dependabot-go_modules 0.212.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a4dc6858676aa3f1b955c586842f791cb99b2685f6c4c1254481bef52e4fcd3
-  data.tar.gz: e1d58699f368c4d17982156b7a485cf5c7ce10c261abb1754f832dbbec9f0b0d
+  metadata.gz: 5825bfefc09a4e3ef05bf5286f52f1de9825c0d7ffd3e34b3281c67847b67bc4
+  data.tar.gz: 2eedaaa966c5b7d76e09ee6dc2747a2f3e02b169391de945f3ea8a78a0dbd73b
 SHA512:
-  metadata.gz: c24e914689efc47b2bf3faffd11cef23f9b0f07804a79d90177aa7e5600b7dd8666316330d7e13e3d4efb489a2082d53837e9baeb4a4bdc3c148603fe2554d65
-  data.tar.gz: b019db2774816b9f78d687494ad12ee3119aef1158e63acf31df12cce09f4baca7f58763d61d578216930d612576070dd23cef788424ed6c873e5f7f392360ad
+  metadata.gz: 5bf996465ae67751493da4cb2fd27c9db2a128551e41328be4cdd5ee654f373d8b2938d9449dada9c7e5eae9c2f203a6d6367cb9de66d4c4c9e7cc21bdecb5af
+  data.tar.gz: 48873014f7eaf642d5010e449fa04081eca67e0d7dc039f1687476dddf152a514cbd21c0ff1b73ad720eecd0d9bca3012104657f6708f86c52391cdb0793bf74

data/lib/dependabot/go_modules/file_fetcher.rb

@@ -47,6 +47,10 @@ module Dependabot
       def go_sum
         @go_sum ||= fetch_file_if_present("go.sum")
       end
+
+      def recurse_submodules_when_cloning?
+        true
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_parser.rb

@@ -12,7 +12,7 @@ require "dependabot/file_parsers/base"
 module Dependabot
   module GoModules
     class FileParser < Dependabot::FileParsers::Base
-      GIT_VERSION_REGEX = /^v\d+\.\d+\.\d+-.*-(?<sha>[0-9a-f]{12})$/.freeze
+      GIT_VERSION_REGEX = /^v\d+\.\d+\.\d+-.*-(?<sha>[0-9a-f]{12})$/
 
       def parse
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
@@ -135,6 +135,9 @@ module Dependabot
         }
       rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
         if e.message == "Cannot detect VCS"
+          # if the dependency is locally replaced, this is not a fatal error
+          return { type: "default", source: dep["Path"] } if dependency_has_local_replacement(dep)
+
           msg = e.message + " for #{dep['Path']}. Attempted to detect VCS " \
                             "because the version looks like a git revision: " \
                             "#{dep['Version']}"
@@ -179,6 +182,18 @@ module Dependabot
         end
         false
       end
+
+      def dependency_has_local_replacement(details)
+        if manifest["Replace"]
+          has_local_replacement = manifest["Replace"].find do |replace|
+            replace["New"]["Path"].start_with?("./", "../") &&
+              replace["Old"]["Path"] == details["Path"]
+          end
+
+          return true if has_local_replacement
+        end
+        false
+      end
     end
   end
 end

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -13,7 +13,7 @@ module Dependabot
       class GoModUpdater
         RESOLVABILITY_ERROR_REGEXES = [
           # The checksum in go.sum does not match the downloaded content
-          /verifying .*: checksum mismatch/.freeze,
+          /verifying .*: checksum mismatch/,
           /go(?: get)?: .*: go.mod has post-v\d+ module path/
         ].freeze
 
@@ -21,19 +21,19 @@ module Dependabot
           /fatal: The remote end hung up unexpectedly/,
           /repository '.+' not found/,
           # (Private) module could not be fetched
-          /go(?: get)?: .*: git (fetch|ls-remote) .*: exit status 128/m.freeze,
+          /go(?: get)?: .*: git (fetch|ls-remote) .*: exit status 128/m,
           # (Private) module could not be found
-          /cannot find module providing package/.freeze,
+          /cannot find module providing package/,
           # Package in module was likely renamed or removed
-          /module .* found \(.*\), but does not contain package/m.freeze,
+          /module .* found \(.*\), but does not contain package/m,
           # Package pseudo-version does not match the version-control metadata
           # https://golang.google.cn/doc/go1.13#version-validation
-          /go(?: get)?: .*: invalid pseudo-version/m.freeze,
+          /go(?: get)?: .*: invalid pseudo-version/m,
           # Package does not exist, has been pulled or cannot be reached due to
           # auth problems with either git or the go proxy
-          /go(?: get)?: .*: unknown revision/m.freeze,
+          /go(?: get)?: .*: unknown revision/m,
           # Package pointing to a proxy that 404s
-          /go(?: get)?: .*: unrecognized import path/m.freeze
+          /go(?: get)?: .*: unrecognized import path/m
         ].freeze
 
         MODULE_PATH_MISMATCH_REGEXES = [
@@ -43,11 +43,11 @@ module Dependabot
         ].freeze
 
         OUT_OF_DISK_REGEXES = [
-          %r{input/output error}.freeze,
-          /no space left on device/.freeze
+          %r{input/output error},
+          /no space left on device/
         ].freeze
 
-        GO_MOD_VERSION = /^go 1\.[\d]+$/.freeze
+        GO_MOD_VERSION = /^go 1\.[\d]+$/
 
         def initialize(dependencies:, credentials:, repo_contents_path:,
                        directory:, options:)

data/lib/dependabot/go_modules/requirement.rb

@@ -12,15 +12,15 @@ require "dependabot/go_modules/version"
 module Dependabot
   module GoModules
     class Requirement < Gem::Requirement
-      WILDCARD_REGEX = /(?:\.|^)[xX*]/.freeze
-      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/.freeze
+      WILDCARD_REGEX = /(?:\.|^)[xX*]/
+      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/
 
       # Override the version pattern to allow a 'v' prefix
       quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
       version_pattern = "v?#{Version::VERSION_PATTERN}"
 
       PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       # Use GoModules::Version rather than Gem::Version to ensure that
       # pre-release versions aren't transformed.

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -3,7 +3,7 @@
 module Dependabot
   module GoModules
     module ResolvabilityErrors
-      GITHUB_REPO_REGEX = %r{github.com/[^:@]*}.freeze
+      GITHUB_REPO_REGEX = %r{github.com/[^:@]*}
 
       def self.handle(message, credentials:, goprivate:)
         mod_path = message.scan(GITHUB_REPO_REGEX).last

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -22,10 +22,10 @@ module Dependabot
           /unrecognized import path/,
           /malformed module path/,
           # (Private) module could not be fetched
-          /module .*: git ls-remote .*: exit status 128/m.freeze
+          /module .*: git ls-remote .*: exit status 128/m
         ].freeze
-        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m.freeze
-        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
+        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m
+        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
 
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:, raise_on_ignored: false,
@@ -143,10 +143,10 @@ module Dependabot
         end
 
         def filter_lower_versions(versions_array)
-          return versions_array unless dependency.version && version_class.correct?(dependency.version)
+          return versions_array unless dependency.numeric_version
 
           versions_array.
-            select { |version| version > version_class.new(dependency.version) }
+            select { |version| version > dependency.numeric_version }
         end
 
         def filter_ignored_versions(versions_array)
@@ -162,9 +162,8 @@ module Dependabot
         def wants_prerelease?
           @wants_prerelease ||=
             begin
-              current_version = dependency.version
-              current_version && version_class.correct?(current_version) &&
-                version_class.new(current_version).prerelease?
+              current_version = dependency.numeric_version
+              current_version&.prerelease?
             end
         end
 

data/lib/dependabot/go_modules/update_checker.rb

@@ -21,7 +21,7 @@ module Dependabot
         unless dependency.top_level?
           return unless dependency.version
 
-          return version_class.new(dependency.version)
+          return current_version
         end
 
         latest_version_finder.latest_version
@@ -40,7 +40,7 @@ module Dependabot
         unless dependency.top_level?
           return unless dependency.version
 
-          return version_class.new(dependency.version)
+          return current_version
         end
 
         lowest_security_fix_version

data/lib/dependabot/go_modules/version.rb

@@ -13,7 +13,7 @@ module Dependabot
       VERSION_PATTERN = '[0-9]+[0-9a-zA-Z]*(?>\.[0-9a-zA-Z]+)*' \
                         '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
                         '(\+incompatible)?'
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       def self.correct?(version)
         version = version.gsub(/^v/, "") if version.is_a?(String)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.212.0
+  version: 0.214.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-06 00:00:00.000000000 Z
+date: 2022-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,42 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.14.2
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -287,14 +245,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Go modules support for dependabot