dependabot-go_modules 0.378.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da203b1b62048d35cedc82132b37afb9253ac4a0d18bbaa25ff4675f4401d32e
-  data.tar.gz: 822f8647f4ef9250747d1ad2f5b8ac0644a2dc83bd96799341b8edc97441e4db
+  metadata.gz: 7416aab2410b4a4f4f7b2f56c0034baa13956825415fc1af57a84fd383f5baa3
+  data.tar.gz: 7a36751b391d9d8d2a184098d8dd0a2ba521e1de92292b4ee059d9dd0f2c0e0b
 SHA512:
-  metadata.gz: cd15284e846a0b2e8efdce0a8dee0dcb2e3d24fcd981a3cf00c132b56c57c946e69d50b631f664906daf3ed6447c16ae509d7e5f952f3dcfc8c9d39cd09923e8
-  data.tar.gz: 4065535671b4ab16eaac81f3fce31257c836a20fba2e9aff63f87f283bb52ed7020c7958ee7052726d6227fca5ef130acba8b4751e7439b033e7c6e6ff7b4295
+  metadata.gz: 8aa196a52e254dc86a25aca1b727b631afc931164b1ad3e842fa62a1611d82884ee0a3844010f53b9a3598a0521dda2012c2b1fa6d6bdea36e732b4fda92cb09
+  data.tar.gz: 54d75e5a9b298b855f2761e87e101ceab4686d8dfe7833493e662b7f977c93538303690d01c65f933b69b10724efa76aa41debf590af2d06fbeec3398dc995b8

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -85,6 +85,10 @@ module Dependabot
               )
               version_strings = JSON.parse(versions_json)["Versions"]
 
+              # If no versions found, the path may be a sub-package rather than a module root.
+              # Try progressively shorter paths to find the actual module.
+              version_strings = resolve_module_versions_from_subpath(dependency_name) if version_strings.nil?
+
               return [package_release(version: T.must(dependency.version))] if version_strings.nil?
 
               version_info = version_strings.select { |v| version_class.correct?(v) }
@@ -161,6 +165,36 @@ module Dependabot
           dependency.version_class
         end
 
+        sig { params(module_path: String).returns(T.nilable(T::Array[String])) }
+        def fetch_module_versions(module_path)
+          versions_json = SharedHelpers.run_shell_command(
+            "go list -m -versions -json #{module_path}",
+            fingerprint: "go list -m -versions -json <dependency_name>"
+          )
+          JSON.parse(versions_json)["Versions"]
+        end
+
+        # When a full import path (e.g. github.com/owner/repo/cmd/tool) is not a module,
+        # try progressively shorter paths to find the actual module root.
+        sig { params(full_path: String).returns(T.nilable(T::Array[String])) }
+        def resolve_module_versions_from_subpath(full_path)
+          parts = full_path.split("/")
+          # Valid Go module roots can be as short as 2 segments (e.g., k8s.io/kubernetes)
+          min_parts = 2
+          return nil if parts.length <= min_parts
+
+          (parts.length - 1).downto(min_parts).each do |i|
+            candidate = T.must(parts[0...i]).join("/")
+            Dependabot.logger.debug("Trying shorter module path: #{candidate}")
+            versions = fetch_module_versions(candidate)
+            return versions if versions&.any?
+          rescue SharedHelpers::HelperSubprocessFailed
+            next
+          end
+
+          nil
+        end
+
         sig do
           params(releases: T::Array[Dependabot::Package::PackageRelease])
             .returns(Dependabot::Package::PackageDetails)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.378.0
+  version: 0.379.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.378.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
 rdoc_options: []
 require_paths:
 - lib