dependabot-go_modules 0.138.3 → 0.139.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0359aeb1be27a263692850924f70bf10e521ba9c6e9a9c6ca79c497b0d2717f6'
-  data.tar.gz: 0e70c2cc20154e27b7c6bb6e9b4570db9341160f3839ac55e4029d3e5f40e7e7
+  metadata.gz: 22cf13ec824a1a13bf3540a3f870af253dc18e84d35c88e5029391acfb3d3858
+  data.tar.gz: 8c0711d3e4fae045cbce2331469de2f133e7cef53d4b8ab849920aae8480d59b
 SHA512:
-  metadata.gz: 22ef4a5030e11353bc772976710214d8e6e7aa33d6b09bc8151fe64e8dcf2a3ca61fd3c5971f2fd6f7bd0e38c6e23395647c15c196e56fe09332b1bdf1803010
-  data.tar.gz: aae5d2719556277dabae80a902a591824efa283155f197b9a02b3c445b7aeeabcb9be4940be7aad7dfeea873fe7827e805930d00895aad1d7332a1ce46008791
+  metadata.gz: 3605094cd5a5358af2cdb567b9096fced93039e20c3d11967729b7db972392665a857deadafa930303825f483ff62b7047e107fa655893b5b4ec6bd2000f2ba0
+  data.tar.gz: f9a11a6692dacd6452ed1ed9cb78dfa42f3e66f4795a8fa25b892a88685051818f2e5c62013bb0d8a94fd7956e07e1eee709254547cb7430a411d4b2b4f31196

data/helpers/go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/Masterminds/vcs v1.13.1
 	github.com/dependabot/dependabot-core/go_modules/helpers/updater v0.0.0
 	github.com/dependabot/gomodules-extracted v1.2.0
-	golang.org/x/mod v0.4.1
+	golang.org/x/mod v0.4.2
 )
 
 replace github.com/dependabot/dependabot-core/go_modules/helpers/importresolver => ./importresolver

data/helpers/go.sum

@@ -6,8 +6,8 @@ github.com/dependabot/gomodules-extracted v1.2.0/go.mod h1:3NWkH8KcZVDM87JuZI8hC
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/mod v0.4.1 h1:Kvvh58BN8Y9/lBi7hTekvtMpm07eUZ0ck5pRHpsMWrY=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2 h1:Gz96sIWK3OalVv/I/qNygP42zyoKp3xptRVCWRFEBvo=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -27,6 +27,9 @@ module Dependabot
           /cannot find module providing package/.freeze,
           # Package in module was likely renamed or removed
           /module .* found \(.*\), but does not contain package/m.freeze,
+          # Package pseudo-version does not match the version-control metadata
+          # https://golang.google.cn/doc/go1.13#version-validation
+          /go: .*: invalid pseudo-version/m.freeze,
           # Package does not exist, has been pulled or cannot be reached due to
           # auth problems with either git or the go proxy
           /go: .*: unknown revision/m.freeze
@@ -219,18 +222,12 @@ module Dependabot
         # process afterwards.
         def replace_directive_substitutions(manifest)
           @replace_directive_substitutions ||=
-            begin
-              # Find all the local replacements, and return them with a stub
-              # path we can use in their place. Using generated paths is safer
-              # as it means we don't need to worry about references to parent
-              # directories, etc.
-              (manifest["Replace"] || []).
-                map { |r| r["New"]["Path"] }.
-                compact.
-                select { |p| stub_replace_path?(p) }.
-                map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
-                to_h
-            end
+            (manifest["Replace"] || []).
+            map { |r| r["New"]["Path"] }.
+            compact.
+            select { |p| stub_replace_path?(p) }.
+            map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
+            to_h
         end
 
         # returns true if the provided path should be replaced with a stub
@@ -266,22 +263,20 @@ module Dependabot
           write_go_mod(body)
         end
 
-        # rubocop:disable Metrics/AbcSize
-        # rubocop:disable Metrics/PerceivedComplexity
         def handle_subprocess_error(stderr)
           stderr = stderr.gsub(Dir.getwd, "")
 
           # Package version doesn't match the module major version
           error_regex = RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
           if error_regex
-            lines = stderr.lines.drop_while { |l| error_regex !~ l }
-            raise Dependabot::DependencyFileNotResolvable, lines.join
+            error_message = filter_error_message(message: stderr, regex: error_regex)
+            raise Dependabot::DependencyFileNotResolvable, error_message
           end
 
           repo_error_regex = REPO_RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
           if repo_error_regex
-            lines = stderr.lines.drop_while { |l| repo_error_regex !~ l }
-            ResolvabilityErrors.handle(lines.join, credentials: credentials)
+            error_message = filter_error_message(message: stderr, regex: repo_error_regex)
+            ResolvabilityErrors.handle(error_message, credentials: credentials)
           end
 
           path_regex = MODULE_PATH_MISMATCH_REGEXES.find { |r| stderr =~ r }
@@ -293,16 +288,22 @@ module Dependabot
 
           out_of_disk_regex = OUT_OF_DISK_REGEXES.find { |r| stderr =~ r }
           if out_of_disk_regex
-            lines = stderr.lines.select { |l| out_of_disk_regex =~ l }
-            raise Dependabot::OutOfDisk.new, lines.join
+            error_message = filter_error_message(message: stderr, regex: out_of_disk_regex)
+            raise Dependabot::OutOfDisk.new, error_message
           end
 
           # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
           raise Dependabot::DependabotError, msg
         end
-        # rubocop:enable Metrics/PerceivedComplexity
-        # rubocop:enable Metrics/AbcSize
+
+        def filter_error_message(message:, regex:)
+          lines = message.lines.select { |l| regex =~ l }
+          return lines.join if lines.any?
+
+          # In case the regex is multi-line, match the whole string
+          message.match(regex).to_s
+        end
 
         def go_mod_path
           return "go.mod" if directory == "/"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.138.3
+  version: 0.139.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-24 00:00:00.000000000 Z
+date: 2021-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.138.3
+        version: 0.139.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.138.3
+        version: 0.139.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement