dependabot-go_modules 0.383.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b413e26c998c666b1e7d8c8eba8153e146d37621b1bd7c7265c8909ff081e8e2
-  data.tar.gz: 3ac8f0be34ae4d134fc2b7bab16b20348f5d974639efcded7d18442e987db719
+  metadata.gz: 74c065d77334d58ec5d9edcd161daece8b1b2e37adc38b1a7afd3fc8e781c2f7
+  data.tar.gz: c5093f709c300b889cb8406a2c89fea74f63c838d3a8e100e580710b693173a3
 SHA512:
-  metadata.gz: d00ad1a766ca11dc865cf98fac55d2eb8f95db67a12dd38797bde99de6d0aef0896306d195bbcdc14c6488d6417ea7f5309753cae4543844e5cc359d2da10633
-  data.tar.gz: eda15cb96be95e17a881f5ce6c0c4a2667a12aa44dd0d924f162aff40a28a02a1e65c9c3e0e371aa2e0676e73305cc2010d5fbede371b30a7948338ec331c65a
+  metadata.gz: 02eec6f48647eac9a54a15e8b0eaff4dc2e328ca98baa9e9d5001cfe0043557f4bef13b4ac98a21b51eb21e43b895f97bf53fe22bc20a3a1aad7bb0dddd5a6ad
+  data.tar.gz: 7a1e3133a3f13a0624bdfb016078f30988de4822f6bd77abb9ee9efac24f4bce6868e4e0628219090f6593ba17ccc4d86b6e53c84d487ef2af80ada0e0f3868f

data/lib/dependabot/go_modules/file_parser.rb

@@ -146,7 +146,7 @@ module Dependabot
         return if go_env&.content&.include?("GOPROXY")
         return if goproxy_credentials.any?
 
-        goprivate = options.fetch(:goprivate, "*")
+        goprivate = T.cast(options.fetch(:goprivate, "*"), T.nilable(String))
         ENV["GOPRIVATE"] = goprivate if goprivate
       end
 
@@ -160,7 +160,7 @@ module Dependabot
         return if go_env_includes_any?(%w(GONOPROXY GOPRIVATE GOPROXY))
         return if goproxy_credentials.any?
 
-        gonoproxy = options.fetch(:gonoproxy, nil)
+        gonoproxy = T.cast(options.fetch(:gonoproxy, nil), T.nilable(String))
         ENV["GONOPROXY"] = gonoproxy if gonoproxy
       end
 
@@ -171,7 +171,7 @@ module Dependabot
       def set_gonosumdb_variable
         return if go_env_includes_any?(%w(GONOSUMDB GOPRIVATE))
 
-        gonosumdb = options.fetch(:gonosumdb, nil)
+        gonosumdb = T.cast(options.fetch(:gonosumdb, nil), T.nilable(String))
         ENV["GONOSUMDB"] = gonosumdb if gonosumdb
       end
 

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -305,7 +305,7 @@ module Dependabot
           @wants_prerelease ||= T.let(
             begin
               current_version = dependency.numeric_version
-              !current_version&.prerelease?.nil?
+              current_version&.prerelease? || false
             end,
             T.nilable(T::Boolean)
           )

data/lib/dependabot/go_modules/version.rb

@@ -34,8 +34,11 @@ module Dependabot
         @version_string = T.let(version.to_s.gsub(/^v/, ""), String)
         version = version.gsub(/^v/, "") if version.is_a?(String)
         version = version.to_s.split("+").first if version.to_s.include?("+")
-        @prerelease = T.let(nil, T.nilable(String))
-        version, @prerelease = version.to_s.split("-", 2) if version.to_s.include?("-")
+        # NOTE: avoid the name `@prerelease`; RubyGems 4's Gem::Version#prerelease?
+        # memoizes its boolean result into an `@prerelease` ivar, so reusing that
+        # name here would corrupt the inherited prerelease? check.
+        @prerelease_suffix = T.let(nil, T.nilable(String))
+        version, @prerelease_suffix = version.to_s.split("-", 2) if version.to_s.include?("-")
 
         super
       end
@@ -50,6 +53,19 @@ module Dependabot
         @version_string
       end
 
+      # Go represents prereleases as a dash-suffix (e.g. "1.2.0-pre2"), which is
+      # stripped off before being handed to Gem::Version. As a result the parent's
+      # prerelease? check (which looks for alphabetic characters in the version it
+      # was given) can't see the suffix, so we report the suffix here and otherwise
+      # delegate to Gem::Version for dot-style prereleases such as "1.0.0.pre1".
+      sig { returns(T::Boolean) }
+      def prerelease?
+        suffix = @prerelease_suffix
+        return true if suffix && !suffix.empty?
+
+        super
+      end
+
       sig { params(other: Object).returns(T.nilable(Integer)) }
       def <=>(other)
         result = super
@@ -57,13 +73,13 @@ module Dependabot
         return result unless result.zero?
 
         other = self.class.new(other.to_s) unless other.is_a?(Version)
-        compare_prerelease(@prerelease || "", T.unsafe(other).prerelease || "")
+        compare_prerelease(@prerelease_suffix || "", T.unsafe(other).prerelease_suffix || "")
       end
 
       protected
 
       sig { returns(T.nilable(String)) }
-      attr_reader :prerelease
+      attr_reader :prerelease_suffix
 
       private
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -275,7 +275,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib
@@ -290,7 +290,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Go Modules
 test_files: []