dependabot-composer 0.112.17 → 0.112.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6373b67a953a57260ceae7218a91678d520fe1eda6ec7f86cba91580401f53cf
-  data.tar.gz: 197f5b37ce9116348803c5c50b1a149ec690ccced64c2da154f3450a508de8a2
+  metadata.gz: 5f8dd3d02ef37c4db350f2cd47924bb35a218abec6ff79ef09baf9014287216a
+  data.tar.gz: c761e25d35945121c57884a82a7e774f4ffef96f7c99f23442a57440d898592c
 SHA512:
-  metadata.gz: a4b7a0bcaf533e923ef577f2a63672700ed0f034a5e8b08a3551d3df15bd534badda508e558b1b207da7ae4c696d34cdc4e3c3c15a1200ad029f4e76306afe13
-  data.tar.gz: 1c3a71790db31e5759e29baa066c727e198c53ba60950a57b02584a02826e39ef9cd93b10e0accdc41c115fda077efdbf137ba408b8ab34be312dc5c72e5bf42
+  metadata.gz: 112ceeb3fe14023d0da4a7fd12572cf48390d3dfb57d8b30bb94dede9226c35bf2be2fcfe1dd58b5926379721e90e3a10ea1b6cc043dd131ce7efe8ecdf09a7e
+  data.tar.gz: f4628265ef52fbe56f47dd2ea59ca368136e217feea449378f949fa1966f3225bd370dcec709facd7a13a58aa46e888d54e0f53f6430bd093348f65d0a262580

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -24,10 +24,15 @@ module Dependabot
           end
         end
 
-        MISSING_PLATFORM_REQ_REGEX =
+        MISSING_EXPLICIT_PLATFORM_REQ_REGEX =
           /
-            \sext\-[^\s]+\s.*?\s(?=->|is|but)|
-            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=->|is|but)
+            (?<=PHP\sextension\s)ext\-[^\s]+\s.*?\s(?=is|but)|
+            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=but)
+          /x.freeze
+        MISSING_IMPLICIT_PLATFORM_REQ_REGEX =
+          /
+            \sext\-[^\s]+\s.*?\s(?=->)|
+            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=->)
           /x.freeze
 
         def initialize(dependencies:, dependency_files:, credentials:)
@@ -125,16 +130,33 @@ module Dependabot
         # rubocop:disable Metrics/MethodLength
         # rubocop:disable Metrics/PerceivedComplexity
         def handle_composer_errors(error)
-          if error.message.include?("package requires php") ||
-             error.message.include?("requested PHP extension") ||
-             !library? && error.message.match?(MISSING_PLATFORM_REQ_REGEX)
+          if error.message.match?(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
+            # These errors occur when platform requirements declared explicitly
+            # in the composer.json aren't met.
             missing_extensions =
-              error.message.scan(MISSING_PLATFORM_REQ_REGEX).
+              error.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX).
               map do |extension_string|
                 name, requirement = extension_string.strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end
             raise MissingExtensions, missing_extensions
+          elsif error.message.match?(MISSING_IMPLICIT_PLATFORM_REQ_REGEX) &&
+                !library? &&
+                !initial_platform.empty? &&
+                implicit_platform_reqs_satisfiable?(error.message)
+            missing_extensions =
+              error.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX).
+              map do |extension_string|
+                name, requirement = extension_string.strip.split(" ", 2)
+                { name: name, requirement: requirement }
+              end
+
+            missing_extension = missing_extensions.find do |hash|
+              existing_reqs = composer_platform_extensions[hash[:name]] || []
+              version_for_reqs(existing_reqs + [hash[:requirement]])
+            end
+
+            raise MissingExtensions, [missing_extension]
           end
 
           if error.message.start_with?("Failed to execute git checkout")
@@ -199,6 +221,20 @@ module Dependabot
           parsed_composer_json["type"] == "library"
         end
 
+        def implicit_platform_reqs_satisfiable?(message)
+          missing_extensions =
+            message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX).
+            map do |extension_string|
+              name, requirement = extension_string.strip.split(" ", 2)
+              { name: name, requirement: requirement }
+            end
+
+          missing_extensions.any? do |hash|
+            existing_reqs = composer_platform_extensions[hash[:name]] || []
+            version_for_reqs(existing_reqs + [hash[:requirement]])
+          end
+        end
+
         def write_temporary_dependency_files
           path_dependencies.each do |file|
             path = file.name

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -23,10 +23,15 @@ module Dependabot
           end
         end
 
-        MISSING_PLATFORM_REQ_REGEX =
+        MISSING_EXPLICIT_PLATFORM_REQ_REGEX =
           /
-            \sext\-[^\s]+\s.*?\s(?=->|is|but)|
-            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=->|is|but)
+            (?<=PHP\sextension\s)ext\-[^\s]+\s.*?\s(?=is|but)|
+            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=but)
+          /x.freeze
+        MISSING_IMPLICIT_PLATFORM_REQ_REGEX =
+          /
+            \sext\-[^\s]+\s.*?\s(?=->)|
+            (?<=requires\s)php(?:\-[^\s]+)?\s.*?\s(?=->)
           /x.freeze
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
         SOURCE_TIMED_OUT_REGEX =
@@ -125,6 +130,10 @@ module Dependabot
           json = JSON.parse(content)
 
           composer_platform_extensions.each do |extension, requirements|
+            unless version_for_reqs(requirements)
+              raise "No matching version for #{requirements}!"
+            end
+
             json["config"] ||= {}
             json["config"]["platform"] ||= {}
             json["config"]["platform"][extension] =
@@ -218,16 +227,33 @@ module Dependabot
           elsif error.message.start_with?("Could not parse version") ||
                 error.message.include?("does not allow connections to http://")
             raise Dependabot::DependencyFileNotResolvable, sanitized_message
-          elsif error.message.include?("package requires php") ||
-                error.message.include?("requested PHP extension") ||
-                !library? && error.message.match?(MISSING_PLATFORM_REQ_REGEX)
+          elsif error.message.match?(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
+            # These errors occur when platform requirements declared explicitly
+            # in the composer.json aren't met.
             missing_extensions =
-              error.message.scan(MISSING_PLATFORM_REQ_REGEX).
+              error.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX).
               map do |extension_string|
                 name, requirement = extension_string.strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end
             raise MissingExtensions, missing_extensions
+          elsif error.message.match?(MISSING_IMPLICIT_PLATFORM_REQ_REGEX) &&
+                !library? &&
+                !initial_platform.empty? &&
+                implicit_platform_reqs_satisfiable?(error.message)
+            missing_extensions =
+              error.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX).
+              map do |extension_string|
+                name, requirement = extension_string.strip.split(" ", 2)
+                { name: name, requirement: requirement }
+              end
+
+            missing_extension = missing_extensions.find do |hash|
+              existing_reqs = composer_platform_extensions[hash[:name]] || []
+              version_for_reqs(existing_reqs + [hash[:requirement]])
+            end
+
+            raise MissingExtensions, [missing_extension]
           elsif error.message.include?("cannot require itself") ||
                 error.message.include?('packages.json" file could not be down')
             raise Dependabot::DependencyFileNotResolvable, error.message
@@ -289,6 +315,23 @@ module Dependabot
           parsed_composer_file["type"] == "library"
         end
 
+        def implicit_platform_reqs_satisfiable?(message)
+          missing_extensions =
+            message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX).
+            map do |extension_string|
+              name, requirement = extension_string.strip.split(" ", 2)
+              { name: name, requirement: requirement }
+            end
+
+          missing_extensions.any? do |hash|
+            existing_reqs = composer_platform_extensions[hash[:name]] || []
+            version_for_reqs(existing_reqs + [hash[:requirement]])
+          end
+        end
+
+        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/MethodLength
+        # rubocop:disable Metrics/PerceivedComplexity
         def check_original_requirements_resolvable
           base_directory = dependency_files.first.directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
@@ -304,10 +347,18 @@ module Dependabot
 
           true
         rescue SharedHelpers::HelperSubprocessFailed => e
-          if e.message.include?("requires php") ||
-             e.message.include?("requested PHP extension")
+          if e.message.match?(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
+            missing_extensions =
+              e.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX).
+              map do |extension_string|
+                name, requirement = extension_string.strip.split(" ", 2)
+                { name: name, requirement: requirement }
+              end
+            raise MissingExtensions, missing_extensions
+          elsif e.message.match?(MISSING_IMPLICIT_PLATFORM_REQ_REGEX) &&
+                implicit_platform_reqs_satisfiable?(e.message)
             missing_extensions =
-              e.message.scan(MISSING_PLATFORM_REQ_REGEX).
+              e.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX).
               map do |extension_string|
                 name, requirement = extension_string.strip.split(" ", 2)
                 { name: name, requirement: requirement }
@@ -317,6 +368,9 @@ module Dependabot
 
           raise Dependabot::DependencyFileNotResolvable, e.message
         end
+        # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/MethodLength
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def version_for_reqs(requirements)
           req_arrays =
@@ -337,7 +391,7 @@ module Dependabot
             find do |v|
               req_arrays.all? { |reqs| reqs.any? { |r| r.satisfied_by?(v) } }
             end
-          raise "No matching version for #{requirements}!" unless version
+          return unless version
 
           version.to_s
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.112.17
+  version: 0.112.18
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.17
+        version: 0.112.18
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.17
+        version: 0.112.18
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement