dependabot-go_modules 0.309.0 → 0.311.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bdfa8f9019ae87b30ca45cc0e0467bb27633e5623d8685b201a73774ff2f6d4
-  data.tar.gz: 85a08d6f45eb27c1385ebc5b6ca13345d20f100035aad79c54daf87e7b7158e9
+  metadata.gz: '087090666b622798f189304a67e8383de5dbeddaaddec1f12ad0d9493310a578'
+  data.tar.gz: c88dfb340497920aefa89a4ba79813755c2a273e1a617205ede0d95f6592d7e2
 SHA512:
-  metadata.gz: '0686f82f561737f48b1e89873e9c20eef7108253829dce89ef5f17c765284740238e461ce5048d8d72e41ed022cca5f03fe39d65ec1f65a4289b0f75abeaef3a'
-  data.tar.gz: 67fd562bd2345704f9ecd90d83674948ca439278563f215c78bf5d2fe68676b5def9cd7b031f8c8fbe262cd6b14528aeb68367a487a7f45fddc136b51247ae39
+  metadata.gz: 8d2f0abb657659d6876e4690d1ec120f6f378e6ba1fd9b193ef8f1cffbc5874726ca8153b0cf652d9d1765ae6fad98ea918e8b45e7dd4eeb6e9e95cf1bdebba2
+  data.tar.gz: 6aaafa90636a7f22b115b36f83ec11a2f271d19c2ffdee3feb7e7842a53f8ccbec4e182334f1948c16aed724e30db733e10950dab4dc52602477ef72f4ac1060

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -0,0 +1,174 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "excon"
+require "sorbet-runtime"
+
+require "dependabot/go_modules/update_checker"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+require "dependabot/go_modules/requirement"
+require "dependabot/go_modules/resolvability_errors"
+
+module Dependabot
+  module GoModules
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        RESOLVABILITY_ERROR_REGEXES = T.let(
+          [
+            # Package url/proxy doesn't include any redirect meta tags
+            /no go-import meta tags/,
+            # Package url 404s
+            /404 Not Found/,
+            /Repository not found/,
+            /unrecognized import path/,
+            /malformed module path/,
+            # (Private) module could not be fetched
+            /module .*: git ls-remote .*: exit status 128/m
+          ].freeze,
+          T::Array[Regexp]
+        )
+        # The module was retracted from the proxy
+        # OR the version of Go required is greater than what Dependabot supports
+        # OR other go.mod version errors
+        INVALID_VERSION_REGEX = /(go: loading module retractions for)|(version "[^"]+" invalid)/m
+        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            goprivate: String
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, goprivate:)
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @goprivate = T.let(goprivate, String)
+
+          @source_type = T.let(nil, T.nilable(String))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :credentials
+
+        sig { returns(String) }
+        attr_reader :goprivate
+
+        # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def fetch_available_versions
+          SharedHelpers.in_a_temporary_directory do
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              manifest = parse_manifest
+
+              # Set up an empty go.mod so 'go list -m' won't attempt to download dependencies. This
+              # appears to be a side effect of operating with modules included in GOPRIVATE. We'll
+              # retain any exclude directives to omit those versions.
+              File.write("go.mod", "module dummy\n")
+              manifest["Exclude"]&.each do |r|
+                SharedHelpers.run_shell_command("go mod edit -exclude=#{r['Path']}@#{r['Version']}")
+              end
+
+              # Turn off the module proxy for private dependencies
+              env = { "GOPRIVATE" => @goprivate }
+
+              versions_json = SharedHelpers.run_shell_command(
+                "go list -m -versions -json #{dependency.name}",
+                fingerprint: "go list -m -versions -json <dependency_name>",
+                env: env
+              )
+              version_strings = JSON.parse(versions_json)["Versions"]
+
+              return [package_release(version: T.must(dependency.version))] if version_strings.nil?
+
+              version_info = version_strings.select { |v| version_class.correct?(v) }
+                                            .map { |version| version }
+
+              package_releases = []
+
+              version_info.map do |version|
+                package_releases << package_release(
+                  version: version
+                )
+              end
+
+              return package_releases
+            end
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          retry_count ||= 0
+          retry_count += 1
+          retry if transitory_failure?(e) && retry_count < 2
+
+          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
+          [package_release(version: T.must(dependency.version))]
+        end
+        # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity
+
+        sig { params(error: StandardError).returns(T::Boolean) }
+        def transitory_failure?(error)
+          return true if error.message.include?("EOF")
+
+          error.message.include?("Internal Server Error")
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
+        def go_mod
+          @go_mod ||= T.let(dependency_files.find { |f| f.name == "go.mod" }, T.nilable(Dependabot::DependencyFile))
+        end
+
+        sig do
+          params(
+            version: String
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def package_release(version:)
+          Dependabot::Package::PackageRelease.new(
+            version: GoModules::Version.new(version),
+            details: { "version_string" => version }
+          )
+        end
+
+        sig { returns(T::Hash[String, T.untyped]) }
+        def parse_manifest
+          SharedHelpers.in_a_temporary_directory do
+            File.write("go.mod", T.must(go_mod).content)
+            json = SharedHelpers.run_shell_command("go mod edit -json")
+
+            JSON.parse(json) || {}
+          end
+        end
+
+        sig { returns(T.class_of(Dependabot::Version)) }
+        def version_class
+          dependency.version_class
+        end
+
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(Dependabot::Package::PackageDetails)
+        end
+        def package_details(releases)
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: releases.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -10,11 +10,13 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
 require "dependabot/go_modules/resolvability_errors"
+require "dependabot/go_modules/package/package_details_fetcher"
+require "dependabot/package/package_latest_version_finder"
 
 module Dependabot
   module GoModules
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
         RESOLVABILITY_ERROR_REGEXES = T.let(
@@ -45,7 +47,8 @@ module Dependabot
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
             goprivate: String,
-            raise_on_ignored: T::Boolean
+            raise_on_ignored: T::Boolean,
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           )
             .void
         end
@@ -56,7 +59,8 @@ module Dependabot
           ignored_versions:,
           security_advisories:,
           goprivate:,
-          raise_on_ignored: false
+          raise_on_ignored: false,
+          cooldown_options: nil
         )
           @dependency          = dependency
           @dependency_files    = dependency_files
@@ -65,16 +69,40 @@ module Dependabot
           @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
           @goprivate           = goprivate
+          @cooldown_options    = cooldown_options
+          super(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            cooldown_options: cooldown_options,
+            raise_on_ignored: raise_on_ignored,
+            options: {}
+          )
+        end
+
+        sig do
+          override.params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+                  .returns(T.nilable(Dependabot::Version))
+        end
+        def latest_version(language_version: nil)
+          @latest_version ||= T.let(fetch_latest_version(language_version: language_version),
+                                    T.nilable(Dependabot::Version))
         end
 
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def latest_version
-          @latest_version ||= T.let(fetch_latest_version, T.nilable(Dependabot::Version))
+        sig do
+          override.params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+                  .returns(T.nilable(Dependabot::Version))
+        end
+        def lowest_security_fix_version(language_version: nil)
+          @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version(language_version: language_version),
+                                                 T.nilable(Dependabot::Version))
         end
 
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def lowest_security_fix_version
-          @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version, T.nilable(Dependabot::Version))
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gomodules)
         end
 
         private
@@ -94,127 +122,144 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def fetch_latest_version
-          candidate_versions = available_versions
-          candidate_versions = filter_prerelease_versions(candidate_versions)
-          candidate_versions = filter_ignored_versions(candidate_versions)
-          # Adding the psuedo-version to the list to avoid downgrades
-          candidate_versions << version_class.new(dependency.version) if PSEUDO_VERSION_REGEX.match?(dependency.version)
+        sig { returns(String) }
+        attr_reader :goprivate
 
-          candidate_versions.max
-        end
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
 
-        sig { returns(T.nilable(Dependabot::Version)) }
-        def fetch_lowest_security_fix_version
-          relevant_versions = available_versions
-          relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
-                                                                                                    security_advisories)
-          relevant_versions = filter_ignored_versions(relevant_versions)
-          relevant_versions = filter_lower_versions(relevant_versions)
-
-          relevant_versions.min
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def available_versions_details
+          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            goprivate: goprivate
+          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
         end
 
-        sig { returns(T::Array[Dependabot::Version]) }
-        def available_versions
-          @available_versions ||= T.let(fetch_available_versions, T.nilable(T::Array[Dependabot::Version]))
+        # rubocop:disable Lint/UnusedMethodArgument
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
         end
+        def fetch_latest_version(language_version: nil)
+          candidate_versions = available_versions_details
+          candidate_versions = filter_prerelease_versions(candidate_versions)
+          candidate_versions = filter_ignored_versions(candidate_versions)
+          candidate_versions = lazy_filter_cooldown_versions(candidate_versions)
+          # Adding the psuedo-version to the list to avoid downgrades
+          if PSEUDO_VERSION_REGEX.match?(dependency.version)
+            candidate_versions << Dependabot::Package::PackageRelease.new(
+              version: GoModules::Version.new(dependency.version)
+            )
+          end
 
-        sig { returns(T::Array[Dependabot::Version]) }
-        def fetch_available_versions
-          SharedHelpers.in_a_temporary_directory do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              manifest = parse_manifest
+          candidate_versions.max_by(&:version)&.version
+        end
 
-              # Set up an empty go.mod so 'go list -m' won't attempt to download dependencies. This
-              # appears to be a side effect of operating with modules included in GOPRIVATE. We'll
-              # retain any exclude directives to omit those versions.
-              File.write("go.mod", "module dummy\n")
-              manifest["Exclude"]&.each do |r|
-                SharedHelpers.run_shell_command("go mod edit -exclude=#{r['Path']}@#{r['Version']}")
-              end
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease], check_max: T::Boolean)
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def lazy_filter_cooldown_versions(releases, check_max: true)
+          return releases unless cooldown_enabled?
+          return releases unless cooldown_options
+
+          Dependabot.logger.info("Initializing cooldown filter")
+
+          sorted_releases = if check_max
+                              releases.sort_by(&:version).reverse
+                            else
+                              releases.sort_by(&:version)
+                            end
+
+          filtered_versions = []
+          cooldown_filtered_versions = 0
+
+          # Iterate through the sorted versions lazily, filtering out cooldown versions
+          sorted_releases.each do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_versions += 1
+              next
+            end
 
-              # Turn off the module proxy for private dependencies
-              env = { "GOPRIVATE" => @goprivate }
+            filtered_versions << release
+            break
+          end
 
-              versions_json = SharedHelpers.run_shell_command(
-                "go list -m -versions -json #{dependency.name}",
-                fingerprint: "go list -m -versions -json <dependency_name>",
-                env: env
-              )
-              version_strings = JSON.parse(versions_json)["Versions"]
+          Dependabot.logger.info("Filtered out #{cooldown_filtered_versions} version(s) due to cooldown")
 
-              return [version_class.new(dependency.version)] if version_strings.nil?
+          filtered_versions
+        end
 
-              version_strings.select { |v| version_class.correct?(v) }
-                             .map { |v| version_class.new(v) }
-            end
+        # rubocop:disable Metrics/AbcSize
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          env = { "GOPRIVATE" => @goprivate }
+
+          begin
+            release_info = SharedHelpers.run_shell_command(
+              "go list -m -json #{dependency.name}@#{release.details.[]('version_string')}",
+              fingerprint: "go list -m -json <dependency_name>",
+              env: env
+            )
+          rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+            Dependabot.logger.info("Error while fetching release date info: #{e.message}")
+            return false
           end
-        rescue SharedHelpers::HelperSubprocessFailed => e
-          retry_count ||= 0
-          retry_count += 1
-          retry if transitory_failure?(e) && retry_count < 2
 
-          ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
-        end
+          release.instance_variable_set(
+            :@released_at, JSON.parse(release_info)["Time"] ? Time.parse(JSON.parse(release_info)["Time"]) : nil
+          )
 
-        sig { params(error: StandardError).returns(T::Boolean) }
-        def transitory_failure?(error)
-          return true if error.message.include?("EOF")
+          return false unless release.released_at
 
-          error.message.include?("Internal Server Error")
-        end
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+          days = cooldown_days_for(current_version, release.version)
 
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        def go_mod
-          @go_mod ||= T.let(dependency_files.find { |f| f.name == "go.mod" }, T.nilable(Dependabot::DependencyFile))
-        end
+          # Calculate the number of seconds passed since the release
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parse_manifest
-          SharedHelpers.in_a_temporary_directory do
-            File.write("go.mod", T.must(go_mod).content)
-            json = SharedHelpers.run_shell_command("go mod edit -json")
-
-            JSON.parse(json) || {}
+          if passed_days < days
+            Dependabot.logger.info("Version #{release.version}, Release date: #{release.released_at}." \
+                                   " Days since release: #{passed_days} (cooldown days: #{days})")
           end
-        end
-
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_prerelease_versions(versions_array)
-          return versions_array if wants_prerelease?
 
-          filtered = versions_array.reject(&:prerelease?)
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
-          end
-          filtered
+          # Check if the release is within the cooldown period
+          passed_seconds < days * DAY_IN_SECONDS
         end
+        # rubocop:enable Metrics/AbcSize
 
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_lower_versions(versions_array)
-          return versions_array unless dependency.numeric_version
-
-          versions_array
-            .select { |version| version > dependency.numeric_version }
+        sig do
+          override.returns(T.nilable(Dependabot::Package::PackageDetails))
+        end
+        def package_details
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: available_versions_details.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
         end
 
-        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
-        def filter_ignored_versions(versions_array)
-          filtered = versions_array
-                     .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
-          if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
-            raise AllVersionsIgnored
-          end
-
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
-          end
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_lowest_security_fix_version(language_version: nil)
+          relevant_versions = available_versions_details
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+          relevant_versions = filter_lower_versions(relevant_versions)
 
-          filtered
+          relevant_versions.min_by(&:version)&.version
         end
+        # rubocop:enable Lint/UnusedMethodArgument
 
         sig { returns(T::Boolean) }
         def wants_prerelease?
@@ -226,21 +271,6 @@ module Dependabot
             T.nilable(T::Boolean)
           )
         end
-
-        sig { returns(T::Array[Dependabot::Requirement]) }
-        def ignore_requirements
-          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
-        end
-
-        sig { returns(T.class_of(Dependabot::Requirement)) }
-        def requirement_class
-          dependency.requirement_class
-        end
-
-        sig { returns(T.class_of(Dependabot::Version)) }
-        def version_class
-          dependency.version_class
-        end
       end
     end
   end

data/lib/dependabot/go_modules/update_checker.rb

@@ -66,6 +66,7 @@ module Dependabot
             ignored_versions: ignored_versions,
             security_advisories: security_advisories,
             raise_on_ignored: raise_on_ignored,
+            cooldown_options: update_cooldown,
             goprivate: options.fetch(:goprivate, "*")
           ),
           T.nilable(Dependabot::GoModules::UpdateChecker::LatestVersionFinder)

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.309.0
+  version: 0.311.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-17 00:00:00.000000000 Z
+date: 2025-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.309.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.309.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -223,16 +223,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Go_Modules provides support for bumping Go Modules versions
   via Dependabot. If you want support for multiple package managers, you probably
   want the meta-gem dependabot-omnibus.
@@ -257,6 +257,7 @@ files:
 - lib/dependabot/go_modules/language.rb
 - lib/dependabot/go_modules/metadata_finder.rb
 - lib/dependabot/go_modules/native_helpers.rb
+- lib/dependabot/go_modules/package/package_details_fetcher.rb
 - lib/dependabot/go_modules/package_manager.rb
 - lib/dependabot/go_modules/path_converter.rb
 - lib/dependabot/go_modules/replace_stubber.rb
@@ -270,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.309.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
 rdoc_options: []
 require_paths:
 - lib