dependabot-conda 0.330.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c517085fb61f2912b18a3f54c12d421ce03374d9afda6c2901df09f653bc1fa
-  data.tar.gz: a20edf95149380ede0798e4054504f4a829c9ce614c4ee363b2baeea71590fcb
+  metadata.gz: 8575063b9703256c28cf5dafaa89a2cdee5a7f1159bb6a65d906ad34120e937c
+  data.tar.gz: fce31ba90bf623fa8fb5a4c2703cca3cc9a2a7905972996c40b37ea02c6b72be
 SHA512:
-  metadata.gz: 0ee96061dcb26e0510066232486ba23349ac1829b1749f0b51809acf0c5aea01390df452859fcc138feb910a19b0d0b93daed2117eaa75c76c845687a910076a
-  data.tar.gz: 32128d133c34b2ee87579c602f6d012c88f299ef45618e93042b9342460900161802c2cf393095cf8eef904394d8e3fb29cac24c044ea57fcd29208bbb7cfd11
+  metadata.gz: 60528c5bbb89b2213a1f3592b8327bc2c380cb12f1a1bc66a3a892d623fbdaa1d3d0afce0c007e3059e753416ba00fcd41e90a9f7fd643b3414150022b4cdf73
+  data.tar.gz: fe960766d75131ae9f67e0d082a9efe31ac11b53e4c00b0f483fadc56535add79b535f9ec6646e71946856371cefdce83aa5f77ef9fab7771c00e193f1d2a4b9

data/lib/dependabot/conda/file_parser.rb

@@ -8,6 +8,7 @@ require "dependabot/file_parsers/base"
 require "dependabot/conda/python_package_classifier"
 require "dependabot/conda/requirement"
 require "dependabot/conda/version"
+require "dependabot/conda/package_manager"
 
 module Dependabot
   module Conda
@@ -25,8 +26,28 @@ module Dependabot
         dependencies.uniq
       end
 
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Ecosystem.new(
+            name: ECOSYSTEM,
+            package_manager: package_manager,
+            language: nil
+          ),
+          T.nilable(Ecosystem)
+        )
+      end
+
       private
 
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        @package_manager ||= T.let(
+          CondaPackageManager.new,
+          T.nilable(Ecosystem::VersionManager)
+        )
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def environment_files
         dependency_files.select { |f| f.name.match?(/^environment\.ya?ml$/i) }

data/lib/dependabot/conda/package_manager.rb

@@ -16,7 +16,6 @@ module Dependabot
       extend T::Sig
 
       NAME = "conda"
-      VERSION = "latest"
 
       SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
       DEPRECATED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
@@ -25,7 +24,7 @@ module Dependabot
       def initialize
         super(
           name: NAME,
-          version: Dependabot::Conda::Version.new(VERSION),
+          version: nil,
           deprecated_versions: DEPRECATED_VERSIONS,
           supported_versions: SUPPORTED_VERSIONS
         )

data/lib/dependabot/conda/update_checker/latest_version_finder.rb

@@ -54,7 +54,7 @@ module Dependabot
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,
-              security_advisories: security_advisories,
+              security_advisories: python_compatible_security_advisories,
               cooldown_options: @cooldown_options
             ),
             T.nilable(Dependabot::Python::UpdateChecker::LatestVersionFinder)
@@ -81,6 +81,28 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        def python_compatible_security_advisories
+          security_advisories.map do |advisory|
+            # Convert Conda requirements to Python requirements for pip compatibility
+            python_vulnerable_versions = advisory.vulnerable_versions.flat_map do |conda_req|
+              Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
+            end
+
+            python_safe_versions = advisory.safe_versions.flat_map do |conda_req|
+              Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
+            end
+
+            # Normalize security advisories to use 'pip' package manager for Python delegation
+            Dependabot::SecurityAdvisory.new(
+              dependency_name: advisory.dependency_name,
+              package_manager: "pip", # Use pip for PyPI compatibility
+              vulnerable_versions: python_vulnerable_versions,
+              safe_versions: python_safe_versions
+            )
+          end
+        end
+
         sig { params(conda_requirement: T.nilable(String)).returns(T.nilable(String)) }
         def convert_conda_requirement_to_pip(conda_requirement)
           RequirementTranslator.conda_to_pip(conda_requirement)

data/lib/dependabot/conda/update_checker.rb

@@ -25,6 +25,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          exclude_paths: T.nilable(T::Array[String]),
           options: T::Hash[Symbol, T.untyped]
         )
           .void
@@ -33,7 +34,7 @@ module Dependabot
                      repo_contents_path: nil, ignored_versions: [],
                      raise_on_ignored: false, security_advisories: [],
                      requirements_update_strategy: nil, dependency_group: nil,
-                     update_cooldown: nil, options: {})
+                     update_cooldown: nil, exclude_paths: [], options: {})
         super
         @latest_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
         @lowest_resolvable_security_fix_version = T.let(nil, T.nilable(Dependabot::Version))
@@ -134,19 +135,26 @@ module Dependabot
       def fetch_lowest_resolvable_security_fix_version
         # Delegate to latest_version_finder for security fix resolution
         # This leverages Python ecosystem's security advisory infrastructure
-        latest_version_finder.lowest_security_fix_version
+        fix_version = latest_version_finder.lowest_security_fix_version
+
+        # If no security fix version is found, fall back to latest_resolvable_version
+        if fix_version.nil?
+          fallback = latest_resolvable_version
+          return fallback.is_a?(String) ? Dependabot::Conda::Version.new(fallback) : fallback
+        end
+
+        fix_version
       end
 
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
-        # For Phase 3, return false as placeholder since we're not doing full dependency resolution
+        # No lock file support for Conda
         false
       end
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
-        # For Phase 3, return empty array as placeholder
-        []
+        raise NotImplementedError
       end
 
       sig { params(requirement_string: String, new_version: String).returns(String) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-conda
 version: !ruby/object:Gem::Version
-  version: 0.330.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.330.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -273,7 +273,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.330.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib