dependabot-composer 0.98.31 → 0.98.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33403db147e2782406f3b54bc6310b92ad6848ef2de0490eae35a68a5f3b814a
-  data.tar.gz: ee765d016c894e1974ef44343359be855e40e9cbfd91bf1656cb666781d78bb3
+  metadata.gz: da13b2ccaa88210d58d9fee2498718b30a571ed0a668ff9fab6b13c0518b5a41
+  data.tar.gz: 53045ed445c8b0a1221113da47bdcd6afab4de5fd318f446f77c5c8ecfdf0757
 SHA512:
-  metadata.gz: e6c39a7ca1bea32d86061091aabe367caca04fbdd50934e57c6707f3313750b604ead44745700d8d208fe23e07ed4260933ddd6c4e8374f390ec0eb62b410812
-  data.tar.gz: efe70d97b5acbaace955d501f3eb87f2ce8fc6a381bb754eaf7ed908294fc78e8acd4966ff85acabd5f629de8d4824f894e4da0245b67b745c097bfe5097740c
+  metadata.gz: 9d7a76841eeefaa6fc2d43c4bfbb1a7c267fe3a1fe8a36fbe1eca20877e463a298cfecc78c87746dcc89f4f2b4585b3f7695426316b56b68893dadb7c6229cd9
+  data.tar.gz: e63734f21052fae6161549d8d7bd741f20561aa931575c9184613aa57c951e2667e985aada1dba136f306d62348e4b5193e62c8ae8498b4730b17f2ab9a08fdc

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -247,12 +247,14 @@ module Dependabot
 
         def git_credentials
           credentials.
-            select { |cred| cred.fetch("type") == "git_source" }
+            select { |cred| cred.fetch("type") == "git_source" }.
+            select { |cred| cred["password"] }
         end
 
         def registry_credentials
           credentials.
-            select { |cred| cred.fetch("type") == "composer_repository" }
+            select { |cred| cred.fetch("type") == "composer_repository" }.
+            select { |cred| cred["password"] }
         end
 
         def composer_json

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -122,6 +122,8 @@ module Dependabot
         # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/MethodLength
         def handle_composer_errors(error)
+          sanitized_message = remove_url_credentials(error.message)
+
           if error.message.start_with?("Failed to execute git clone")
             dependency_url =
               error.message.match(/--mirror '(?<url>.*?)'/).
@@ -132,8 +134,9 @@ module Dependabot
               error.message.match(/Failed to clone (?<url>.*?) via/).
               named_captures.fetch("url")
             raise Dependabot::GitDependenciesNotReachable, dependency_url
-          elsif error.message.start_with?("Could not parse version")
-            raise Dependabot::DependencyFileNotResolvable, error.message
+          elsif error.message.start_with?("Could not parse version") ||
+                error.message.include?("does not allow connections to http://")
+            raise Dependabot::DependencyFileNotResolvable, sanitized_message
           elsif error.message.include?("requested PHP extension")
             extensions = error.message.scan(/\sext\-.*?\s/).map(&:strip).uniq
             msg = "Dependabot's installed extensions didn't match those "\
@@ -212,11 +215,19 @@ module Dependabot
         end
 
         def git_credentials
-          credentials.select { |cred| cred["type"] == "git_source" }
+          credentials.
+            select { |cred| cred["type"] == "git_source" }.
+            select { |cred| cred["password"] }
         end
 
         def registry_credentials
-          credentials.select { |cred| cred["type"] == "composer_repository" }
+          credentials.
+            select { |cred| cred["type"] == "composer_repository" }.
+            select { |cred| cred["password"] }
+        end
+
+        def remove_url_credentials(message)
+          message.gsub(%r{(?<=://)[^\s]*:[^\s]*(?=@)}, "****")
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.98.31
+  version: 0.98.32
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-22 00:00:00.000000000 Z
+date: 2019-03-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.31
+        version: 0.98.32
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.31
+        version: 0.98.32
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement