dependabot-conda 0.331.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc19f39b65ce06c34486f5c76beec237b6f8d0b80ec1923a9abb4f65d185fe58
-  data.tar.gz: fbc90795ea5658d1927fe5a962d6d5197d7780f14800e7522229f74cbf2b51ba
+  metadata.gz: 8575063b9703256c28cf5dafaa89a2cdee5a7f1159bb6a65d906ad34120e937c
+  data.tar.gz: fce31ba90bf623fa8fb5a4c2703cca3cc9a2a7905972996c40b37ea02c6b72be
 SHA512:
-  metadata.gz: e03d6276d31c07caa4b3f5f78d739a5bb07ec06829dde598a509c6cf28be57a99a02593e45f6d25c11eb97ab452c9b6b1792761f7d32d40382ee28bec622c43e
-  data.tar.gz: a2b1a800a86d9c557294fa2741ccb6b618fc98e4aa7755eff791835c46672ede6458d7336155db95c366b97c3afe38e20b45b391b2b7d6b5c56de2a26ea9d1ab
+  metadata.gz: 60528c5bbb89b2213a1f3592b8327bc2c380cb12f1a1bc66a3a892d623fbdaa1d3d0afce0c007e3059e753416ba00fcd41e90a9f7fd643b3414150022b4cdf73
+  data.tar.gz: fe960766d75131ae9f67e0d082a9efe31ac11b53e4c00b0f483fadc56535add79b535f9ec6646e71946856371cefdce83aa5f77ef9fab7771c00e193f1d2a4b9

data/lib/dependabot/conda/update_checker/latest_version_finder.rb

@@ -54,7 +54,7 @@ module Dependabot
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,
-              security_advisories: security_advisories,
+              security_advisories: python_compatible_security_advisories,
               cooldown_options: @cooldown_options
             ),
             T.nilable(Dependabot::Python::UpdateChecker::LatestVersionFinder)
@@ -81,6 +81,28 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        def python_compatible_security_advisories
+          security_advisories.map do |advisory|
+            # Convert Conda requirements to Python requirements for pip compatibility
+            python_vulnerable_versions = advisory.vulnerable_versions.flat_map do |conda_req|
+              Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
+            end
+
+            python_safe_versions = advisory.safe_versions.flat_map do |conda_req|
+              Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
+            end
+
+            # Normalize security advisories to use 'pip' package manager for Python delegation
+            Dependabot::SecurityAdvisory.new(
+              dependency_name: advisory.dependency_name,
+              package_manager: "pip", # Use pip for PyPI compatibility
+              vulnerable_versions: python_vulnerable_versions,
+              safe_versions: python_safe_versions
+            )
+          end
+        end
+
         sig { params(conda_requirement: T.nilable(String)).returns(T.nilable(String)) }
         def convert_conda_requirement_to_pip(conda_requirement)
           RequirementTranslator.conda_to_pip(conda_requirement)

data/lib/dependabot/conda/update_checker.rb

@@ -135,19 +135,26 @@ module Dependabot
       def fetch_lowest_resolvable_security_fix_version
         # Delegate to latest_version_finder for security fix resolution
         # This leverages Python ecosystem's security advisory infrastructure
-        latest_version_finder.lowest_security_fix_version
+        fix_version = latest_version_finder.lowest_security_fix_version
+
+        # If no security fix version is found, fall back to latest_resolvable_version
+        if fix_version.nil?
+          fallback = latest_resolvable_version
+          return fallback.is_a?(String) ? Dependabot::Conda::Version.new(fallback) : fallback
+        end
+
+        fix_version
       end
 
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
-        # For Phase 3, return false as placeholder since we're not doing full dependency resolution
+        # No lock file support for Conda
         false
       end
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
-        # For Phase 3, return empty array as placeholder
-        []
+        raise NotImplementedError
       end
 
       sig { params(requirement_string: String, new_version: String).returns(String) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-conda
 version: !ruby/object:Gem::Version
-  version: 0.331.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -273,7 +273,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.331.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib