dependabot-go_modules 0.377.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf97969c0a98df4328d5ed5780f92a9340a2a382acb7159a8a54141bfc5a75d8
-  data.tar.gz: aacdfc5d7c13bf0a8e3c1fb9db5ab9e30dfb3fbcc0adcd1059cea0551eee5ade
+  metadata.gz: 7416aab2410b4a4f4f7b2f56c0034baa13956825415fc1af57a84fd383f5baa3
+  data.tar.gz: 7a36751b391d9d8d2a184098d8dd0a2ba521e1de92292b4ee059d9dd0f2c0e0b
 SHA512:
-  metadata.gz: a608eb9a09a25ab99d680a32a75eab06c2782fba4e5f9bd3d363da9c314f94f15c7b08cb1501a2ddc2754c88fb499c0a9a67dd41c64a09105383a89710a47ed3
-  data.tar.gz: f5bbfefc7577f2d65e035b2b976fe2824cc423b063dd62875f1af201185c32332a6daf4f6c603d5e5165b75aa664728aec712fabf8ce9be529a1b8002546a083
+  metadata.gz: 8aa196a52e254dc86a25aca1b727b631afc931164b1ad3e842fa62a1611d82884ee0a3844010f53b9a3598a0521dda2012c2b1fa6d6bdea36e732b4fda92cb09
+  data.tar.gz: 54d75e5a9b298b855f2761e87e101ceab4686d8dfe7833493e662b7f977c93538303690d01c65f933b69b10724efa76aa41debf590af2d06fbeec3398dc995b8

data/lib/dependabot/go_modules/file_parser.rb

@@ -114,10 +114,30 @@ module Dependabot
         return unless go_env
 
         env_file = T.must(go_env)
-        File.write(env_file.name, env_file.content)
+        File.write(env_file.name, sanitize_go_env_content(T.must(env_file.content)))
         ENV["GOENV"] = Pathname.new(env_file.name).realpath.to_s
       end
 
+      # Go's GOENV file format does not support shell-style quoting, but users
+      # commonly write values like GOPROXY="https://..." which Go reads literally
+      # (including the quotes), causing URL parse failures. Strip surrounding
+      # matching " or ' from each value.
+      sig { params(content: String).returns(String) }
+      def sanitize_go_env_content(content)
+        content.gsub(
+          /
+            ^          # start of line
+            ([^=\n]+)  # key: one or more chars that are not = or newline
+            =          # separator
+            (["'])     # opening quote, captured for backreference
+            (.*)       # value
+            \2         # closing quote must match opening
+            $          # end of line
+          /x,
+          '\1=\3'
+        )
+      end
+
       sig { void }
       def set_goprivate_variable
         return if go_env&.content&.include?("GOPRIVATE")

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -85,6 +85,10 @@ module Dependabot
               )
               version_strings = JSON.parse(versions_json)["Versions"]
 
+              # If no versions found, the path may be a sub-package rather than a module root.
+              # Try progressively shorter paths to find the actual module.
+              version_strings = resolve_module_versions_from_subpath(dependency_name) if version_strings.nil?
+
               return [package_release(version: T.must(dependency.version))] if version_strings.nil?
 
               version_info = version_strings.select { |v| version_class.correct?(v) }
@@ -161,6 +165,36 @@ module Dependabot
           dependency.version_class
         end
 
+        sig { params(module_path: String).returns(T.nilable(T::Array[String])) }
+        def fetch_module_versions(module_path)
+          versions_json = SharedHelpers.run_shell_command(
+            "go list -m -versions -json #{module_path}",
+            fingerprint: "go list -m -versions -json <dependency_name>"
+          )
+          JSON.parse(versions_json)["Versions"]
+        end
+
+        # When a full import path (e.g. github.com/owner/repo/cmd/tool) is not a module,
+        # try progressively shorter paths to find the actual module root.
+        sig { params(full_path: String).returns(T.nilable(T::Array[String])) }
+        def resolve_module_versions_from_subpath(full_path)
+          parts = full_path.split("/")
+          # Valid Go module roots can be as short as 2 segments (e.g., k8s.io/kubernetes)
+          min_parts = 2
+          return nil if parts.length <= min_parts
+
+          (parts.length - 1).downto(min_parts).each do |i|
+            candidate = T.must(parts[0...i]).join("/")
+            Dependabot.logger.debug("Trying shorter module path: #{candidate}")
+            versions = fetch_module_versions(candidate)
+            return versions if versions&.any?
+          rescue SharedHelpers::HelperSubprocessFailed
+            next
+          end
+
+          nil
+        end
+
         sig do
           params(releases: T::Array[Dependabot::Package::PackageRelease])
             .returns(Dependabot::Package::PackageDetails)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.377.0
+  version: 0.379.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.379.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.379.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
 rdoc_options: []
 require_paths:
 - lib