dependabot-composer 0.295.0 → 0.296.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d85bd1ad74378720906cdd9859f26ce0714b1b95a2858d0543b98dc1a777133
-  data.tar.gz: a579d3f1e46f43f8e6e8c0ec17c2a7125d620986fd685d5a38bada8cf76d79e9
+  metadata.gz: 0af2f173fa02cd21f81d4f91269332f220886a0c1fa3a272def5cbc85ec40368
+  data.tar.gz: a10e62096f71cd6b0636f562790a6213cdc2d92aaecf3726dad56df76ced281e
 SHA512:
-  metadata.gz: f055d8341e1ef864bc17e6ddfcfd2e4e7b35d48c9cd2c74430315692bdb9cdb02a678cb9b739e25177f417808374a8c6ea7df98af4a9fcfe4a4a4aff6ffecd3c
-  data.tar.gz: f267b7fd5bf57b381f9f199cce7ed7c6d5c3f70f7bddf49ba6e04ecf02bbb5826d233fb923751a59698487a211216372d39c655214891c10ee2c450fc2679111
+  metadata.gz: f93ec5ad2f8755b01b16b1fbe37da6581f60e50c48ded3224fcd68bda2ff4f527dcc90656ab26a6d93d56394557a04cfdfde0d0011d1464bdc29907f85a08f21
+  data.tar.gz: 867705928cce53572e4d7a5369d22d09602943a7322c4336b4d8ce98ce5c7542b0cd12de1db83a5461a6273d1d2ccdf3ad864c28d0b39f71f0e3bf15f8ab296b

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -48,6 +48,7 @@ module Dependabot
           @requirements_to_unlock       = requirements_to_unlock
           @latest_allowable_version     = latest_allowable_version
           @composer_platform_extensions = initial_platform
+          @error_handler                = ComposerErrorHandler.new
         end
 
         def latest_resolvable_version
@@ -62,6 +63,7 @@ module Dependabot
         attr_reader :requirements_to_unlock
         attr_reader :latest_allowable_version
         attr_reader :composer_platform_extensions
+        attr_reader :error_handler
 
         def fetch_latest_resolvable_version
           version = fetch_latest_resolvable_version_string
@@ -344,6 +346,8 @@ module Dependabot
                   "See https://getcomposer.org/doc/04-schema.md for details on the schema."
             raise Dependabot::DependencyFileNotParseable, msg
           else
+            error_handler.handle_composer_error(error)
+
             raise error
           end
         end
@@ -524,5 +528,52 @@ module Dependabot
         end
       end
     end
+
+    class ComposerErrorHandler
+      extend T::Sig
+
+      # Private source errors
+      CURL_ERROR = /curl error 52 while downloading (?<url>.*): Empty reply from server/
+
+      PRIVATE_SOURCE_AUTH_FAIL = [
+        /Could not authenticate against (?<url>.*)/,
+        /The '(?<url>.*)' URL could not be accessed \(HTTP 403\)/,
+        /The "(?<url>.*)" file could not be downloaded/
+      ].freeze
+
+      REQUIREMENT_ERROR = /^(?<req>.*) is invalid, it should not contain uppercase characters/
+
+      NO_URL = "No URL specified"
+
+      def sanitize_uri(url)
+        url = "http://#{url}" unless url.start_with?("http")
+        uri = URI.parse(url)
+        host = T.must(uri.host).downcase
+        host.start_with?("www.") ? host[4..-1] : host
+      end
+
+      # Handles errors with specific to composer error codes
+      sig { params(error: SharedHelpers::HelperSubprocessFailed).void }
+      def handle_composer_error(error)
+        # private source auth errors
+        PRIVATE_SOURCE_AUTH_FAIL.each do |regex|
+          next unless error.message.match?(regex)
+
+          url = T.must(error.message.match(regex)).named_captures["url"]
+          raise Dependabot::PrivateSourceAuthenticationFailure, sanitize_uri(url).empty? ? NO_URL : sanitize_uri(url)
+        end
+
+        # invalid requirement mentioned in manifest file
+        if error.message.match?(REQUIREMENT_ERROR)
+          raise DependencyFileNotResolvable,
+                "Invalid requirement: #{T.must(error.message.match(REQUIREMENT_ERROR)).named_captures['req']}"
+        end
+
+        return unless error.message.match?(CURL_ERROR)
+
+        url = T.must(error.message.match(CURL_ERROR)).named_captures["url"]
+        raise PrivateSourceBadResponse, url
+      end
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.295.0
+  version: 0.296.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-30 00:00:00.000000000 Z
+date: 2025-02-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.295.0
+        version: 0.296.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -280,7 +280,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.296.0
 post_install_message:
 rdoc_options: []
 require_paths: