RubyGems - dependabot-go_modules - Versions diffs - 0.308.0 → 0.310.0 - Mend

dependabot-go_modules 0.308.0 → 0.310.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

checksums.yaml +4 -4
data/lib/dependabot/go_modules/package/package_details_fetcher.rb +173 -0
data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb +61 -128
metadata +6 -5

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 781d565e569738ce7a26a085c917036cb61d9491b3b6288cc131a8f8362d20d3
-  data.tar.gz: 4689184ef1f74ee7178c6544e8c10bd53a00c810586a57efd15a59d308cac8df
+  metadata.gz: '0584130933245e950367cb0ccdbbb7f62b3789316c32965452a103b6b705516b'
+  data.tar.gz: b0b12c5d0ce02e625a82aaeeb3503b2afc0c1349598edd97fe32f2be4a8a0947
 SHA512:
-  metadata.gz: 412570a735d8c82f8f77afa163a330798302453ae8f1f9238dc67fdd8866f0da997cd8c3925997df393252f49d2acf476d4d76633ebba861ded4b76b0aae3cab
-  data.tar.gz: 75a08ca3bf310a8aec0658619823960bfd68f141da5e558391e5632db516ee05e2ae4554bd950fc2f3b55f64ff6601b90d3a2b78bcffeb2bf94b566695add1ab
+  metadata.gz: f086a3ba6f21b2532cd2ae8e84db5caf971db67f1d1cc9d566e00c89029c89862408acbcbd08128ea92df162f6d402abc123a5464c5bc6eaff06825edbe00375
+  data.tar.gz: f7f8d638f4e7db951e1faee9ec10e1a0db5c587d21e29e7d46b11002797dfae18ffc20887d456ac37ce77310541e323b3b563c8f81b84488f13981c5e82fbe83

data/lib/dependabot/go_modules/package/package_details_fetcher.rb ADDED Viewed

@@ -0,0 +1,173 @@
+# typed: strict
+# frozen_string_literal: true
+require "excon"
+require "sorbet-runtime"
+require "dependabot/go_modules/update_checker"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+require "dependabot/go_modules/requirement"
+require "dependabot/go_modules/resolvability_errors"
+module Dependabot
+  module GoModules
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+        RESOLVABILITY_ERROR_REGEXES = T.let(
+          [
+            # Package url/proxy doesn't include any redirect meta tags
+            /no go-import meta tags/,
+            # Package url 404s
+            /404 Not Found/,
+            /Repository not found/,
+            /unrecognized import path/,
+            /malformed module path/,
+            # (Private) module could not be fetched
+            /module .*: git ls-remote .*: exit status 128/m
+          ].freeze,
+          T::Array[Regexp]
+        )
+        # The module was retracted from the proxy
+        # OR the version of Go required is greater than what Dependabot supports
+        # OR other go.mod version errors
+        INVALID_VERSION_REGEX = /(go: loading module retractions for)|(version "[^"]+" invalid)/m
+        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            goprivate: String
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, goprivate:)
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @goprivate = T.let(goprivate, String)
+          @source_type = T.let(nil, T.nilable(String))
+        end
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :dependency_files
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :credentials
+        sig { returns(String) }
+        attr_reader :goprivate
+        # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def fetch_available_versions
+          SharedHelpers.in_a_temporary_directory do
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              manifest = parse_manifest
+              # Set up an empty go.mod so 'go list -m' won't attempt to download dependencies. This
+              # appears to be a side effect of operating with modules included in GOPRIVATE. We'll
+              # retain any exclude directives to omit those versions.
+              File.write("go.mod", "module dummy\n")
+              manifest["Exclude"]&.each do |r|
+                SharedHelpers.run_shell_command("go mod edit -exclude=#{r['Path']}@#{r['Version']}")
+              end
+              # Turn off the module proxy for private dependencies
+              env = { "GOPRIVATE" => @goprivate }
+              versions_json = SharedHelpers.run_shell_command(
+                "go list -m -versions -json #{dependency.name}",
+                fingerprint: "go list -m -versions -json <dependency_name>",
+                env: env
+              )
+              version_strings = JSON.parse(versions_json)["Versions"]
+              return [package_release(version: T.must(dependency.version))] if version_strings.nil?
+              version_info = version_strings.select { |v| version_class.correct?(v) }
+                                            .map { |v| version_class.new(v) }
+              package_releases = []
+              version_info.map do |version|
+                package_releases << package_release(
+                  version: version.to_s
+                )
+              end
+              return package_releases
+            end
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          retry_count ||= 0
+          retry_count += 1
+          retry if transitory_failure?(e) && retry_count < 2
+          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
+          [package_release(version: T.must(dependency.version))]
+        end
+        # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity
+        sig { params(error: StandardError).returns(T::Boolean) }
+        def transitory_failure?(error)
+          return true if error.message.include?("EOF")
+          error.message.include?("Internal Server Error")
+        end
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def go_mod
+          @go_mod ||= T.let(dependency_files.find { |f| f.name == "go.mod" }, T.nilable(Dependabot::DependencyFile))
+        end
+        sig do
+          params(
+            version: String
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def package_release(version:)
+          Dependabot::Package::PackageRelease.new(
+            version: GoModules::Version.new(version)
+          )
+        end
+        sig { returns(T::Hash[String, T.untyped]) }
+        def parse_manifest
+          SharedHelpers.in_a_temporary_directory do
+            File.write("go.mod", T.must(go_mod).content)
+            json = SharedHelpers.run_shell_command("go mod edit -json")
+            JSON.parse(json) || {}
+          end
+        end
+        sig { returns(T.class_of(Dependabot::Version)) }
+        def version_class
+          dependency.version_class
+        end
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(Dependabot::Package::PackageDetails)
+        end
+        def package_details(releases)
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: releases.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb CHANGED Viewed

@@ -10,11 +10,13 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
 require "dependabot/go_modules/resolvability_errors"
+require "dependabot/go_modules/package/package_details_fetcher"
+require "dependabot/package/package_latest_version_finder"
 module Dependabot
   module GoModules
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
         RESOLVABILITY_ERROR_REGEXES = T.let(
@@ -67,14 +69,22 @@ module Dependabot
           @goprivate           = goprivate
         end
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def latest_version
-          @latest_version ||= T.let(fetch_latest_version, T.nilable(Dependabot::Version))
+        sig do
+          override.params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+                  .returns(T.nilable(Dependabot::Version))
+        end
+        def latest_version(language_version: nil)
+          @latest_version ||= T.let(fetch_latest_version(language_version: language_version),
+                                    T.nilable(Dependabot::Version))
         end
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def lowest_security_fix_version
-          @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version, T.nilable(Dependabot::Version))
+        sig do
+          override.params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+                  .returns(T.nilable(Dependabot::Version))
+        end
+        def lowest_security_fix_version(language_version: nil)
+          @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version(language_version: language_version),
+                                                 T.nilable(Dependabot::Version))
         end
         private
@@ -94,126 +104,64 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def fetch_latest_version
-          candidate_versions = available_versions
+        sig { returns(String) }
+        attr_reader :goprivate
+        # rubocop:disable Lint/UnusedMethodArgument
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_latest_version(language_version: nil)
+          candidate_versions = available_versions_details
           candidate_versions = filter_prerelease_versions(candidate_versions)
           candidate_versions = filter_ignored_versions(candidate_versions)
           # Adding the psuedo-version to the list to avoid downgrades
-          candidate_versions << version_class.new(dependency.version) if PSEUDO_VERSION_REGEX.match?(dependency.version)
+          if PSEUDO_VERSION_REGEX.match?(dependency.version)
+            candidate_versions << Dependabot::Package::PackageRelease.new(
+              version: GoModules::Version.new(dependency.version)
+            )
+          end
+          candidate_versions.max_by(&:version)&.version
+        end
-          candidate_versions.max
+        sig do
+          override.returns(T.nilable(Dependabot::Package::PackageDetails))
+        end
+        def package_details
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: available_versions_details.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
         end
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def fetch_lowest_security_fix_version
-          relevant_versions = available_versions
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_lowest_security_fix_version(language_version: nil)
+          relevant_versions = available_versions_details
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
                                                                                                     security_advisories)
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
-          relevant_versions.min
-        end
-        sig { returns(T::Array[Dependabot::Version]) }
-        def available_versions
-          @available_versions ||= T.let(fetch_available_versions, T.nilable(T::Array[Dependabot::Version]))
-        end
-        sig { returns(T::Array[Dependabot::Version]) }
-        def fetch_available_versions
-          SharedHelpers.in_a_temporary_directory do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              manifest = parse_manifest
-              # Set up an empty go.mod so 'go list -m' won't attempt to download dependencies. This
-              # appears to be a side effect of operating with modules included in GOPRIVATE. We'll
-              # retain any exclude directives to omit those versions.
-              File.write("go.mod", "module dummy\n")
-              manifest["Exclude"]&.each do |r|
-                SharedHelpers.run_shell_command("go mod edit -exclude=#{r['Path']}@#{r['Version']}")
-              end
-              # Turn off the module proxy for private dependencies
-              env = { "GOPRIVATE" => @goprivate }
-              versions_json = SharedHelpers.run_shell_command(
-                "go list -m -versions -json #{dependency.name}",
-                fingerprint: "go list -m -versions -json <dependency_name>",
-                env: env
-              )
-              version_strings = JSON.parse(versions_json)["Versions"]
-              return [version_class.new(dependency.version)] if version_strings.nil?
-              version_strings.select { |v| version_class.correct?(v) }
-                             .map { |v| version_class.new(v) }
-            end
-          end
-        rescue SharedHelpers::HelperSubprocessFailed => e
-          retry_count ||= 0
-          retry_count += 1
-          retry if transitory_failure?(e) && retry_count < 2
-          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
-        end
-        sig { params(error: StandardError).returns(T::Boolean) }
-        def transitory_failure?(error)
-          return true if error.message.include?("EOF")
-          error.message.include?("Internal Server Error")
+          relevant_versions.min_by(&:version)&.version
         end
+        # rubocop:enable Lint/UnusedMethodArgument
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        def go_mod
-          @go_mod ||= T.let(dependency_files.find { |f| f.name == "go.mod" }, T.nilable(Dependabot::DependencyFile))
-        end
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parse_manifest
-          SharedHelpers.in_a_temporary_directory do
-            File.write("go.mod", T.must(go_mod).content)
-            json = SharedHelpers.run_shell_command("go mod edit -json")
-            JSON.parse(json) || {}
-          end
-        end
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_prerelease_versions(versions_array)
-          return versions_array if wants_prerelease?
-          filtered = versions_array.reject(&:prerelease?)
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
-          end
-          filtered
-        end
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_lower_versions(versions_array)
-          return versions_array unless dependency.numeric_version
-          versions_array
-            .select { |version| version > dependency.numeric_version }
-        end
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_ignored_versions(versions_array)
-          filtered = versions_array
-                     .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
-          if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
-            raise AllVersionsIgnored
-          end
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
-          end
-          filtered
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def available_versions_details
+          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            goprivate: goprivate
+          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
         sig { returns(T::Boolean) }
@@ -226,21 +174,6 @@ module Dependabot
             T.nilable(T::Boolean)
           )
         end
-        sig { returns(T::Array[Dependabot::Requirement]) }
-        def ignore_requirements
-          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
-        end
-        sig { returns(T.class_of(Dependabot::Requirement)) }
-        def requirement_class
-          dependency.requirement_class
-        end
-        sig { returns(T.class_of(Dependabot::Version)) }
-        def version_class
-          dependency.version_class
-        end
       end
     end
   end

metadata CHANGED Viewed

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.308.0
+  version: 0.310.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-12 00:00:00.000000000 Z
+date: 2025-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.310.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.310.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -257,6 +257,7 @@ files:
 - lib/dependabot/go_modules/language.rb
 - lib/dependabot/go_modules/metadata_finder.rb
 - lib/dependabot/go_modules/native_helpers.rb
+- lib/dependabot/go_modules/package/package_details_fetcher.rb
 - lib/dependabot/go_modules/package_manager.rb
 - lib/dependabot/go_modules/path_converter.rb
 - lib/dependabot/go_modules/replace_stubber.rb
@@ -270,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
 rdoc_options: []
 require_paths:
 - lib