dependabot-core 0.76.1

data/helpers/elixir/mix.exs

@@ -0,0 +1,21 @@
+defmodule DependabotCore.Mixfile do
+  use Mix.Project
+
+  def project do
+    [app: :dependabot_core,
+     version: "0.1.0",
+     elixir: "~> 1.5",
+     start_permanent: Mix.env == :prod,
+     lockfile: System.get_env("MIX_LOCK") || "mix.lock",
+     deps_path: System.get_env("MIX_DEPS") || "deps",
+     deps: deps()]
+  end
+
+  def application do
+    [extra_applications: [:logger]]
+  end
+
+  defp deps() do
+    [{:jason, "~> 1.0-rc"}]
+  end
+end

data/helpers/elixir/mix.lock

@@ -0,0 +1,3 @@
+%{
+  "jason": {:hex, :jason, "1.1.2", "b03dedea67a99223a2eaf9f1264ce37154564de899fd3d8b9a21b1a6fd64afe7", [:mix], [{:decimal, "~> 1.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm"},
+}

data/helpers/go/Makefile

@@ -0,0 +1,9 @@
+.PHONY = all
+
+all: darwin linux
+
+darwin:
+	GO111MODULE=on GOOS=darwin GOARCH=amd64 go build -o go-helpers.darwin64 .
+
+linux:
+	GO111MODULE=on GOOS=linux GOARCH=amd64  go build -o go-helpers.linux64 .

data/helpers/go/go.mod

@@ -0,0 +1,9 @@
+module github.com/dependabot/dependabot-core/helpers/go
+
+require (
+	github.com/Masterminds/vcs v1.12.0
+	github.com/dependabot/dependabot-core/helpers/go/updater v0.0.0
+	github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3
+)
+
+replace github.com/dependabot/dependabot-core/helpers/go/updater => ./updater

data/helpers/go/go.sum

@@ -0,0 +1,5 @@
+github.com/Masterminds/vcs v1.12.0 h1:bt9Hb4XlfmEfLnVA0MVz2NO0GFuMN5vX8iOWW38Xde4=
+github.com/Masterminds/vcs v1.12.0/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
+github.com/dependabot/dependabot-core v0.74.6 h1:SB2Oyie+Ex9ARXLHbFrnoQSWSixAG4ORHA+s6YEvVag=
+github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3 h1:Xj2leY0FVyZuo+p59vkIWG3dIqo+QtjskT5O1iTiywA=
+github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3/go.mod h1:+dRXSrUymjpT4yzKtn1QmeknT1S/yAHRr35en18dHp8=

data/helpers/go/importresolver/main.go

@@ -0,0 +1,34 @@
+package importresolver
+
+import (
+	"io/ioutil"
+	"strings"
+
+	"github.com/Masterminds/vcs"
+)
+
+type Args struct {
+	Import string
+}
+
+func VCSRemoteForImport(args *Args) (interface{}, error) {
+	remote := args.Import
+	scheme := strings.Split(remote, ":")[0]
+	switch scheme {
+	case "http", "https":
+	default:
+		remote = "https://" + remote
+	}
+
+	local, err := ioutil.TempDir("", "unused-vcs-local-dir")
+	if err != nil {
+		return nil, err
+	}
+
+	repo, err := vcs.NewRepo(remote, local)
+	if err != nil {
+		return nil, err
+	}
+
+	return repo.Remote(), nil
+}

data/helpers/go/main.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/dependabot/dependabot-core/helpers/go/importresolver"
+	"github.com/dependabot/dependabot-core/helpers/go/updatechecker"
+	"github.com/dependabot/dependabot-core/helpers/go/updater"
+)
+
+type HelperParams struct {
+	Function string          `json:"function"`
+	Args     json.RawMessage `json:"args"`
+}
+
+type Output struct {
+	Error  string      `json:"error,omitempty"`
+	Result interface{} `json:"result,omitempty"`
+}
+
+func main() {
+	d := json.NewDecoder(os.Stdin)
+	helperParams := &HelperParams{}
+	if err := d.Decode(helperParams); err != nil {
+		abort(err)
+	}
+
+	var (
+		funcOut interface{}
+		funcErr error
+	)
+	switch helperParams.Function {
+	case "getUpdatedVersion":
+		var args updatechecker.Args
+		parseArgs(helperParams.Args, &args)
+		funcOut, funcErr = updatechecker.GetUpdatedVersion(&args)
+	case "updateDependencyFile":
+		var args updater.Args
+		parseArgs(helperParams.Args, &args)
+		funcOut, funcErr = updater.UpdateDependencyFile(&args)
+	case "getVcsRemoteForImport":
+		var args importresolver.Args
+		parseArgs(helperParams.Args, &args)
+		funcOut, funcErr = importresolver.VCSRemoteForImport(&args)
+	default:
+		abort(fmt.Errorf("Unrecognised function '%s'", helperParams.Function))
+	}
+
+	if funcErr != nil {
+		abort(funcErr)
+	}
+
+	output(&Output{Result: funcOut})
+}
+
+func parseArgs(data []byte, args interface{}) {
+	if err := json.Unmarshal(data, args); err != nil {
+		abort(err)
+	}
+}
+
+func output(o *Output) {
+	bytes, jsonErr := json.Marshal(o)
+	if jsonErr != nil {
+		log.Fatal(jsonErr)
+	}
+
+	os.Stdout.Write(bytes)
+}
+
+func abort(err error) {
+	output(&Output{Error: err.Error()})
+	os.Exit(1)
+}

data/helpers/go/updatechecker/main.go

@@ -0,0 +1,107 @@
+package updatechecker
+
+import (
+	"errors"
+	"io/ioutil"
+
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfetch"
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modload"
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/semver"
+)
+
+type Dependency struct {
+	Name     string `json:"name"`
+	Version  string `json:"version"`
+	Indirect bool   `json:"indirect"`
+}
+
+type IgnoreRange struct {
+	MinVersionInclusive string `json:"min_version_inclusive"`
+	MaxVersionExclusive string `json:"max_version_exclusive"`
+}
+
+type Args struct {
+	Dependency   *Dependency    `json:"dependency"`
+	IgnoreRanges []*IgnoreRange `json:"ignore_ranges"`
+}
+
+func GetUpdatedVersion(args *Args) (interface{}, error) {
+	if args.Dependency == nil {
+		return nil, errors.New("Expected args.dependency to not be nil")
+	}
+
+	modload.InitMod()
+
+	repo, err := modfetch.Lookup(args.Dependency.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	versions, err := repo.Versions("")
+	if err != nil {
+		return nil, err
+	}
+
+	excludes, err := goModExcludes(args.Dependency.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	currentVersion := args.Dependency.Version
+	currentMajor := semver.Major(currentVersion)
+	currentPrerelease := semver.Prerelease(currentVersion)
+	latestVersion := args.Dependency.Version
+
+Outer:
+	for _, v := range versions {
+		if semver.Major(v) != currentMajor {
+			continue
+		}
+
+		if semver.Compare(v, latestVersion) < 1 {
+			continue
+		}
+
+		if currentPrerelease == "" && semver.Prerelease(v) != "" {
+			continue
+		}
+
+		for _, exclude := range excludes {
+			if v == exclude {
+				continue Outer
+			}
+		}
+
+		latestVersion = v
+	}
+
+	return latestVersion, nil
+}
+
+func goModExcludes(dependency string) ([]string, error) {
+	data, err := ioutil.ReadFile("go.mod")
+	if err != nil {
+		return nil, err
+	}
+
+	var f *modfile.File
+	// TODO library detection - don't consider exclude etc for libraries
+	if "library" == "true" {
+		f, err = modfile.ParseLax("go.mod", data, nil)
+	} else {
+		f, err = modfile.Parse("go.mod", data, nil)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var excludes []string
+	for _, e := range f.Exclude {
+		if e.Mod.Path == dependency {
+			excludes = append(excludes, e.Mod.Version)
+		}
+	}
+
+	return excludes, nil
+}

data/helpers/go/updater/go.mod

@@ -0,0 +1,3 @@
+module github.com/dependabot/dependabot-core/helpers/go/updater
+
+require github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3

data/helpers/go/updater/go.sum

@@ -0,0 +1,2 @@
+github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3 h1:Xj2leY0FVyZuo+p59vkIWG3dIqo+QtjskT5O1iTiywA=
+github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3/go.mod h1:+dRXSrUymjpT4yzKtn1QmeknT1S/yAHRr35en18dHp8=

data/helpers/go/updater/helpers.go

@@ -0,0 +1,57 @@
+package updater
+
+import (
+	"strings"
+
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
+)
+
+// Private methods lifted from the `modfile` package
+
+// setIndirect sets line to have (or not have) a "// indirect" comment.
+func setIndirect(line *modfile.Line, indirect bool) {
+	if isIndirect(line) == indirect {
+		return
+	}
+	if indirect {
+		// Adding comment.
+		if len(line.Suffix) == 0 {
+			// New comment.
+			line.Suffix = []modfile.Comment{{Token: "// indirect", Suffix: true}}
+			return
+		}
+		// Insert at beginning of existing comment.
+		com := &line.Suffix[0]
+		space := " "
+		if len(com.Token) > 2 && com.Token[2] == ' ' || com.Token[2] == '\t' {
+			space = ""
+		}
+		com.Token = "// indirect;" + space + com.Token[2:]
+		return
+	}
+
+	// Removing comment.
+	f := strings.Fields(line.Suffix[0].Token)
+	if len(f) == 2 {
+		// Remove whole comment.
+		line.Suffix = nil
+		return
+	}
+
+	// Remove comment prefix.
+	com := &line.Suffix[0]
+	i := strings.Index(com.Token, "indirect;")
+	com.Token = "//" + com.Token[i+len("indirect;"):]
+}
+
+// isIndirect reports whether line has a "// indirect" comment,
+// meaning it is in go.mod only for its effect on indirect dependencies,
+// so that it can be dropped entirely once the effective version of the
+// indirect dependency reaches the given minimum version.
+func isIndirect(line *modfile.Line) bool {
+	if len(line.Suffix) == 0 {
+		return false
+	}
+	f := strings.Fields(line.Suffix[0].Token)
+	return (len(f) == 2 && f[1] == "indirect" || len(f) > 2 && f[1] == "indirect;") && f[0] == "//"
+}

data/helpers/go/updater/main.go

@@ -0,0 +1,48 @@
+package updater
+
+import (
+	"io/ioutil"
+
+	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
+)
+
+type Dependency struct {
+	Name     string `json:"name"`
+	Version  string `json:"version"`
+	Indirect bool   `json:"indirect"`
+}
+
+type Args struct {
+	Dependencies []Dependency `json:"dependencies"`
+}
+
+func UpdateDependencyFile(args *Args) (interface{}, error) {
+	data, err := ioutil.ReadFile("go.mod")
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := modfile.Parse("go.mod", data, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, dep := range args.Dependencies {
+		f.AddRequire(dep.Name, dep.Version)
+	}
+
+	for _, r := range f.Require {
+		for _, dep := range args.Dependencies {
+			if r.Mod.Path == dep.Name {
+				setIndirect(r.Syntax, dep.Indirect)
+			}
+		}
+	}
+
+	f.SortBlocks()
+	f.Cleanup()
+
+	newModFile, _ := f.Format()
+
+	return string(newModFile), nil
+}

data/helpers/npm/.agignore

@@ -0,0 +1 @@
+node_modules/

data/helpers/npm/.envrc

@@ -0,0 +1,2 @@
+PATH_add node_modules/.bin
+export LOCAL_VIMRC=true

data/helpers/npm/.eslintrc

@@ -0,0 +1,14 @@
+{
+  "plugins": [
+    "prettier"
+  ],
+  "rules": {
+    "prettier/prettier": "error"
+  },
+  "env": {
+    "node": true
+  },
+  "parserOptions": {
+    "ecmaVersion": 8
+  }
+}

data/helpers/npm/.nvimrc

@@ -0,0 +1,7 @@
+augroup fmt
+  autocmd!
+  autocmd BufWritePre * Neoformat
+augroup END
+
+let test#javascript#jest#file_pattern = '\.test\.js'
+let test#javascript#mocha#file_pattern = 'mocha'

data/helpers/npm/bin/run.js

@@ -0,0 +1,34 @@
+const updater = require("../lib/updater");
+const peerDependencyChecker = require("../lib/peer-dependency-checker");
+const subdependencyUpdater = require("../lib/subdependency-updater");
+
+const functionMap = {
+  update: updater.updateDependencyFiles,
+  updateSubdependency: subdependencyUpdater.updateDependencyFile,
+  checkPeerDependencies: peerDependencyChecker.checkPeerDependencies
+};
+
+function output(obj) {
+  process.stdout.write(JSON.stringify(obj));
+}
+
+const input = [];
+process.stdin.on("data", data => input.push(data));
+process.stdin.on("end", () => {
+  const request = JSON.parse(input.join(""));
+  const func = functionMap[request.function];
+  if (!func) {
+    output({ error: `Invalid function ${request.function}` });
+    process.exit(1);
+  }
+
+  func
+    .apply(null, request.args)
+    .then(result => {
+      output({ result: result });
+    })
+    .catch(error => {
+      output({ error: error.message });
+      process.exit(1);
+    });
+});