dependabot-go_modules 0.211.0 → 0.213.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2fd2d0b1e09d48b7bea41af75ff0c823f7fa97f3fc428f6961ca09c1f0a7473
-  data.tar.gz: c4c938fd3210c4c84f8e946afc04aacdb4b332099697a52476fab15020f02af4
+  metadata.gz: fa899f6cb84134185a0301e5527097c6ca4508807512764f8f4cd733c45effbb
+  data.tar.gz: 4718f6bf91b3fbd5cf757a4f6de78defd584df38d8a9814be3b10fa236d17cfa
 SHA512:
-  metadata.gz: da1c93d034f2ce7ff361b6f8972a7b8f71f68a29d0f2451bc0a4e5b6a7613d9e8e875f1f4adb6e8c78efe8e8aab11366cbeb43ae472b77205f0bb06ae55cbb14
-  data.tar.gz: f09ef513ea9835d19f85ed2e9fb82076cf1120d39f5bfb35b4a60c8ad1b16ffe01797e85bf648df35540c08312414284dd6fb962e891ab6cab4eddcfec85ec7c
+  metadata.gz: 24fa02bcc6e1f89000adf4405a6efc921e6bd3e0c7f2e92a8771e5fc77d1508034fbcc8efe0d5adebcb0243cd878761944ac1e61d6495206c907888261506a4b
+  data.tar.gz: d6846ea7a5d4c423101fada0f5d4f11024f093e67a9f79ea8d5b3413920a0b6b0f45ec687456d04fd5d120af035b8040e2c2bb6190dfbb88c7e9c94193a2376a

data/lib/dependabot/go_modules/file_fetcher.rb

@@ -47,6 +47,10 @@ module Dependabot
       def go_sum
         @go_sum ||= fetch_file_if_present("go.sum")
       end
+
+      def recurse_submodules_when_cloning?
+        true
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_parser.rb

@@ -12,7 +12,7 @@ require "dependabot/file_parsers/base"
 module Dependabot
   module GoModules
     class FileParser < Dependabot::FileParsers::Base
-      GIT_VERSION_REGEX = /^v\d+\.\d+\.\d+-.*-(?<sha>[0-9a-f]{12})$/.freeze
+      GIT_VERSION_REGEX = /^v\d+\.\d+\.\d+-.*-(?<sha>[0-9a-f]{12})$/
 
       def parse
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
@@ -65,7 +65,7 @@ module Dependabot
             # `go mod edit` works, even if some modules have been `replace`d with
             # a local module that we don't have access to.
             local_replacements.each do |_, stub_path|
-              Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
+              FileUtils.mkdir_p(stub_path)
               FileUtils.touch(File.join(stub_path, "go.mod"))
             end
 
@@ -135,8 +135,8 @@ module Dependabot
         }
       rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
         if e.message == "Cannot detect VCS"
-          msg = e.message + " for #{dep['Path']}. Attempted to detect VCS "\
-                            "because the version looks like a git revision: "\
+          msg = e.message + " for #{dep['Path']}. Attempted to detect VCS " \
+                            "because the version looks like a git revision: " \
                             "#{dep['Version']}"
           raise Dependabot::DependencyFileNotResolvable, msg
         end

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -13,7 +13,7 @@ module Dependabot
       class GoModUpdater
         RESOLVABILITY_ERROR_REGEXES = [
           # The checksum in go.sum does not match the downloaded content
-          /verifying .*: checksum mismatch/.freeze,
+          /verifying .*: checksum mismatch/,
           /go(?: get)?: .*: go.mod has post-v\d+ module path/
         ].freeze
 
@@ -21,19 +21,19 @@ module Dependabot
           /fatal: The remote end hung up unexpectedly/,
           /repository '.+' not found/,
           # (Private) module could not be fetched
-          /go(?: get)?: .*: git (fetch|ls-remote) .*: exit status 128/m.freeze,
+          /go(?: get)?: .*: git (fetch|ls-remote) .*: exit status 128/m,
           # (Private) module could not be found
-          /cannot find module providing package/.freeze,
+          /cannot find module providing package/,
           # Package in module was likely renamed or removed
-          /module .* found \(.*\), but does not contain package/m.freeze,
+          /module .* found \(.*\), but does not contain package/m,
           # Package pseudo-version does not match the version-control metadata
           # https://golang.google.cn/doc/go1.13#version-validation
-          /go(?: get)?: .*: invalid pseudo-version/m.freeze,
+          /go(?: get)?: .*: invalid pseudo-version/m,
           # Package does not exist, has been pulled or cannot be reached due to
           # auth problems with either git or the go proxy
-          /go(?: get)?: .*: unknown revision/m.freeze,
+          /go(?: get)?: .*: unknown revision/m,
           # Package pointing to a proxy that 404s
-          /go(?: get)?: .*: unrecognized import path/m.freeze
+          /go(?: get)?: .*: unrecognized import path/m
         ].freeze
 
         MODULE_PATH_MISMATCH_REGEXES = [
@@ -43,11 +43,11 @@ module Dependabot
         ].freeze
 
         OUT_OF_DISK_REGEXES = [
-          %r{input/output error}.freeze,
-          /no space left on device/.freeze
+          %r{input/output error},
+          /no space left on device/
         ].freeze
 
-        GO_MOD_VERSION = /^go 1\.[\d]+$/.freeze
+        GO_MOD_VERSION = /^go 1\.[\d]+$/
 
         def initialize(dependencies:, credentials:, repo_contents_path:,
                        directory:, options:)
@@ -175,7 +175,7 @@ module Dependabot
           _, stderr, status = Open3.capture3(environment, command)
           handle_subprocess_error(stderr) unless status.success?
         ensure
-          File.delete(tmp_go_file) if File.exist?(tmp_go_file)
+          FileUtils.rm_f(tmp_go_file)
         end
 
         def parse_manifest
@@ -188,9 +188,7 @@ module Dependabot
 
         def in_repo_path(&block)
           SharedHelpers.in_a_temporary_repo_directory(directory, repo_contents_path) do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              block.call
-            end
+            SharedHelpers.with_git_configured(credentials: credentials, &block)
           end
         end
 
@@ -199,7 +197,7 @@ module Dependabot
           # `go get` works, even if some modules have been `replace`d
           # with a local module that we don't have access to.
           stub_paths.each do |stub_path|
-            Dir.mkdir(stub_path) unless Dir.exist?(stub_path)
+            FileUtils.mkdir_p(stub_path)
             FileUtils.touch(File.join(stub_path, "go.mod"))
             FileUtils.touch(File.join(stub_path, "main.go"))
           end

data/lib/dependabot/go_modules/file_updater.rb

@@ -70,7 +70,7 @@ module Dependabot
           dependency_files.each do |file|
             path = File.join(@repo_contents_path, directory, file.name)
             path = Pathname.new(path).expand_path
-            FileUtils.mkdir_p(path.dirname) unless Dir.exist?(path.dirname)
+            FileUtils.mkdir_p(path.dirname)
             File.write(path, file.content)
           end
 

data/lib/dependabot/go_modules/replace_stubber.rb

@@ -17,11 +17,9 @@ module Dependabot
 
       def stub_paths(manifest, directory)
         (manifest["Replace"] || []).
-          map { |r| r["New"]["Path"] }.
-          compact.
+          filter_map { |r| r["New"]["Path"] }.
           select { |p| stub_replace_path?(p, directory) }.
-          map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
-          to_h
+          to_h { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }
       end
 
       private
@@ -44,7 +42,7 @@ module Dependabot
 
       def relative_replacement_path?(path)
         # https://golang.org/ref/mod#go-mod-file-replace
-        path.start_with?("./") || path.start_with?("../")
+        path.start_with?("./", "../")
       end
 
       def module_pathname(directory)

data/lib/dependabot/go_modules/requirement.rb

@@ -12,15 +12,15 @@ require "dependabot/go_modules/version"
 module Dependabot
   module GoModules
     class Requirement < Gem::Requirement
-      WILDCARD_REGEX = /(?:\.|^)[xX*]/.freeze
-      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/.freeze
+      WILDCARD_REGEX = /(?:\.|^)[xX*]/
+      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/
 
       # Override the version pattern to allow a 'v' prefix
       quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
       version_pattern = "v?#{Version::VERSION_PATTERN}"
 
       PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       # Use GoModules::Version rather than Gem::Version to ensure that
       # pre-release versions aren't transformed.

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -3,7 +3,7 @@
 module Dependabot
   module GoModules
     module ResolvabilityErrors
-      GITHUB_REPO_REGEX = %r{github.com/[^:@]*}.freeze
+      GITHUB_REPO_REGEX = %r{github.com/[^:@]*}
 
       def self.handle(message, credentials:, goprivate:)
         mod_path = message.scan(GITHUB_REPO_REGEX).last

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -22,10 +22,10 @@ module Dependabot
           /unrecognized import path/,
           /malformed module path/,
           # (Private) module could not be fetched
-          /module .*: git ls-remote .*: exit status 128/m.freeze
+          /module .*: git ls-remote .*: exit status 128/m
         ].freeze
-        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m.freeze
-        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
+        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m
+        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
 
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:, raise_on_ignored: false,
@@ -52,7 +52,7 @@ module Dependabot
         attr_reader :dependency, :dependency_files, :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version
-          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+          return dependency.version if PSEUDO_VERSION_REGEX.match?(dependency.version)
 
           candidate_versions = available_versions
           candidate_versions = filter_prerelease_versions(candidate_versions)
@@ -62,7 +62,7 @@ module Dependabot
         end
 
         def fetch_lowest_security_fix_version
-          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+          return dependency.version if PSEUDO_VERSION_REGEX.match?(dependency.version)
 
           relevant_versions = available_versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
@@ -110,7 +110,7 @@ module Dependabot
         def handle_subprocess_error(error)
           if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
             ResolvabilityErrors.handle(error.message, credentials: credentials, goprivate: @goprivate)
-          elsif INVALID_VERSION_REGEX =~ error.message
+          elsif INVALID_VERSION_REGEX.match?(error.message)
             raise Dependabot::DependencyFileNotResolvable, error.message
           end
 

data/lib/dependabot/go_modules/version.rb

@@ -13,7 +13,7 @@ module Dependabot
       VERSION_PATTERN = '[0-9]+[0-9a-zA-Z]*(?>\.[0-9a-zA-Z]+)*' \
                         '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
                         '(\+incompatible)?'
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       def self.correct?(version)
         version = version.gsub(/^v/, "") if version.is_a?(String)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.211.0
+  version: 0.213.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-23 00:00:00.000000000 Z
+date: 2022-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
+        version: 0.213.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.213.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.13.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.37.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.37.1
 - !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
+  name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -273,14 +245,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Go modules support for dependabot