dependabot-go_modules 0.398.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c24f81fa270b8d7bf45160f66c0f97ebbf87c28847793b3043b83d5cf00ee9c
-  data.tar.gz: 4f1403eccfc751c1f0948796a484e3d63cf7e7ded7c5c947f0776066140983dc
+  metadata.gz: c542fdbc9273e2bc8287b1763076eabc222f1c53318a298584b6991304edd18f
+  data.tar.gz: 06066f37ca5940ee83ee6073e7a8215201577e9da520163eda7b6bf30a6f6a25
 SHA512:
-  metadata.gz: a1396231e48e22303ee26a75ddb7d69fcf481691036e0b04c1dc59b069f648fc592c2d39b401055069ea56fa970bd9915670ce5a1df2ae44acd8e8558e10eade
-  data.tar.gz: 54d6fbb363c517792c0ce1d8bcd5119147d7429fbc29a09c845162bd734c3bfa90b40d5a8679ead205d9e0bc8143320c8d82d401ca8facd43c44ea4698d01afa
+  metadata.gz: cfd2c42fe78c12e7f7129afb4c5c066e01195c780fca8a2584766588abaae8a14f1e992506485f4ecc387d54a5dace6b47383f9fd0ebf0cc3f36cd1299f7c62f
+  data.tar.gz: 8c16abde1c7c011714160a0f6bb99540356704b7d79ff50321d92d8f280a3fc890ec951342de4748e8609b3638bd384b4c647ddc3777f32b0b0addde94c2f766

data/lib/dependabot/go_modules/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,6 +7,7 @@ require "open3"
 require "dependabot/dependency"
 require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/go_modules/go_work_parser"
+require "dependabot/go_modules/go_mod_manifest"
 require "dependabot/go_modules/path_converter"
 require "dependabot/go_modules/replace_stubber"
 require "dependabot/errors"
@@ -291,49 +292,46 @@ module Dependabot
           stdout, stderr, status = Open3.capture3(command)
           handle_parser_error(path, stderr, file_path: mod_file.path) unless status.success?
 
-          parsed = JSON.parse(stdout)
-          packages = parsed["Require"] || []
+          parsed = GoModManifest.from_json(stdout, file_path: mod_file.path)
 
-          packages.filter_map do |hsh|
-            next if skip_dependency_in_manifest?(hsh, parsed)
+          parsed.requirements.filter_map do |entry|
+            next if skip_dependency_in_manifest?(entry, parsed)
 
-            source = { type: "default", source: hsh["Path"] }
-            version = hsh["Version"]&.sub(/^v?/, "")
+            source = { type: "default", source: entry.path }
+            version = entry.version&.sub(/^v?/, "")
 
             reqs = [{
-              requirement: hsh["Version"],
+              requirement: entry.version,
               file: mod_file.name,
               source: source,
               groups: []
             }]
 
             Dependency.new(
-              name: hsh["Path"],
+              name: entry.path,
               version: version,
-              requirements: hsh["Indirect"] ? [] : reqs,
+              requirements: entry.indirect ? [] : reqs,
               package_manager: "go_modules"
             )
           end
         end
       end
 
-      sig { params(dep: T::Hash[String, T.untyped], mod_manifest: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      sig { params(dep: GoModManifest::RequirementEntry, mod_manifest: GoModManifest).returns(T::Boolean) }
       def skip_dependency_in_manifest?(dep, mod_manifest)
         return true if dependency_is_replaced_in?(dep, mod_manifest)
 
-        path_uri = URI.parse("https://#{dep['Path']}")
+        path_uri = URI.parse("https://#{dep.path}")
         !path_uri.host&.include?(".")
       rescue URI::InvalidURIError
         false
       end
 
-      sig { params(details: T::Hash[String, T.untyped], mod_manifest: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      sig { params(details: GoModManifest::RequirementEntry, mod_manifest: GoModManifest).returns(T::Boolean) }
       def dependency_is_replaced_in?(details, mod_manifest)
-        return false unless mod_manifest["Replace"]
-
-        mod_manifest["Replace"].any? do |replace|
-          replace["Old"]["Path"] == details["Path"] &&
-            (!replace["Old"]["Version"] || replace["Old"]["Version"] == details["Version"])
+        mod_manifest.replacements.any? do |replacement|
+          replacement.old.path == details.path &&
+            (replacement.old.version.nil? || replacement.old.version == details.version)
         end
       end
 
@@ -342,32 +340,35 @@ module Dependabot
         raise "No go.mod or go.work!" unless go_mod || go_work
       end
 
-      sig { params(details: T::Hash[String, T.untyped]).returns(Dependabot::Dependency) }
+      sig { params(details: GoModManifest::RequirementEntry).returns(Dependabot::Dependency) }
       def dependency_from_details(details)
-        source = { type: "default", source: details["Path"] }
-        version = details["Version"]&.sub(/^v?/, "")
+        source = { type: "default", source: details.path }
+        version = details.version&.sub(/^v?/, "")
 
         reqs = [{
-          requirement: details["Version"],
+          requirement: details.version,
           file: go_mod&.name,
           source: source,
           groups: []
         }]
 
         Dependency.new(
-          name: details["Path"],
+          name: details.path,
           version: version,
-          requirements: details["Indirect"] ? [] : reqs,
+          requirements: details.indirect ? [] : reqs,
           package_manager: "go_modules"
         )
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[GoModManifest::RequirementEntry]) }
       def required_packages
         @required_packages ||=
           T.let(
-            JSON.parse(run_in_parsed_context("go mod edit -json"))["Require"] || [],
-            T.nilable(T::Array[T::Hash[String, T.untyped]])
+            GoModManifest.from_json(
+              run_in_parsed_context("go mod edit -json"),
+              file_path: T.must(go_mod).path
+            ).requirements,
+            T.nilable(T::Array[GoModManifest::RequirementEntry])
           )
       end
 
@@ -384,7 +385,7 @@ module Dependabot
           )
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(GoModManifest) }
       def manifest
         @manifest ||=
           T.let(
@@ -398,9 +399,9 @@ module Dependabot
               stdout, stderr, status = Open3.capture3(command)
               handle_parser_error(path, stderr) unless status.success?
 
-              JSON.parse(stdout)
+              GoModManifest.from_json(stdout, file_path: T.must(go_mod).path)
             end,
-            T.nilable(T::Hash[String, T.untyped])
+            T.nilable(GoModManifest)
           )
       end
 
@@ -418,18 +419,18 @@ module Dependabot
         raise Dependabot::DependencyFileNotParseable.new(resolved_path, msg)
       end
 
-      sig { params(dep: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      sig { params(dep: GoModManifest::RequirementEntry).returns(T::Boolean) }
       def skip_dependency?(dep)
         # Updating replaced dependencies is not supported
         return true if dependency_is_replaced(dep)
 
-        path_uri = URI.parse("https://#{dep['Path']}")
+        path_uri = URI.parse("https://#{dep.path}")
         !path_uri.host&.include?(".")
       rescue URI::InvalidURIError
         false
       end
 
-      sig { params(details: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      sig { params(details: GoModManifest::RequirementEntry).returns(T::Boolean) }
       def dependency_is_replaced(details)
         # Mark dependency as replaced if the requested dependency has a
         # "replace" directive and that either has the same version, or no
@@ -437,15 +438,7 @@ module Dependabot
         # prevents that we change dependency versions without any impact since
         # the actual version that is being imported is defined by the replace
         # directive.
-        if manifest["Replace"]
-          dep_replace = manifest["Replace"].find do |replace|
-            replace["Old"]["Path"] == details["Path"] &&
-              (!replace["Old"]["Version"] || replace["Old"]["Version"] == details["Version"])
-          end
-
-          return true if dep_replace
-        end
-        false
+        dependency_is_replaced_in?(details, manifest)
       end
     end
   end

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -8,6 +8,7 @@ require "dependabot/errors"
 require "dependabot/logger"
 require "dependabot/go_modules/file_updater"
 require "dependabot/go_modules/go_work_parser"
+require "dependabot/go_modules/go_mod_manifest"
 require "dependabot/go_modules/replace_stubber"
 require "dependabot/go_modules/resolvability_errors"
 
@@ -386,13 +387,13 @@ module Dependabot
           FileUtils.rm_f(T.must(tmp_go_file))
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(GoModManifest) }
         def parse_manifest
           command = "go mod edit -json"
           stdout, stderr, status = Open3.capture3(command)
           handle_subprocess_error(stderr) unless status.success?
 
-          JSON.parse(stdout) || {}
+          GoModManifest.from_json(stdout, file_path: File.join(directory, "go.mod"))
         end
 
         sig do
@@ -426,7 +427,7 @@ module Dependabot
         # the layout of the filesystem with a structure we can reproduce (i.e.
         # no paths such as ../../../foo), run the Go tooling, then reverse the
         # process afterwards.
-        sig { params(manifest: T::Hash[String, T.untyped]).returns(T::Hash[String, String]) }
+        sig { params(manifest: GoModManifest).returns(T::Hash[String, String]) }
         def replace_directive_substitutions(manifest)
           @replace_directive_substitutions ||=
             T.let(

data/lib/dependabot/go_modules/go_mod_manifest.rb

@@ -0,0 +1,165 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module GoModules
+    class GoModManifest < T::ImmutableStruct
+      extend T::Sig
+
+      class InvalidOutput < SharedHelpers::HelperSubprocessFailed; end
+
+      class RequirementEntry < T::ImmutableStruct
+        const :path, String
+        const :version, T.nilable(String)
+        const :indirect, T::Boolean
+      end
+
+      class ModuleReference < T::ImmutableStruct
+        const :path, String
+        const :version, T.nilable(String)
+      end
+
+      class Replacement < T::ImmutableStruct
+        const :old, ModuleReference
+        const :new, ModuleReference
+      end
+
+      class Exclusion < T::ImmutableStruct
+        const :path, String
+        const :version, String
+      end
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      const :requirements, T::Array[RequirementEntry]
+      const :replacements, T::Array[Replacement]
+      const :exclusions, T::Array[Exclusion]
+
+      sig { params(content: String, file_path: String).returns(GoModManifest) }
+      def self.from_json(content, file_path:)
+        context = "go mod edit -json for #{file_path}"
+        fields = object(T.cast(JSON.parse(content), Object), "#{context}: result")
+        new(
+          requirements: parse_requirements(fields["Require"], "#{context}: Require"),
+          replacements: parse_replacements(fields["Replace"], "#{context}: Replace"),
+          exclusions: parse_exclusions(fields["Exclude"], "#{context}: Exclude")
+        )
+      rescue JSON::ParserError
+        invalid_output("#{context}: result must be valid JSON")
+      end
+
+      sig { params(value: Object, context: String).returns(T::Array[RequirementEntry]) }
+      def self.parse_requirements(value, context)
+        array(value, context).each_with_index.map do |entry, index|
+          location = "#{context}[#{index}]"
+          fields = object(entry, location)
+          RequirementEntry.new(
+            path: string(fields["Path"], "#{location}.Path"),
+            version: optional_string(fields["Version"], "#{location}.Version"),
+            indirect: indirect(fields["Indirect"], "#{location}.Indirect")
+          )
+        end
+      end
+      private_class_method :parse_requirements
+
+      sig { params(value: Object, context: String).returns(T::Array[Replacement]) }
+      def self.parse_replacements(value, context)
+        array(value, context).each_with_index.map do |entry, index|
+          location = "#{context}[#{index}]"
+          fields = object(entry, location)
+          Replacement.new(
+            old: module_reference(fields["Old"], "#{location}.Old"),
+            new: module_reference(fields["New"], "#{location}.New")
+          )
+        end
+      end
+      private_class_method :parse_replacements
+
+      sig { params(value: Object, context: String).returns(T::Array[Exclusion]) }
+      def self.parse_exclusions(value, context)
+        array(value, context).each_with_index.map do |entry, index|
+          location = "#{context}[#{index}]"
+          fields = object(entry, location)
+          Exclusion.new(
+            path: string(fields["Path"], "#{location}.Path"),
+            version: string(fields["Version"], "#{location}.Version")
+          )
+        end
+      end
+      private_class_method :parse_exclusions
+
+      sig { params(value: Object, context: String).returns(ModuleReference) }
+      def self.module_reference(value, context)
+        fields = object(value, context)
+        ModuleReference.new(
+          path: string(fields["Path"], "#{context}.Path"),
+          version: optional_string(fields["Version"], "#{context}.Version")
+        )
+      end
+      private_class_method :module_reference
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object(value, context)
+        invalid_output("#{context} must be an object") unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          invalid_output("#{context} keys must be strings") unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+      private_class_method :object
+
+      sig { params(value: Object, context: String).returns(T::Array[Object]) }
+      def self.array(value, context)
+        return [] if value.nil?
+
+        invalid_output("#{context} must be an array") unless value.is_a?(Array)
+        value.map { |entry| T.cast(entry, Object) }
+      end
+      private_class_method :array
+
+      sig { params(value: Object, context: String).returns(String) }
+      def self.string(value, context)
+        return value if value.is_a?(String)
+
+        invalid_output("#{context} must be a string")
+      end
+      private_class_method :string
+
+      sig { params(value: Object, context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+
+        string(value, context)
+      end
+      private_class_method :optional_string
+
+      sig { params(value: Object, context: String).returns(T::Boolean) }
+      def self.indirect(value, context)
+        case value
+        when nil, false then false
+        when true then true
+        else invalid_output("#{context} must be a boolean or nil")
+        end
+      end
+      private_class_method :indirect
+
+      sig { params(message: String).returns(T.noreturn) }
+      def self.invalid_output(message)
+        raise InvalidOutput.new(
+          message: message,
+          error_class: "TypeError",
+          error_context: { command: "go mod edit -json" }
+        ),
+              cause: nil
+      end
+      private_class_method :invalid_output
+    end
+  end
+end

data/lib/dependabot/go_modules/module_info.rb

@@ -0,0 +1,82 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "sorbet-runtime"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module GoModules
+    class ModuleInfo < T::ImmutableStruct
+      extend T::Sig
+
+      class InvalidOutput < SharedHelpers::HelperSubprocessFailed; end
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      const :versions, T.nilable(T::Array[String])
+      const :released_at, T.nilable(Time)
+
+      sig { params(content: String, command: String).returns(ModuleInfo) }
+      def self.from_json(content, command:)
+        fields = object(T.cast(JSON.parse(content), Object), command)
+        new(
+          versions: parse_versions(fields["Versions"], command),
+          released_at: parse_time(fields["Time"], command)
+        )
+      rescue JSON::ParserError
+        invalid_output(command, "result must be valid JSON")
+      end
+
+      sig { params(value: Object, command: String).returns(ObjectHash) }
+      def self.object(value, command)
+        invalid_output(command, "result must be an object") unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          invalid_output(command, "result keys must be strings") unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+      private_class_method :object
+
+      sig { params(value: Object, command: String).returns(T.nilable(T::Array[String])) }
+      def self.parse_versions(value, command)
+        return if value.nil?
+
+        invalid_output(command, "Versions must be an array or nil") unless value.is_a?(Array)
+        value.each_with_index.map do |raw_entry, index|
+          entry = T.cast(raw_entry, Object)
+          invalid_output(command, "Versions[#{index}] must be a string") unless entry.is_a?(String)
+
+          entry
+        end
+      end
+      private_class_method :parse_versions
+
+      sig { params(value: Object, command: String).returns(T.nilable(Time)) }
+      def self.parse_time(value, command)
+        return if value.nil?
+
+        invalid_output(command, "Time must be a string or nil") unless value.is_a?(String)
+        Time.parse(value)
+      rescue ArgumentError
+        invalid_output(command, "Time must be a valid timestamp")
+      end
+      private_class_method :parse_time
+
+      sig { params(command: String, message: String).returns(T.noreturn) }
+      def self.invalid_output(command, message)
+        raise InvalidOutput.new(
+          message: "#{command}: #{message}",
+          error_class: "TypeError",
+          error_context: { command: command }
+        ),
+              cause: nil
+      end
+      private_class_method :invalid_output
+    end
+  end
+end

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -9,6 +9,8 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
+require "dependabot/go_modules/go_mod_manifest"
+require "dependabot/go_modules/module_info"
 require "dependabot/go_modules/resolvability_errors"
 require "dependabot/go_modules/azure_devops_path_normalizer"
 
@@ -73,17 +75,13 @@ module Dependabot
               # appears to be a side effect of operating with modules included in GOPRIVATE. We'll
               # retain any exclude directives to omit those versions.
               File.write("go.mod", "module dummy\n")
-              manifest["Exclude"]&.each do |r|
-                SharedHelpers.run_shell_command("go mod edit -exclude=#{r['Path']}@#{r['Version']}")
+              manifest.exclusions.each do |exclusion|
+                SharedHelpers.run_shell_command("go mod edit -exclude=#{exclusion.path}@#{exclusion.version}")
               end
 
               # Turn off the module proxy for private dependencies
               dependency_name = AzureDevopsPathNormalizer.normalize(dependency.name)
-              versions_json = SharedHelpers.run_shell_command(
-                "go list -m -versions -json #{dependency_name}",
-                fingerprint: "go list -m -versions -json <dependency_name>"
-              )
-              version_strings = JSON.parse(versions_json)["Versions"]
+              version_strings = fetch_module_versions(dependency_name)
 
               # If no versions found, the path may be a sub-package rather than a module root.
               # Try progressively shorter paths to find the actual module.
@@ -106,6 +104,8 @@ module Dependabot
             end
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
+          raise if e.is_a?(GoModManifest::InvalidOutput) || e.is_a?(ModuleInfo::InvalidOutput)
+
           retry_count ||= 0
           retry_count += 1
           retry if transitory_failure?(e) && retry_count < 2
@@ -150,13 +150,13 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(GoModManifest) }
         def parse_manifest
           SharedHelpers.in_a_temporary_directory do
             File.write("go.mod", T.must(go_mod).content)
             json = SharedHelpers.run_shell_command("go mod edit -json")
 
-            JSON.parse(json) || {}
+            GoModManifest.from_json(json, file_path: T.must(go_mod).path)
           end
         end
 
@@ -171,7 +171,10 @@ module Dependabot
             "go list -m -versions -json #{module_path}",
             fingerprint: "go list -m -versions -json <dependency_name>"
           )
-          JSON.parse(versions_json)["Versions"]
+          ModuleInfo.from_json(
+            versions_json,
+            command: "go list -m -versions -json <dependency_name>"
+          ).versions
         end
 
         # When a full import path (e.g. github.com/owner/repo/cmd/tool) is not a module,
@@ -188,7 +191,9 @@ module Dependabot
             Dependabot.logger.debug("Trying shorter module path: #{candidate}")
             versions = fetch_module_versions(candidate)
             return versions if versions&.any?
-          rescue SharedHelpers::HelperSubprocessFailed
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            raise if e.is_a?(ModuleInfo::InvalidOutput)
+
             next
           end
 

data/lib/dependabot/go_modules/replace_stubber.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/go_modules/go_mod_manifest"
 
 module Dependabot
   module GoModules
@@ -22,13 +23,13 @@ module Dependabot
       end
 
       sig do
-        params(manifest: T::Hash[String, T.untyped], directory: T.nilable(String)).returns(T::Hash[String, String])
+        params(manifest: GoModManifest, directory: T.nilable(String)).returns(T::Hash[String, String])
       end
       def stub_paths(manifest, directory)
-        (manifest["Replace"] || [])
-          .filter_map { |r| r["New"]["Path"] }
-          .select { |p| stub_replace_path?(p, directory) }
-          .to_h { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }
+        manifest.replacements
+                .map { |replacement| replacement.new.path }
+                .select { |p| stub_replace_path?(p, directory) }
+                .to_h { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }
       end
 
       private

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -9,6 +9,7 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
+require "dependabot/go_modules/module_info"
 require "dependabot/go_modules/resolvability_errors"
 require "dependabot/go_modules/package/package_details_fetcher"
 require "dependabot/go_modules/azure_devops_path_normalizer"
@@ -210,9 +211,10 @@ module Dependabot
             return false
           end
 
-          release.instance_variable_set(
-            :@released_at, JSON.parse(release_info)["Time"] ? Time.parse(JSON.parse(release_info)["Time"]) : nil
-          )
+          release.released_at = ModuleInfo.from_json(
+            release_info,
+            command: "go list -m -json <dependency_name>"
+          ).released_at
 
           return false unless release.released_at
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -256,9 +256,11 @@ files:
 - lib/dependabot/go_modules/file_parser.rb
 - lib/dependabot/go_modules/file_updater.rb
 - lib/dependabot/go_modules/file_updater/go_mod_updater.rb
+- lib/dependabot/go_modules/go_mod_manifest.rb
 - lib/dependabot/go_modules/go_work_parser.rb
 - lib/dependabot/go_modules/language.rb
 - lib/dependabot/go_modules/metadata_finder.rb
+- lib/dependabot/go_modules/module_info.rb
 - lib/dependabot/go_modules/native_helpers.rb
 - lib/dependabot/go_modules/package/package_details_fetcher.rb
 - lib/dependabot/go_modules/package_manager.rb
@@ -275,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib