dependabot-core 0.76.1

data/lib/dependabot/update_checkers.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "dependabot/update_checkers/ruby/bundler"
+require "dependabot/update_checkers/python/pip"
+require "dependabot/update_checkers/java_script/npm_and_yarn"
+require "dependabot/update_checkers/java/maven"
+require "dependabot/update_checkers/java/gradle"
+require "dependabot/update_checkers/php/composer"
+require "dependabot/update_checkers/git/submodules"
+require "dependabot/update_checkers/docker/docker"
+require "dependabot/update_checkers/elixir/hex"
+require "dependabot/update_checkers/rust/cargo"
+require "dependabot/update_checkers/dotnet/nuget"
+require "dependabot/update_checkers/go/dep"
+require "dependabot/update_checkers/go/modules"
+require "dependabot/update_checkers/elm/elm_package"
+
+module Dependabot
+  module UpdateCheckers
+    @update_checkers = {
+      "bundler" => UpdateCheckers::Ruby::Bundler,
+      "npm_and_yarn" => UpdateCheckers::JavaScript::NpmAndYarn,
+      "maven" => UpdateCheckers::Java::Maven,
+      "gradle" => UpdateCheckers::Java::Gradle,
+      "pip" => UpdateCheckers::Python::Pip,
+      "composer" => UpdateCheckers::Php::Composer,
+      "submodules" => UpdateCheckers::Git::Submodules,
+      "docker" => UpdateCheckers::Docker::Docker,
+      "hex" => UpdateCheckers::Elixir::Hex,
+      "cargo" => UpdateCheckers::Rust::Cargo,
+      "nuget" => UpdateCheckers::Dotnet::Nuget,
+      "dep" => UpdateCheckers::Go::Dep,
+      "go_modules" => UpdateCheckers::Go::Modules,
+      "elm-package" => UpdateCheckers::Elm::ElmPackage
+    }
+
+    def self.for_package_manager(package_manager)
+      update_checker = @update_checkers[package_manager]
+      return update_checker if update_checker
+
+      raise "Unsupported package_manager #{package_manager}"
+    end
+
+    def self.register(package_manager, update_checker)
+      @update_checkers[package_manager] = update_checker
+    end
+  end
+end

data/lib/dependabot/update_checkers/README.md

@@ -0,0 +1,67 @@
+# Update checkers
+
+Update checkers check whether a given dependency is up-to-date. If it isn't,
+they augment it with details of the version to update to.
+
+There is a `Dependabot::UpdateCheckers` class for each language Dependabot
+supports.
+
+## Public API
+
+Each `Dependabot::UpdateCheckers` class implements the following methods:
+
+| Method                       | Description                                                                                   |
+|------------------------------|-----------------------------------------------------------------------------------------------|
+| `#up_to_date?`               | Returns a boolean for whether the dependency this instance was created with is currently at the latest version. |
+| `#can_update?`               | Returns a boolean for whether the dependency this instance was created with needs updating. This will be true if the dependency and/or its requirements can be updated to support a newer version whilst keeping the dependency files it came from resolvable. |
+| `#updated_dependencies`      | Returns an array of updated `Dependabot::Dependency` instance with updated `version` and `requirements` attributes. The previous valuse are stored on the instance as `previous_version` and `previous_requirements`. |
+| `#latest_version`            | See the "Writing an update checker" section. |
+| `#latest_resolvable_version` | See the "Writing an update checker" section. |
+| `#updated_requirements`      | See the "Writing an update checker" section. |
+
+An integration might look as follows:
+
+```ruby
+require 'dependabot/update_checkers'
+
+dependency = dependencies.first
+
+update_checker_class = Dependabot::UpdateCheckers::Ruby::Bundler
+update_checker = update_checker_class.new(
+  dependency: dependency,
+  dependency_files: files,
+  credentials: [{
+    "type" => "git_source",
+    "host" => "github.com",
+    "username" => "x-access-token",
+    "password" => "token"
+  }]
+)
+
+puts "Update needed for #{dependency.name}? "\
+     "#{update_checker.can_update?(requirements_to_update: :own)}"
+```
+
+## Writing an update checker for a new language
+
+All new update checkers should inherit from `Dependabot::UpdateCheckers::Base` and
+implement the following methods:
+
+| Method                       | Description                                                                                   |
+|------------------------------|-----------------------------------------------------------------------------------------------|
+| `#latest_version`            | The latest version of the dependency, ignoring resolvability. This is used to short-circuit update checking when the dependency is already at the latest version (since checking resolvability is typically slow). |
+| `#latest_resolvable_version` | The latest version of the dependency that will still allow the full dependency set to resolve. |
+| `#latest_resolvable_version_with_no_unlock` | The latest version of the dependency that satisfies the dependency's current version constraints and will still allow the full dependency set to resolve. |
+| `#updated_requirements`      | An updated set of requirements for the dependency that should replace the existing requirements in the manifest file. Use by the file updater class when updating the manifest file. |
+| `#latest_version_resolvable_with_full_unlock?` | A boolean for whether the latest version can be resolved if all other dependencies are unlocked in the manifest file. Can be set to always return `false` if multi-dependency updates aren't yet supported. |
+| `#updated_dependencies_after_full_unlock` | And updated set of dependencies after a full unlock and update has taken place. Not required if `latest_version_resolvable_with_full_unlock?` always returns false. |
+
+
+To ensure the above are implemented, you should include
+`it_behaves_like "a dependency update checker"` in your specs for the new update
+checker.
+
+Writing update checkers generally gets tricky when resolvability has to
+be taken into account. It is almost always easiest to do so in the language your
+update checker relates to, so you may wish to shell out to that language. See
+`UpdateCheckers::Php::Composer` for an example of how to do so.

data/lib/dependabot/update_checkers/base.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+require "json"
+require "dependabot/utils"
+
+module Dependabot
+  module UpdateCheckers
+    class Base
+      attr_reader :dependency, :dependency_files, :credentials,
+                  :ignored_versions, :requirements_update_strategy
+
+      def initialize(dependency:, dependency_files:, credentials:,
+                     ignored_versions: [], requirements_update_strategy: nil)
+        @dependency = dependency
+        @dependency_files = dependency_files
+        @credentials = credentials
+        @requirements_update_strategy = requirements_update_strategy
+        @ignored_versions = ignored_versions
+      end
+
+      def up_to_date?
+        if dependency.appears_in_lockfile?
+          version_up_to_date?
+        else
+          requirements_up_to_date?
+        end
+      end
+
+      def can_update?(requirements_to_unlock:)
+        if dependency.appears_in_lockfile?
+          version_can_update?(requirements_to_unlock: requirements_to_unlock)
+        else
+          # TODO: Handle full unlock updates for dependencies without a lockfile
+          return false if requirements_to_unlock == :none
+
+          requirements_can_update?
+        end
+      end
+
+      def updated_dependencies(requirements_to_unlock:)
+        unless can_update?(requirements_to_unlock: requirements_to_unlock)
+          return []
+        end
+
+        case requirements_to_unlock&.to_sym
+        when :none then [updated_dependency_without_unlock]
+        when :own then [updated_dependency_with_own_req_unlock]
+        when :all then updated_dependencies_after_full_unlock
+        else raise "Unknown unlock level '#{requirements_to_unlock}'"
+        end
+      end
+
+      def latest_version
+        raise NotImplementedError
+      end
+
+      def latest_resolvable_version
+        raise NotImplementedError
+      end
+
+      def latest_resolvable_version_with_no_unlock
+        raise NotImplementedError
+      end
+
+      def updated_requirements
+        raise NotImplementedError
+      end
+
+      def version_class
+        Utils.version_class_for_package_manager(dependency.package_manager)
+      end
+
+      def requirement_class
+        Utils.requirement_class_for_package_manager(dependency.package_manager)
+      end
+
+      # For some langauges, the manifest file may be constructed such that
+      # Dependabot has no way to update it (e.g., if it fetches its versions
+      # from a web API). This method is overridden in those cases.
+      def requirements_unlocked_or_can_be?
+        true
+      end
+
+      private
+
+      def latest_version_resolvable_with_full_unlock?
+        raise NotImplementedError
+      end
+
+      def updated_dependency_without_unlock
+        Dependency.new(
+          name: dependency.name,
+          version: latest_resolvable_version_with_no_unlock.to_s,
+          requirements: dependency.requirements,
+          previous_version: dependency.version,
+          previous_requirements: dependency.requirements,
+          package_manager: dependency.package_manager
+        )
+      end
+
+      def updated_dependency_with_own_req_unlock
+        Dependency.new(
+          name: dependency.name,
+          version: latest_resolvable_version.to_s,
+          requirements: updated_requirements,
+          previous_version: dependency.version,
+          previous_requirements: dependency.requirements,
+          package_manager: dependency.package_manager
+        )
+      end
+
+      def updated_dependencies_after_full_unlock
+        raise NotImplementedError
+      end
+
+      def version_up_to_date?
+        return sha1_version_up_to_date? if existing_version_is_sha?
+
+        numeric_version_up_to_date?
+      end
+
+      def version_can_update?(requirements_to_unlock:)
+        if existing_version_is_sha?
+          return sha1_version_can_update?(
+            requirements_to_unlock: requirements_to_unlock
+          )
+        end
+
+        numeric_version_can_update?(
+          requirements_to_unlock: requirements_to_unlock
+        )
+      end
+
+      def existing_version_is_sha?
+        return false if version_class.correct?(dependency.version)
+
+        dependency.version.match?(/^[0-9a-f]{6,}$/)
+      end
+
+      def sha1_version_up_to_date?
+        latest_version&.to_s&.start_with?(dependency.version)
+      end
+
+      def sha1_version_can_update?(requirements_to_unlock:)
+        return false if sha1_version_up_to_date?
+
+        # All we can do with SHA-1 hashes is check for presence and equality
+        case requirements_to_unlock&.to_sym
+        when :none
+          new_version = latest_resolvable_version_with_no_unlock
+          new_version && !new_version.to_s.start_with?(dependency.version)
+        when :own
+          new_version = latest_resolvable_version
+          new_version && !new_version.to_s.start_with?(dependency.version)
+        when :all
+          latest_version_resolvable_with_full_unlock?
+        else raise "Unknown unlock level '#{requirements_to_unlock}'"
+        end
+      end
+
+      def numeric_version_up_to_date?
+        return false unless latest_version
+
+        # If a lockfile isn't out of date and the package has switched to a git
+        # source then we'll get a numeric version switching to a git SHA. In
+        # this case we treat the verison as up-to-date so that it's ignored.
+        return true if latest_version.to_s.match?(/^[0-9a-f]{40}$/)
+
+        latest_version <= version_class.new(dependency.version)
+      end
+
+      def numeric_version_can_update?(requirements_to_unlock:)
+        return false if numeric_version_up_to_date?
+
+        case requirements_to_unlock&.to_sym
+        when :none
+          new_version = latest_resolvable_version_with_no_unlock
+          new_version && new_version > version_class.new(dependency.version)
+        when :own
+          new_version = latest_resolvable_version
+          new_version && new_version > version_class.new(dependency.version)
+        when :all
+          latest_version_resolvable_with_full_unlock?
+        else raise "Unknown unlock level '#{requirements_to_unlock}'"
+        end
+      end
+
+      def requirements_up_to_date?
+        return true if (updated_requirements - dependency.requirements).none?
+        return false unless latest_version
+        return false unless version_class.correct?(latest_version.to_s)
+        return false unless version_from_requirements
+
+        version_from_requirements >= version_class.new(latest_version.to_s)
+      end
+
+      def version_from_requirements
+        @version_from_requirements ||=
+          dependency.requirements.map { |r| r.fetch(:requirement) }.compact.
+          flat_map { |req_str| requirement_class.requirements_array(req_str) }.
+          flat_map(&:requirements).
+          reject { |req_array| req_array.first.start_with?("<") }.
+          map(&:last).
+          max
+      end
+
+      def requirements_can_update?
+        changed_reqs = updated_requirements - dependency.requirements
+
+        return false if changed_reqs.none?
+
+        changed_reqs.none? { |r| r[:requirement] == :unfixable }
+      end
+
+      def ignore_reqs
+        ignored_versions.map { |req| requirement_class.new(req.split(",")) }
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/docker/docker.rb

@@ -0,0 +1,290 @@
+# frozen_string_literal: true
+
+require "docker_registry2"
+
+require "dependabot/update_checkers/base"
+require "dependabot/errors"
+require "dependabot/utils/docker/credentials_finder"
+
+module Dependabot
+  module UpdateCheckers
+    module Docker
+      class Docker < Dependabot::UpdateCheckers::Base
+        VERSION_REGEX = /(?<version>[0-9]+(?:\.[a-zA-Z0-9]+)*)/.freeze
+        VERSION_WITH_SUFFIX =
+          /^#{VERSION_REGEX}(?<affix>-[a-z0-9.\-]+)?$/.freeze
+        VERSION_WITH_PREFIX =
+          /^(?<affix>[a-z0-9.\-]+-)?#{VERSION_REGEX}$/.freeze
+        NAME_WITH_VERSION =
+          /#{VERSION_WITH_PREFIX}|#{VERSION_WITH_SUFFIX}/.freeze
+
+        def latest_version
+          @latest_version ||= fetch_latest_version
+        end
+
+        def latest_resolvable_version
+          # Resolvability isn't an issue for Docker containers.
+          latest_version
+        end
+
+        def latest_resolvable_version_with_no_unlock
+          # No concept of "unlocking" for Docker containers
+          dependency.version
+        end
+
+        def updated_requirements
+          dependency.requirements.map do |req|
+            updated_source = req.fetch(:source).dup
+            updated_source[:digest] = updated_digest if req[:source][:digest]
+            updated_source[:tag] = latest_version if req[:source][:tag]
+
+            req.merge(source: updated_source)
+          end
+        end
+
+        private
+
+        def latest_version_resolvable_with_full_unlock?
+          # Full unlock checks aren't relevant for Dockerfiles
+          false
+        end
+
+        def updated_dependencies_after_full_unlock
+          raise NotImplementedError
+        end
+
+        def version_can_update?(*)
+          !version_up_to_date?
+        end
+
+        def version_up_to_date?
+          # If the tag isn't up-to-date then we can definitely update
+          return false if version_tag_up_to_date? == false
+
+          # Otherwise, if the Dockerfile specifies a digest check that that is
+          # up-to-date
+          digest_up_to_date?
+        end
+
+        def version_tag_up_to_date?
+          return unless dependency.version.match?(NAME_WITH_VERSION)
+
+          old_v = numeric_version_from(dependency.version)
+          latest_v = numeric_version_from(latest_version)
+
+          return true if version_class.new(latest_v) <= version_class.new(old_v)
+
+          # Check the precision of the potentially higher tag is the same as the
+          # one it would replace. In the event that it's not the same, check the
+          # digests are also unequal. Avoids 'updating' ruby-2 -> ruby-2.5.1
+          return false if old_v.split(".").count == latest_v.split(".").count
+
+          digest_of(dependency.version) == digest_of(latest_version)
+        end
+
+        def digest_up_to_date?
+          dependency.requirements.all? do |req|
+            next true unless req.fetch(:source)[:digest]
+
+            req.fetch(:source).fetch(:digest) == digest_of(dependency.version)
+          end
+        end
+
+        # Note: It's important that this *always* returns a version (even if
+        # it's the existing one) as it is what we later check the digest of.
+        def fetch_latest_version
+          unless dependency.version.match?(NAME_WITH_VERSION)
+            return dependency.version
+          end
+
+          # Prune out any downgrade tags before checking for pre-releases
+          # (which requires a call to the registry for each tag, so can be slow)
+          candidate_tags = comparable_tags_from_registry
+          non_downgrade_tags = remove_version_downgrades(candidate_tags)
+          candidate_tags = non_downgrade_tags if non_downgrade_tags.any?
+
+          wants_prerelease = prerelease?(dependency.version)
+          candidate_tags =
+            candidate_tags.
+            reject { |tag| prerelease?(tag) && !wants_prerelease }.
+            reject do |tag|
+              version = version_class.new(numeric_version_from(tag))
+              ignore_reqs.any? { |r| r.satisfied_by?(version) }
+            end
+
+          latest_tag =
+            candidate_tags.
+            max_by { |tag| version_class.new(numeric_version_from(tag)) }
+
+          latest_tag || dependency.version
+        end
+
+        def comparable_tags_from_registry
+          original_affix = affix_of(dependency.version)
+
+          tags_from_registry.
+            select { |tag| tag.match?(NAME_WITH_VERSION) }.
+            select { |tag| affix_of(tag) == original_affix }.
+            reject { |tag| commit_sha_suffix?(tag) }
+        end
+
+        def remove_version_downgrades(candidate_tags)
+          candidate_tags.select do |tag|
+            version_class.new(numeric_version_from(tag)) >=
+              version_class.new(numeric_version_from(dependency.version))
+          end
+        end
+
+        def commit_sha_suffix?(tag)
+          # Some people suffix their versions with commit SHAs. Dependabot
+          # can't order on those but will try to, so instead we should exclude
+          # them (unless there's a `latest` version pushed to the registry, in
+          # which case we'll use that to find the latest version)
+          return false unless tag.match?(/(^|\-)[0-9a-f]{7,}$/)
+
+          !tag.match?(/(^|\-)20[0-1]\d{5}$/)
+        end
+
+        def version_of_latest_tag
+          return unless latest_digest
+
+          tags_from_registry.
+            select { |tag| canonical_version?(tag) }.
+            select { |t| digest_of(t) == latest_digest }.
+            map { |t| version_class.new(numeric_version_from(t)) }.
+            max
+        end
+
+        def canonical_version?(tag)
+          return false unless numeric_version_from(tag)
+          return true if tag == numeric_version_from(tag)
+
+          # .NET tags are suffixed with -sdk. There may be other cases we need
+          # to consider in future, too.
+          tag == numeric_version_from(tag) + "-sdk"
+        end
+
+        def updated_digest
+          @updated_digest ||=
+            begin
+              docker_registry_client.digest(docker_repo_name, latest_version)
+            rescue RestClient::Exceptions::Timeout
+              attempt ||= 1
+              attempt += 1
+              raise if attempt > 3
+
+              retry
+            end
+        rescue DockerRegistry2::RegistryAuthenticationException,
+               RestClient::Forbidden
+          raise PrivateSourceAuthenticationFailure, registry_hostname
+        end
+
+        def tags_from_registry
+          @tags_from_registry ||=
+            begin
+              docker_registry_client.tags(docker_repo_name).fetch("tags")
+            rescue RestClient::Exceptions::Timeout
+              attempt ||= 1
+              attempt += 1
+              raise if attempt > 3
+
+              retry
+            end
+        rescue DockerRegistry2::RegistryAuthenticationException,
+               RestClient::Forbidden
+          raise PrivateSourceAuthenticationFailure, registry_hostname
+        end
+
+        def latest_digest
+          return unless tags_from_registry.include?("latest")
+
+          digest_of("latest")
+        end
+
+        def digest_of(tag)
+          @digests ||= {}
+          return @digests[tag] if @digests.key?(tag)
+
+          @digests[tag] =
+            begin
+              docker_registry_client.digest(docker_repo_name, tag)
+            rescue *transient_docker_errors => e
+              attempt ||= 1
+              attempt += 1
+              return if attempt > 3 && e.is_a?(DockerRegistry2::NotFound)
+              raise if attempt > 3
+
+              retry
+            end
+        end
+
+        def transient_docker_errors
+          [RestClient::Exceptions::Timeout, DockerRegistry2::NotFound]
+        end
+
+        def affix_of(tag)
+          tag.match(NAME_WITH_VERSION).named_captures.fetch("affix")
+        end
+
+        def prerelease?(tag)
+          return true if numeric_version_from(tag).match?(/[a-zA-Z]/)
+
+          # If we're dealing with a numeric version we can compare it against
+          # the digest for the `latest` tag.
+          return false unless numeric_version_from(tag)
+          return false unless latest_digest
+          return false unless version_of_latest_tag
+
+          version_class.new(numeric_version_from(tag)) > version_of_latest_tag
+        end
+
+        def numeric_version_from(tag)
+          return unless tag.match?(NAME_WITH_VERSION)
+
+          tag.match(NAME_WITH_VERSION).named_captures.fetch("version")
+        end
+
+        def registry_hostname
+          dependency.requirements.first[:source][:registry] ||
+            "registry.hub.docker.com"
+        end
+
+        def using_dockerhub?
+          registry_hostname == "registry.hub.docker.com"
+        end
+
+        def registry_credentials
+          credentials_finder.credentials_for_registry(registry_hostname)
+        end
+
+        def credentials_finder
+          @credentials_finder ||=
+            Utils::Docker::CredentialsFinder.new(credentials)
+        end
+
+        def docker_repo_name
+          return dependency.name unless using_dockerhub?
+          return dependency.name unless dependency.name.split("/").count < 2
+
+          "library/#{dependency.name}"
+        end
+
+        def docker_registry_client
+          @docker_registry_client ||=
+            DockerRegistry2::Registry.new(
+              "https://#{registry_hostname}",
+              user: registry_credentials&.fetch("username"),
+              password: registry_credentials&.fetch("password")
+            )
+        end
+
+        def ignore_reqs
+          # Note: we use Gem::Requirement here because ignore conditions will
+          # be passed as Ruby ranges
+          ignored_versions.map { |req| Gem::Requirement.new(req.split(",")) }
+        end
+      end
+    end
+  end
+end