dependabot-core 0.76.1

data/lib/bundler_definition_bundler_version_patch.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require "bundler/definition"
+
+# Ignore the Bundler version specified in the Gemfile (since the only Bundler
+# version available to us is the one we're using).
+module Bundler
+  class Definition
+    def expanded_dependencies
+      @expanded_dependencies ||=
+        expand_dependencies(dependencies + metadata_dependencies, @remote).
+        reject { |d| d.name == "bundler" }
+    end
+  end
+end

data/lib/bundler_definition_ruby_version_patch.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module BundlerDefinitionRubyVersionPatch
+  def index
+    @index ||= super.tap do
+      if ruby_version
+        requested_version = ruby_version.to_gem_version_with_patchlevel
+        sources.metadata_source.specs <<
+          Gem::Specification.new("ruby\0", requested_version)
+      end
+    end
+  end
+end
+Bundler::Definition.prepend(BundlerDefinitionRubyVersionPatch)

data/lib/bundler_git_source_patch.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Source
+    class Git
+      class GitProxy
+        private
+
+        # Bundler allows ssh authentication when talking to GitHub but there's
+        # no way for Dependabot to do so (it doesn't have any ssh keys).
+        # Instead, we convert all `git@github.com:` URLs to use HTTPS.
+        def configured_uri_for(uri)
+          uri = uri.gsub(/git@(.*?):/, 'https://\1/')
+          if uri.match?(/https?:/)
+            remote = URI(uri)
+            config_auth =
+              Bundler.settings[remote.to_s] || Bundler.settings[remote.host]
+            remote.userinfo ||= config_auth
+            remote.to_s
+          else
+            uri
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+module Dependabot
+end

data/lib/dependabot/clients/bitbucket.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "dependabot/shared_helpers"
+require "excon"
+
+module Dependabot
+  module Clients
+    class Bitbucket
+      class NotFound < StandardError; end
+
+      #######################
+      # Constructor methods #
+      #######################
+
+      def self.for_bitbucket_dot_org(credentials:)
+        credential =
+          credentials.
+          select { |cred| cred["type"] == "git_source" }.
+          find { |cred| cred["host"] == "bitbucket.org" }
+
+        new(credential)
+      end
+
+      ##########
+      # Client #
+      ##########
+
+      def initialize(credentials)
+        @credentials = credentials
+      end
+
+      def fetch_commit(repo, branch)
+        path = "#{repo}/refs/branches/#{branch}"
+        response = get(base_url + path)
+
+        JSON.parse(response.body).fetch("target").fetch("hash")
+      end
+
+      def fetch_default_branch(repo)
+        response = get(base_url + repo)
+
+        JSON.parse(response.body).fetch("mainbranch").fetch("name")
+      end
+
+      def fetch_repo_contents(repo, commit = nil, path = nil)
+        raise "Commit is required if path provided!" if commit.nil? && path
+
+        api_path = "#{repo}/src"
+        api_path += "/#{commit}" if commit
+        api_path += "/#{path.gsub(%r{/+$}, '')}" if path
+        api_path += "?pagelen=100"
+        response = get(base_url + api_path)
+
+        JSON.parse(response.body).fetch("values")
+      end
+
+      def fetch_file_contents(repo, commit, path)
+        path = "#{repo}/src/#{commit}/#{path.gsub(%r{/+$}, '')}"
+        response = get(base_url + path)
+
+        response.body
+      end
+
+      def tags(repo)
+        path = "#{repo}/refs/tags?pagelen=100"
+        response = get(base_url + path)
+
+        JSON.parse(response.body).fetch("values")
+      end
+
+      def compare(repo, previous_tag, new_tag)
+        path = "#{repo}/commits/?include=#{new_tag}&exclude=#{previous_tag}"
+        response = get(base_url + path)
+
+        JSON.parse(response.body).fetch("values")
+      end
+
+      def get(url)
+        response = Excon.get(
+          url,
+          user: credentials&.fetch("username"),
+          password: credentials&.fetch("password"),
+          idempotent: true,
+          **SharedHelpers.excon_defaults
+        )
+        raise NotFound if response.status == 404
+
+        response
+      end
+
+      private
+
+      attr_reader :credentials
+
+      def base_url
+        # TODO: Make this configurable when we support enterprise Bitbucket
+        "https://api.bitbucket.org/2.0/repositories/"
+      end
+    end
+  end
+end

data/lib/dependabot/clients/github_with_retries.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "octokit"
+
+module Dependabot
+  module Clients
+    class GithubWithRetries
+      DEFAULT_CLIENT_ARGS = {
+        connection_options: {
+          request: {
+            open_timeout: 2,
+            timeout: 5
+          }
+        }
+      }.freeze
+
+      RETRYABLE_ERRORS = [
+        Faraday::ConnectionFailed,
+        Faraday::TimeoutError,
+        Octokit::InternalServerError,
+        Octokit::BadGateway
+      ].freeze
+
+      #######################
+      # Constructor methods #
+      #######################
+
+      def self.for_source(source:, credentials:)
+        access_tokens =
+          credentials.
+          select { |cred| cred["type"] == "git_source" }.
+          select { |cred| cred["host"] == source.hostname }.
+          map { |cred| cred.fetch("password") }
+
+        new(
+          access_tokens: access_tokens,
+          api_endpoint: source.api_endpoint
+        )
+      end
+
+      def self.for_github_dot_com(credentials:)
+        access_tokens =
+          credentials.
+          select { |cred| cred["type"] == "git_source" }.
+          select { |cred| cred["host"] == "github.com" }.
+          map { |cred| cred.fetch("password") }
+
+        new(access_tokens: access_tokens)
+      end
+
+      #################
+      # VCS Interface #
+      #################
+
+      def fetch_commit(repo, branch)
+        ref(repo, "heads/#{branch}").object.sha
+      end
+
+      def fetch_default_branch(repo)
+        repository(repo).default_branch
+      end
+
+      ############
+      # Proxying #
+      ############
+
+      def initialize(max_retries: 1, **args)
+        args = DEFAULT_CLIENT_ARGS.merge(args)
+
+        access_tokens = args.delete(:access_tokens) || []
+        access_tokens << args[:access_token] if args[:access_token]
+        access_tokens << nil if access_tokens.empty?
+        access_tokens.uniq!
+
+        @max_retries = max_retries || 1
+        @clients = access_tokens.map do |token|
+          Octokit::Client.new(args.merge(access_token: token))
+        end
+      end
+
+      def method_missing(method_name, *args, &block)
+        untried_clients = @clients.dup
+        client = untried_clients.pop
+
+        begin
+          retry_connection_failures do
+            if client.respond_to?(method_name)
+              mutatable_args = args.map(&:dup)
+              client.public_send(method_name, *mutatable_args, &block)
+            else
+              super
+            end
+          end
+        rescue Octokit::NotFound, Octokit::Unauthorized, Octokit::Forbidden
+          raise unless (client = untried_clients.pop)
+
+          retry
+        end
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        @clients.first.respond_to?(method_name) || super
+      end
+
+      def retry_connection_failures
+        retry_attempt = 0
+
+        begin
+          yield
+        rescue *RETRYABLE_ERRORS
+          retry_attempt += 1
+          retry_attempt <= @max_retries ? retry : raise
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/clients/gitlab.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "gitlab"
+
+module Dependabot
+  module Clients
+    class Gitlab
+      #######################
+      # Constructor methods #
+      #######################
+
+      def self.for_source(source:, credentials:)
+        access_token =
+          credentials.
+          select { |cred| cred["type"] == "git_source" }.
+          find { |cred| cred["host"] == source.hostname }&.
+          fetch("password")
+
+        new(
+          endpoint: source.api_endpoint,
+          private_token: access_token || ""
+        )
+      end
+
+      def self.for_gitlab_dot_com(credentials:)
+        access_token =
+          credentials.
+          select { |cred| cred["type"] == "git_source" }.
+          find { |cred| cred["host"] == "gitlab.com" }&.
+          fetch("password")
+
+        new(
+          endpoint: "https://gitlab.com/api/v4",
+          private_token: access_token || ""
+        )
+      end
+
+      #################
+      # VCS Interface #
+      #################
+
+      def fetch_commit(repo, branch)
+        branch(repo, branch).commit.id
+      end
+
+      def fetch_default_branch(repo)
+        project(repo).default_branch
+      end
+
+      ############
+      # Proxying #
+      ############
+
+      def initialize(**args)
+        @client = ::Gitlab::Client.new(args)
+      end
+
+      def method_missing(method_name, *args, &block)
+        if @client.respond_to?(method_name)
+          mutatable_args = args.map(&:dup)
+          @client.public_send(method_name, *mutatable_args, &block)
+        else
+          super
+        end
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        @client.respond_to?(method_name) || super
+      end
+    end
+  end
+end

data/lib/dependabot/dependency.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Dependabot
+  class Dependency
+    attr_reader :name, :version, :requirements, :package_manager,
+                :previous_version, :previous_requirements
+
+    def initialize(name:, requirements:, package_manager:, version: nil,
+                   previous_version: nil, previous_requirements: nil)
+      @name = name
+      @version = version
+      @requirements = requirements.map { |req| symbolize_keys(req) }
+      @previous_version = previous_version
+      @previous_requirements =
+        previous_requirements&.map { |req| symbolize_keys(req) }
+      @package_manager = package_manager
+
+      check_values
+    end
+
+    def top_level?
+      requirements.any?
+    end
+
+    def to_h
+      {
+        "name" => name,
+        "version" => version,
+        "requirements" => requirements,
+        "previous_version" => previous_version,
+        "previous_requirements" => previous_requirements,
+        "package_manager" => package_manager
+      }
+    end
+
+    def appears_in_lockfile?
+      previous_version || (version && previous_requirements.nil?)
+    end
+
+    # rubocop:disable Metrics/CyclomaticComplexity
+    # rubocop:disable Metrics/PerceivedComplexity
+    def production?
+      return true unless top_level?
+
+      groups = requirements.flat_map { |r| r.fetch(:groups).map(&:to_s) }
+
+      case package_manager
+      when "hex" then groups.empty? || groups.any? { |g| g.include?("prod") }
+      when "npm_and_yarn"
+        groups.include?("optionalDependencies") ||
+          groups.include?("dependencies")
+      when "composer" then groups.include?("runtime")
+      when "pip"
+        groups.empty? ||
+          groups.include?("default") ||
+          groups.include?("dependencies")
+      when "bundler"
+        groups.empty? ||
+          groups.include?("runtime") ||
+          groups.include?("default") ||
+          groups.any? { |g| g.include?("prod") }
+      else true
+      end
+    end
+    # rubocop:enable Metrics/CyclomaticComplexity
+    # rubocop:enable Metrics/PerceivedComplexity
+
+    def display_name
+      return name unless %w(maven gradle).include?(package_manager)
+
+      name.split(":").last
+    end
+
+    def ==(other)
+      other.instance_of?(self.class) && to_h == other.to_h
+    end
+
+    def hash
+      to_h.hash
+    end
+
+    def eql?(other)
+      self.==(other)
+    end
+
+    private
+
+    def check_values
+      if [version, previous_version].any? { |v| v == "" }
+        raise ArgumentError, "blank strings must not be provided as versions"
+      end
+
+      requirement_fields = [requirements, previous_requirements].compact
+      unless requirement_fields.all? { |r| r.is_a?(Array) } &&
+             requirement_fields.flatten.all? { |r| r.is_a?(Hash) }
+        raise ArgumentError, "requirements must be an array of hashes"
+      end
+
+      required_keys = %i(requirement file groups source)
+      optional_keys = %i(metadata)
+      unless requirement_fields.flatten.
+             all? { |r| required_keys.sort == (r.keys - optional_keys).sort }
+        raise ArgumentError, "each requirement must have the following "\
+                             "required keys: #{required_keys.join(', ')}."\
+                             "Optionally, it may have the following keys: "\
+                             "#{optional_keys.join(', ')}."
+      end
+
+      return if requirement_fields.flatten.none? { |r| r[:requirement] == "" }
+
+      raise ArgumentError, "blank strings must not be provided as requirements"
+    end
+
+    def symbolize_keys(hash)
+      Hash[hash.keys.map { |k| [k.to_sym, hash[k]] }]
+    end
+  end
+end