dependabot-go_modules 0.144.0 → 0.145.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2505607e3f2717b5a8cb513b12801baa4ff1ff575e1a3a54ae21724ab1f1353d
-  data.tar.gz: fbac460701747cdeacd631163234633ea5d8e5779d3c8dc78e66f2721166d18d
+  metadata.gz: e5a1572ab4bc566ad0c86a6ff2c332124e76c98cbbf8ba711b31bea5ee129656
+  data.tar.gz: 910e1cc9f46cbdd5816e0dbc9ae4faf59e362c7005bac0827c8179b06fe88cba
 SHA512:
-  metadata.gz: 5ea7b06a9c99783e6cc6301ceda812b728b929a1a5fc5909c6654f1b1f17c030d630a5c0e6307a39cd5f0647bb2866e6261e95e9e79d2d279f009abf803e72e9
-  data.tar.gz: 18b9e5f44a0f99612f53579abadc77b25b71621dfea5867b1b59f7452657e65c100990ae12ebc0b9ff27f19803260cfb667d9cd9194acb41f8fdb92f9351f786
+  metadata.gz: 04cd9f7ea9755e2818896714d5f8b0d038b08b8b96bf777a937f75c0ee3e7a2577c8170bea33ad6db25a87a7ad681fc135221809424d02fa204e9b9eaf4f3524
+  data.tar.gz: 18dfc3b740ceca107e515a594eb432737530d020bd6a60fc10625488ac8bb158b6eb48d6d506295411a9a18df4243b9febf152544c108b30c690795025a9a7b2

data/helpers/go.mod

@@ -4,6 +4,6 @@ go 1.16
 
 require (
 	github.com/Masterminds/vcs v1.13.1
-	github.com/dependabot/gomodules-extracted v1.2.0
+	github.com/dependabot/gomodules-extracted v1.3.0
 	golang.org/x/mod v0.4.2
 )

data/helpers/go.sum

@@ -1,7 +1,7 @@
 github.com/Masterminds/vcs v1.13.1 h1:NL3G1X7/7xduQtA2sJLpVpfHTNBALVNSjob6KEjPXNQ=
 github.com/Masterminds/vcs v1.13.1/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
-github.com/dependabot/gomodules-extracted v1.2.0 h1:K/gTyOyhasOt4cjULvOPNiD3MAFGytp4F7e39aB+0Y0=
-github.com/dependabot/gomodules-extracted v1.2.0/go.mod h1:3NWkH8KcZVDM87JuZI8hCZzYbjfUSz98EZI53qjgMgY=
+github.com/dependabot/gomodules-extracted v1.3.0 h1:Rsnl5uR+wjE+7ontePia/B3p48aBRsyEhyNrzCwbkaw=
+github.com/dependabot/gomodules-extracted v1.3.0/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=

data/helpers/main.go

@@ -33,10 +33,10 @@ func main() {
 		funcErr error
 	)
 	switch helperParams.Function {
-	case "getUpdatedVersion":
+	case "getVersions":
 		var args updatechecker.Args
 		parseArgs(helperParams.Args, &args)
-		funcOut, funcErr = updatechecker.GetUpdatedVersion(&args)
+		funcOut, funcErr = updatechecker.GetVersions(&args)
 	case "updateDependencyFile":
 		var args updater.Args
 		parseArgs(helperParams.Args, &args)

data/helpers/updatechecker/main.go

@@ -1,9 +1,9 @@
 package updatechecker
 
 import (
+	"context"
 	"errors"
 	"io/ioutil"
-	"regexp"
 
 	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfetch"
 	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modload"
@@ -11,44 +11,27 @@ import (
 	"golang.org/x/mod/semver"
 )
 
-var (
-	pseudoVersionRegexp = regexp.MustCompile(`\b\d{14}-[0-9a-f]{12}$`)
-)
-
 type Dependency struct {
-	Name     string `json:"name"`
-	Version  string `json:"version"`
-	Indirect bool   `json:"indirect"`
-}
-
-type IgnoreRange struct {
-	MinVersionInclusive string `json:"min_version_inclusive"`
-	MaxVersionExclusive string `json:"max_version_exclusive"`
+	Name    string `json:"name"`
+	Version string `json:"version"`
 }
 
 type Args struct {
-	Dependency   *Dependency    `json:"dependency"`
-	IgnoreRanges []*IgnoreRange `json:"ignore_ranges"`
+	Dependency *Dependency `json:"dependency"`
 }
 
-func GetUpdatedVersion(args *Args) (interface{}, error) {
+// GetVersions returns a list of versions for the given dependency that
+// are within the same major version.
+func GetVersions(args *Args) (interface{}, error) {
 	if args.Dependency == nil {
 		return nil, errors.New("Expected args.dependency to not be nil")
 	}
 
 	currentVersion := args.Dependency.Version
-	currentPrerelease := semver.Prerelease(currentVersion)
-	if pseudoVersionRegexp.MatchString(currentPrerelease) {
-		return currentVersion, nil
-	}
-
-	modload.InitMod()
 
-	repo, err := modfetch.Lookup("direct", args.Dependency.Name)
-	if err != nil {
-		return nil, err
-	}
+	modload.LoadModFile(context.Background())
 
+	repo := modfetch.Lookup("direct", args.Dependency.Name)
 	versions, err := repo.Versions("")
 	if err != nil {
 		return nil, err
@@ -60,7 +43,8 @@ func GetUpdatedVersion(args *Args) (interface{}, error) {
 	}
 
 	currentMajor := semver.Major(currentVersion)
-	latestVersion := args.Dependency.Version
+
+	var candidateVersions []string
 
 Outer:
 	for _, v := range versions {
@@ -68,24 +52,16 @@ Outer:
 			continue
 		}
 
-		if semver.Compare(v, latestVersion) < 1 {
-			continue
-		}
-
-		if currentPrerelease == "" && semver.Prerelease(v) != "" {
-			continue
-		}
-
 		for _, exclude := range excludes {
 			if v == exclude {
 				continue Outer
 			}
 		}
 
-		latestVersion = v
+		candidateVersions = append(candidateVersions, v)
 	}
 
-	return latestVersion, nil
+	return candidateVersions, nil
 }
 
 func goModExcludes(dependency string) ([]string, error) {

data/lib/dependabot/go_modules/update_checker.rb

@@ -5,20 +5,12 @@ require "dependabot/update_checkers/base"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/native_helpers"
-require "dependabot/go_modules/resolvability_errors"
 require "dependabot/go_modules/version"
 
 module Dependabot
   module GoModules
     class UpdateChecker < Dependabot::UpdateCheckers::Base
-      RESOLVABILITY_ERROR_REGEXES = [
-        # Package url/proxy doesn't include any redirect meta tags
-        /no go-import meta tags/,
-        # Package url 404s
-        /404 Not Found/,
-        /Repository not found/,
-        /unrecognized import path/
-      ].freeze
+      require_relative "update_checker/latest_version_finder"
 
       def latest_resolvable_version
         # We don't yet support updating indirect dependencies for go_modules
@@ -33,7 +25,13 @@ module Dependabot
         end
 
         @latest_resolvable_version ||=
-          version_class.new(find_latest_resolvable_version.gsub(/^v/, ""))
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
+          ).latest_version
       end
 
       # This is currently used to short-circuit latest_resolvable_version,
@@ -56,51 +54,6 @@ module Dependabot
 
       private
 
-      def find_latest_resolvable_version
-        SharedHelpers.in_a_temporary_directory do
-          SharedHelpers.with_git_configured(credentials: credentials) do
-            File.write("go.mod", go_mod.content)
-
-            # Turn off the module proxy for now, as it's causing issues with
-            # private git dependencies
-            env = { "GOPRIVATE" => "*" }
-
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
-              env: env,
-              function: "getUpdatedVersion",
-              args: {
-                dependency: {
-                  name: dependency.name,
-                  version: "v" + dependency.version,
-                  indirect: dependency.requirements.empty?
-                }
-              }
-            )
-          end
-        end
-      rescue SharedHelpers::HelperSubprocessFailed => e
-        retry_count ||= 0
-        retry_count += 1
-        retry if transitory_failure?(e) && retry_count < 2
-
-        handle_subprocess_error(e)
-      end
-
-      def handle_subprocess_error(error)
-        if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
-          ResolvabilityErrors.handle(error.message, credentials: credentials)
-        end
-
-        raise
-      end
-
-      def transitory_failure?(error)
-        return true if error.message.include?("EOF")
-
-        error.message.include?("Internal Server Error")
-      end
-
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Go (yet)
         false
@@ -137,10 +90,6 @@ module Dependabot
         { type: "default", source: dependency.name }
       end
 
-      def go_mod
-        @go_mod ||= dependency_files.find { |f| f.name == "go.mod" }
-      end
-
       def git_commit_checker
         @git_commit_checker ||=
           GitCommitChecker.new(

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "excon"
+
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+require "dependabot/go_modules/requirement"
+require "dependabot/go_modules/resolvability_errors"
+
+module Dependabot
+  module GoModules
+    class UpdateChecker
+      class LatestVersionFinder
+        RESOLVABILITY_ERROR_REGEXES = [
+          # Package url/proxy doesn't include any redirect meta tags
+          /no go-import meta tags/,
+          # Package url 404s
+          /404 Not Found/,
+          /Repository not found/,
+          /unrecognized import path/
+        ].freeze
+        PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
+
+        def initialize(dependency:, dependency_files:, credentials:,
+                       ignored_versions:, raise_on_ignored: false)
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @raise_on_ignored    = raise_on_ignored
+        end
+
+        def latest_version
+          @latest_version ||= fetch_latest_version
+        end
+
+        private
+
+        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions
+
+        def fetch_latest_version
+          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+
+          candidate_versions = available_versions
+          candidate_versions = filter_prerelease_versions(candidate_versions)
+          candidate_versions = filter_lower_versions(candidate_versions)
+          candidate_versions = filter_ignored_versions(candidate_versions)
+
+          candidate_versions.max
+        end
+
+        def available_versions
+          SharedHelpers.in_a_temporary_directory do
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              File.write("go.mod", go_mod.content)
+
+              # Turn off the module proxy for now, as it's causing issues with
+              # private git dependencies
+              env = { "GOPRIVATE" => "*" }
+
+              version_strings = SharedHelpers.run_helper_subprocess(
+                command: NativeHelpers.helper_path,
+                env: env,
+                function: "getVersions",
+                args: {
+                  dependency: {
+                    name: dependency.name,
+                    version: "v" + dependency.version,
+                  }
+                }
+              )
+
+              version_strings.select { |v| version_class.correct?(v) }
+                             .map { |v| version_class.new(v) }
+            end
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          retry_count ||= 0
+          retry_count += 1
+          retry if transitory_failure?(e) && retry_count < 2
+
+          handle_subprocess_error(e)
+        end
+
+        def handle_subprocess_error(error)
+          if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
+            ResolvabilityErrors.handle(error.message, credentials: credentials)
+          end
+
+          raise
+        end
+
+        def transitory_failure?(error)
+          return true if error.message.include?("EOF")
+
+          error.message.include?("Internal Server Error")
+        end
+
+        def go_mod
+          @go_mod ||= dependency_files.find { |f| f.name == "go.mod" }
+        end
+
+        def filter_prerelease_versions(versions_array)
+          return versions_array if wants_prerelease?
+
+          versions_array.reject(&:prerelease?)
+        end
+
+        def filter_lower_versions(versions_array)
+          versions_array.
+            select { |version| version > version_class.new(dependency.version) }
+        end
+
+        def filter_ignored_versions(versions_array)
+          filtered = versions_array.
+                     reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
+          raise AllVersionsIgnored if @raise_on_ignored && filtered.empty? && versions_array.any?
+
+          filtered
+        end
+
+        def wants_prerelease?
+          @wants_prerelease ||=
+            begin
+              current_version = dependency.version
+              current_version && version_class.correct?(current_version) &&
+                version_class.new(current_version).prerelease?
+            end
+        end
+
+        def ignore_requirements
+          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
+        end
+
+        def requirement_class
+          Utils.requirement_class_for_package_manager(
+            dependency.package_manager
+          )
+        end
+
+        def version_class
+          Utils.version_class_for_package_manager(dependency.package_manager)
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.144.0
+  version: 0.145.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.144.0
+        version: 0.145.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.144.0
+        version: 0.145.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -206,6 +206,7 @@ files:
 - lib/dependabot/go_modules/requirement.rb
 - lib/dependabot/go_modules/resolvability_errors.rb
 - lib/dependabot/go_modules/update_checker.rb
+- lib/dependabot/go_modules/update_checker/latest_version_finder.rb
 - lib/dependabot/go_modules/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses: