dependabot-go_modules 0.154.2 → 0.155.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73c298cca4dd5af16d6655240434cc8c568442b9c924cc1f796bb5ba94913fdb
-  data.tar.gz: cbdbfca7047df18ee416ca85841b31ceb5ef89d86ee280ea21ccdb70e4a45f2c
+  metadata.gz: 4129bd88effbb6a08eef94c1bcf038659b3c625f6663a47b21319f9af8875fb3
+  data.tar.gz: ee8e0cd235120bb93b598da4f1fc8afa22dac9f4460340c64e32debce37caa62
 SHA512:
-  metadata.gz: 9a789ca9b5e70454db4ff51732162f421311376d6d8a263ba2545e028499987e8734838861295d6341aab82874d53613a70de9d6d808b1e9d093760f6e0a8707
-  data.tar.gz: 307f712dee4f8c3a742d980f57b3242bd91e283581dd88b91a451e9ad19d9c08a5ab0029864437a1f5c646fe7140a50f53c61747e2b9c9107a59776a3b0d1025
+  metadata.gz: db522a53f2f73b4bc578290afab334da56a3190956248e1a5d11443d85c142d3d5ce998ebc45bddfc222ddcc2174402d842ae0882a083a7ec3803eeb9ad7293b
+  data.tar.gz: 74ba7c3b473a792525abc934d27c8fffb0227e500b5d62c2428d20683304128024dae0010a316e55e1154b5b80751c4547139400a977055adf5f0adeb44576a0

data/lib/dependabot/go_modules/update_checker.rb

@@ -24,14 +24,7 @@ module Dependabot
           return version_class.new(dependency.version)
         end
 
-        @latest_resolvable_version ||=
-          LatestVersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: raise_on_ignored
-          ).latest_version
+        latest_version_finder.latest_version
       end
 
       # This is currently used to short-circuit latest_resolvable_version,
@@ -41,6 +34,22 @@ module Dependabot
         latest_resolvable_version
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        unless dependency.top_level?
+          return unless dependency.version
+
+          return version_class.new(dependency.version)
+        end
+
+        lowest_security_fix_version
+      end
+
+      def lowest_security_fix_version
+        latest_version_finder.lowest_security_fix_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Go modules uses a single dependency file
         nil
@@ -54,6 +63,18 @@ module Dependabot
 
       private
 
+      def latest_version_finder
+        @latest_version_finder ||=
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            raise_on_ignored: raise_on_ignored
+          )
+      end
+
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Go (yet)
         false

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -3,6 +3,7 @@
 require "excon"
 
 require "dependabot/go_modules/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
@@ -23,11 +24,12 @@ module Dependabot
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false)
+                       ignored_versions:, security_advisories:, raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
         end
 
@@ -35,9 +37,13 @@ module Dependabot
           @latest_version ||= fetch_latest_version
         end
 
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
         private
 
-        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions
+        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version
           return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
@@ -49,6 +55,19 @@ module Dependabot
           candidate_versions.max
         end
 
+        def fetch_lowest_security_fix_version
+          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+
+          relevant_versions = available_versions
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+          relevant_versions = filter_lower_versions(relevant_versions)
+
+          relevant_versions.min
+        end
+
         def available_versions
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.154.2
+  version: 0.155.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-17 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.2
+        version: 0.155.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.2
+        version: 0.155.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement