dependabot-go_modules 0.310.0 → 0.311.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0584130933245e950367cb0ccdbbb7f62b3789316c32965452a103b6b705516b'
-  data.tar.gz: b0b12c5d0ce02e625a82aaeeb3503b2afc0c1349598edd97fe32f2be4a8a0947
+  metadata.gz: '087090666b622798f189304a67e8383de5dbeddaaddec1f12ad0d9493310a578'
+  data.tar.gz: c88dfb340497920aefa89a4ba79813755c2a273e1a617205ede0d95f6592d7e2
 SHA512:
-  metadata.gz: f086a3ba6f21b2532cd2ae8e84db5caf971db67f1d1cc9d566e00c89029c89862408acbcbd08128ea92df162f6d402abc123a5464c5bc6eaff06825edbe00375
-  data.tar.gz: f7f8d638f4e7db951e1faee9ec10e1a0db5c587d21e29e7d46b11002797dfae18ffc20887d456ac37ce77310541e323b3b563c8f81b84488f13981c5e82fbe83
+  metadata.gz: 8d2f0abb657659d6876e4690d1ec120f6f378e6ba1fd9b193ef8f1cffbc5874726ca8153b0cf652d9d1765ae6fad98ea918e8b45e7dd4eeb6e9e95cf1bdebba2
+  data.tar.gz: 6aaafa90636a7f22b115b36f83ec11a2f271d19c2ffdee3feb7e7842a53f8ccbec4e182334f1948c16aed724e30db733e10950dab4dc52602477ef72f4ac1060

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -94,13 +94,13 @@ module Dependabot
               return [package_release(version: T.must(dependency.version))] if version_strings.nil?
 
               version_info = version_strings.select { |v| version_class.correct?(v) }
-                                            .map { |v| version_class.new(v) }
+                                            .map { |version| version }
 
               package_releases = []
 
               version_info.map do |version|
                 package_releases << package_release(
-                  version: version.to_s
+                  version: version
                 )
               end
 
@@ -136,7 +136,8 @@ module Dependabot
         end
         def package_release(version:)
           Dependabot::Package::PackageRelease.new(
-            version: GoModules::Version.new(version)
+            version: GoModules::Version.new(version),
+            details: { "version_string" => version }
           )
         end
 

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -47,7 +47,8 @@ module Dependabot
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
             goprivate: String,
-            raise_on_ignored: T::Boolean
+            raise_on_ignored: T::Boolean,
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           )
             .void
         end
@@ -58,7 +59,8 @@ module Dependabot
           ignored_versions:,
           security_advisories:,
           goprivate:,
-          raise_on_ignored: false
+          raise_on_ignored: false,
+          cooldown_options: nil
         )
           @dependency          = dependency
           @dependency_files    = dependency_files
@@ -67,6 +69,17 @@ module Dependabot
           @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
           @goprivate           = goprivate
+          @cooldown_options    = cooldown_options
+          super(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            cooldown_options: cooldown_options,
+            raise_on_ignored: raise_on_ignored,
+            options: {}
+          )
         end
 
         sig do
@@ -87,6 +100,11 @@ module Dependabot
                                                  T.nilable(Dependabot::Version))
         end
 
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gomodules)
+        end
+
         private
 
         sig { returns(Dependabot::Dependency) }
@@ -107,6 +125,19 @@ module Dependabot
         sig { returns(String) }
         attr_reader :goprivate
 
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def available_versions_details
+          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            goprivate: goprivate
+          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+
         # rubocop:disable Lint/UnusedMethodArgument
         sig do
           params(language_version: T.nilable(T.any(String, Dependabot::Version)))
@@ -116,6 +147,7 @@ module Dependabot
           candidate_versions = available_versions_details
           candidate_versions = filter_prerelease_versions(candidate_versions)
           candidate_versions = filter_ignored_versions(candidate_versions)
+          candidate_versions = lazy_filter_cooldown_versions(candidate_versions)
           # Adding the psuedo-version to the list to avoid downgrades
           if PSEUDO_VERSION_REGEX.match?(dependency.version)
             candidate_versions << Dependabot::Package::PackageRelease.new(
@@ -126,6 +158,81 @@ module Dependabot
           candidate_versions.max_by(&:version)&.version
         end
 
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease], check_max: T::Boolean)
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def lazy_filter_cooldown_versions(releases, check_max: true)
+          return releases unless cooldown_enabled?
+          return releases unless cooldown_options
+
+          Dependabot.logger.info("Initializing cooldown filter")
+
+          sorted_releases = if check_max
+                              releases.sort_by(&:version).reverse
+                            else
+                              releases.sort_by(&:version)
+                            end
+
+          filtered_versions = []
+          cooldown_filtered_versions = 0
+
+          # Iterate through the sorted versions lazily, filtering out cooldown versions
+          sorted_releases.each do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_versions += 1
+              next
+            end
+
+            filtered_versions << release
+            break
+          end
+
+          Dependabot.logger.info("Filtered out #{cooldown_filtered_versions} version(s) due to cooldown")
+
+          filtered_versions
+        end
+
+        # rubocop:disable Metrics/AbcSize
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          env = { "GOPRIVATE" => @goprivate }
+
+          begin
+            release_info = SharedHelpers.run_shell_command(
+              "go list -m -json #{dependency.name}@#{release.details.[]('version_string')}",
+              fingerprint: "go list -m -json <dependency_name>",
+              env: env
+            )
+          rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+            Dependabot.logger.info("Error while fetching release date info: #{e.message}")
+            return false
+          end
+
+          release.instance_variable_set(
+            :@released_at, JSON.parse(release_info)["Time"] ? Time.parse(JSON.parse(release_info)["Time"]) : nil
+          )
+
+          return false unless release.released_at
+
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+          days = cooldown_days_for(current_version, release.version)
+
+          # Calculate the number of seconds passed since the release
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
+
+          if passed_days < days
+            Dependabot.logger.info("Version #{release.version}, Release date: #{release.released_at}." \
+                                   " Days since release: #{passed_days} (cooldown days: #{days})")
+          end
+
+          # Check if the release is within the cooldown period
+          passed_seconds < days * DAY_IN_SECONDS
+        end
+        # rubocop:enable Metrics/AbcSize
+
         sig do
           override.returns(T.nilable(Dependabot::Package::PackageDetails))
         end
@@ -154,16 +261,6 @@ module Dependabot
         end
         # rubocop:enable Lint/UnusedMethodArgument
 
-        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
-        def available_versions_details
-          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            goprivate: goprivate
-          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
-        end
-
         sig { returns(T::Boolean) }
         def wants_prerelease?
           @wants_prerelease ||= T.let(

data/lib/dependabot/go_modules/update_checker.rb

@@ -66,6 +66,7 @@ module Dependabot
             ignored_versions: ignored_versions,
             security_advisories: security_advisories,
             raise_on_ignored: raise_on_ignored,
+            cooldown_options: update_cooldown,
             goprivate: options.fetch(:goprivate, "*")
           ),
           T.nilable(Dependabot::GoModules::UpdateChecker::LatestVersionFinder)

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.310.0
+  version: 0.311.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-24 00:00:00.000000000 Z
+date: 2025-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.311.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -223,16 +223,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Go_Modules provides support for bumping Go Modules versions
   via Dependabot. If you want support for multiple package managers, you probably
   want the meta-gem dependabot-omnibus.
@@ -271,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
 rdoc_options: []
 require_paths:
 - lib