dependabot-go_modules 0.154.3 → 0.156.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91f4a2a6a8b3b8379aac02c33906653c2c417d2a60f04458e37a76b45d649864
-  data.tar.gz: b0326bdf06a8d32321d8883947f4d81537ab183d8a56b8e83f9af08ae15e20c5
+  metadata.gz: d3bb56b6afd1bb95fd441662d261a227449a4ed3de7af71c6ff2ec24a9a5ca28
+  data.tar.gz: 8f460e17cb519c6c4b402203daede24179e40bf4b8f54783eb7f880f4b1c4ae3
 SHA512:
-  metadata.gz: 41697b9f2bbf40a022d5f944e722ccafb2de8f657ea807cc96e2d174f631d6c7ece1ddd47b1f5f82399677948ee3bf9a42cb4a374e6572024e18dfb4d1a75211
-  data.tar.gz: 3fd772a52ddc630b59e7e92d3f84f3f248cd289908ed5159de576e4f796152396da60720071f00eefdaecb547a9212aa350236d4ab2740d014a98ae71f165d25
+  metadata.gz: f7a3735400081c65d3188b02a777c60828e2a291c9297b8210565a0ac7a3f7cb1f83f5523d7c7cf51b8021d9051fd4aa9ddd368b728f0f206ef0646187b4f410
+  data.tar.gz: 2c1528d8978402e7b9fbd995e11624408cd2b7ec6c144e7aa344f8cb8e5e0a5181fb2950e671a9bf38b38e12e482792f2ad2028ea51033e77cb608e01e1f08ec

data/lib/dependabot/go_modules/update_checker.rb

@@ -24,14 +24,7 @@ module Dependabot
           return version_class.new(dependency.version)
         end
 
-        @latest_resolvable_version ||=
-          LatestVersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: raise_on_ignored
-          ).latest_version
+        latest_version_finder.latest_version
       end
 
       # This is currently used to short-circuit latest_resolvable_version,
@@ -41,6 +34,22 @@ module Dependabot
         latest_resolvable_version
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        unless dependency.top_level?
+          return unless dependency.version
+
+          return version_class.new(dependency.version)
+        end
+
+        lowest_security_fix_version
+      end
+
+      def lowest_security_fix_version
+        latest_version_finder.lowest_security_fix_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Go modules uses a single dependency file
         nil
@@ -54,6 +63,18 @@ module Dependabot
 
       private
 
+      def latest_version_finder
+        @latest_version_finder ||=
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            raise_on_ignored: raise_on_ignored
+          )
+      end
+
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Go (yet)
         false

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -3,6 +3,7 @@
 require "excon"
 
 require "dependabot/go_modules/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
@@ -23,11 +24,12 @@ module Dependabot
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false)
+                       ignored_versions:, security_advisories:, raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
         end
 
@@ -35,9 +37,13 @@ module Dependabot
           @latest_version ||= fetch_latest_version
         end
 
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
         private
 
-        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions
+        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version
           return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
@@ -49,6 +55,19 @@ module Dependabot
           candidate_versions.max
         end
 
+        def fetch_lowest_security_fix_version
+          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+
+          relevant_versions = available_versions
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+          relevant_versions = filter_lower_versions(relevant_versions)
+
+          relevant_versions.min
+        end
+
         def available_versions
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.154.3
+  version: 0.156.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-21 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement