dependabot-core 0.76.1

data/lib/dependabot/file_updaters/go/dep/manifest_updater.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/go/dep"
+
+module Dependabot
+  module FileUpdaters
+    module Go
+      class Dep
+        class ManifestUpdater
+          def initialize(dependencies:, manifest:)
+            @dependencies = dependencies
+            @manifest = manifest
+          end
+
+          def updated_manifest_content
+            dependencies.
+              select { |dep| requirement_changed?(manifest, dep) }.
+              reduce(manifest.content.dup) do |content, dep|
+                updated_content = content
+
+                updated_content = update_requirements(
+                  content: updated_content,
+                  filename: manifest.name,
+                  dependency: dep
+                )
+                updated_content = update_git_pin(
+                  content: updated_content,
+                  filename: manifest.name,
+                  dependency: dep
+                )
+
+                if content == updated_content
+                  raise "Expected content to change!"
+                end
+
+                updated_content
+              end
+          end
+
+          private
+
+          attr_reader :dependencies, :manifest
+
+          def requirement_changed?(file, dependency)
+            changed_requirements =
+              dependency.requirements - dependency.previous_requirements
+
+            changed_requirements.any? { |f| f[:file] == file.name }
+          end
+
+          def update_requirements(content:, filename:, dependency:)
+            updated_content = content.dup
+
+            # The UpdateChecker ensures the order of requirements is preserved
+            # when updating, so we can zip them together in new/old pairs.
+            reqs = dependency.requirements.
+                   zip(dependency.previous_requirements).
+                   reject { |new_req, old_req| new_req == old_req }
+
+            # Loop through each changed requirement
+            reqs.each do |new_req, old_req|
+              raise "Bad req match" unless new_req[:file] == old_req[:file]
+              next if new_req[:requirement] == old_req[:requirement]
+              next unless new_req[:file] == filename
+
+              updated_content = update_manifest_req(
+                content: updated_content,
+                dep: dependency,
+                old_req: old_req.fetch(:requirement),
+                new_req: new_req.fetch(:requirement)
+              )
+            end
+
+            updated_content
+          end
+
+          def update_git_pin(content:, filename:, dependency:)
+            updated_pin =
+              dependency.requirements.
+              find { |r| r[:file] == filename }&.
+              dig(:source, :ref)
+
+            old_pin =
+              dependency.previous_requirements.
+              find { |r| r[:file] == filename }&.
+              dig(:source, :ref)
+
+            return content unless old_pin
+
+            update_manifest_pin(
+              content: content,
+              dep: dependency,
+              old_pin: old_pin,
+              new_pin: updated_pin
+            )
+          end
+
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/PerceivedComplexity
+          def update_manifest_req(content:, dep:, old_req:, new_req:)
+            declaration = content.scan(declaration_regex(dep)).
+                          find { |m| old_req.nil? || m.include?(old_req) }
+
+            return content unless declaration
+
+            if old_req && new_req
+              content.gsub(declaration) do |line|
+                line.gsub(old_req, new_req)
+              end
+            elsif old_req && new_req.nil?
+              content.gsub(declaration) do |line|
+                line.gsub(/\R+.*version\s*=.*/, "")
+              end
+            elsif old_req.nil? && new_req
+              content.gsub(declaration) do |line|
+                indent = line.match(/(?<indent>\s*)name/).
+                         named_captures.fetch("indent")
+                version_declaration = indent + "version = \"#{new_req}\""
+                line.gsub(/name\s*=.*/) { |nm_ln| nm_ln + version_declaration }
+              end
+            end
+          end
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/PerceivedComplexity
+
+          def update_manifest_pin(content:, dep:, old_pin:, new_pin:)
+            declaration = content.scan(declaration_regex(dep)).
+                          find { |m| m.include?(old_pin) }
+
+            return content unless declaration
+
+            if old_pin && new_pin
+              content.gsub(declaration) do |line|
+                line.gsub(old_pin, new_pin)
+              end
+            elsif old_pin && new_pin.nil?
+              content.gsub(declaration) do |line|
+                line.gsub(/\R+.*(revision|branch)\s*=.*/, "")
+              end
+            end
+          end
+
+          def declaration_regex(dep)
+            /
+              (?<=\]\])
+              (?:(?!^\[).)*
+              name\s*=\s*["']#{Regexp.escape(dep.name)}["']
+              (?:(?!^\[).)*
+            /mx
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/go/modules.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "dependabot/shared_helpers"
+require "dependabot/file_updaters/base"
+
+module Dependabot
+  module FileUpdaters
+    module Go
+      class Modules < Dependabot::FileUpdaters::Base
+        require_relative "modules/go_mod_updater"
+
+        def self.updated_files_regex
+          [
+            /^go\.mod$/,
+            /^go\.sum$/
+          ]
+        end
+
+        def updated_dependency_files
+          updated_files = []
+
+          if go_mod && file_changed?(go_mod)
+            updated_files <<
+              updated_file(
+                file: go_mod,
+                content: file_updater.updated_go_mod_content
+              )
+
+            if go_sum && go_sum.content != file_updater.updated_go_sum_content
+              updated_files <<
+                updated_file(
+                  file: go_sum,
+                  content: file_updater.updated_go_sum_content
+                )
+            end
+          end
+
+          raise "No files changed!" if updated_files.none?
+
+          updated_files
+        end
+
+        private
+
+        def check_required_files
+          return if go_mod
+
+          raise "No go.mod!"
+        end
+
+        def go_mod
+          @go_mod ||= get_original_file("go.mod")
+        end
+
+        def go_sum
+          @go_sum ||= get_original_file("go.sum")
+        end
+
+        def file_updater
+          @file_updater ||=
+            Modules::GoModUpdater.new(
+              dependencies: dependencies,
+              go_mod: go_mod,
+              go_sum: go_sum,
+              credentials: credentials
+            )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/go/modules/go_mod_updater.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/go/modules"
+require "dependabot/utils/go/shared_helper"
+
+module Dependabot
+  module FileUpdaters
+    module Go
+      class Modules
+        class GoModUpdater
+          def initialize(dependencies:, go_mod:, go_sum:, credentials:)
+            @dependencies = dependencies
+            @go_mod = go_mod
+            @go_sum = go_sum
+            @credentials = credentials
+          end
+
+          def updated_go_mod_content
+            @updated_go_mod_content ||=
+              SharedHelpers.in_a_temporary_directory do
+                SharedHelpers.with_git_configured(credentials: credentials) do
+                  File.write("go.mod", go_mod.content)
+
+                  deps = dependencies.map do |dep|
+                    {
+                      name: dep.name,
+                      version: "v" + dep.version.sub(/^v/i, ""),
+                      indirect: dep.requirements.empty?
+                    }
+                  end
+
+                  SharedHelpers.run_helper_subprocess(
+                    command: Utils::Go::SharedHelper.path,
+                    function: "updateDependencyFile",
+                    args: { dependencies: deps }
+                  )
+                end
+              end
+          end
+
+          def updated_go_sum_content
+            return nil unless go_sum
+
+            # This needs to be run separately so we don't nest subprocess calls
+            updated_go_mod_content
+
+            @updated_go_sum_content ||=
+              SharedHelpers.in_a_temporary_directory do
+                SharedHelpers.with_git_configured(credentials: credentials) do
+                  File.write("go.mod", updated_go_mod_content)
+                  File.write("go.sum", go_sum.content)
+                  File.write("main.go", dummy_main_go)
+
+                  `GO111MODULE=on go get -d`
+                  unless $CHILD_STATUS.success?
+                    raise Dependabot::DependencyFileNotParseable, go_sum.path
+                  end
+
+                  File.read("go.sum")
+                end
+              end
+          end
+
+          private
+
+          def dummy_main_go
+            lines = ["package main", "import ("]
+            dependencies.each do |dep|
+              lines << "_ \"#{dep.name}\""
+            end
+            lines << ")"
+            lines << "func main() {}"
+            lines.join("\n")
+          end
+
+          attr_reader :dependencies, :go_mod, :go_sum, :credentials
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/java/gradle.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/base"
+require "dependabot/file_parsers/java/gradle"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Gradle < Dependabot::FileUpdaters::Base
+        require_relative "gradle/dependency_set_updater"
+        require_relative "gradle/property_value_updater"
+
+        def self.updated_files_regex
+          [/^build\.gradle$/, %r{/build\.gradle$}]
+        end
+
+        def updated_dependency_files
+          updated_files = buildfiles.dup
+
+          # Loop through each of the changed requirements, applying changes to
+          # all buildfiles for that change. Note that the logic is different
+          # here to other languages because Java has property inheritance across
+          # files (although we're not supporting it for gradle yet).
+          dependencies.each do |dependency|
+            updated_files = update_buildfiles_for_dependency(
+              buildfiles: updated_files,
+              dependency: dependency
+            )
+          end
+
+          updated_files = updated_files.reject { |f| buildfiles.include?(f) }
+
+          raise "No files changed!" if updated_files.none?
+
+          updated_files
+        end
+
+        private
+
+        def check_required_files
+          raise "No build.gradle!" unless get_original_file("build.gradle")
+        end
+
+        def update_buildfiles_for_dependency(buildfiles:, dependency:)
+          files = buildfiles.dup
+
+          # The UpdateChecker ensures the order of requirements is preserved
+          # when updating, so we can zip them together in new/old pairs.
+          reqs = dependency.requirements.zip(dependency.previous_requirements).
+                 reject { |new_req, old_req| new_req == old_req }
+
+          # Loop through each changed requirement and update the buildfiles
+          reqs.each do |new_req, old_req|
+            raise "Bad req match" unless new_req[:file] == old_req[:file]
+            next if new_req[:requirement] == old_req[:requirement]
+
+            buildfile = files.find { |f| f.name == new_req.fetch(:file) }
+
+            if new_req.dig(:metadata, :property_name)
+              files = update_files_for_property_change(files, old_req, new_req)
+            elsif new_req.dig(:metadata, :dependency_set)
+              files = update_files_for_dep_set_change(files, old_req, new_req)
+            else
+              files[files.index(buildfile)] =
+                update_version_in_buildfile(
+                  dependency,
+                  buildfile,
+                  old_req,
+                  new_req
+                )
+            end
+          end
+
+          files
+        end
+
+        def update_files_for_property_change(buildfiles, old_req, new_req)
+          files = buildfiles.dup
+          property_name = new_req.fetch(:metadata).fetch(:property_name)
+          buildfile = files.find { |f| f.name == new_req.fetch(:file) }
+
+          PropertyValueUpdater.new(dependency_files: files).
+            update_files_for_property_change(
+              property_name: property_name,
+              callsite_buildfile: buildfile,
+              previous_value: old_req.fetch(:requirement),
+              updated_value: new_req.fetch(:requirement)
+            )
+        end
+
+        def update_files_for_dep_set_change(buildfiles, old_req, new_req)
+          files = buildfiles.dup
+          dependency_set = new_req.fetch(:metadata).fetch(:dependency_set)
+          buildfile = files.find { |f| f.name == new_req.fetch(:file) }
+
+          DependencySetUpdater.new(dependency_files: files).
+            update_files_for_dep_set_change(
+              dependency_set: dependency_set,
+              buildfile: buildfile,
+              previous_requirement: old_req.fetch(:requirement),
+              updated_requirement: new_req.fetch(:requirement)
+            )
+        end
+
+        def update_version_in_buildfile(dependency, buildfile, previous_req,
+                                        requirement)
+          updated_content =
+            buildfile.content.gsub(
+              original_buildfile_declaration(dependency, previous_req),
+              updated_buildfile_declaration(
+                dependency,
+                previous_req,
+                requirement
+              )
+            )
+
+          if updated_content == buildfile.content
+            raise "Expected content to change!"
+          end
+
+          updated_file(file: buildfile, content: updated_content)
+        end
+
+        def original_buildfile_declaration(dependency, requirement)
+          # This implementation is limited to declarations that appear on a
+          # single line.
+          buildfile = buildfiles.find { |f| f.name == requirement.fetch(:file) }
+          buildfile.content.lines.find do |line|
+            line = evaluate_properties(line, buildfile)
+            next false unless line.include?(dependency.name.split(":").first)
+            next false unless line.include?(dependency.name.split(":").last)
+
+            line.include?(requirement.fetch(:requirement))
+          end
+        end
+
+        def evaluate_properties(string, buildfile)
+          result = string.dup
+
+          string.scan(FileParsers::Java::Gradle::PROPERTY_REGEX) do
+            prop_name = Regexp.last_match.named_captures.fetch("property_name")
+            property_value = property_value_finder.property_value(
+              property_name: prop_name,
+              callsite_buildfile: buildfile
+            )
+            next unless property_value
+
+            result.sub!(Regexp.last_match.to_s, property_value)
+          end
+
+          result
+        end
+
+        def property_value_finder
+          @property_value_finder ||=
+            FileParsers::Java::Gradle::PropertyValueFinder.
+            new(dependency_files: dependency_files)
+        end
+
+        def updated_buildfile_declaration(dependency, previous_req, requirement)
+          original_req_string = previous_req.fetch(:requirement)
+
+          original_buildfile_declaration(dependency, previous_req).gsub(
+            original_req_string,
+            requirement.fetch(:requirement)
+          )
+        end
+
+        def buildfiles
+          @buildfiles ||=
+            dependency_files.select { |f| f.name.end_with?("build.gradle") }
+        end
+      end
+    end
+  end
+end