dependabot-core 0.76.1

data/LICENSE

@@ -0,0 +1,37 @@
+The Prosperity Public License 1.0.1
+
+Copyright Notice: {Licensor Name}
+
+Source Notice: {https://example.com/project}
+
+This license lets you use and share this software for free,
+with a trial-length time limit on commercial use. Specifically:
+
+If you follow the rules below, you may do everything with this
+software that would otherwise infringe my copyright in it or any
+patent claim I can license that covers this software as of my
+latest contribution.
+
+1. You must limit use of this software in any manner primarily
+   intended for or directed toward commercial advantage or
+   private monetary compensation to a trial period of 32
+   consecutive calendar days. This limit does not apply to use in
+   developing feedback, modifications, or extensions that you
+   contribute back to those giving this license.
+
+2. Ensure everyone who gets a copy of this software from you,
+   in source code or any other form, gets the text of this
+   license and the copyright and source notices above.
+
+3. Do not make any legal claim against anyone for infringing
+   any patent claim they would infringe by using this software
+   alone, accusing this software, with or without changes,
+   alone or as part of a larger program.
+
+You are excused for unknowingly breaking rule 1 if you stop
+doing anything requiring this license within 30 days of
+learning you broke the rule.
+
+**This software comes as is, without any warranty at all. As far
+as the law allows, I will not be liable for any damages related
+to this software or this license, for any kind of legal claim.**

data/README.md

@@ -0,0 +1,115 @@
+<p align="center">
+  <img src="https://s3.eu-west-2.amazonaws.com/dependabot-images/logo-with-name-horizontal.svg" alt="Dependabot" width="300">
+</p>
+
+# Dependabot Core [![Dependabot Status][dependabot-status]][dependabot]
+
+Dependabot Core is the heart of [Dependabot][dependabot]. It handles the logic
+for updating dependencies on GitHub (including GitHub Enterprise) and GitLab. We
+plan to add support for Bitbucket in future, too.
+
+If you want to host your own automated dependency update bot then this repo
+should give you the tools you need. A reference implementation is available
+[here][dependabot-script].
+
+## What's in this repo?
+
+Dependabot Core is a collection of helper classes for automating dependency
+updating in Ruby, JavaScript, Python, PHP, Elixir, Elm, Go, Rust, Java and
+.NET. It can also update git submodules, Docker files and Terraform files.
+Highlights include:
+
+- Logic to check for the latest version of a dependency *that's resolvable given
+  a project's other dependencies*
+- Logic to generate updated manifest and lockfiles for a new dependency version
+- Logic to find changelogs, release notes, and commits for a dependency update
+
+## Other Dependabot resources
+
+In addition to this library, you may be interested in:
+
+- The [dependabot-script][dependabot-script] repo, which provides a collection
+  of scripts that use this library to update dependencies on GitHub Enterprise
+  or GitLab
+- The [API docs][api-docs] for Dependabot's hosted instance (dependabot.com)
+
+## Setup
+
+To run all of Dependabot Core, you'll need Ruby, Python, PHP, Elixir, Node, Go,
+Elm and Rust installed. However, if you just wish to run it for a single
+language you can get away with just having that language and Ruby.
+
+The main library is written in Ruby, while JavaScript, Python, PHP, Elm,
+Elixir, Go and Rust are required for dealing with updates for their respective
+languages.
+
+Before running Dependabot Core, install dependencies for the core library and
+the helpers:
+
+1. `bundle install`
+2. `cd helpers/yarn && yarn install && cd -`
+3. `cd helpers/npm && yarn install && cd -`
+4. `cd helpers/php && composer install && cd -`
+5. `cd helpers/python && pyenv exec pip install -r requirements.txt && cd -`
+6. `cd helpers/elixir && mix deps.get && cd -`
+
+## Architecture
+
+Dependabot Core has helper classes for seven concerns. Where relevant, each
+concern will have a language-specific class.
+
+| Service                          | Description                                                                                   |
+|----------------------------------|-----------------------------------------------------------------------------------------------|
+| `Dependabot::FileFetchers`       | Fetches the relevant dependency files for a project (e.g., the `Gemfile` and `Gemfile.lock`). See the [file fetchers](https://github.com/dependabot/dependabot-core/tree/master/lib/dependabot/file_fetchers) for more details. |
+| `Dependabot::FileParsers`        | Parses a dependency file and extracts a list of dependencies for a project. See the [file parsers](https://github.com/dependabot/dependabot-core/tree/master/lib/dependabot/file_parsers) for more details. |
+| `Dependabot::UpdateCheckers`     | Checks whether a given dependency is up-to-date. See the [update checkers](https://github.com/dependabot/dependabot-core/tree/master/lib/dependabot/update_checkers) for more details. |
+| `Dependabot::FileUpdaters`       | Updates a dependency file to use the latest version of a given dependency. See the [file updaters](https://github.com/dependabot/dependabot-core/tree/master/lib/dependabot/file_updaters) for more details. |
+| `Dependabot::MetadataFinders`    | Looks up metadata about a dependency, such as its GitHub URL. See the [metadata finders](https://github.com/dependabot/dependabot-core/tree/master/lib/dependabot/metadata_finders) for more details. |
+| `Dependabot::PullRequestCreator` | Creates a Pull Request to the original repo with the updated dependency file.                 |
+| `Dependabot::PullRequestUpdater` | Updates an existing Pull Request with new dependency files (e.g., to resolve conflicts).      |
+
+## Why is this public?
+
+As the name suggests, Dependabot Core is the core of Dependabot (the rest of the
+app is pretty much just a UI and database). If we were paranoid about someone
+stealing our business then we'd be keeping it under lock and key.
+
+Dependabot Core is public because we're more interested in it having an
+impact than we are in making a buck from it. We'd love you to use
+[Dependabot][dependabot], so that we can continue to develop it, but if you want
+to build and host your own version then this library should make doing so a
+*lot* easier.
+
+If you use Dependabot Core then we'd love to hear what you build!
+
+## License
+
+We use the License Zero Prosperity Public License, which essentially enshrines
+the following:
+- If you would like to use Dependabot Core for non-commerical purposes, such as
+  to host a bot at your workplace, then we give you full permission to do so. In
+  fact, we'd love you to, and will help and support you however we can.
+- If you would like to add Dependabot's functionality to your for-profit
+  company's offering then we DO NOT give you permission to use Dependabot Core
+  to do so. Please contact us directly to discuss a partnership or licensing
+  arrangement.
+
+If you make a significant contribution to Dependabot Core then you will be asked
+to transfer the IP of that contribution to Dependabot Ltd so that it can be
+licensed in the same way as the above.
+
+## History
+
+Dependabot and Dependabot Core started life as [Bump][bump] and
+[Bump Core][bump-core], back when Harry and Grey were working at
+[GoCardless][gocardless]. We remain grateful for the help and support of
+GoCardless in helping make Dependabot possible - if you need to collect
+recurring payments from Europe, check them out.
+
+[dependabot]: https://dependabot.com
+[dependabot-status]: https://api.dependabot.com/badges/status?host=github&identifier=93163073
+[dependabot-script]: https://github.com/dependabot/dependabot-script
+[api-docs]: https://github.com/dependabot/api-docs
+[bump]: https://github.com/gocardless/bump
+[bump-core]: https://github.com/gocardless/bump-core
+[gocardless]: https://gocardless.com

data/helpers/elixir/bin/check_update.exs

@@ -0,0 +1,92 @@
+defmodule UpdateChecker do
+  def run(dependency_name, credentials) do
+    set_credentials(credentials)
+
+    # Update the lockfile in a session that we can time out
+    task = Task.async(fn -> do_resolution(dependency_name) end)
+    case Task.yield(task, 30000) || Task.shutdown(task) do
+      {:ok, {:ok, :resolution_successful}} ->
+        # Read the new lock
+        {updated_lock, _updated_rest_lock} =
+          Map.split(Mix.Dep.Lock.read(), [String.to_atom(dependency_name)])
+
+        # Get the new dependency version
+        version =
+          updated_lock
+          |> Map.get(String.to_atom(dependency_name))
+          |> elem(2)
+        {:ok, version}
+
+      {:ok, {:error, error}} -> {:error, error}
+
+      nil -> {:error, :dependency_resolution_timed_out}
+
+      {:exit, reason} -> {:error, reason}
+    end
+  end
+
+  defp set_credentials(credentials) do
+    credentials
+    |> Enum.reduce([], fn cred, acc ->
+      if List.last(acc) == nil || List.last(acc)[:token] do
+        List.insert_at(acc, -1, %{organization: cred})
+      else
+        {item, acc} = List.pop_at(acc, -1)
+        item = Map.put(item, :token, cred)
+        List.insert_at(acc, -1, item)
+      end
+    end)
+    |> Enum.each(fn cred ->
+      hexpm = Hex.Repo.get_repo("hexpm")
+
+      repo = %{
+        url: hexpm.url <> "/repos/#{cred.organization}",
+        public_key: nil,
+        auth_key: cred.token
+      }
+
+      Hex.Config.read()
+      |> Hex.Config.read_repos()
+      |> Map.put("hexpm:#{cred.organization}", repo)
+      |> Hex.Config.update_repos()
+    end)
+  end
+
+  defp do_resolution(dependency_name) do
+    # Fetch dependencies that needs updating
+    {dependency_lock, rest_lock} =
+      Map.split(Mix.Dep.Lock.read(), [String.to_atom(dependency_name)])
+
+    try do
+      Mix.Dep.Fetcher.by_name([dependency_name], dependency_lock, rest_lock, [])
+      {:ok, :resolution_successful}
+    rescue
+      error -> {:error, error}
+    end
+  end
+end
+
+[dependency_name | credentials] = System.argv()
+
+
+case UpdateChecker.run(dependency_name, credentials) do
+  {:ok, version} ->
+    version = :erlang.term_to_binary({:ok, version})
+    IO.write(:stdio, version)
+
+  {:error, %Hex.Version.InvalidRequirementError{} = error}  ->
+    result = :erlang.term_to_binary({:error, "Invalid requirement: #{error.requirement}"})
+    IO.write(:stdio, result)
+
+  {:error, %Mix.Error{} = error} ->
+    result = :erlang.term_to_binary({:error, "Dependency resolution failed: #{error.message}"})
+    IO.write(:stdio, result)
+
+  {:error, :dependency_resolution_timed_out} ->
+    # We do nothing here because Hex is already printing out a message in stdout
+    nil
+
+  {:error, error} ->
+    result = :erlang.term_to_binary({:error, "Unknown error in check_update: #{inspect(error)}"})
+    IO.write(:stdio, result)
+end

data/helpers/elixir/bin/do_update.exs

@@ -0,0 +1,39 @@
+[dependency_name | credentials] = System.argv()
+
+grouped_creds = Enum.reduce credentials, [], fn cred, acc ->
+  if List.last(acc) == nil || List.last(acc)[:token] do
+    List.insert_at(acc, -1, %{ organization: cred })
+  else
+    { item, acc } = List.pop_at(acc, -1)
+    item = Map.put(item, :token, cred)
+    List.insert_at(acc, -1, item)
+  end
+end
+
+Enum.each grouped_creds, fn cred ->
+  hexpm = Hex.Repo.get_repo("hexpm")
+  repo = %{
+    url: hexpm.url <> "/repos/#{cred.organization}",
+    public_key: nil,
+    auth_key: cred.token
+  }
+
+  Hex.Config.read()
+  |> Hex.Config.read_repos()
+  |> Map.put("hexpm:#{cred.organization}", repo)
+  |> Hex.Config.update_repos()
+end
+
+# dependency atom
+dependency = String.to_atom(dependency_name)
+
+# Fetch dependencies that needs updating
+{dependency_lock, rest_lock} = Map.split(Mix.Dep.Lock.read(), [dependency])
+Mix.Dep.Fetcher.by_name([dependency_name], dependency_lock, rest_lock, [])
+
+lockfile_content =
+  "mix.lock"
+  |> File.read()
+  |> :erlang.term_to_binary()
+
+IO.write(:stdio, lockfile_content)

data/helpers/elixir/bin/parse_deps.exs

@@ -0,0 +1,103 @@
+defmodule Parser do
+  def run do
+    Mix.Dep.load_on_environment([])
+    |> Enum.flat_map(&parse_dep/1)
+    |> Enum.map(&build_dependency(&1.opts[:lock], &1))
+  end
+
+  defp build_dependency(nil, dep) do
+    %{
+      name: dep.app,
+      from: Path.relative_to_cwd(dep.from),
+      groups: [],
+      requirement: normalise_requirement(dep.requirement),
+      top_level: dep.top_level || umbrella_top_level_dep?(dep)
+    }
+  end
+
+  defp build_dependency(lock, dep) do
+    {version, checksum, source} = parse_lock(lock)
+    groups = parse_groups(dep.opts[:only])
+
+    %{
+      name: dep.app,
+      from: Path.relative_to_cwd(dep.from),
+      version: version,
+      groups: groups,
+      checksum: checksum,
+      requirement: normalise_requirement(dep.requirement),
+      source: source,
+      top_level: dep.top_level || umbrella_top_level_dep?(dep)
+    }
+  end
+
+  defp parse_groups(nil), do: []
+  defp parse_groups(only) when is_list(only), do: only
+  defp parse_groups(only), do: [only]
+
+  # path dependency
+  defp parse_dep(%{scm: Mix.SCM.Path, opts: opts} = dep) do
+    cond do
+      # umbrella dependency - ignore
+      opts[:in_umbrella] ->
+        []
+
+      # umbrella application
+      opts[:from_umbrella] ->
+        Enum.reject(dep.deps, fn dep -> dep.opts[:in_umbrella] end)
+
+      true ->
+        []
+    end
+  end
+
+  # hex, git dependency
+  defp parse_dep(%{scm: scm} = dep) when scm in [Hex.SCM, Mix.SCM.Git], do: [dep]
+
+  # unsupported
+  defp parse_dep(_dep), do: []
+
+  defp umbrella_top_level_dep?(dep) do
+    if Mix.Project.umbrella?() do
+      apps_paths = Path.expand(Mix.Project.config()[:apps_path], File.cwd!())
+      String.contains?(Path.dirname(Path.dirname(dep.from)), apps_paths)
+    else
+      false
+    end
+  end
+
+  defp parse_lock({:git, repo_url, checksum, opts}),
+    do: {nil, checksum, git_source(repo_url, opts)}
+
+  defp parse_lock({:hex, _app, version, checksum, _managers, _dependencies, _source}),
+    do: {version, checksum, nil}
+
+  defp parse_lock({:hex, _app, version, checksum, _managers, _dependencies}),
+    do: {version, checksum, nil}
+
+  defp normalise_requirement(req) do
+    req
+    |> maybe_regex_to_str()
+    |> empty_str_to_nil()
+  end
+
+  defp maybe_regex_to_str(s), do: if Regex.regex?(s), do: Regex.source(s), else: s
+  defp empty_str_to_nil(""), do: nil
+  defp empty_str_to_nil(s), do: s
+
+  def git_source(repo_url, opts) do
+    ref = opts[:ref] || opts[:tag]
+    ref = if is_list(ref), do: to_string(ref), else: ref
+
+    %{
+      type: "git",
+      url: repo_url,
+      branch: opts[:branch] || "master",
+      ref: ref
+    }
+  end
+end
+
+dependencies = :erlang.term_to_binary({:ok, Parser.run()})
+
+IO.write(:stdio, dependencies)

data/helpers/elixir/bin/run.exs

@@ -0,0 +1,76 @@
+defmodule DependencyHelper do
+  def main() do
+    IO.read(:stdio, :all)
+    |> Jason.decode!()
+    |> run()
+    |> case do
+      {output, 0} ->
+        if output =~ "No authenticated organization found" do
+          {:error, output}
+        else
+          {:ok, :erlang.binary_to_term(output)}
+        end
+
+      {error, 1} -> {:error, error}
+    end
+    |> handle_result()
+  end
+
+  defp handle_result({:ok, {:ok, result}}) do
+    encode_and_write(%{"result" => result})
+  end
+
+  defp handle_result({:ok, {:error, reason}}) do
+    encode_and_write(%{"error" => reason})
+    System.halt(1)
+  end
+
+  defp handle_result({:error, reason}) do
+    encode_and_write(%{"error" => reason})
+    System.halt(1)
+  end
+
+  defp encode_and_write(content) do
+    content
+    |> Jason.encode!()
+    |> IO.write()
+  end
+
+  defp run(%{"function" => "parse", "args" => [dir]}) do
+    run_script("parse_deps.exs", dir)
+  end
+
+  defp run(%{"function" => "get_latest_resolvable_version", "args" => [dir, dependency_name, credentials]}) do
+    run_script("check_update.exs", dir, [dependency_name] ++ credentials)
+  end
+
+  defp run(%{"function" => "get_updated_lockfile", "args" => [dir, dependency_name, credentials]}) do
+    run_script("do_update.exs", dir, [dependency_name] ++ credentials)
+  end
+
+  defp run_script(script, dir, args \\ []) do
+    args = [
+      "run",
+      "--no-deps-check",
+      "--no-start",
+      "--no-compile",
+      "--no-elixir-version-check",
+      script
+    ] ++ args
+
+    System.cmd(
+      "mix",
+      args,
+      [
+        cd: dir,
+        env: %{
+          "MIX_EXS" => nil,
+          "MIX_LOCK" => nil,
+          "MIX_DEPS" => nil
+        }
+      ]
+    )
+  end
+end
+
+DependencyHelper.main()