dependabot-core 0.76.1

data/lib/dependabot/utils/java_script/requirement.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/java_script/version"
+
+module Dependabot
+  module Utils
+    module JavaScript
+      class Requirement < Gem::Requirement
+        AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/.freeze
+        OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/.freeze
+
+        # Override the version pattern to allow a 'v' prefix
+        quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
+        version_pattern = "v?#{Gem::Version::VERSION_PATTERN}"
+
+        PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::JavaScript::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::JavaScript::Version.new(matches[2])]
+        end
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        def self.requirements_array(requirement_string)
+          return [new(nil)] if requirement_string.nil?
+
+          # Removing parentheses is technically wrong but they are extremely
+          # rarely used.
+          # TODO: Handle complicated parenthesised requirements
+          requirement_string = requirement_string.gsub(/[()]/, "")
+          requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+            requirements = req_string.strip.split(AND_SEPARATOR)
+            new(requirements)
+          end
+        end
+
+        def initialize(*requirements)
+          requirements = requirements.flatten.flat_map do |req_string|
+            convert_js_constraint_to_ruby_constraint(req_string)
+          end
+
+          super(requirements)
+        end
+
+        private
+
+        # rubocop:disable Metrics/PerceivedComplexity
+        def convert_js_constraint_to_ruby_constraint(req_string)
+          return req_string if req_string.match?(/^([A-Za-uw-z]|v[^\d])/)
+
+          req_string = req_string.gsub(/(?:\.|^)[xX*]/, "")
+
+          if req_string.empty? then ">= 0"
+          elsif req_string.start_with?("~") then convert_tilde_req(req_string)
+          elsif req_string.start_with?("^") then convert_caret_req(req_string)
+          elsif req_string.include?(" - ") then convert_hyphen_req(req_string)
+          elsif req_string.match?(/[<>]/) then req_string
+          else ruby_range(req_string)
+          end
+        end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        def convert_tilde_req(req_string)
+          version = req_string.gsub(/^~\>?/, "")
+          parts = version.split(".")
+          parts << "0" if parts.count < 3
+          "~> #{parts.join('.')}"
+        end
+
+        def convert_hyphen_req(req_string)
+          lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+          [">= #{lower_bound}", "<= #{upper_bound}"]
+        end
+
+        def ruby_range(req_string)
+          parts = req_string.split(".")
+          # If we have three or more parts then this is an exact match
+          return req_string if parts.count >= 3
+
+          # If we have fewer than three parts we do a partial match
+          parts << "0"
+          "~> #{parts.join('.')}"
+        end
+
+        def convert_caret_req(req_string)
+          version = req_string.gsub(/^\^/, "")
+          parts = version.split(".")
+          parts = parts.fill(0, parts.length...3)
+          first_non_zero = parts.find { |d| d != "0" }
+          first_non_zero_index =
+            first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          upper_bound = parts.map.with_index do |part, i|
+            if i < first_non_zero_index then part
+            elsif i == first_non_zero_index then (part.to_i + 1).to_s
+            elsif i > first_non_zero_index && i == 2 then "0.a"
+            else 0
+            end
+          end.join(".")
+
+          [">= #{version}", "< #{upper_bound}"]
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/java_script/version.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+# JavaScript pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
+# converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
+# alteration.
+#
+# See https://semver.org/ for details of node's version syntax.
+
+module Dependabot
+  module Utils
+    module JavaScript
+      class Version < Gem::Version
+        def self.correct?(version)
+          version = version.gsub(/^v/, "") if version.is_a?(String)
+          super(version)
+        end
+
+        def initialize(version)
+          @version_string = version.to_s
+          version = version.gsub(/^v/, "") if version.is_a?(String)
+          super
+        end
+
+        def to_s
+          @version_string
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/php/requirement.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/php/version"
+
+module Dependabot
+  module Utils
+    module Php
+      class Requirement < Gem::Requirement
+        AND_SEPARATOR =
+          /(?<=[a-zA-Z0-9*])(?<!\sas)[\s,]+(?![\s,]*[|-]|as)/.freeze
+        OR_SEPARATOR = /(?<=[a-zA-Z0-9*])[\s,]*\|\|?\s*/.freeze
+
+        def self.parse(obj)
+          new_obj = obj.gsub(/@\w+/, "").gsub(/[a-z0-9\-_\.]*\sas\s+/i, "")
+          super(new_obj)
+        end
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        def self.requirements_array(requirement_string)
+          requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+            new(req_string)
+          end
+        end
+
+        def initialize(*requirements)
+          requirements =
+            requirements.flatten.
+            flat_map { |req_string| req_string.split(AND_SEPARATOR) }.
+            flat_map { |req| convert_php_constraint_to_ruby_constraint(req) }
+
+          super(requirements)
+        end
+
+        private
+
+        # rubocop:disable Metrics/PerceivedComplexity
+        def convert_php_constraint_to_ruby_constraint(req_string)
+          req_string = req_string.gsub(/v(?=\d)/, "")
+
+          # Return an unlikely version if a dev requirement is specified. This
+          # ensures that the dev-requirement doesn't match anything.
+          return "0-dev-branch-match" if req_string.strip.start_with?("dev-")
+
+          if req_string.start_with?("*") then ">= 0"
+          elsif req_string.include?("*") then convert_wildcard_req(req_string)
+          elsif req_string.match?(/^~[^>]/) then convert_tilde_req(req_string)
+          elsif req_string.start_with?("^") then convert_caret_req(req_string)
+          elsif req_string.match?(/\s-\s/) then convert_hyphen_req(req_string)
+          else req_string
+          end
+        end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        def convert_wildcard_req(req_string)
+          version = req_string.gsub(/^~/, "").gsub(/(?:\.|^)\*/, "")
+          "~> #{version}.0"
+        end
+
+        def convert_tilde_req(req_string)
+          version = req_string.gsub(/^~/, "")
+          "~> #{version}"
+        end
+
+        def convert_caret_req(req_string)
+          version = req_string.gsub(/^\^/, "")
+          parts = version.split(".")
+          first_non_zero = parts.find { |d| d != "0" }
+          first_non_zero_index =
+            first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          upper_bound = parts.map.with_index do |part, i|
+            if i < first_non_zero_index then part
+            elsif i == first_non_zero_index then (part.to_i + 1).to_s
+            else 0
+            end
+          end.join(".")
+
+          [">= #{version}", "< #{upper_bound}"]
+        end
+
+        def convert_hyphen_req(req_string)
+          req_string = req_string
+          lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+          if upper_bound.split(".").count < 3
+            upper_bound_parts = upper_bound.split(".")
+            upper_bound_parts[-1] = (upper_bound_parts[-1].to_i + 1).to_s
+            upper_bound = upper_bound_parts.join(".")
+
+            [">= #{lower_bound}", "< #{upper_bound}"]
+          else
+            [">= #{lower_bound}", "<= #{upper_bound}"]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/php/version.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# PHP pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
+# converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
+# alteration.
+
+module Dependabot
+  module Utils
+    module Php
+      class Version < Gem::Version
+        def initialize(version)
+          @version_string = version.to_s
+          super
+        end
+
+        def to_s
+          @version_string
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/python/requirement.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/python/version"
+
+module Dependabot
+  module Utils
+    module Python
+      class Requirement < Gem::Requirement
+        OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/.freeze
+
+        # Add equality and arbitrary-equality matchers
+        OPS["=="] = ->(v, r) { v == r }
+        OPS["==="] = ->(v, r) { v.to_s == r.to_s }
+
+        quoted = OPS.keys.sort_by(&:length).reverse.
+                 map { |k| Regexp.quote(k) }.join("|")
+        version_pattern = Utils::Python::Version::VERSION_PATTERN
+
+        PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::Python::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::Python::Version.new(matches[2])]
+        end
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        #
+        # NOTE: Or requirements are only valid for Poetry.
+        def self.requirements_array(requirement_string)
+          return [new(nil)] if requirement_string.nil?
+
+          requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+            new(req_string.strip)
+          end
+        end
+
+        def initialize(*requirements)
+          requirements = requirements.flatten.flat_map do |req_string|
+            next if req_string.nil?
+
+            req_string.split(",").map do |r|
+              convert_python_constraint_to_ruby_constraint(r)
+            end
+          end
+
+          super(requirements)
+        end
+
+        def satisfied_by?(version)
+          version = Utils::Python::Version.new(version.to_s)
+          super
+        end
+
+        def exact?
+          return false unless @requirements.size == 1
+
+          %w(= == ===).include?(@requirements[0][0])
+        end
+
+        private
+
+        def convert_python_constraint_to_ruby_constraint(req_string)
+          return nil if req_string.nil?
+          return nil if req_string == "*"
+
+          req_string = req_string.gsub("~=", "~>")
+          req_string = req_string.gsub(/(?<=\d)[<=>].*/, "")
+
+          if req_string.match?(/~[^>]/) then convert_tilde_req(req_string)
+          elsif req_string.start_with?("^") then convert_caret_req(req_string)
+          elsif req_string.include?(".*") then convert_wildcard(req_string)
+          else req_string
+          end
+        end
+
+        # Poetry uses ~ requirements.
+        # https://github.com/sdispater/poetry#tilde-requirements
+        def convert_tilde_req(req_string)
+          version = req_string.gsub(/^~\>?/, "")
+          parts = version.split(".")
+          parts << "0" if parts.count < 3
+          "~> #{parts.join('.')}"
+        end
+
+        # Poetry uses ^ requirements
+        # https://github.com/sdispater/poetry#caret-requirement
+        def convert_caret_req(req_string)
+          version = req_string.gsub(/^\^/, "")
+          parts = version.split(".")
+          parts = parts.fill(0, parts.length...3)
+          first_non_zero = parts.find { |d| d != "0" }
+          first_non_zero_index =
+            first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          upper_bound = parts.map.with_index do |part, i|
+            if i < first_non_zero_index then part
+            elsif i == first_non_zero_index then (part.to_i + 1).to_s
+            elsif i > first_non_zero_index && i == 2 then "0.a"
+            else 0
+            end
+          end.join(".")
+
+          [">= #{version}", "< #{upper_bound}"]
+        end
+
+        def convert_wildcard(req_string)
+          # Note: This isn't perfect. It replaces the "!= 1.0.*" case with
+          # "!= 1.0.0". There's no way to model this correctly in Ruby :'(
+          req_string.
+            split(".").
+            first(req_string.split(".").index("*") + 1).
+            join(".").
+            tr("*", "0").
+            gsub(/^(?<!!)=*/, "~>")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/python/version.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+# Python versions can include a local version identifier, which Ruby can't
+# parser. This class augments Gem::Version with local version identifier info.
+# See https://www.python.org/dev/peps/pep-0440 for details.
+
+module Dependabot
+  module Utils
+    module Python
+      class Version < Gem::Version
+        attr_reader :local_version
+
+        VERSION_PATTERN = '[0-9]+[0-9a-zA-Z]*(?>\.[0-9a-zA-Z]+)*' \
+                          '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
+                          '(\+[0-9a-zA-Z]+(\.[0-9a-zA-Z]+)*)?'
+        ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+
+        def self.correct?(version)
+          return false if version.nil?
+
+          version.to_s.match?(ANCHORED_VERSION_PATTERN)
+        end
+
+        def initialize(version)
+          @version_string = version.to_s
+          version, @local_version = version.split("+")
+          version ||= ""
+          version = normalise_prerelease(version)
+          if @local_version
+            @local_version = normalise_prerelease(@local_version)
+          end
+          super
+        end
+
+        def to_s
+          @version_string
+        end
+
+        def inspect # :nodoc:
+          "#<#{self.class} #{@version_string}>"
+        end
+
+        def <=>(other)
+          version_comparison = super(other)
+          return version_comparison unless version_comparison.zero?
+
+          unless other.is_a?(Utils::Python::Version)
+            return local_version.nil? ? 0 : 1
+          end
+
+          # Local version comparison works differently in Python: `1.0.beta`
+          # compares as greater than `1.0`. To accommodate, we make the
+          # strings the same length before comparing.
+          lhsegments = local_version.to_s.split(".").map(&:downcase)
+          rhsegments = other.local_version.to_s.split(".").map(&:downcase)
+          limit = [lhsegments.count, rhsegments.count].min
+
+          lhs = ["1", *lhsegments.first(limit)].join(".")
+          rhs = ["1", *rhsegments.first(limit)].join(".")
+
+          local_comparison = Gem::Version.new(lhs) <=> Gem::Version.new(rhs)
+
+          return local_comparison unless local_comparison.zero?
+
+          lhsegments.count <=> rhsegments.count
+        end
+
+        private
+
+        def normalise_prerelease(version)
+          # Python has reserved words for release states, which are treated
+          # as equal (e.g., preview, pre and rc).
+          # Further, Python treats dashes as a separator between version
+          # parts and treats the alphabetical characters in strings as the
+          # start of a new version part (so 1.1a2 == 1.1.alpha.2).
+          version.
+            gsub("alpha", "a").
+            gsub("beta", "b").
+            gsub("preview", "rc").
+            gsub("pre", "rc").
+            gsub(/([\d.\-_])c([\d.\-_])?/, '\1rc\2').
+            tr("-", ".").
+            gsub(/(\d)([a-z])/i, '\1.\2')
+        end
+      end
+    end
+  end
+end