dependabot-core 0.76.1

data/lib/dependabot/update_checkers/rust/cargo.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/git_commit_checker"
+require "dependabot/update_checkers/base"
+
+module Dependabot
+  module UpdateCheckers
+    module Rust
+      class Cargo < Dependabot::UpdateCheckers::Base
+        require_relative "cargo/requirements_updater"
+        require_relative "cargo/version_resolver"
+        require_relative "cargo/file_preparer"
+
+        def latest_version
+          return if path_dependency?
+
+          @latest_version =
+            if git_dependency?
+              latest_version_for_git_dependency
+            elsif git_subdependency?
+              # TODO: Dependabot can't update git sub-dependencies yet, because
+              # they can't be passed to GitCommitChecker.
+              nil
+            else
+              versions = available_versions
+              versions.reject!(&:prerelease?) unless wants_prerelease?
+              versions.reject! do |v|
+                ignore_reqs.any? { |r| r.satisfied_by?(v) }
+              end
+              versions.max
+            end
+        end
+
+        def latest_resolvable_version
+          return if path_dependency?
+
+          @latest_resolvable_version ||=
+            if git_dependency?
+              latest_resolvable_version_for_git_dependency
+            elsif git_subdependency?
+              # TODO: Dependabot can't update git sub-dependencies yet, because
+              # they can't be passed to GitCommitChecker.
+              nil
+            else
+              fetch_latest_resolvable_version(unlock_requirement: true)
+            end
+        end
+
+        def latest_resolvable_version_with_no_unlock
+          return if path_dependency?
+
+          @latest_resolvable_version_with_no_unlock ||=
+            if git_dependency?
+              latest_resolvable_commit_with_unchanged_git_source
+            else
+              fetch_latest_resolvable_version(unlock_requirement: false)
+            end
+        end
+
+        def updated_requirements
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            updated_source: updated_source,
+            latest_resolvable_version: latest_resolvable_version&.to_s,
+            latest_version: latest_version&.to_s,
+            library: library?,
+            update_strategy: requirement_update_strategy
+          ).updated_requirements
+        end
+
+        private
+
+        def latest_version_resolvable_with_full_unlock?
+          # Full unlock checks aren't implemented for Rust (yet)
+          false
+        end
+
+        def updated_dependencies_after_full_unlock
+          raise NotImplementedError
+        end
+
+        def library?
+          # If it has a lockfile, treat it as an application. Otherwise treat it
+          # as a library.
+          dependency_files.none? { |f| f.name == "Cargo.lock" }
+        end
+
+        def requirement_update_strategy
+          library? ? :bump_versions_if_necessary : :bump_versions
+        end
+
+        def latest_version_for_git_dependency
+          latest_git_version_sha
+        end
+
+        def latest_git_version_sha
+          # If the gem isn't pinned, the latest version is just the latest
+          # commit for the specified branch.
+          unless git_commit_checker.pinned?
+            return git_commit_checker.head_commit_for_current_branch
+          end
+
+          # If the dependency is pinned to a tag that looks like a version then
+          # we want to update that tag. The latest version will then be the SHA
+          # of the latest tag that looks like a version.
+          if git_commit_checker.pinned_ref_looks_like_version?
+            latest_tag = git_commit_checker.local_tag_for_latest_version
+            return latest_tag&.fetch(:commit_sha) || dependency.version
+          end
+
+          # If the dependency is pinned to a tag that doesn't look like a
+          # version then there's nothing we can do.
+          dependency.version
+        end
+
+        def latest_resolvable_version_for_git_dependency
+          # If the gem isn't pinned, the latest version is just the latest
+          # commit for the specified branch.
+          unless git_commit_checker.pinned?
+            return latest_resolvable_commit_with_unchanged_git_source
+          end
+
+          # If the dependency is pinned to a tag that looks like a version then
+          # we want to update that tag. The latest version will then be the SHA
+          # of the latest tag that looks like a version.
+          if git_commit_checker.pinned_ref_looks_like_version? &&
+             latest_git_tag_is_resolvable?
+            new_tag = git_commit_checker.local_tag_for_latest_version
+            return new_tag.fetch(:commit_sha)
+          end
+
+          # If the dependency is pinned then there's nothing we can do.
+          dependency.version
+        end
+
+        def latest_git_tag_is_resolvable?
+          return @git_tag_resolvable if @latest_git_tag_is_resolvable_checked
+
+          @latest_git_tag_is_resolvable_checked = true
+
+          return false if git_commit_checker.local_tag_for_latest_version.nil?
+
+          replacement_tag = git_commit_checker.local_tag_for_latest_version
+
+          prepared_files = FilePreparer.new(
+            dependency_files: dependency_files,
+            dependency: dependency,
+            unlock_requirement: true,
+            replacement_git_pin: replacement_tag.fetch(:tag)
+          ).prepared_dependency_files
+
+          VersionResolver.new(
+            dependency: dependency,
+            prepared_dependency_files: prepared_files,
+            original_dependency_files: dependency_files,
+            credentials: credentials
+          ).latest_resolvable_version
+          @git_tag_resolvable = true
+        rescue SharedHelpers::HelperSubprocessFailed => error
+          raise error unless error.message.include?("versions conflict")
+
+          @git_tag_resolvable = false
+        end
+
+        def latest_resolvable_commit_with_unchanged_git_source
+          fetch_latest_resolvable_version(unlock_requirement: false)
+        rescue SharedHelpers::HelperSubprocessFailed => error
+          # Resolution may fail, as Cargo updates straight to the tip of the
+          # branch. Just return `nil` if it does (so no update).
+          return if error.message.include?("versions conflict")
+
+          raise error
+        end
+
+        def fetch_latest_resolvable_version(unlock_requirement:)
+          prepared_files = FilePreparer.new(
+            dependency_files: dependency_files,
+            dependency: dependency,
+            unlock_requirement: unlock_requirement,
+            latest_allowable_version: latest_version
+          ).prepared_dependency_files
+
+          VersionResolver.new(
+            dependency: dependency,
+            prepared_dependency_files: prepared_files,
+            original_dependency_files: dependency_files,
+            credentials: credentials
+          ).latest_resolvable_version
+        end
+
+        def updated_source
+          # Never need to update source, unless a git_dependency
+          return dependency_source_details unless git_dependency?
+
+          # Update the git tag if updating a pinned version
+          if git_commit_checker.pinned_ref_looks_like_version? &&
+             latest_git_tag_is_resolvable?
+            new_tag = git_commit_checker.local_tag_for_latest_version
+            return dependency_source_details.merge(ref: new_tag.fetch(:tag))
+          end
+
+          # Otherwise return the original source
+          dependency_source_details
+        end
+
+        def dependency_source_details
+          sources =
+            dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact
+
+          raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+
+          sources.first
+        end
+
+        def wants_prerelease?
+          if dependency.version &&
+             version_class.new(dependency.version).prerelease?
+            return true
+          end
+
+          dependency.requirements.any? do |req|
+            reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
+            reqs.any? { |r| r.match?(/[A-Za-z]/) }
+          end
+        end
+
+        def available_versions
+          crates_listing.
+            fetch("versions", []).
+            reject { |v| v["yanked"] }.
+            map { |v| version_class.new(v.fetch("num")) }
+        end
+
+        def git_dependency?
+          git_commit_checker.git_dependency?
+        end
+
+        def git_subdependency?
+          return false if dependency.top_level?
+
+          !version_class.correct?(dependency.version)
+        end
+
+        def path_dependency?
+          sources = dependency.requirements.
+                    map { |r| r.fetch(:source) }.uniq.compact
+
+          raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+
+          sources.first&.fetch(:type) == "path"
+        end
+
+        def git_commit_checker
+          @git_commit_checker ||=
+            GitCommitChecker.new(
+              dependency: dependency,
+              credentials: credentials
+            )
+        end
+
+        def crates_listing
+          return @crates_listing unless @crates_listing.nil?
+
+          response = Excon.get(
+            "https://crates.io/api/v1/crates/#{dependency.name}",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          @crates_listing = JSON.parse(response.body)
+        rescue Excon::Error::Timeout
+          retrying ||= false
+          raise if retrying
+
+          retrying = true
+          sleep(rand(1.0..5.0)) && retry
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/rust/cargo/file_preparer.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require "toml-rb"
+require "dependabot/dependency_file"
+require "dependabot/file_parsers/rust/cargo"
+require "dependabot/update_checkers/rust/cargo"
+
+module Dependabot
+  module UpdateCheckers
+    module Rust
+      class Cargo
+        # This class takes a set of dependency files and sanitizes them for use
+        # in UpdateCheckers::Rust::Cargo.
+        class FilePreparer
+          def initialize(dependency_files:, dependency:,
+                         unlock_requirement: true,
+                         replacement_git_pin: nil,
+                         latest_allowable_version: nil)
+            @dependency_files         = dependency_files
+            @dependency               = dependency
+            @unlock_requirement       = unlock_requirement
+            @replacement_git_pin      = replacement_git_pin
+            @latest_allowable_version = latest_allowable_version
+          end
+
+          def prepared_dependency_files
+            files = []
+            files += manifest_files.map do |file|
+              DependencyFile.new(
+                name: file.name,
+                content: manifest_content_for_update_check(file),
+                directory: file.directory
+              )
+            end
+            files << lockfile if lockfile
+            files << toolchain if toolchain
+            files
+          end
+
+          private
+
+          attr_reader :dependency_files, :dependency, :replacement_git_pin,
+                      :latest_allowable_version
+
+          def unlock_requirement?
+            @unlock_requirement
+          end
+
+          def replace_git_pin?
+            !replacement_git_pin.nil?
+          end
+
+          def manifest_content_for_update_check(file)
+            content = file.content
+
+            unless file.support_file?
+              content = replace_version_constraint(content, file.name)
+              content = replace_git_pin(content) if replace_git_pin?
+            end
+
+            content = replace_ssh_urls(content)
+
+            content
+          end
+
+          # Note: We don't need to care about formatting in this method, since
+          # we're only using the manifest to find the latest resolvable version
+          def replace_version_constraint(content, filename)
+            parsed_manifest = TomlRB.parse(content)
+
+            FileParsers::Rust::Cargo::DEPENDENCY_TYPES.each do |type|
+              next unless (req = parsed_manifest.dig(type, dependency.name))
+
+              updated_req = temporary_requirement_for_resolution(filename)
+
+              if req.is_a?(Hash)
+                parsed_manifest[type][dependency.name]["version"] = updated_req
+              else
+                parsed_manifest[type][dependency.name] = updated_req
+              end
+            end
+
+            TomlRB.dump(parsed_manifest)
+          end
+
+          def replace_git_pin(content)
+            parsed_manifest = TomlRB.parse(content)
+
+            FileParsers::Rust::Cargo::DEPENDENCY_TYPES.each do |type|
+              next unless (req = parsed_manifest.dig(type, dependency.name))
+              next unless req.is_a?(Hash)
+              next unless [req["tag"], req["rev"]].compact.uniq.count == 1
+
+              if req["tag"]
+                parsed_manifest[type][dependency.name]["tag"] =
+                  replacement_git_pin
+              end
+
+              if req["rev"]
+                parsed_manifest[type][dependency.name]["rev"] =
+                  replacement_git_pin
+              end
+            end
+
+            TomlRB.dump(parsed_manifest)
+          end
+
+          def replace_ssh_urls(content)
+            parsed_manifest = TomlRB.parse(content)
+
+            FileParsers::Rust::Cargo::DEPENDENCY_TYPES.each do |type|
+              (parsed_manifest[type] || {}).each do |_, details|
+                next unless details.is_a?(Hash)
+                next unless details["git"]
+
+                details["git"] = details["git"].
+                                 gsub(%r{ssh://git@(.*?)/}, 'https://\1/')
+              end
+            end
+
+            TomlRB.dump(parsed_manifest)
+          end
+
+          def temporary_requirement_for_resolution(filename)
+            original_req = dependency.requirements.
+                           find { |r| r.fetch(:file) == filename }&.
+                           fetch(:requirement)
+
+            lower_bound_req =
+              if original_req && !unlock_requirement?
+                original_req
+              else
+                ">= #{lower_bound_version}"
+              end
+
+            unless Utils::Rust::Version.correct?(latest_allowable_version) &&
+                   Utils::Rust::Version.new(latest_allowable_version) >=
+                   Utils::Rust::Version.new(lower_bound_version)
+              return lower_bound_req
+            end
+
+            lower_bound_req + ", <= #{latest_allowable_version}"
+          end
+
+          def lower_bound_version
+            @lower_bound_version ||=
+              if git_dependency? && git_dependency_version
+                git_dependency_version
+              elsif !git_dependency? && dependency.version
+                dependency.version
+              else
+                version_from_requirement =
+                  dependency.requirements.map { |r| r.fetch(:requirement) }.
+                  compact.
+                  flat_map { |req_str| Utils::Rust::Requirement.new(req_str) }.
+                  flat_map(&:requirements).
+                  reject { |req_array| req_array.first.start_with?("<") }.
+                  map(&:last).
+                  max&.to_s
+
+                version_from_requirement || 0
+              end
+          end
+
+          def git_dependency_version
+            return unless lockfile
+
+            TomlRB.parse(lockfile.content).
+              fetch("package", []).
+              select { |p| p["name"] == dependency.name }.
+              find { |p| p["source"].end_with?(dependency.version) }.
+              fetch("version")
+          end
+
+          def manifest_files
+            @manifest_files ||=
+              dependency_files.select { |f| f.name.end_with?("Cargo.toml") }
+
+            raise "No Cargo.toml!" if @manifest_files.none?
+
+            @manifest_files
+          end
+
+          def lockfile
+            @lockfile ||= dependency_files.find { |f| f.name == "Cargo.lock" }
+          end
+
+          def toolchain
+            @toolchain ||=
+              dependency_files.find { |f| f.name == "rust-toolchain" }
+          end
+
+          def git_dependency?
+            GitCommitChecker.
+              new(dependency: dependency, credentials: []).
+              git_dependency?
+          end
+        end
+      end
+    end
+  end
+end