|\|?[ \t]*) # Match optional whitespace, a pipe (|| or |), and optional whitespace
+      (?=\S|$)           # Positive lookahead for a non-whitespace character or end of string
+    /x
+
     class FileParser < Dependabot::FileParsers::Base
       require "dependabot/file_parsers/base/dependency_set"
 
@@ -40,7 +46,8 @@ module Dependabot
         @ecosystem ||= T.let(
           Ecosystem.new(
             name: ECOSYSTEM,
-            package_manager: package_manager
+            package_manager: package_manager,
+            language: language
           ),
           T.nilable(Ecosystem)
         )
@@ -50,7 +57,48 @@ module Dependabot
 
       sig { returns(Ecosystem::VersionManager) }
       def package_manager
-        PackageManager.new(composer_version)
+        raw_composer_version = env_versions[:composer] || composer_version
+        PackageManager.new(
+          raw_composer_version
+        )
+      end
+
+      sig { returns(T.nilable(Ecosystem::VersionManager)) }
+      def language
+        php_version = env_versions[:php]
+
+        return unless php_version
+
+        Language.new(
+          php_version,
+          requirement: php_requirement
+        )
+      end
+
+      sig { returns(T::Hash[Symbol, T.nilable(String)]) }
+      def env_versions
+        @env_versions ||= T.let(
+          Helpers.fetch_composer_and_php_versions,
+          T.nilable(T::Hash[Symbol, T.nilable(String)])
+        )
+      end
+
+      # Capture PHP requirement from the composer.json
+      sig { returns(T.nilable(Requirement)) }
+      def php_requirement
+        requirement_string = Helpers.php_constraint(parsed_composer_json)
+
+        return nil unless requirement_string
+
+        requirements = requirement_string
+                       .strip
+                       .split(REQUIREMENT_SEPARATOR)
+                       .map(&:strip)
+                       .reject(&:empty?)
+
+        return nil unless requirements.any?
+
+        Requirement.new(requirements)
       end
 
       sig { returns(DependencySet) }
@@ -95,7 +143,7 @@ module Dependabot
           version: dependency_version(name: name, type: group),
           requirements: [{
             requirement: req,
-            file: "composer.json",
+            file: PackageManager::MANIFEST_FILENAME,
             source: dependency_source(
               name: name,
               type: group,
@@ -103,7 +151,7 @@ module Dependabot
             ),
             groups: [group]
           }],
-          package_manager: "composer"
+          package_manager: PackageManager::NAME
         )
       end
 
@@ -141,7 +189,7 @@ module Dependabot
           name: name,
           version: version,
           requirements: [],
-          package_manager: "composer",
+          package_manager: PackageManager::NAME,
           subdependency_metadata: [{
             production: keys.fetch(:group) != "development"
           }]
@@ -162,7 +210,8 @@ module Dependabot
       end
 
       sig do
-        params(name: String, type: String, requirement: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)]))
+        params(name: String, type: String,
+               requirement: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)]))
       end
       def dependency_source(name:, type:, requirement:)
         return unless lockfile
@@ -223,7 +272,7 @@ module Dependabot
 
       sig { override.void }
       def check_required_files
-        raise "No composer.json!" unless get_original_file("composer.json")
+        raise "No #{PackageManager::MANIFEST_FILENAME}!" unless get_original_file(PackageManager::MANIFEST_FILENAME)
       end
 
       sig { returns(T.nilable(T::Hash[String, T.untyped])) }
@@ -243,7 +292,10 @@ module Dependabot
       def parsed_composer_json
         content = composer_json&.content
 
-        raise Dependabot::DependencyFileNotParseable, composer_json&.path || "" if content.nil? || content.strip.empty?
+        if content.nil? || content.strip.empty?
+          raise Dependabot::DependencyFileNotParseable,
+                composer_json&.path || ""
+        end
 
         @parsed_composer_json ||= T.let(JSON.parse(content), T.nilable(T::Hash[String, T.untyped]))
       rescue JSON::ParserError
@@ -252,17 +304,24 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def composer_json
-        @composer_json ||= T.let(get_original_file("composer.json"), T.nilable(Dependabot::DependencyFile))
+        @composer_json ||= T.let(
+          get_original_file(PackageManager::MANIFEST_FILENAME),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= T.let(get_original_file("composer.lock"), T.nilable(Dependabot::DependencyFile))
+        @lockfile ||= T.let(
+          get_original_file(PackageManager::LOCKFILE_FILENAME),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
       sig { returns(String) }
       def composer_version
-        @composer_version ||= T.let(Helpers.composer_version(parsed_composer_json, parsed_lockfile), T.nilable(String))
+        @composer_version ||= T.let(Helpers.composer_version(parsed_composer_json, parsed_lockfile),
+                                    T.nilable(String))
       end
     end
   end

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -68,7 +68,7 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files
 
-            updated_content = run_update_helper.fetch("composer.lock")
+            updated_content = run_update_helper.fetch(PackageManager::LOCKFILE_FILENAME)
 
             updated_content = post_process_lockfile(updated_content)
             raise "Expected content to change!" if lockfile.content == updated_content
@@ -256,9 +256,9 @@ module Dependabot
             File.write(file.name, file.content)
           end
 
-          File.write("composer.json", locked_composer_json_content)
-          File.write("composer.lock", lockfile.content)
-          File.write("auth.json", auth_json.content) if auth_json
+          File.write(PackageManager::MANIFEST_FILENAME, locked_composer_json_content)
+          File.write(PackageManager::LOCKFILE_FILENAME, lockfile.content)
+          File.write(PackageManager::AUTH_FILENAME, auth_json.content) if auth_json
         end
 
         def locked_composer_json_content
@@ -288,7 +288,7 @@ module Dependabot
             next content unless Composer::Version.correct?(updated_req)
 
             old_req =
-              dep.requirements.find { |r| r[:file] == "composer.json" }
+              dep.requirements.find { |r| r[:file] == PackageManager::MANIFEST_FILENAME }
                  &.fetch(:requirement)
 
             # When updating a subdep there won't be an old requirement
@@ -379,11 +379,11 @@ module Dependabot
         def replace_content_hash(content)
           existing_hash = JSON.parse(content).fetch("content-hash")
           SharedHelpers.in_a_temporary_directory do
-            File.write("composer.json", updated_composer_json_content)
+            File.write(PackageManager::MANIFEST_FILENAME, updated_composer_json_content)
 
             content_hash =
               SharedHelpers.run_helper_subprocess(
-                command: "php #{php_helper_path}",
+                command: "#{Language::NAME} #{php_helper_path}",
                 function: "get_content_hash",
                 env: credentials_env,
                 args: [Dir.pwd]
@@ -466,25 +466,25 @@ module Dependabot
 
         def registry_credentials
           credentials
-            .select { |cred| cred.fetch("type") == "composer_repository" }
+            .select { |cred| cred.fetch("type") == PackageManager::REPOSITORY_KEY }
             .select { |cred| cred["password"] }
         end
 
         def initial_platform
-          platform_php = parsed_composer_json.dig("config", "platform", "php")
+          platform_php = Helpers.capture_platform_php(parsed_composer_json)
 
           platform = {}
-          platform["php"] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
+          platform[Language::NAME] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
 
           # NOTE: We *don't* include the require-dev PHP version in our initial
           # platform. If we fail to resolve with the PHP version specified in
           # `require` then it will be picked up in a subsequent iteration.
-          requirement_php = parsed_composer_json.dig("require", "php")
+          requirement_php = Helpers.php_constraint(parsed_composer_json)
           return platform unless requirement_php.is_a?(String)
           return platform unless requirement_valid?(requirement_php)
 
-          platform["php"] ||= []
-          platform["php"] << requirement_php
+          platform[Language::NAME] ||= []
+          platform[Language::NAME] << requirement_php
           platform
         end
 
@@ -505,16 +505,16 @@ module Dependabot
 
         def composer_json
           @composer_json ||=
-            dependency_files.find { |f| f.name == "composer.json" }
+            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
         end
 
         def lockfile
           @lockfile ||=
-            dependency_files.find { |f| f.name == "composer.lock" }
+            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME }
         end
 
         def auth_json
-          @auth_json ||= dependency_files.find { |f| f.name == "auth.json" }
+          @auth_json ||= dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
         end
 
         def artifact_dependencies
@@ -524,7 +524,7 @@ module Dependabot
 
         def path_dependencies
           @path_dependencies ||=
-            dependency_files.select { |f| f.name.end_with?("/composer.json") }
+            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") }
         end
       end
     end

data/lib/dependabot/composer/file_updater.rb

@@ -46,7 +46,7 @@ module Dependabot
       private
 
       def check_required_files
-        raise "No composer.json!" unless get_original_file("composer.json")
+        raise "No #{PackageManager::MANIFEST_FILENAME}!" unless get_original_file(PackageManager::MANIFEST_FILENAME)
       end
 
       def updated_composer_json_content
@@ -66,11 +66,11 @@ module Dependabot
       end
 
       def composer_json
-        @composer_json ||= get_original_file("composer.json")
+        @composer_json ||= get_original_file(PackageManager::MANIFEST_FILENAME)
       end
 
       def lockfile
-        @lockfile ||= get_original_file("composer.lock")
+        @lockfile ||= get_original_file(PackageManager::LOCKFILE_FILENAME)
       end
     end
   end

data/lib/dependabot/composer/helpers.rb

@@ -45,8 +45,8 @@ module Dependabot
       def self.composer_version(composer_json, parsed_lockfile = nil)
         # If the parsed lockfile has a plugin API version, we return either V1 or V2
         # based on the major version of the lockfile.
-        if parsed_lockfile && parsed_lockfile["plugin-api-version"]
-          version = Composer::Version.new(parsed_lockfile["plugin-api-version"])
+        if parsed_lockfile && parsed_lockfile[PackageManager::PLUGIN_API_VERSION_KEY]
+          version = Composer::Version.new(parsed_lockfile[PackageManager::PLUGIN_API_VERSION_KEY])
           major_version = version.canonical_segments.first
 
           return major_version.nil? || major_version > 1 ? V2 : V1
@@ -89,11 +89,84 @@ module Dependabot
         nil
       end
 
+      # Run single composer command returning stdout/stderr
+      sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
+      def self.package_manager_run_command(command, fingerprint: nil)
+        full_command = "composer #{command}"
+
+        Dependabot.logger.info("Running composer command: #{full_command}")
+
+        result = Dependabot::SharedHelpers.run_shell_command(
+          full_command,
+          fingerprint: "composer #{fingerprint || command}"
+        ).strip
+
+        Dependabot.logger.info("Command executed successfully: #{full_command}")
+        result
+      rescue StandardError => e
+        Dependabot.logger.error("Error running composer command: #{full_command}, Error: #{e.message}")
+        raise
+      end
+
+      # Example output:
+      # [dependabot] ~ $ composer --version
+      # Composer version 2.7.7 2024-06-10 22:11:12
+      # PHP version 7.4.33 (/usr/bin/php7.4)
+      # Run the "diagnose" command to get more detailed diagnostics output.
+      # Get the version of the composer and php form the command output
+      # @return [Hash] with the composer and php version
+      # => { composer: "2.7.7", php: "7.4.33" }
+      sig { returns(T::Hash[Symbol, T.nilable(String)]) }
+      def self.fetch_composer_and_php_versions
+        output = package_manager_run_command("--version").strip
+
+        composer_version = capture_version(output, /Composer version (?<version>\d+\.\d+\.\d+)/)
+        php_version = capture_version(output, /PHP version (?<version>\d+\.\d+\.\d+)/)
+
+        Dependabot.logger.info("Dependabot running with Composer version: #{composer_version}")
+        Dependabot.logger.info("Dependabot running with PHP version: #{php_version}")
+
+        { composer: composer_version, php: php_version }
+      rescue StandardError => e
+        Dependabot.logger.error("Error fetching versions for package manager and language #{name}: #{e.message}")
+        {}
+      end
+
+      sig { params(output: String, regex: Regexp).returns(T.nilable(String)) }
+      def self.capture_version(output, regex)
+        match = output.match(regex)
+        match&.named_captures&.fetch("version", nil)
+      end
+
+      # Capture the platform PHP version from composer.json
+      sig { params(parsed_composer_json: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
+      def self.capture_platform_php(parsed_composer_json)
+        capture_platform(parsed_composer_json, Language::NAME)
+      end
+
+      # Capture the platform extension from composer.json
+      sig { params(parsed_composer_json: T::Hash[String, T.untyped], name: String).returns(T.nilable(String)) }
+      def self.capture_platform(parsed_composer_json, name)
+        parsed_composer_json.dig(PackageManager::CONFIG_KEY, PackageManager::PLATFORM_KEY, name)
+      end
+
+      # Capture PHP version constraint from composer.json
+      sig { params(parsed_composer_json: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
+      def self.php_constraint(parsed_composer_json)
+        dependency_constraint(parsed_composer_json, Language::NAME)
+      end
+
+      # Capture extension version constraint from composer.json
+      sig { params(parsed_composer_json: T::Hash[String, T.untyped], name: String).returns(T.nilable(String)) }
+      def self.dependency_constraint(parsed_composer_json, name)
+        parsed_composer_json.dig(PackageManager::REQUIRE_KEY, name)
+      end
+
       sig { params(composer_json: T::Hash[String, T.untyped]).returns(T::Boolean) }
       def self.invalid_v2_requirement?(composer_json)
-        return false unless composer_json.key?("require")
+        return false unless composer_json.key?(PackageManager::REQUIRE_KEY)
 
-        composer_json["require"].keys.any? do |key|
+        composer_json[PackageManager::REQUIRE_KEY].keys.any? do |key|
           key !~ PLATFORM_PACKAGE_REGEX && key !~ COMPOSER_V2_NAME_REGEX
         end
       end

data/lib/dependabot/composer/language.rb

@@ -0,0 +1,38 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/ecosystem"
+require "dependabot/composer/requirement"
+require "dependabot/composer/version"
+
+module Dependabot
+  module Composer
+    class Language < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      NAME = "php"
+
+      sig { params(raw_version: String, requirement: T.nilable(Requirement)).void }
+      def initialize(raw_version, requirement: nil)
+        super(
+          NAME,
+          Version.new(raw_version),
+          [],
+          [],
+          requirement
+       )
+      end
+
+      sig { returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/composer/package_manager.rb

@@ -8,22 +8,35 @@ require "dependabot/composer/version"
 module Dependabot
   module Composer
     ECOSYSTEM = "composer"
-    PACKAGE_MANAGER = "composer"
-
-    # Keep versions in ascending order
-    SUPPORTED_COMPOSER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
-
-    DEPRECATED_COMPOSER_VERSIONS = T.let([
-      Version.new("1")
-    ].freeze, T::Array[Dependabot::Version])
 
     class PackageManager < Dependabot::Ecosystem::VersionManager
       extend T::Sig
 
+      NAME = "composer"
+      MANIFEST_FILENAME = "composer.json"
+      LOCKFILE_FILENAME = "composer.lock"
+      AUTH_FILENAME = "auth.json"
+      DEPENDENCY_NAME = "composer/composer"
+
+      REQUIRE_KEY = "require"
+      CONFIG_KEY = "config"
+      PLATFORM_KEY = "platform"
+      PLUGIN_API_VERSION_KEY = "plugin-api-version"
+      REPOSITORY_KEY = "composer_repository"
+
+      # Keep versions in ascending order
+      SUPPORTED_COMPOSER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
+
+      # Currently, we don't support any deprecated versions of Composer
+      # When a version is going to be unsupported, it will be added here for a while to give users time to upgrade
+      # Example for deprecation:
+      # DEPRECATED_COMPOSER_VERSIONS = T.let([Version.new("1")].freeze, T::Array[Dependabot::Version])
+      DEPRECATED_COMPOSER_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
       sig { params(raw_version: String).void }
       def initialize(raw_version)
         super(
-          PACKAGE_MANAGER,
+          NAME,
           Version.new(raw_version),
           DEPRECATED_COMPOSER_VERSIONS,
           SUPPORTED_COMPOSER_VERSIONS,

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -107,7 +107,7 @@ module Dependabot
                 .select { |r| r.is_a?(Hash) }
 
           urls = repositories
-                 .select { |h| h["type"] == "composer" }
+                 .select { |h| h["type"] == PackageManager::NAME }
                  .filter_map { |h| h["url"] }
                  .map { |url| url.gsub(%r{\/$}, "") + "/packages.json" }
 
@@ -170,7 +170,7 @@ module Dependabot
         end
 
         def registry_credentials
-          credentials.select { |cred| cred["type"] == "composer_repository" } +
+          credentials.select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY } +
             auth_json_credentials
         end
 
@@ -191,14 +191,16 @@ module Dependabot
 
         def composer_file
           composer_file =
-            dependency_files.find { |f| f.name == "composer.json" }
-          raise "No composer.json!" unless composer_file
+            dependency_files.find do |f|
+              f.name == PackageManager::MANIFEST_FILENAME
+            end
+          raise "No #{PackageManager::MANIFEST_FILENAME}!" unless composer_file
 
           composer_file
         end
 
         def auth_json
-          dependency_files.find { |f| f.name == "auth.json" }
+          dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
         end
 
         def ignore_requirements

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -108,7 +108,7 @@ module Dependabot
 
         def write_dependency_file(unlock_requirement:)
           File.write(
-            "composer.json",
+            PackageManager::MANIFEST_FILENAME,
             prepared_composer_json_content(
               unlock_requirement: unlock_requirement
             )
@@ -123,11 +123,11 @@ module Dependabot
         end
 
         def write_lockfile
-          File.write("composer.lock", lockfile.content) if lockfile
+          File.write(PackageManager::LOCKFILE_FILENAME, lockfile.content) if lockfile
         end
 
         def write_auth_file
-          File.write("auth.json", auth_json.content) if auth_json
+          File.write(PackageManager::AUTH_FILENAME, auth_json.content) if auth_json
         end
 
         def transitory_failure?(error)
@@ -175,9 +175,9 @@ module Dependabot
           composer_platform_extensions.each do |extension, requirements|
             next unless version_for_reqs(requirements)
 
-            json["config"] ||= {}
-            json["config"]["platform"] ||= {}
-            json["config"]["platform"][extension] =
+            json[PackageManager::CONFIG_KEY] ||= {}
+            json[PackageManager::CONFIG_KEY][PackageManager::PLATFORM_KEY] ||= {}
+            json[PackageManager::CONFIG_KEY][PackageManager::PLATFORM_KEY][extension] =
               version_for_reqs(requirements)
           end
 
@@ -338,8 +338,10 @@ module Dependabot
             # composer.json. In this case we just ignore the dependency.
             nil
           elsif error.message.include?("does not match the expected JSON schema")
-            msg = "Composer failed to parse your composer.json as it does not match the expected JSON schema.\n" \
-                  "Run `composer validate` to check your composer.json and composer.lock files.\n\n" \
+            msg = "Composer failed to parse your #{PackageManager::MANIFEST_FILENAME}" \
+                  "as it does not match the expected JSON schema.\n" \
+                  "Run `composer validate` to check your #{PackageManager::MANIFEST_FILENAME} " \
+                  "and #{PackageManager::LOCKFILE_FILENAME} files.\n\n" \
                   "See https://getcomposer.org/doc/04-schema.md for details on the schema."
             raise Dependabot::DependencyFileNotParseable, msg
           else
@@ -452,20 +454,22 @@ module Dependabot
         end
 
         def initial_platform
-          platform_php = parsed_composer_file.dig("config", "platform", "php")
+          platform_php = Helpers.capture_platform_php(parsed_composer_file)
 
           platform = {}
-          platform["php"] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
+          if platform_php.is_a?(String) && requirement_valid?(platform_php)
+            platform[Dependabot::Composer::Language::NAME] = [platform_php]
+          end
 
           # NOTE: We *don't* include the require-dev PHP version in our initial
           # platform. If we fail to resolve with the PHP version specified in
           # `require` then it will be picked up in a subsequent iteration.
-          requirement_php = parsed_composer_file.dig("require", "php")
+          requirement_php = Helpers.php_constraint(parsed_composer_file)
           return platform unless requirement_php.is_a?(String)
           return platform unless requirement_valid?(requirement_php)
 
-          platform["php"] ||= []
-          platform["php"] << requirement_php
+          platform[Dependabot::Composer::Language::NAME] ||= []
+          platform[Dependabot::Composer::Language::NAME] << requirement_php
           platform
         end
 
@@ -479,12 +483,12 @@ module Dependabot
 
         def composer_file
           @composer_file ||=
-            dependency_files.find { |f| f.name == "composer.json" }
+            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
         end
 
         def path_dependency_files
           @path_dependency_files ||=
-            dependency_files.select { |f| f.name.end_with?("/composer.json") }
+            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") }
         end
 
         def zipped_path_dependency_files
@@ -494,11 +498,11 @@ module Dependabot
 
         def lockfile
           @lockfile ||=
-            dependency_files.find { |f| f.name == "composer.lock" }
+            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME }
         end
 
         def auth_json
-          @auth_json ||= dependency_files.find { |f| f.name == "auth.json" }
+          @auth_json ||= dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
         end
 
         def requirement_valid?(req_string)
@@ -516,7 +520,7 @@ module Dependabot
 
         def registry_credentials
           credentials
-            .select { |cred| cred["type"] == "composer_repository" }
+            .select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY }
             .select { |cred| cred["password"] }
         end
       end

data/lib/dependabot/composer/update_checker.rb

@@ -139,8 +139,8 @@ module Dependabot
 
       def composer_file
         composer_file =
-          dependency_files.find { |f| f.name == "composer.json" }
-        raise "No composer.json!" unless composer_file
+          dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
+        raise "No #{PackageManager::MANIFEST_FILENAME}!" unless composer_file
 
         composer_file
       end

data/lib/dependabot/composer.rb

@@ -12,6 +12,7 @@ require "dependabot/composer/requirement"
 require "dependabot/composer/version"
 require "dependabot/composer/helpers"
 require "dependabot/composer/package_manager"
+require "dependabot/composer/language"
 
 require "dependabot/pull_request_creator/labeler"
 Dependabot::PullRequestCreator::Labeler

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.287.0
+  version: 0.289.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-19 00:00:00.000000000 Z
+date: 2024-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.287.0
+        version: 0.289.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.287.0
+        version: 0.289.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,6 +261,7 @@ files:
 - lib/dependabot/composer/file_updater/lockfile_updater.rb
 - lib/dependabot/composer/file_updater/manifest_updater.rb
 - lib/dependabot/composer/helpers.rb
+- lib/dependabot/composer/language.rb
 - lib/dependabot/composer/metadata_finder.rb
 - lib/dependabot/composer/native_helpers.rb
 - lib/dependabot/composer/package_manager.rb
@@ -275,7 +276,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.287.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.289.0
 post_install_message: 
 rdoc_options: []
 require_paths: