dependabot-go_modules 0.310.0 → 0.312.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0584130933245e950367cb0ccdbbb7f62b3789316c32965452a103b6b705516b'
-  data.tar.gz: b0b12c5d0ce02e625a82aaeeb3503b2afc0c1349598edd97fe32f2be4a8a0947
+  metadata.gz: a5ebb159ef51fc8d23107f99d210c922c06c73cd9732883879fd70ddbd058faf
+  data.tar.gz: 6f3a772c98fded0f05c6686bf630b0fc99a20c77735fdce27a7f97a67b16c750
 SHA512:
-  metadata.gz: f086a3ba6f21b2532cd2ae8e84db5caf971db67f1d1cc9d566e00c89029c89862408acbcbd08128ea92df162f6d402abc123a5464c5bc6eaff06825edbe00375
-  data.tar.gz: f7f8d638f4e7db951e1faee9ec10e1a0db5c587d21e29e7d46b11002797dfae18ffc20887d456ac37ce77310541e323b3b563c8f81b84488f13981c5e82fbe83
+  metadata.gz: 2be7417f6af5e4c8cfd98e8290cd530208f58b81b711c1b13a896beafa23a08571208b7edce5519bbdfbe677c4d60bed4ba32778dea9125bedb2221f8d6fbe4d
+  data.tar.gz: ff25c45e98ebf9d436b843d925909bbe0db8c2532b70481d7b3136286cd11602f0f0b71b4b7a76886f01e222204574c16c3d7601261fe9b846a3fc6391b97fdd

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -132,7 +132,7 @@ module Dependabot
         end
 
         sig { returns(T::Hash[Symbol, String]) }
-        def update_files # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
+        def update_files
           in_repo_path do
             # During grouped updates, the dependency_files are from a previous dependency
             # update, so we need to update them on disk after the git reset in in_repo_path.
@@ -143,7 +143,6 @@ module Dependabot
             end
 
             # Map paths in local replace directives to path hashes
-            original_go_mod = File.read("go.mod")
             original_manifest = parse_manifest
             original_go_sum = File.read("go.sum") if File.exist?("go.sum")
 
@@ -175,23 +174,6 @@ module Dependabot
             updated_go_sum = original_go_sum ? File.read("go.sum") : nil
             updated_go_mod = File.read("go.mod")
 
-            # running "go get" may inject the current go version, remove it
-            original_go_version = original_go_mod.match(GO_MOD_VERSION)&.to_a&.first
-            updated_go_version = updated_go_mod.match(GO_MOD_VERSION)&.to_a&.first
-            if original_go_version != updated_go_version
-              go_mod_lines = T.let(updated_go_mod.lines, T::Array[T.nilable(String)])
-              go_mod_lines.each_with_index do |line, i|
-                next unless line&.match?(GO_MOD_VERSION)
-
-                # replace with the original version
-                go_mod_lines[i] = original_go_version
-                # avoid a stranded newline if there was no version originally
-                go_mod_lines[i + 1] = nil if original_go_version.nil?
-              end
-
-              updated_go_mod = go_mod_lines.compact.join
-            end
-
             { go_mod: updated_go_mod, go_sum: updated_go_sum }
           end
         end

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -94,13 +94,13 @@ module Dependabot
               return [package_release(version: T.must(dependency.version))] if version_strings.nil?
 
               version_info = version_strings.select { |v| version_class.correct?(v) }
-                                            .map { |v| version_class.new(v) }
+                                            .map { |version| version }
 
               package_releases = []
 
               version_info.map do |version|
                 package_releases << package_release(
-                  version: version.to_s
+                  version: version
                 )
               end
 
@@ -136,7 +136,8 @@ module Dependabot
         end
         def package_release(version:)
           Dependabot::Package::PackageRelease.new(
-            version: GoModules::Version.new(version)
+            version: GoModules::Version.new(version),
+            details: { "version_string" => version }
           )
         end
 

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -47,7 +47,8 @@ module Dependabot
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
             goprivate: String,
-            raise_on_ignored: T::Boolean
+            raise_on_ignored: T::Boolean,
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           )
             .void
         end
@@ -58,7 +59,8 @@ module Dependabot
           ignored_versions:,
           security_advisories:,
           goprivate:,
-          raise_on_ignored: false
+          raise_on_ignored: false,
+          cooldown_options: nil
         )
           @dependency          = dependency
           @dependency_files    = dependency_files
@@ -67,6 +69,17 @@ module Dependabot
           @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
           @goprivate           = goprivate
+          @cooldown_options    = cooldown_options
+          super(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            cooldown_options: cooldown_options,
+            raise_on_ignored: raise_on_ignored,
+            options: {}
+          )
         end
 
         sig do
@@ -87,6 +100,11 @@ module Dependabot
                                                  T.nilable(Dependabot::Version))
         end
 
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gomodules)
+        end
+
         private
 
         sig { returns(Dependabot::Dependency) }
@@ -107,6 +125,19 @@ module Dependabot
         sig { returns(String) }
         attr_reader :goprivate
 
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def available_versions_details
+          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            goprivate: goprivate
+          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+
         # rubocop:disable Lint/UnusedMethodArgument
         sig do
           params(language_version: T.nilable(T.any(String, Dependabot::Version)))
@@ -116,6 +147,7 @@ module Dependabot
           candidate_versions = available_versions_details
           candidate_versions = filter_prerelease_versions(candidate_versions)
           candidate_versions = filter_ignored_versions(candidate_versions)
+          candidate_versions = lazy_filter_cooldown_versions(candidate_versions)
           # Adding the psuedo-version to the list to avoid downgrades
           if PSEUDO_VERSION_REGEX.match?(dependency.version)
             candidate_versions << Dependabot::Package::PackageRelease.new(
@@ -126,6 +158,81 @@ module Dependabot
           candidate_versions.max_by(&:version)&.version
         end
 
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease], check_max: T::Boolean)
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
+        def lazy_filter_cooldown_versions(releases, check_max: true)
+          return releases unless cooldown_enabled?
+          return releases unless cooldown_options
+
+          Dependabot.logger.info("Initializing cooldown filter")
+
+          sorted_releases = if check_max
+                              releases.sort_by(&:version).reverse
+                            else
+                              releases.sort_by(&:version)
+                            end
+
+          filtered_versions = []
+          cooldown_filtered_versions = 0
+
+          # Iterate through the sorted versions lazily, filtering out cooldown versions
+          sorted_releases.each do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_versions += 1
+              next
+            end
+
+            filtered_versions << release
+            break
+          end
+
+          Dependabot.logger.info("Filtered out #{cooldown_filtered_versions} version(s) due to cooldown")
+
+          filtered_versions
+        end
+
+        # rubocop:disable Metrics/AbcSize
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          env = { "GOPRIVATE" => @goprivate }
+
+          begin
+            release_info = SharedHelpers.run_shell_command(
+              "go list -m -json #{dependency.name}@#{release.details.[]('version_string')}",
+              fingerprint: "go list -m -json <dependency_name>",
+              env: env
+            )
+          rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+            Dependabot.logger.info("Error while fetching release date info: #{e.message}")
+            return false
+          end
+
+          release.instance_variable_set(
+            :@released_at, JSON.parse(release_info)["Time"] ? Time.parse(JSON.parse(release_info)["Time"]) : nil
+          )
+
+          return false unless release.released_at
+
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+          days = cooldown_days_for(current_version, release.version)
+
+          # Calculate the number of seconds passed since the release
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
+
+          if passed_days < days
+            Dependabot.logger.info("Version #{release.version}, Release date: #{release.released_at}." \
+                                   " Days since release: #{passed_days} (cooldown days: #{days})")
+          end
+
+          # Check if the release is within the cooldown period
+          passed_seconds < days * DAY_IN_SECONDS
+        end
+        # rubocop:enable Metrics/AbcSize
+
         sig do
           override.returns(T.nilable(Dependabot::Package::PackageDetails))
         end
@@ -154,16 +261,6 @@ module Dependabot
         end
         # rubocop:enable Lint/UnusedMethodArgument
 
-        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
-        def available_versions_details
-          @available_versions_details ||= T.let(Package::PackageDetailsFetcher.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            goprivate: goprivate
-          ).fetch_available_versions, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
-        end
-
         sig { returns(T::Boolean) }
         def wants_prerelease?
           @wants_prerelease ||= T.let(

data/lib/dependabot/go_modules/update_checker.rb

@@ -66,6 +66,7 @@ module Dependabot
             ignored_versions: ignored_versions,
             security_advisories: security_advisories,
             raise_on_ignored: raise_on_ignored,
+            cooldown_options: update_cooldown,
             goprivate: options.fetch(:goprivate, "*")
           ),
           T.nilable(Dependabot::GoModules::UpdateChecker::LatestVersionFinder)

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.310.0
+  version: 0.312.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-24 00:00:00.000000000 Z
+date: 2025-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.312.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.310.0
+        version: 0.312.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -99,98 +99,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -223,16 +223,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Go_Modules provides support for bumping Go Modules versions
   via Dependabot. If you want support for multiple package managers, you probably
   want the meta-gem dependabot-omnibus.
@@ -271,7 +271,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.310.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.312.0
 rdoc_options: []
 require_paths:
 - lib