dependabot-core 0.76.10 → 0.76.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea5efa14e9bf750844ec81c5566726109c3300827886e530423cdb46dd163d76
-  data.tar.gz: 2649ba3489b8286fe121bb203f6afb012e4856e11911c758a0f6f6e70b066c99
+  metadata.gz: a5a81bf12f28897fd225b92b4e37e0476b0896fcc58685457173f696f3010c44
+  data.tar.gz: b30ff79c7eb025531e5d559270f7f13b06d4a0fd099f478a3019a9ad9fa2fe63
 SHA512:
-  metadata.gz: 3c15ebc60b7ed05e863cd331d8881473a3c8cd191c0e49b8837213231a122ff0fede2fe034b80d1ec16ef68d2baa31e15f2309bc1ff1b8e2c85c911f11797500
-  data.tar.gz: 4f04914e2406c1a48344e3b486c38b5c555eceb1406e5c99335b3961a600803d8d2ec71e2b812435fee08a4c33f3869d24d54cdcb12a94e9d0be445c03c5bbaa
+  metadata.gz: b1379cee6737a8d68f06463024c9793f1db3ffc0750af144e358e717ae8fab08febb492c7ff4638bd8b74980d257cf7ca50d901be33f51e757409dc5ee68c8cc
+  data.tar.gz: 527956ec32bea4528e5868d2168cd9ac5c23331783a8da287393a00b7a669dee2a8cfdb91066bbd315deb93dd23b623c0f4461e2ff177d2eda1bfb33ca7e2f4f

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## v0.76.11, 7 December 2018
+
+- Python: Ignore dependencies that we had to insert a version for
+- JS(npm): Raise helpful errer for forbidden missing deps
+- Gradle: Don't consider dependencies that concatenate properties to build a version
+- Maven: Check distribution type when looking up declaration to update
+
 ## v0.76.10, 6 December 2018
 
 - Cache commit tag lookup in changelog finder

data/helpers/python/lib/parser.py

@@ -92,8 +92,8 @@ def parse_setup(directory):
 
         global fake_open
         def fake_open(*args, **kwargs):
-            content = ("VERSION = (0, 0, 1)\n"
-                       "__version__ = '0.0.1'\n"
+            content = ("VERSION = ('0', '0', '1+dependabot')\n"
+                       "__version__ = '0.0.1+dependabot'\n"
                        "__author__ = 'someone'\n"
                        "__title__ = 'something'\n"
                        "__description__ = 'something'\n"
@@ -113,7 +113,7 @@ def parse_setup(directory):
         content = re.sub(version_re, "", content)
 
         # Set variables likely to be imported
-        __version__ = '0.0.1'
+        __version__ = '0.0.1+dependabot'
         __author__ = 'someone'
         __title__ = 'something'
         __description__ = 'something'

data/lib/dependabot/file_parsers/java/gradle.rb

@@ -175,7 +175,7 @@ module Dependabot
         end
 
         def evaluated_value(value, buildfile)
-          return value unless value.match?(PROPERTY_REGEX)
+          return value unless value.scan(PROPERTY_REGEX).count == 1
 
           property_name  = value.match(PROPERTY_REGEX).
                            named_captures.fetch("property_name")

data/lib/dependabot/file_parsers/python/pip/setup_file_parser.rb

@@ -29,6 +29,10 @@ module Dependabot
               # probably blocked. Ignore it.
               next if dep["markers"].include?("<")
 
+              # If the requirement is our inserted version, ignore it
+              # (we wouldn't be able to update it)
+              next if dep["version"] == "0.0.1+dependabot"
+
               dependencies <<
                 Dependency.new(
                   name: normalised_name(dep["name"]),

data/lib/dependabot/file_updaters/java/maven/declaration_finder.rb

@@ -59,6 +59,7 @@ module Dependabot
               ].compact.join(":")
 
               next false unless node_name == dependency_name
+              next false unless packaging_type_matches?(node)
 
               declaring_requirement_matches?(node)
             end
@@ -99,6 +100,21 @@ module Dependabot
             end
           end
 
+          def packaging_type_matches?(node)
+            type = declaring_requirement.dig(:metadata, :packaging_type)
+            type == packaging_type(node)
+          end
+
+          def packaging_type(dependency_node)
+            return "pom" if dependency_node.child.node_name == "parent"
+            return "jar" unless dependency_node.at_xpath("./*/type")
+
+            packaging_type_content = dependency_node.at_xpath("./*/type").
+                                     content.strip
+
+            evaluated_value(packaging_type_content)
+          end
+
           def evaluated_value(value)
             unless value.match?(FileParsers::Java::Maven::PROPERTY_REGEX)
               return value

data/lib/dependabot/file_updaters/java_script/npm_and_yarn/npm_lockfile_updater.rb

@@ -175,7 +175,7 @@ module Dependabot
                 error.message.match(MISSING_PACKAGE).
                 named_captures["package_req"].
                 split(/(?<=\w)\@/).first
-              handle_missing_package(package_name)
+              handle_missing_package(package_name, error, lockfile)
             end
             names = dependencies.map(&:name)
             if names.any? { |name| error.message.include?("#{name}@") } &&
@@ -209,7 +209,7 @@ module Dependabot
                 error.message.match(FORBIDDEN_PACKAGE).
                 named_captures["package_req"].
                 split(/(?<=\w)\@/).first
-              handle_missing_package(package_name)
+              handle_missing_package(package_name, error, lockfile)
             end
             if error.message.match?(UNREACHABLE_GIT)
               dependency_url =
@@ -232,14 +232,14 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
 
-          def handle_missing_package(package_name)
+          def handle_missing_package(package_name, error, lockfile)
             missing_dep = FileParsers::JavaScript::NpmAndYarn.new(
               dependency_files: dependency_files,
               source: nil,
               credentials: credentials
             ).parse.find { |dep| dep.name == package_name }
 
-            return unless missing_dep
+            raise_resolvability_error(error, lockfile) unless missing_dep
 
             reg = UpdateCheckers::JavaScript::NpmAndYarn::RegistryFinder.new(
               dependency: missing_dep,
@@ -250,13 +250,17 @@ module Dependabot
                            find { |f| f.name.end_with?(".yarnrc") }
             ).registry
 
-            if reg == "registry.npmjs.org" && !package_name.start_with?("@")
-              return
-            end
+            return if central_registry?(reg) && !package_name.start_with?("@")
 
             raise Dependabot::PrivateSourceAuthenticationFailure, reg
           end
 
+          def central_registry?(registry)
+            FileParsers::JavaScript::NpmAndYarn::CENTRAL_REGISTRIES.any? do |r|
+              r.include?(registry)
+            end
+          end
+
           def resolvable_before_update?(lockfile)
             @resolvable_before_update ||= {}
             if @resolvable_before_update.key?(lockfile.name)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.76.10"
+  VERSION = "0.76.11"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-core
 version: !ruby/object:Gem::Version
-  version: 0.76.10
+  version: 0.76.11
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-12-06 00:00:00.000000000 Z
+date: 2018-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr