dependabot-core 0.76.1

data/lib/dependabot/file_updaters/java/gradle/dependency_set_updater.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "dependabot/file_parsers/java/gradle"
+require "dependabot/file_updaters/java/gradle"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Gradle
+        class DependencySetUpdater
+          def initialize(dependency_files:)
+            @dependency_files = dependency_files
+          end
+
+          def update_files_for_dep_set_change(dependency_set:,
+                                              buildfile:,
+                                              previous_requirement:,
+                                              updated_requirement:)
+            declaration_string =
+              original_declaration_string(dependency_set, buildfile)
+
+            return dependency_files unless declaration_string
+
+            updated_content = buildfile.content.sub(
+              declaration_string,
+              declaration_string.sub(
+                previous_requirement,
+                updated_requirement
+              )
+            )
+
+            updated_files = dependency_files.dup
+            updated_files[updated_files.index(buildfile)] =
+              update_file(file: buildfile, content: updated_content)
+
+            updated_files
+          end
+
+          private
+
+          attr_reader :dependency_files
+
+          def original_declaration_string(dependency_set, buildfile)
+            regex = FileParsers::Java::Gradle::DEPENDENCY_SET_DECLARATION_REGEX
+            dependency_sets = []
+            buildfile.content.scan(regex) do
+              dependency_sets << Regexp.last_match.to_s
+            end
+
+            dependency_sets.find do |mtch|
+              next unless mtch.include?(dependency_set[:group])
+
+              mtch.include?(dependency_set[:version])
+            end
+          end
+
+          def update_file(file:, content:)
+            updated_file = file.dup
+            updated_file.content = content
+            updated_file
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/java/gradle/property_value_updater.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/java/gradle"
+require "dependabot/file_parsers/java/gradle/property_value_finder"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Gradle
+        class PropertyValueUpdater
+          def initialize(dependency_files:)
+            @dependency_files = dependency_files
+          end
+
+          def update_files_for_property_change(property_name:,
+                                               callsite_buildfile:,
+                                               previous_value:,
+                                               updated_value:)
+            declaration_details = property_value_finder.property_details(
+              property_name: property_name,
+              callsite_buildfile: callsite_buildfile
+            )
+            declaration_string = declaration_details.fetch(:declaration_string)
+            filename = declaration_details.fetch(:file)
+
+            file_to_update = dependency_files.find { |f| f.name == filename }
+            updated_content = file_to_update.content.sub(
+              declaration_string,
+              declaration_string.sub(previous_value, updated_value)
+            )
+
+            updated_files = dependency_files.dup
+            updated_files[updated_files.index(file_to_update)] =
+              update_file(file: file_to_update, content: updated_content)
+
+            updated_files
+          end
+
+          private
+
+          attr_reader :dependency_files
+
+          def property_value_finder
+            @property_value_finder ||=
+              FileParsers::Java::Gradle::PropertyValueFinder.
+              new(dependency_files: dependency_files)
+          end
+
+          def update_file(file:, content:)
+            updated_file = file.dup
+            updated_file.content = content
+            updated_file
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/java/maven.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/file_updaters/base"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Maven < Dependabot::FileUpdaters::Base
+        require_relative "maven/declaration_finder"
+        require_relative "maven/property_value_updater"
+
+        def self.updated_files_regex
+          [/^pom\.xml$/, %r{/pom\.xml$}]
+        end
+
+        def updated_dependency_files
+          updated_files = dependency_files.dup
+
+          # Loop through each of the changed requirements, applying changes to
+          # all pomfiles for that change. Note that the logic is different here
+          # to other languages because Java has property inheritance across
+          # files
+          dependencies.each do |dependency|
+            updated_files = update_pomfiles_for_dependency(
+              pomfiles: updated_files,
+              dependency: dependency
+            )
+          end
+
+          updated_files.select! { |f| f.name.end_with?("pom.xml") }
+          updated_files.reject! { |f| original_pomfiles.include?(f) }
+
+          raise "No files changed!" if updated_files.none?
+          if updated_files.any? { |f| f.name.end_with?("pom_parent.xml") }
+            raise "Updated a supporting POM!"
+          end
+
+          updated_files
+        end
+
+        private
+
+        def check_required_files
+          raise "No pom.xml!" unless get_original_file("pom.xml")
+        end
+
+        def update_pomfiles_for_dependency(pomfiles:, dependency:)
+          files = pomfiles.dup
+
+          # The UpdateChecker ensures the order of requirements is preserved
+          # when updating, so we can zip them together in new/old pairs.
+          reqs = dependency.requirements.zip(dependency.previous_requirements).
+                 reject { |new_req, old_req| new_req == old_req }
+
+          # Loop through each changed requirement and update the pomfiles
+          reqs.each do |new_req, old_req|
+            raise "Bad req match" unless new_req[:file] == old_req[:file]
+            next if new_req[:requirement] == old_req[:requirement]
+
+            if new_req.dig(:metadata, :property_name)
+              files = update_pomfiles_for_property_change(files, new_req)
+              pom = files.find { |f| f.name == new_req.fetch(:file) }
+              files[files.index(pom)] =
+                remove_property_suffix_in_pom(dependency, pom, old_req)
+            else
+              pom = files.find { |f| f.name == new_req.fetch(:file) }
+              files[files.index(pom)] =
+                update_version_in_pom(dependency, pom, old_req, new_req)
+            end
+          end
+
+          files
+        end
+
+        def update_pomfiles_for_property_change(pomfiles, req)
+          property_name = req.fetch(:metadata).fetch(:property_name)
+
+          PropertyValueUpdater.new(dependency_files: pomfiles).
+            update_pomfiles_for_property_change(
+              property_name: property_name,
+              callsite_pom: pomfiles.find { |f| f.name == req.fetch(:file) },
+              updated_value: req.fetch(:requirement)
+            )
+        end
+
+        def update_version_in_pom(dependency, pom, previous_req, requirement)
+          updated_content = pom.content
+
+          original_pom_declarations(dependency, previous_req).each do |old_dec|
+            updated_content = updated_content.gsub(
+              old_dec,
+              updated_pom_declaration(old_dec, previous_req, requirement)
+            )
+          end
+
+          raise "Expected content to change!" if updated_content == pom.content
+
+          updated_file(file: pom, content: updated_content)
+        end
+
+        def remove_property_suffix_in_pom(dep, pom, req)
+          updated_content = pom.content
+
+          original_pom_declarations(dep, req).each do |old_declaration|
+            updated_content = updated_content.gsub(old_declaration) do |old_dec|
+              version_string =
+                old_dec.match(%r{(?<=\<version\>).*(?=\</version\>)})
+              cleaned_version_string = version_string.to_s.gsub(/(?<=\}).*/, "")
+
+              old_dec.gsub(
+                "<version>#{version_string}</version>",
+                "<version>#{cleaned_version_string}</version>"
+              )
+            end
+          end
+
+          updated_file(file: pom, content: updated_content)
+        end
+
+        def original_pom_declarations(dependency, requirement)
+          declaration_finder(dependency, requirement).declaration_strings
+        end
+
+        # The declaration finder may need to make remote calls (to get parent
+        # POMs if it's searching for the value of a property), so we cache it.
+        def declaration_finder(dependency, requirement)
+          @declaration_finders ||= {}
+          @declaration_finders[dependency.hash + requirement.hash] ||=
+            begin
+              DeclarationFinder.new(
+                dependency: dependency,
+                declaring_requirement: requirement,
+                dependency_files: dependency_files
+              )
+            end
+        end
+
+        def updated_pom_declaration(old_declaration, previous_req, requirement)
+          original_req_string = previous_req.fetch(:requirement)
+
+          old_declaration.gsub(
+            %r{<version>\s*#{Regexp.quote(original_req_string)}\s*</version>},
+            "<version>#{requirement.fetch(:requirement)}</version>"
+          )
+        end
+
+        def original_pomfiles
+          @original_pomfiles ||=
+            dependency_files.select { |f| f.name.end_with?("pom.xml") }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/java/maven/declaration_finder.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/file_updaters/java/maven"
+require "dependabot/file_parsers/java/maven"
+require "dependabot/file_parsers/java/maven/property_value_finder"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Maven
+        class DeclarationFinder
+          DECLARATION_REGEX =
+            %r{<parent>.*?</parent>|<dependency>.*?</dependency>|
+               <plugin>.*?</plugin>|<extension>.*?</extension>}mx.freeze
+
+          attr_reader :dependency, :declaring_requirement, :dependency_files
+
+          def initialize(dependency:, dependency_files:, declaring_requirement:)
+            @dependency            = dependency
+            @dependency_files      = dependency_files
+            @declaring_requirement = declaring_requirement
+          end
+
+          def declaration_strings
+            @declaration_strings ||= fetch_pom_declaration_strings
+          end
+
+          def declaration_nodes
+            declaration_strings.map do |declaration_string|
+              Nokogiri::XML(declaration_string)
+            end
+          end
+
+          private
+
+          def declaring_pom
+            filename = declaring_requirement.fetch(:file)
+            declaring_pom = dependency_files.find { |f| f.name == filename }
+            return declaring_pom if declaring_pom
+
+            raise "No pom found with name #{filename}!"
+          end
+
+          def dependency_name
+            dependency.name
+          end
+
+          def fetch_pom_declaration_strings
+            deep_find_declarations(declaring_pom.content).select do |nd|
+              node = Nokogiri::XML(nd)
+              node.remove_namespaces!
+              next false unless node_group_id(node)
+              next false unless node.at_xpath("./*/artifactId")
+
+              node_name = [
+                node_group_id(node),
+                evaluated_value(node.at_xpath("./*/artifactId").content.strip)
+              ].compact.join(":")
+
+              next false unless node_name == dependency_name
+
+              declaring_requirement_matches?(node)
+            end
+          end
+
+          def node_group_id(node)
+            unless node.at_xpath("./*/groupId") || node.at_xpath("./plugin")
+              return
+            end
+            unless node.at_xpath("./*/groupId")
+              return "org.apache.maven.plugins"
+            end
+
+            evaluated_value(node.at_xpath("./*/groupId").content.strip)
+          end
+
+          def deep_find_declarations(string)
+            string.scan(DECLARATION_REGEX).flat_map do |matching_node|
+              [matching_node, *deep_find_declarations(matching_node[1..-1])]
+            end
+          end
+
+          def declaring_requirement_matches?(node)
+            node_requirement = node.at_css("version")&.content&.strip
+
+            if declaring_requirement.dig(:metadata, :property_name)
+              return false unless node_requirement
+
+              property_name =
+                node_requirement.
+                match(FileParsers::Java::Maven::PROPERTY_REGEX)&.
+                named_captures&.
+                fetch("property")
+
+              property_name == declaring_requirement[:metadata][:property_name]
+            else
+              node_requirement == declaring_requirement.fetch(:requirement)
+            end
+          end
+
+          def evaluated_value(value)
+            unless value.match?(FileParsers::Java::Maven::PROPERTY_REGEX)
+              return value
+            end
+
+            property_name =
+              value.match(FileParsers::Java::Maven::PROPERTY_REGEX).
+              named_captures.fetch("property")
+
+            property_value =
+              property_value_finder.
+              property_details(
+                property_name: property_name,
+                callsite_pom: declaring_pom
+              )&.fetch(:value)
+
+            return value unless property_value
+
+            value.gsub(FileParsers::Java::Maven::PROPERTY_REGEX, property_value)
+          end
+
+          def property_value_finder
+            @property_value_finder ||=
+              FileParsers::Java::Maven::PropertyValueFinder.
+              new(dependency_files: dependency_files)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/java/maven/property_value_updater.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+
+require "dependabot/dependency_file"
+require "dependabot/file_updaters/java/maven"
+require "dependabot/file_parsers/java/maven/property_value_finder"
+
+module Dependabot
+  module FileUpdaters
+    module Java
+      class Maven
+        class PropertyValueUpdater
+          def initialize(dependency_files:)
+            @dependency_files = dependency_files
+          end
+
+          def update_pomfiles_for_property_change(property_name:, callsite_pom:,
+                                                  updated_value:)
+            declaration_details = property_value_finder.property_details(
+              property_name: property_name,
+              callsite_pom: callsite_pom
+            )
+            node = declaration_details.fetch(:node)
+            filename = declaration_details.fetch(:file)
+
+            pom_to_update = dependency_files.find { |f| f.name == filename }
+            updated_content = pom_to_update.content.sub(
+              %r{<#{Regexp.quote(node.name)}>
+                 \s*#{Regexp.quote(node.content)}\s*
+                 </#{Regexp.quote(node.name)}>}xm,
+              "<#{node.name}>#{updated_value}</#{node.name}>"
+            )
+
+            updated_pomfiles = dependency_files.dup
+            updated_pomfiles[updated_pomfiles.index(pom_to_update)] =
+              update_file(file: pom_to_update, content: updated_content)
+
+            updated_pomfiles
+          end
+
+          private
+
+          attr_reader :dependency_files
+
+          def property_value_finder
+            @property_value_finder ||=
+              FileParsers::Java::Maven::PropertyValueFinder.
+              new(dependency_files: dependency_files)
+          end
+
+          def update_file(file:, content:)
+            updated_file = file.dup
+            updated_file.content = content
+            updated_file
+          end
+        end
+      end
+    end
+  end
+end