dependabot-core 0.76.1

data/lib/dependabot/file_updaters/php/composer.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/base"
+require "dependabot/utils/php/version"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+
+module Dependabot
+  module FileUpdaters
+    module Php
+      class Composer < Base
+        require_relative "composer/manifest_updater"
+        require_relative "composer/lockfile_updater"
+
+        def self.updated_files_regex
+          [
+            /^composer\.json$/,
+            /^composer\.lock$/
+          ]
+        end
+
+        def updated_dependency_files
+          updated_files = []
+
+          if file_changed?(composer_json)
+            updated_files <<
+              updated_file(
+                file: composer_json,
+                content: updated_composer_json_content
+              )
+          end
+
+          if lockfile
+            updated_files <<
+              updated_file(file: lockfile, content: updated_lockfile_content)
+          end
+
+          if updated_files.none? ||
+             updated_files.sort_by(&:name) == dependency_files.sort_by(&:name)
+            raise "No files have changed!"
+          end
+
+          updated_files
+        end
+
+        private
+
+        def check_required_files
+          raise "No composer.json!" unless get_original_file("composer.json")
+        end
+
+        def updated_composer_json_content
+          ManifestUpdater.new(
+            dependencies: dependencies,
+            manifest: composer_json
+          ).updated_manifest_content
+        end
+
+        def updated_lockfile_content
+          @updated_lockfile_content ||=
+            LockfileUpdater.new(
+              dependencies: dependencies,
+              dependency_files: dependency_files,
+              credentials: credentials
+            ).updated_lockfile_content
+        end
+
+        def composer_json
+          @composer_json ||= get_original_file("composer.json")
+        end
+
+        def lockfile
+          @lockfile ||= get_original_file("composer.lock")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/php/composer/lockfile_updater.rb

@@ -0,0 +1,264 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/php/composer"
+require "dependabot/utils/php/version"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+
+module Dependabot
+  module FileUpdaters
+    module Php
+      class Composer
+        class LockfileUpdater
+          require_relative "manifest_updater"
+
+          def initialize(dependencies:, dependency_files:, credentials:)
+            @dependencies = dependencies
+            @dependency_files = dependency_files
+            @credentials = credentials
+          end
+
+          def updated_lockfile_content
+            base_directory = dependency_files.first.directory
+            @updated_lockfile_content ||=
+              SharedHelpers.in_a_temporary_directory(base_directory) do
+                write_temporary_dependency_files
+
+                updated_content = run_update_helper.fetch("composer.lock")
+
+                updated_content = post_process_lockfile(updated_content)
+                if lockfile.content == updated_content
+                  raise "Expected content to change!"
+                end
+
+                updated_content
+              end
+          rescue SharedHelpers::HelperSubprocessFailed => error
+            handle_composer_errors(error)
+          end
+
+          private
+
+          attr_reader :dependencies, :dependency_files, :credentials
+
+          def dependency
+            # For now, we'll only ever be updating a single dependency for PHP
+            dependencies.first
+          end
+
+          def run_update_helper
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              SharedHelpers.run_helper_subprocess(
+                command: "php #{php_helper_path}",
+                function: "update",
+                env: credentials_env,
+                args: [
+                  Dir.pwd,
+                  dependency.name,
+                  dependency.version,
+                  git_credentials,
+                  registry_credentials
+                ]
+              )
+            end
+          end
+
+          def updated_composer_json_content
+            ManifestUpdater.new(
+              dependencies: dependencies,
+              manifest: composer_json
+            ).updated_manifest_content
+          end
+
+          # rubocop:disable Metrics/PerceivedComplexity
+          # rubocop:disable Metrics/AbcSize
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/MethodLength
+          def handle_composer_errors(error)
+            if error.message.start_with?("Failed to execute git checkout")
+              raise git_dependency_reference_error(error)
+            end
+
+            if error.message.start_with?("Failed to execute git clone")
+              dependency_url =
+                error.message.match(/(?:mirror|checkout) '(?<url>.*?)'/).
+                named_captures.fetch("url")
+              raise GitDependenciesNotReachable, dependency_url
+            end
+            if error.message.start_with?("Failed to clone")
+              dependency_url =
+                error.message.match(/Failed to clone (?<url>.*?) via/).
+                named_captures.fetch("url")
+              raise GitDependenciesNotReachable, dependency_url
+            end
+            if error.message.start_with?("Could not find a key for ACF PRO")
+              raise MissingEnvironmentVariable, "ACF_PRO_KEY"
+            end
+            if error.message.start_with?("Unknown downloader type: npm-signatu")
+              raise DependencyFileNotResolvable, error.message
+            end
+            if error.message.include?("file could not be downloaded")
+              raise DependencyFileNotResolvable, error.message
+            end
+            if error.message.start_with?("Allowed memory size")
+              raise Dependabot::OutOfMemory
+            end
+
+            if error.message.include?("403 Forbidden")
+              source = error.message.match(%r{https?://(?<source>[^/]+)/}).
+                       named_captures.fetch("source")
+              raise PrivateSourceAuthenticationFailure, source
+            end
+            if error.message.include?("Argument 1 passed to Composer")
+              msg = "One of your Composer plugins is not compatible with the "\
+                    "latest version of Composer. Please update Composer and "\
+                    "try running `composer update` to debug further."
+              raise DependencyFileNotResolvable, msg
+            end
+            raise error
+          end
+          # rubocop:enable Metrics/PerceivedComplexity
+          # rubocop:enable Metrics/AbcSize
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/MethodLength
+
+          def write_temporary_dependency_files
+            path_dependencies.each do |file|
+              path = file.name
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(file.name, file.content)
+            end
+
+            File.write("composer.json", locked_composer_json_content)
+            File.write("composer.lock", lockfile.content)
+          end
+
+          def locked_composer_json_content
+            dependencies.
+              reduce(updated_composer_json_content) do |content, dep|
+                updated_req = dep.version
+                next content unless Utils::Php::Version.correct?(updated_req)
+
+                old_req =
+                  dep.requirements.find { |r| r[:file] == "composer.json" }&.
+                  fetch(:requirement)
+
+                # When updating a subdep there won't be an old requirement
+                next content unless old_req
+
+                regex =
+                  /
+                    "#{Regexp.escape(dep.name)}"\s*:\s*
+                    "#{Regexp.escape(old_req)}"
+                  /x
+
+                content.gsub(regex) do |declaration|
+                  declaration.gsub(%("#{old_req}"), %("#{updated_req}"))
+                end
+              end
+          end
+
+          def git_dependency_reference_error(error)
+            ref = error.message.match(/checkout '(?<ref>.*?)'/).
+                  named_captures.fetch("ref")
+            dependency_name =
+              JSON.parse(lockfile.content).
+              values_at("packages", "packages-dev").flatten(1).
+              find { |dep| dep.dig("source", "reference") == ref }&.
+              fetch("name")
+
+            raise unless dependency_name
+
+            raise GitDependencyReferenceNotFound, dependency_name
+          end
+
+          def post_process_lockfile(content)
+            content = replace_patches(content)
+            replace_content_hash(content)
+          end
+
+          def replace_patches(updated_content)
+            content = updated_content
+            %w(packages packages-dev).each do |package_type|
+              JSON.parse(lockfile.content).fetch(package_type).each do |details|
+                next unless details["extra"].is_a?(Hash)
+                next unless (patches = details.dig("extra", "patches_applied"))
+
+                updated_object = JSON.parse(content)
+                updated_object_package =
+                  updated_object.
+                  fetch(package_type).
+                  find { |d| d["name"] == details["name"] }
+
+                next unless updated_object_package
+
+                updated_object_package["extra"] ||= {}
+                updated_object_package["extra"]["patches_applied"] = patches
+
+                content =
+                  JSON.pretty_generate(updated_object, indent: "    ").
+                  gsub(/\[\n\n\s*\]/, "[]").
+                  gsub(/\}\z/, "}\n")
+              end
+            end
+            content
+          end
+
+          def replace_content_hash(content)
+            existing_hash = JSON.parse(content).fetch("content-hash")
+            SharedHelpers.in_a_temporary_directory do
+              File.write("composer.json", updated_composer_json_content)
+
+              content_hash =
+                SharedHelpers.run_helper_subprocess(
+                  command: "php #{php_helper_path}",
+                  function: "get_content_hash",
+                  env: credentials_env,
+                  args: [Dir.pwd]
+                )
+
+              content.gsub(existing_hash, content_hash)
+            end
+          end
+
+          def php_helper_path
+            project_root = File.join(File.dirname(__FILE__), "../../../../..")
+            File.join(project_root, "helpers/php/bin/run.php")
+          end
+
+          def credentials_env
+            credentials.
+              select { |c| c.fetch("type") == "php_environment_variable" }.
+              map { |cred| [cred["env-key"], cred["env-value"]] }.
+              to_h
+          end
+
+          def git_credentials
+            credentials.
+              select { |cred| cred.fetch("type") == "git_source" }
+          end
+
+          def registry_credentials
+            credentials.
+              select { |cred| cred.fetch("type") == "composer_repository" }
+          end
+
+          def composer_json
+            @composer_json ||=
+              dependency_files.find { |f| f.name == "composer.json" }
+          end
+
+          def lockfile
+            @lockfile ||=
+              dependency_files.find { |f| f.name == "composer.lock" }
+          end
+
+          def path_dependencies
+            @path_dependencies ||=
+              dependency_files.select { |f| f.name.end_with?("/composer.json") }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/php/composer/manifest_updater.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/php/composer"
+
+module Dependabot
+  module FileUpdaters
+    module Php
+      class Composer
+        class ManifestUpdater
+          def initialize(dependencies:, manifest:)
+            @dependencies = dependencies
+            @manifest = manifest
+          end
+
+          def updated_manifest_content
+            dependencies.reduce(manifest.content.dup) do |content, dep|
+              updated_content = content
+              updated_requirements(dep).each do |new_req|
+                old_req = old_requirement(dep, new_req).fetch(:requirement)
+                updated_req = new_req.fetch(:requirement)
+
+                regex =
+                  /
+                    "#{Regexp.escape(dep.name)}"\s*:\s*
+                    "#{Regexp.escape(old_req)}"
+                  /x
+
+                updated_content = content.gsub(regex) do |declaration|
+                  declaration.gsub(%("#{old_req}"), %("#{updated_req}"))
+                end
+
+                if content == updated_content
+                  raise "Expected content to change!"
+                end
+              end
+
+              updated_content
+            end
+          end
+
+          private
+
+          attr_reader :dependencies, :manifest
+
+          def new_requirements(dependency)
+            dependency.requirements.select { |r| r[:file] == manifest.name }
+          end
+
+          def old_requirement(dependency, new_requirement)
+            dependency.previous_requirements.
+              select { |r| r[:file] == manifest.name }.
+              find { |r| r[:groups] == new_requirement[:groups] }
+          end
+
+          def updated_requirements(dependency)
+            new_requirements(dependency).
+              reject { |r| dependency.previous_requirements.include?(r) }
+          end
+
+          def requirement_changed?(file, dependency)
+            changed_requirements =
+              dependency.requirements - dependency.previous_requirements
+
+            changed_requirements.any? { |f| f[:file] == file.name }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/python/pip.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "dependabot/file_updaters/base"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module FileUpdaters
+    module Python
+      class Pip < Dependabot::FileUpdaters::Base
+        require_relative "pip/pipfile_file_updater"
+        require_relative "pip/pip_compile_file_updater"
+        require_relative "pip/poetry_file_updater"
+        require_relative "pip/requirement_file_updater"
+
+        def self.updated_files_regex
+          [
+            /^Pipfile$/,
+            /^Pipfile\.lock$/,
+            /.*\.txt$/,
+            /.*\.in$/,
+            /^setup\.py$/,
+            /^pyproject\.toml$/,
+            /^pyproject\.lock$/
+          ]
+        end
+
+        def updated_dependency_files
+          updated_files =
+            case resolver_type
+            when :pipfile then updated_pipfile_based_files
+            when :poetry then updated_poetry_based_files
+            when :pip_compile then updated_pip_compile_based_files
+            when :requirements then updated_requirement_based_files
+            else raise "Unexpected resolver type: #{resolver_type}"
+            end
+
+          if updated_files.none? ||
+             updated_files.sort_by(&:name) == dependency_files.sort_by(&:name)
+            raise "No files have changed!"
+          end
+
+          updated_files
+        end
+
+        private
+
+        def resolver_type
+          reqs = dependencies.flat_map(&:requirements)
+          req_files = reqs.map { |r| r.fetch(:file) }
+
+          # If there are no requirements then this is a sub-dependency. It
+          # must come from one of Pipenv, Poetry or pip-tools, and can't come
+          # from the first two unless they have a lockfile.
+          return subdependency_resolver if reqs.none?
+
+          # Otherwise, this is a top-level dependency, and we can figure out
+          # which resolver to use based on the filename of its requirements
+          return :pipfile if req_files.any? { |f| f == "Pipfile" }
+          return :poetry if req_files.any? { |f| f == "pyproject.toml" }
+          return :pip_compile if req_files.any? { |f| f.end_with?(".in") }
+
+          # Finally, we should only ever be updating a requirements.txt file if
+          # some requirements have changed. Otherwise, this must be a case where
+          # we have a requirements.txt *and* some other resolver of which the
+          # dependency is a sub-dependency.
+          changed_reqs = reqs - dependencies.flat_map(&:previous_requirements)
+          changed_reqs.none? ? subdependency_resolver : :requirements
+        end
+
+        def subdependency_resolver
+          return :pipfile if pipfile_lock
+          return :poetry if poetry_lock || pyproject_lock
+          return :pip_compile if pip_compile_files.any?
+
+          raise "Claimed to be a sub-dependency, but no lockfile exists!"
+        end
+
+        def updated_pipfile_based_files
+          PipfileFileUpdater.new(
+            dependencies: dependencies,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).updated_dependency_files
+        end
+
+        def updated_poetry_based_files
+          PoetryFileUpdater.new(
+            dependencies: dependencies,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).updated_dependency_files
+        end
+
+        def updated_pip_compile_based_files
+          PipCompileFileUpdater.new(
+            dependencies: dependencies,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).updated_dependency_files
+        end
+
+        def updated_requirement_based_files
+          RequirementFileUpdater.new(
+            dependencies: dependencies,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).updated_dependency_files
+        end
+
+        def check_required_files
+          filenames = dependency_files.map(&:name)
+          return if filenames.any? { |name| name.end_with?(".txt", ".in") }
+          return if pipfile
+          return if pyproject
+          return if get_original_file("setup.py")
+
+          raise "No requirements.txt or setup.py!"
+        end
+
+        def pipfile
+          @pipfile ||= get_original_file("Pipfile")
+        end
+
+        def pipfile_lock
+          @pipfile_lock ||= get_original_file("Pipfile.lock")
+        end
+
+        def pyproject
+          @pyproject ||= get_original_file("pyproject.toml")
+        end
+
+        def pyproject_lock
+          @pyproject_lock ||= get_original_file("pyproject.lock")
+        end
+
+        def poetry_lock
+          @poetry_lock ||= get_original_file("poetry.lock")
+        end
+
+        def pip_compile_files
+          @pip_compile_files ||=
+            dependency_files.select { |f| f.name.end_with?(".in") }
+        end
+      end
+    end
+  end
+end