dependabot-core 0.76.1

data/lib/dependabot/utils/go/requirement.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+################################################################################
+# For more details on Go version constraints, see:                             #
+# - https://github.com/Masterminds/semver                                      #
+# - https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md               #
+################################################################################
+
+require "dependabot/utils/go/version"
+
+module Dependabot
+  module Utils
+    module Go
+      class Requirement < Gem::Requirement
+        WILDCARD_REGEX = /(?:\.|^)[xX*]/.freeze
+        OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/.freeze
+
+        # Override the version pattern to allow a 'v' prefix
+        quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
+        version_pattern = "v?#{Utils::Go::Version::VERSION_PATTERN}"
+
+        PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+
+        # Use Utils::Go::Version rather than Gem::Version to ensure that
+        # pre-release versions aren't transformed.
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::Go::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::Go::Version.new(matches[2])]
+        end
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        def self.requirements_array(requirement_string)
+          return [new(nil)] if requirement_string.nil?
+
+          requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+            new(req_string)
+          end
+        end
+
+        def initialize(*requirements)
+          requirements = requirements.flatten.flat_map do |req_string|
+            req_string.split(",").map do |r|
+              convert_go_constraint_to_ruby_constraint(r.strip)
+            end
+          end
+
+          super(requirements)
+        end
+
+        private
+
+        def convert_go_constraint_to_ruby_constraint(req_string)
+          req_string = req_string
+          req_string = convert_wildcard_characters(req_string)
+
+          if req_string.match?(WILDCARD_REGEX)
+            ruby_range(req_string.gsub(WILDCARD_REGEX, "").gsub(/^[^\d]/, ""))
+          elsif req_string.match?(/^~[^>]/) then convert_tilde_req(req_string)
+          elsif req_string.include?(" - ") then convert_hyphen_req(req_string)
+          elsif req_string.match?(/^[\dv^]/) then convert_caret_req(req_string)
+          elsif req_string.match?(/[<=>]/) then req_string
+          else ruby_range(req_string)
+          end
+        end
+
+        def convert_wildcard_characters(req_string)
+          if req_string.match?(/^[\dv^>~]/)
+            replace_wildcard_in_lower_bound(req_string)
+          elsif req_string.start_with?("<")
+            parts = req_string.split(".")
+            parts.map.with_index do |part, index|
+              next "0" if part.match?(WILDCARD_REGEX)
+              next part.to_i + 1 if parts[index + 1]&.match?(WILDCARD_REGEX)
+
+              part
+            end.join(".")
+          else
+            req_string
+          end
+        end
+
+        def replace_wildcard_in_lower_bound(req_string)
+          after_wildcard = false
+
+          if req_string.start_with?("~")
+            req_string = req_string.gsub(/(?:(?:\.|^)[xX*])(\.[xX*])+/, "")
+          end
+
+          req_string.split(".").
+            map do |part|
+              part.split("-").map.with_index do |p, i|
+                # Before we hit a wildcard we just return the existing part
+                next p unless p.match?(WILDCARD_REGEX) || after_wildcard
+
+                # On or after a wildcard we replace the version part with zero
+                after_wildcard = true
+                i.zero? ? "0" : "a"
+              end.join("-")
+            end.join(".")
+        end
+
+        def convert_tilde_req(req_string)
+          version = req_string.gsub(/^~/, "")
+          parts = version.split(".")
+          parts << "0" if parts.count < 3
+          "~> #{parts.join('.')}"
+        end
+
+        def convert_hyphen_req(req_string)
+          lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+          [">= #{lower_bound}", "<= #{upper_bound}"]
+        end
+
+        def ruby_range(req_string)
+          parts = req_string.split(".")
+
+          # If we have three or more parts then this is an exact match
+          return req_string if parts.count >= 3
+
+          # If we have no parts then the version is completely unlocked
+          return ">= 0" if parts.count.zero?
+
+          # If we have fewer than three parts we do a partial match
+          parts << "0"
+          "~> #{parts.join('.')}"
+        end
+
+        # Note: Dep's caret notation implementation doesn't distinguish between
+        # pre and post-1.0.0 requirements (unlike in JS)
+        def convert_caret_req(req_string)
+          version = req_string.gsub(/^\^?v?/, "")
+          parts = version.split(".")
+          upper_bound = [parts.first.to_i + 1, 0, 0, "a"].map(&:to_s).join(".")
+
+          [">= #{version}", "< #{upper_bound}"]
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/go/shared_helper.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Utils
+    module Go
+      module SharedHelper
+        def self.path
+          project_root = File.join(File.dirname(__FILE__), "../../../..")
+          platform =
+            case RbConfig::CONFIG["arch"]
+            when /linux/ then "linux"
+            when /darwin/ then "darwin"
+            else raise "Invalid platform #{RbConfig::CONFIG['arch']}"
+            end
+          File.join(project_root, "helpers/go/go-helpers.#{platform}64")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/go/version.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+# Go pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
+# converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
+# alteration.
+# Best docs are at https://github.com/Masterminds/semver
+
+module Dependabot
+  module Utils
+    module Go
+      class Version < Gem::Version
+        VERSION_PATTERN = '[0-9]+[0-9a-zA-Z]*(?>\.[0-9a-zA-Z]+)*' \
+                          '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
+                          '(\+incompatible)?'
+        ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+
+        def self.correct?(version)
+          version = version.gsub(/^v/, "") if version.is_a?(String)
+          version = version&.to_s&.split("+")&.first
+          super(version)
+        end
+
+        def initialize(version)
+          @version_string = version.to_s.gsub(/^v/, "")
+          version = version.gsub(/^v/, "") if version.is_a?(String)
+          version = version&.to_s&.split("+")&.first
+          super
+        end
+
+        def inspect # :nodoc:
+          "#<#{self.class} #{@version_string.inspect}>"
+        end
+
+        def to_s
+          @version_string
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/java/requirement.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/java/version"
+
+module Dependabot
+  module Utils
+    module Java
+      class Requirement < Gem::Requirement
+        quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
+        PATTERN_RAW =
+          "\\s*(#{quoted})?\\s*(#{Utils::Java::Version::VERSION_PATTERN})\\s*"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::Java::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::Java::Version.new(matches[2])]
+        end
+
+        def self.requirements_array(requirement_string)
+          split_java_requirement(requirement_string).map do |str|
+            new(str)
+          end
+        end
+
+        def initialize(*requirements)
+          requirements = requirements.flatten.flat_map do |req_string|
+            convert_java_constraint_to_ruby_constraint(req_string)
+          end
+
+          super(requirements)
+        end
+
+        def satisfied_by?(version)
+          version = Utils::Java::Version.new(version.to_s)
+          super
+        end
+
+        private
+
+        def self.split_java_requirement(req_string)
+          req_string.split(/(?<=\]|\)),/).flat_map do |str|
+            next str if str.start_with?("(", "[")
+
+            exacts, *rest = str.split(/,(?=\[|\()/)
+            [*exacts.split(","), *rest]
+          end
+        end
+        private_class_method :split_java_requirement
+
+        def convert_java_constraint_to_ruby_constraint(req_string)
+          return unless req_string
+
+          if self.class.send(:split_java_requirement, req_string).count > 1
+            raise "Can't convert multiple Java reqs to a single Ruby one"
+          end
+
+          if req_string&.include?(",")
+            return convert_java_range_to_ruby_range(req_string)
+          end
+
+          convert_java_equals_req_to_ruby(req_string)
+        end
+
+        def convert_java_range_to_ruby_range(req_string)
+          lower_b, upper_b = req_string.split(",").map(&:strip)
+
+          lower_b =
+            if ["(", "["].include?(lower_b) then nil
+            elsif lower_b.start_with?("(") then "> #{lower_b.sub(/\(\s*/, '')}"
+            else ">= #{lower_b.sub(/\[\s*/, '').strip}"
+            end
+
+          upper_b =
+            if [")", "]"].include?(upper_b) then nil
+            elsif upper_b.end_with?(")") then "< #{upper_b.sub(/\s*\)/, '')}"
+            else "<= #{upper_b.sub(/\s*\]/, '').strip}"
+            end
+
+          [lower_b, upper_b].compact
+        end
+
+        def convert_java_equals_req_to_ruby(req_string)
+          return convert_wildcard_req(req_string) if req_string&.include?("+")
+
+          # If a soft requirement is being used, treat it as an equality matcher
+          return req_string unless req_string&.start_with?("[")
+
+          req_string.gsub(/[\[\]\(\)]/, "")
+        end
+
+        def convert_wildcard_req(req_string)
+          version = req_string.gsub(/(?:\.|^)\+/, "")
+          return ">= 0" if version.empty?
+
+          "~> #{version}.0"
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/java/version.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+# Java versions use dots and dashes when tokenising their versions.
+# Gem::Version converts a "-" to ".pre.", so we override the `to_s` method.
+#
+# See https://maven.apache.org/pom.html#Version_Order_Specification for details.
+
+module Dependabot
+  module Utils
+    module Java
+      class Version < Gem::Version
+        NULL_VALUES = %w(0 final ga).freeze
+        PREFIXED_TOKEN_HIERARCHY = {
+          "." => { qualifier: 1, number: 4 },
+          "-" => { qualifier: 2, number: 3 }
+        }.freeze
+        NAMED_QUALIFIERS_HIERARCHY = {
+          "a" => 1, "alpha"     => 1,
+          "b" => 2, "beta"      => 2,
+          "m" => 3, "milestone" => 3,
+          "rc" => 4, "cr" => 4,
+          "snapshot" => 5,
+          "ga" => 6, "" => 6, "final" => 6,
+          "sp" => 7
+        }.freeze
+        VERSION_PATTERN =
+          '[0-9a-zA-Z]+(?>\.[0-9a-zA-Z]*)*(-[0-9A-Za-z-]*(\.[0-9A-Za-z-]*)*)?'
+        ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+
+        def self.correct?(version)
+          return false if version.nil?
+
+          version.to_s.match?(ANCHORED_VERSION_PATTERN)
+        end
+
+        def initialize(version)
+          @version_string = version.to_s
+          super(version.to_s.tr("_", "-"))
+        end
+
+        def to_s
+          @version_string
+        end
+
+        def prerelease?
+          tokens.any? do |token|
+            next false unless NAMED_QUALIFIERS_HIERARCHY[token]
+
+            NAMED_QUALIFIERS_HIERARCHY[token] < 6
+          end
+        end
+
+        private
+
+        def tokens
+          @tokens ||=
+            begin
+              version = @version_string.to_s.downcase
+              version = fill_tokens(version)
+              version = trim_version(version)
+              split_into_prefixed_tokens(version).map { |t| t[1..-1] }
+            end
+        end
+
+        def <=>(other)
+          version = stringify_version(@version_string)
+          version = fill_tokens(version)
+          version = trim_version(version)
+
+          other_version = stringify_version(other)
+          other_version = fill_tokens(other_version)
+          other_version = trim_version(other_version)
+
+          version, other_version = convert_dates(version, other_version)
+
+          prefixed_tokens = split_into_prefixed_tokens(version)
+          other_prefixed_tokens = split_into_prefixed_tokens(other_version)
+
+          prefixed_tokens, other_prefixed_tokens =
+            pad_for_comparison(prefixed_tokens, other_prefixed_tokens)
+
+          prefixed_tokens.count.times.each do |index|
+            comp = compare_prefixed_token(
+              prefix: prefixed_tokens[index][0],
+              token: prefixed_tokens[index][1..-1] || "",
+              other_prefix: other_prefixed_tokens[index][0],
+              other_token: other_prefixed_tokens[index][1..-1] || ""
+            )
+            return comp unless comp.zero?
+          end
+
+          0
+        end
+
+        def stringify_version(version)
+          version = version.to_s.downcase
+
+          # Not technically correct, but pragmatic
+          version.gsub(/^v(?=\d)/, "")
+        end
+
+        def fill_tokens(version)
+          # Add separators when transitioning from digits to characters
+          version = version.gsub(/(\d)([A-Za-z])/, '\1-\2')
+          version = version.gsub(/([A-Za-z])(\d)/, '\1-\2')
+
+          # Replace empty tokens with 0
+          version = version.gsub(/([\.\-])([\.\-])/, '\10\2')
+          version = version.gsub(/^([\.\-])/, '0\1')
+          version.gsub(/([\.\-])$/, '\10')
+        end
+
+        def trim_version(version)
+          version.split("-").map do |v|
+            parts = v.split(".")
+            parts = parts[0..-2] while NULL_VALUES.include?(parts&.last)
+            parts&.join(".")
+          end.compact.reject(&:empty?).join("-")
+        end
+
+        def convert_dates(version, other_version)
+          default = [version, other_version]
+          return default unless version.match?(/^\d{4}-?\d{2}-?\d{2}$/)
+          return default unless other_version.match?(/^\d{4}-?\d{2}-?\d{2}$/)
+
+          [version.delete("-"), other_version.delete("-")]
+        end
+
+        def split_into_prefixed_tokens(version)
+          ".#{version}".split(/(?=[\-\.])/)
+        end
+
+        def pad_for_comparison(prefixed_tokens, other_prefixed_tokens)
+          prefixed_tokens = prefixed_tokens.dup
+          other_prefixed_tokens = other_prefixed_tokens.dup
+
+          longest = [prefixed_tokens, other_prefixed_tokens].max_by(&:count)
+          shortest = [prefixed_tokens, other_prefixed_tokens].min_by(&:count)
+
+          longest.count.times do |index|
+            next unless shortest[index].nil?
+
+            shortest[index] = longest[index].start_with?(".") ? ".0" : "-"
+          end
+
+          [prefixed_tokens, other_prefixed_tokens]
+        end
+
+        def compare_prefixed_token(prefix:, token:, other_prefix:, other_token:)
+          token_type = token.match?(/^\d+$/) ? :number : :qualifier
+          other_token_type = other_token.match?(/^\d+$/) ? :number : :qualifier
+
+          hierarchy = PREFIXED_TOKEN_HIERARCHY.fetch(prefix).fetch(token_type)
+          other_hierarchy =
+            PREFIXED_TOKEN_HIERARCHY.fetch(other_prefix).fetch(other_token_type)
+
+          hierarchy_comparison = hierarchy <=> other_hierarchy
+          return hierarchy_comparison unless hierarchy_comparison.zero?
+
+          compare_token(token: token, other_token: other_token)
+        end
+
+        def compare_token(token:, other_token:)
+          if (token_hierarchy = NAMED_QUALIFIERS_HIERARCHY[token])
+            return -1 unless NAMED_QUALIFIERS_HIERARCHY[other_token]
+
+            return token_hierarchy <=> NAMED_QUALIFIERS_HIERARCHY[other_token]
+          end
+
+          return 1 if NAMED_QUALIFIERS_HIERARCHY[other_token]
+
+          token = token.to_i if token.match?(/^\d+$/)
+          other_token = other_token.to_i if other_token.match?(/^\d+$/)
+          token <=> other_token
+        end
+      end
+    end
+  end
+end