dependabot-go_modules 0.154.5 → 0.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6fabe025492fdf05d0ee350bfa88b816a14a37d6f983f2cfc0d7cf86530fbec
-  data.tar.gz: 79da77d67d26a2f6e05df6fd7a018fba037088718c427dab4baca361822cb9f0
+  metadata.gz: a22515c63450e8e75482634d205444f95891a6cd1f8b49e6eb381cb2b700ffa3
+  data.tar.gz: 364a289eecab254b2bf0da29c3a0488a0ea87774b481684f669ea4816b0ec9a9
 SHA512:
-  metadata.gz: 40d6a7b816b14956aab89c5064a19cbc17409a45415b54e20c94afbe82a85e3c73549f125081424232f101dc7a0c3e05babd54dcf6f8bca86762b0f956556570
-  data.tar.gz: 5945a8bfd6c32350fa146c31b2d6ec2947cf5a9ba60ad8c3c57f01311e8f322486e1e71ce812cbf9c27f071272e19165d4d612e9e5a37130dd91cac46bd45b48
+  metadata.gz: ead7c1289f410404d0976e62d6acd95ce9b804ab48d37272cf0c049bce665f83c26d2d1011ef8e7ccdc9d343fcd27abff55448f236268d621444563ced7ea236
+  data.tar.gz: '049c045b259382f3ec2d877a28864fb99fa8dfe0aae50859c2a58ef86db40e18961e903e9dbaa18a3bb5b875830e56fce8aac2ba2bc4e8ebb0381052bde33cc9'

data/lib/dependabot/go_modules/update_checker.rb

@@ -24,14 +24,7 @@ module Dependabot
           return version_class.new(dependency.version)
         end
 
-        @latest_resolvable_version ||=
-          LatestVersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: raise_on_ignored
-          ).latest_version
+        latest_version_finder.latest_version
       end
 
       # This is currently used to short-circuit latest_resolvable_version,
@@ -41,6 +34,22 @@ module Dependabot
         latest_resolvable_version
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        unless dependency.top_level?
+          return unless dependency.version
+
+          return version_class.new(dependency.version)
+        end
+
+        lowest_security_fix_version
+      end
+
+      def lowest_security_fix_version
+        latest_version_finder.lowest_security_fix_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Go modules uses a single dependency file
         nil
@@ -54,6 +63,18 @@ module Dependabot
 
       private
 
+      def latest_version_finder
+        @latest_version_finder ||=
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            raise_on_ignored: raise_on_ignored
+          )
+      end
+
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Go (yet)
         false

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -24,11 +24,12 @@ module Dependabot
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false)
+                       ignored_versions:, security_advisories:, raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
           @raise_on_ignored    = raise_on_ignored
         end
 
@@ -36,9 +37,13 @@ module Dependabot
           @latest_version ||= fetch_latest_version
         end
 
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
         private
 
-        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions
+        attr_reader :dependency, :dependency_files, :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version
           return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
@@ -50,6 +55,19 @@ module Dependabot
           candidate_versions.max
         end
 
+        def fetch_lowest_security_fix_version
+          return dependency.version if dependency.version =~ PSEUDO_VERSION_REGEX
+
+          relevant_versions = available_versions
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+          relevant_versions = filter_lower_versions(relevant_versions)
+
+          relevant_versions.min
+        end
+
         def available_versions
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.154.5
+  version: 0.155.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.5
+        version: 0.155.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.5
+        version: 0.155.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement