dependabot-go_modules 0.239.0 → 0.240.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10eb41f98ea1a9ad7102bf60c006aa650e5c62a67e360a4c0e3319bd5a122e2b
-  data.tar.gz: eb7260afc262b3ff8873df1ba601f20c98a4f732065c175b584b89d55b4f7bcd
+  metadata.gz: 529ab6a43cd91b307fc18e1e33f3de1d69c5ac312b975277d007c3b8cbc92c02
+  data.tar.gz: 036bd9736ad3510a1687838c1e1b2cb3ac997a0d255ff447cf81603f89148984
 SHA512:
-  metadata.gz: 172d7f7de572fe7d54984c3184ff817ba21505020d0126a437eae851d3d9fccce38e6abfdc030b4efc820ecac0031cd161ff459d169bafa190158fb8926ea18d
-  data.tar.gz: 7baaab1827185336b53b44b6f760ae5b59dfa9bdaddb6e99a7fab9e838846d3eab51dc705f1c3b8e487a0a941ffcdaed22333e4fa74b87651b5a7ea830e4d113
+  metadata.gz: b0172d9f2438553394fd84169561e6c0385d89c8c46d689cd6bdf8c9da8d56b865a2dbef84ee2e4f19e2f52170e0526329585e3292a33846ff1494a45a49554a
+  data.tar.gz: 9b2fc02ce1900450f28d73412c898424d0e3ab8219e683f0cda8095e7185ffd332967158a0bfb553c923452a093736c79b3db11b22aecbace032f1113e7302ae

data/lib/dependabot/go_modules/file_fetcher.rb

@@ -20,8 +20,6 @@ module Dependabot
       end
 
       def ecosystem_versions
-        return nil unless go_mod
-
         {
           package_managers: {
             "gomod" => go_mod.content.match(/^go\s(\d+\.\d+)/)&.captures&.first || "unknown"
@@ -37,14 +35,6 @@ module Dependabot
           directory,
           clone_repo_contents
         ) do
-          unless go_mod
-            raise(
-              Dependabot::DependencyFileNotFound,
-              Pathname.new(File.join(directory, "go.mod"))
-                      .cleanpath.to_path
-            )
-          end
-
           fetched_files = [go_mod]
           # Fetch the (optional) go.sum
           fetched_files << go_sum if go_sum

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -249,7 +249,7 @@ module Dependabot
           write_go_mod(body)
         end
 
-        def handle_subprocess_error(stderr) # rubocop:disable Metrics/AbcSize
+        def handle_subprocess_error(stderr)
           stderr = stderr.gsub(Dir.getwd, "")
 
           # Package version doesn't match the module major version
@@ -264,10 +264,7 @@ module Dependabot
           end
 
           repo_error_regex = REPO_RESOLVABILITY_ERROR_REGEXES.find { |r| stderr =~ r }
-          if repo_error_regex
-            error_message = filter_error_message(message: stderr, regex: repo_error_regex)
-            ResolvabilityErrors.handle(error_message, goprivate: @goprivate)
-          end
+          ResolvabilityErrors.handle(stderr, goprivate: @goprivate) if repo_error_regex
 
           path_regex = MODULE_PATH_MISMATCH_REGEXES.find { |r| stderr =~ r }
           if path_regex

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -8,7 +8,9 @@ module Dependabot
 
       def self.handle(message, goprivate:)
         mod_path = message.scan(GITHUB_REPO_REGEX).last
-        raise Dependabot::DependencyFileNotResolvable, message unless mod_path
+        unless mod_path && message.include?("If this is a private repository")
+          raise Dependabot::DependencyFileNotResolvable, message
+        end
 
         # Module not found on github.com - query for _any_ version to know if it
         # doesn't exist (or is private) or we were just given a bad revision by this manifest

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -25,7 +25,10 @@ module Dependabot
           # (Private) module could not be fetched
           /module .*: git ls-remote .*: exit status 128/m
         ].freeze
-        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m
+        # The module was retracted from the proxy
+        # OR the version of Go required is greater than what Dependabot supports
+        # OR other go.mod version errors
+        INVALID_VERSION_REGEX = /(go: loading module retractions for)|(version "[^"]+" invalid)/m
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
 
         def initialize(dependency:, dependency_files:, credentials:,
@@ -111,17 +114,7 @@ module Dependabot
           retry_count += 1
           retry if transitory_failure?(e) && retry_count < 2
 
-          handle_subprocess_error(e)
-        end
-
-        def handle_subprocess_error(error)
-          if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
-            ResolvabilityErrors.handle(error.message, goprivate: @goprivate)
-          elsif INVALID_VERSION_REGEX.match?(error.message)
-            raise Dependabot::DependencyFileNotResolvable, error.message
-          end
-
-          raise
+          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
         end
 
         def transitory_failure?(error)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.239.0
+  version: 0.240.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-28 00:00:00.000000000 Z
+date: 2024-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.239.0
+        version: 0.240.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.239.0
+        version: 0.240.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -206,6 +206,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.18'
+- !ruby/object:Gem::Dependency
+  name: webrick
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
 description: Dependabot-Go_Modules provides support for bumping Go Modules versions
   via Dependabot. If you want support for multiple package managers, you probably
   want the meta-gem dependabot-omnibus.
@@ -239,7 +253,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.240.0
 post_install_message: 
 rdoc_options: []
 require_paths: