dependabot-go_modules 0.238.0 → 0.240.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aafc8c6dc3de357f6dd46215df056d9ed63c9a06ae75d6d9348dbed9475acc4c
-  data.tar.gz: 3acd7132da5d9bd135a2d98325bed9b9f9062726f2435d0aac4112f2152cae2b
+  metadata.gz: 529ab6a43cd91b307fc18e1e33f3de1d69c5ac312b975277d007c3b8cbc92c02
+  data.tar.gz: 036bd9736ad3510a1687838c1e1b2cb3ac997a0d255ff447cf81603f89148984
 SHA512:
-  metadata.gz: 31c804033f042f08f0d46ad68a6608f9393c123d9b48f45da499df7cd746188c425fa424ccb78ac6147c8a96b8cf588f60cb5a62d2d15c11ed0f646ef70e1ea4
-  data.tar.gz: 71974b91e0f8dacaf930a4e79ad727b8cacc6eb1c48c18715ce85c63a0101829ff3efcb4764e773b488d8ae08dba90aa9e296dd93a52669dde66e04f7c26188b
+  metadata.gz: b0172d9f2438553394fd84169561e6c0385d89c8c46d689cd6bdf8c9da8d56b865a2dbef84ee2e4f19e2f52170e0526329585e3292a33846ff1494a45a49554a
+  data.tar.gz: 9b2fc02ce1900450f28d73412c898424d0e3ab8219e683f0cda8095e7185ffd332967158a0bfb553c923452a093736c79b3db11b22aecbace032f1113e7302ae

data/helpers/build

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 

data/lib/dependabot/go_modules/file_fetcher.rb

@@ -20,8 +20,6 @@ module Dependabot
       end
 
       def ecosystem_versions
-        return nil unless go_mod
-
         {
           package_managers: {
             "gomod" => go_mod.content.match(/^go\s(\d+\.\d+)/)&.captures&.first || "unknown"
@@ -37,14 +35,6 @@ module Dependabot
           directory,
           clone_repo_contents
         ) do
-          unless go_mod
-            raise(
-              Dependabot::DependencyFileNotFound,
-              Pathname.new(File.join(directory, "go.mod"))
-                      .cleanpath.to_path
-            )
-          end
-
           fetched_files = [go_mod]
           # Fetch the (optional) go.sum
           fetched_files << go_sum if go_sum

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -5,7 +5,6 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/logger"
 require "dependabot/go_modules/file_updater"
-require "dependabot/go_modules/native_helpers"
 require "dependabot/go_modules/replace_stubber"
 require "dependabot/go_modules/resolvability_errors"
 
@@ -250,7 +249,7 @@ module Dependabot
           write_go_mod(body)
         end
 
-        def handle_subprocess_error(stderr) # rubocop:disable Metrics/AbcSize
+        def handle_subprocess_error(stderr)
           stderr = stderr.gsub(Dir.getwd, "")
 
           # Package version doesn't match the module major version
@@ -265,10 +264,7 @@ module Dependabot
           end
 
           repo_error_regex = REPO_RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
-          if repo_error_regex
-            error_message = filter_error_message(message: stderr, regex: repo_error_regex)
-            ResolvabilityErrors.handle(error_message, goprivate: @goprivate)
-          end
+          ResolvabilityErrors.handle(stderr, goprivate: @goprivate) if repo_error_regex
 
           path_regex = MODULE_PATH_MISMATCH_REGEXES.find { |r| stderr =~ r }
           if path_regex

data/lib/dependabot/go_modules/file_updater.rb

@@ -84,6 +84,7 @@ module Dependabot
           SharedHelpers.with_git_configured(credentials: []) do
             `git config --global user.email "no-reply@github.com"`
             `git config --global user.name "Dependabot"`
+            `git config --global init.defaultBranch "placeholder-default-branch"`
             `git init .`
             `git add .`
             `git commit -m'fake repo_contents_path'`

data/lib/dependabot/go_modules/requirement.rb

@@ -7,12 +7,17 @@
 # - https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md               #
 ################################################################################
 
+require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/utils"
 require "dependabot/go_modules/version"
 
 module Dependabot
   module GoModules
-    class Requirement < Gem::Requirement
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
       WILDCARD_REGEX = /(?:\.|^)[xX*]/
       OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|{2}/
 
@@ -40,6 +45,7 @@ module Dependabot
 
       # Returns an array of requirements. At least one requirement from the
       # returned array must be satisfied for a version to be valid.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
       def self.requirements_array(requirement_string)
         return [new(nil)] if requirement_string.nil?
 

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -8,7 +8,9 @@ module Dependabot
 
       def self.handle(message, goprivate:)
         mod_path = message.scan(GITHUB_REPO_REGEX).last
-        raise Dependabot::DependencyFileNotResolvable, message unless mod_path
+        unless mod_path && message.include?("If this is a private repository")
+          raise Dependabot::DependencyFileNotResolvable, message
+        end
 
         # Module not found on github.com - query for _any_ version to know if it
         # doesn't exist (or is private) or we were just given a bad revision by this manifest

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -25,7 +25,10 @@ module Dependabot
           # (Private) module could not be fetched
           /module .*: git ls-remote .*: exit status 128/m
         ].freeze
-        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m
+        # The module was retracted from the proxy
+        # OR the version of Go required is greater than what Dependabot supports
+        # OR other go.mod version errors
+        INVALID_VERSION_REGEX = /(go: loading module retractions for)|(version "[^"]+" invalid)/m
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
 
         def initialize(dependency:, dependency_files:, credentials:,
@@ -111,17 +114,7 @@ module Dependabot
           retry_count += 1
           retry if transitory_failure?(e) && retry_count < 2
 
-          handle_subprocess_error(e)
-        end
-
-        def handle_subprocess_error(error)
-          if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
-            ResolvabilityErrors.handle(error.message, goprivate: @goprivate)
-          elsif INVALID_VERSION_REGEX.match?(error.message)
-            raise Dependabot::DependencyFileNotResolvable, error.message
-          end
-
-          raise
+          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
         end
 
         def transitory_failure?(error)

data/lib/dependabot/go_modules/update_checker.rb

@@ -5,7 +5,6 @@ require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
-require "dependabot/go_modules/native_helpers"
 require "dependabot/go_modules/version"
 
 module Dependabot

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.238.0
+  version: 0.240.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-07 00:00:00.000000000 Z
+date: 2024-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.240.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.240.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -206,6 +206,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.18'
+- !ruby/object:Gem::Dependency
+  name: webrick
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
 description: Dependabot-Go_Modules provides support for bumping Go Modules versions
   via Dependabot. If you want support for multiple package managers, you probably
   want the meta-gem dependabot-omnibus.
@@ -239,7 +253,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.240.0
 post_install_message: 
 rdoc_options: []
 require_paths: