dependabot-docker 0.300.0 → 0.301.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c21ead3caae95072e60bc021986aa8c7fc31e2f9bdd3b5fa57f9f8ef52d1ebfd
-  data.tar.gz: 12ad6798d7b959267f5a35f57f3592a4e39d1627340eed91fe9bfff3633e33d4
+  metadata.gz: 37204785920957bb707141c90c50146ffcd40e4887f1f005929072af670a2598
+  data.tar.gz: 2a55642c227e765e435c6972b2091585382b4d006957a5c81b7b1b3be89f0851
 SHA512:
-  metadata.gz: b7e9f9aa5113c1f368890084e78d0294c1da12bdbc24b1843e26b0463b2c1ca8e58709fc1dbed90048ce61b94fda06d2efe197b3b794126f4c4205eec5e04b91
-  data.tar.gz: ecfad5e8a00720b52570ed78c4725c05324c734c5a25357b3ca5f783c74a3fe067d15bdc2edf9f339c4619e272fd5ce6f4324c7db1f10728b6d8a8b7be276a62
+  metadata.gz: 0627f3112a1465b0350de6a93e9ed2870ed43f500789f95ee630cb77720167ace0a9c679b888a31bc7f8e70052040a4793ed89798459a458c31cd786fc648a03
+  data.tar.gz: 56d6d3b387a3acaa7db3c4121ccb89593c4fa230a4fa4a6dd587ad42ee848f3c1dc8093cdaf1015b64540709530d6dcb2204359587df761d32564d48c4ae761b

data/lib/dependabot/docker/file_parser.rb

@@ -53,7 +53,6 @@ module Dependabot
         end
 
         manifest_files.each do |file|
-          check_manifest_file_encoding(file)
           dependency_set += workfile_file_dependencies(file)
         end
 
@@ -83,15 +82,6 @@ module Dependabot
         dependency_files.select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
       end
 
-      sig { params(file: Dependabot::DependencyFile).void }
-      def check_manifest_file_encoding(file)
-        return unless file.content&.start_with?("\uFEFF")
-
-        file_path = Pathname.new(file.directory).join(file.name).cleanpath.to_path
-        msg = "The file appears to have been saved with a byte order mark (BOM). This will prevent proper parsing."
-        raise Dependabot::DependencyFileNotParseable.new(file_path, msg)
-      end
-
       sig { params(file: Dependabot::DependencyFile).returns(DependencySet) }
       def workfile_file_dependencies(file)
         dependency_set = DependencySet.new

data/lib/dependabot/docker/version.rb

@@ -47,7 +47,9 @@ module Dependabot
         return false if parsed_version.nil?
 
         release_part, = T.must(parsed_version[:version]).split("_", 2)
-        release_part = Tag.new(T.must(release_part).chomp(".").chomp("-").chomp("_")).numeric_version || parsed_version
+        release_part = Tag.new(T.must(release_part).chomp(".").chomp("-").chomp("_")).numeric_version
+        return false unless release_part
+
         super(release_part.to_s)
       rescue ArgumentError
         # if we can't instantiate a version, it can't be correct

data/lib/dependabot/shared/shared_file_fetcher.rb

@@ -76,7 +76,13 @@ module Dependabot
         @yamlfiles ||= T.let(
           repo_contents(raise_errors: false)
             .select { |f| f.type == "file" && f.name.match?(YAML_REGEXP) }
-            .map { |f| fetch_file_from_host(f.name) },
+            .map do |f|
+              fetched = fetch_file_from_host(f.name)
+              # The YAML parser used doesn't properly handle a byte-order-mark (BOM) and it can cause failures in
+              # unexpected ways.  That BOM is removed here to allow regular updates to proceed.
+              fetched.content = T.must(fetched.content)[1..-1] if fetched.content&.start_with?("\uFEFF")
+              fetched
+            end,
           T.nilable(T::Array[DependencyFile])
         )
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.300.0
+  version: 0.301.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-06 00:00:00.000000000 Z
+date: 2025-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.300.0
+        version: 0.301.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.300.0
+        version: 0.301.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.300.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.301.0
 post_install_message:
 rdoc_options: []
 require_paths: