dependabot-go_modules 0.363.0 → 0.364.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5965746c422a57549c538c2b97ce0a49b8d2d48f909a702bc0ae1c3eb8d703be
-  data.tar.gz: dac70528a9b16c8fc626876f8d624b0b83415aa55183437a37524a9796be90d1
+  metadata.gz: '0549b6632e12248926b3a3b507c6ef80e389fba47bde1cf5886f0b0493a0faad'
+  data.tar.gz: 3928257803da819ec010c35031c94ad78eeacf6effc8f495b257d9b4d95b91cd
 SHA512:
-  metadata.gz: fe95cd8a7772a0129b312a38470f8460dad450e019c7cd5364c577aab9b4d13d8850d9f68504b1fe24b5b599735857cbf25f6fc93936d62edc126bcac4b27bab
-  data.tar.gz: ef222139597a40135a9e6bf7d29c7717d1a2a868e0f49592364d2ae89a245de87a47206a20ebee567c5cdeb220536b824362d01c8e0ff64c1a4f64fda295b614
+  metadata.gz: 9ae6dd6cca4e9a0dc9e7598c44978f89fcee9fae236b852957718ef0282b7d24f0578f5ef959b37790b16168ea223c78d7fb18a42a4a50fd29cd7b6aff3ef13a
+  data.tar.gz: f9e66da88dd36e4f2da7412f276edbbe296a7745034e4c6ded7d0ec5b46b6071618c21f19b7fe57a1f24087a8dd92b007b5a9b0bc3d4012255c1d6271b633ea7

data/helpers/go.mod

@@ -1,8 +1,8 @@
 module github.com/dependabot/dependabot-core/go_modules/helpers
 
-go 1.23.0
+go 1.24.0
 
 require (
 	github.com/Masterminds/vcs v1.13.3
-	golang.org/x/mod v0.27.0
+	golang.org/x/mod v0.33.0
 )

data/helpers/go.sum

@@ -1,4 +1,4 @@
 github.com/Masterminds/vcs v1.13.3 h1:IIA2aBdXvfbIM+yl/eTnL4hb1XwdpvuQLglAix1gweE=
 github.com/Masterminds/vcs v1.13.3/go.mod h1:TiE7xuEjl1N4j016moRd6vezp6e6Lz23gypeXfzXeW8=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=

data/helpers/importresolver/main.go

@@ -1,6 +1,7 @@
 package importresolver
 
 import (
+	"net/url"
 	"os"
 	"strings"
 
@@ -20,6 +21,8 @@ func VCSRemoteForImport(args *Args) (interface{}, error) {
 		remote = "https://" + remote
 	}
 
+	remote = normalizeAzureDevOpsURL(remote)
+
 	local, err := os.MkdirTemp("", "unused-vcs-local-dir")
 	if err != nil {
 		return nil, err
@@ -34,3 +37,60 @@ func VCSRemoteForImport(args *Args) (interface{}, error) {
 	}()
 	return repo.Remote(), nil
 }
+
+func normalizeAzureDevOpsURL(remote string) string {
+	uri, err := url.Parse(remote)
+	if err != nil {
+		return remote
+	}
+
+	host := strings.ToLower(uri.Host)
+	if host != "dev.azure.com" {
+		return remote
+	}
+
+	segments := strings.Split(strings.TrimPrefix(uri.Path, "/"), "/")
+	if len(segments) < 3 {
+		return remote
+	}
+
+	normalizedSegments := segments
+	removeGitSuffix := false
+	if !strings.Contains(uri.Path, "/_git/") {
+		if len(segments) < 3 {
+			return remote
+		}
+
+		// Azure DevOps paths are /{org}/{project}/_git/{repo}[/{subdir}...].
+		// Insert "_git" after the first two segments and preserve the rest.
+		normalizedSegments = make([]string, 0, len(segments)+1)
+		normalizedSegments = append(normalizedSegments, segments[:2]...)
+		normalizedSegments = append(normalizedSegments, "_git")
+		normalizedSegments = append(normalizedSegments, segments[2:]...)
+		removeGitSuffix = true
+	}
+
+	if !removeGitSuffix {
+		uri.Path = "/" + strings.Join(normalizedSegments, "/")
+
+		return uri.String()
+	}
+
+	for i := range normalizedSegments {
+		if normalizedSegments[i] != "_git" {
+			continue
+		}
+
+		repoIndex := i + 1
+		if repoIndex >= len(normalizedSegments) {
+			return remote
+		}
+
+		normalizedSegments[repoIndex] = strings.TrimSuffix(normalizedSegments[repoIndex], ".git")
+		break
+	}
+
+	uri.Path = "/" + strings.Join(normalizedSegments, "/")
+
+	return uri.String()
+}

data/helpers/importresolver/main_test.go

@@ -13,3 +13,51 @@ func TestVCSRemoteForImport(t *testing.T) {
 		t.Fatalf("failed to get VCS remote for import %s: %v", args.Import, err)
 	}
 }
+
+func TestNormalizeAzureDevOpsURL(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "adds _git segment when missing and removes .git suffix",
+			input: "https://dev.azure.com/VaronisIO/da-cloud/be-protobuf.git",
+			want:  "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf",
+		},
+		{
+			name:  "preserves existing _git segment",
+			input: "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf",
+			want:  "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf",
+		},
+		{
+			name:  "retains .git suffix when _git already exists",
+			input: "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf.git",
+			want:  "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf.git",
+		},
+		{
+			name:  "retains .git suffix and subdirectory when _git already exists",
+			input: "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf.git/submodule",
+			want:  "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf.git/submodule",
+		},
+		{
+			name:  "preserves subdirectory while removing .git suffix",
+			input: "https://dev.azure.com/VaronisIO/da-cloud/be-protobuf.git/submodule",
+			want:  "https://dev.azure.com/VaronisIO/da-cloud/_git/be-protobuf/submodule",
+		},
+		{
+			name:  "ignores non azure hosts",
+			input: "https://github.com/dependabot/dependabot-core",
+			want:  "https://github.com/dependabot/dependabot-core",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := normalizeAzureDevOpsURL(test.input)
+			if got != test.want {
+				t.Fatalf("normalizeAzureDevOpsURL(%q) = %q, want %q", test.input, got, test.want)
+			}
+		})
+	}
+}

data/lib/dependabot/go_modules/azure_devops_path_normalizer.rb

@@ -0,0 +1,27 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module GoModules
+    module AzureDevopsPathNormalizer
+      extend T::Sig
+
+      sig { params(name: String).returns(String) }
+      def self.normalize(name)
+        return name unless name.start_with?("dev.azure.com/")
+
+        segments = name.split("/")
+        return name if segments.length < 4
+        return name if segments[3] == "_git"
+
+        normalized_segments = segments.dup
+        normalized_segments.insert(3, "_git")
+        normalized_segments[4] = normalized_segments.fetch(4).delete_suffix(".git")
+
+        normalized_segments.join("/")
+      end
+    end
+  end
+end

data/lib/dependabot/go_modules/file_updater.rb

@@ -56,7 +56,7 @@ module Dependabot
 
           vendor_updater.updated_files(base_directory: T.must(directory))
                         .each do |file|
-                          updated_files << file
+            updated_files << file
           end
         end
 

data/lib/dependabot/go_modules/package/package_details_fetcher.rb

@@ -10,6 +10,7 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
 require "dependabot/go_modules/resolvability_errors"
+require "dependabot/go_modules/azure_devops_path_normalizer"
 
 module Dependabot
   module GoModules
@@ -77,8 +78,9 @@ module Dependabot
               end
 
               # Turn off the module proxy for private dependencies
+              dependency_name = AzureDevopsPathNormalizer.normalize(dependency.name)
               versions_json = SharedHelpers.run_shell_command(
-                "go list -m -versions -json #{dependency.name}",
+                "go list -m -versions -json #{dependency_name}",
                 fingerprint: "go list -m -versions -json <dependency_name>"
               )
               version_strings = JSON.parse(versions_json)["Versions"]

data/lib/dependabot/go_modules/requirement.rb

@@ -110,14 +110,14 @@ module Dependabot
 
         req_string.split(".")
                   .map do |part|
-                    part.split("-").map.with_index do |p, i|
-                      # Before we hit a wildcard we just return the existing part
-                      next p unless p.match?(WILDCARD_REGEX) || after_wildcard
-
-                      # On or after a wildcard we replace the version part with zero
-                      after_wildcard = true
-                      i.zero? ? "0" : "a"
-                    end.join("-")
+          part.split("-").map.with_index do |p, i|
+            # Before we hit a wildcard we just return the existing part
+            next p unless p.match?(WILDCARD_REGEX) || after_wildcard
+
+            # On or after a wildcard we replace the version part with zero
+            after_wildcard = true
+            i.zero? ? "0" : "a"
+          end.join("-")
         end.join(".")
       end
 
@@ -156,7 +156,7 @@ module Dependabot
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^?v?/, "")
         parts = version.split(".")
-        upper_bound = [parts.first.to_i + 1, 0, 0, "a"].map(&:to_s).join(".")
+        upper_bound = [parts.first.to_i + 1, 0, 0, "a"].join(".")
 
         [">= #{version}", "< #{upper_bound}"]
       end

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -11,6 +11,7 @@ require "dependabot/errors"
 require "dependabot/go_modules/requirement"
 require "dependabot/go_modules/resolvability_errors"
 require "dependabot/go_modules/package/package_details_fetcher"
+require "dependabot/go_modules/azure_devops_path_normalizer"
 require "dependabot/package/package_latest_version_finder"
 
 module Dependabot
@@ -198,8 +199,9 @@ module Dependabot
         sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
         def in_cooldown_period?(release)
           begin
+            dependency_name = AzureDevopsPathNormalizer.normalize(dependency.name)
             release_info = SharedHelpers.run_shell_command(
-              "go list -m -json #{dependency.name}@#{release.details.[]('version_string')}",
+              "go list -m -json #{dependency_name}@#{release.details.[]('version_string')}",
               fingerprint: "go list -m -json <dependency_name>"
             )
           rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.363.0
+  version: 0.364.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -250,6 +250,7 @@ files:
 - helpers/main.go
 - helpers/version_test.go
 - lib/dependabot/go_modules.rb
+- lib/dependabot/go_modules/azure_devops_path_normalizer.rb
 - lib/dependabot/go_modules/dependency_grapher.rb
 - lib/dependabot/go_modules/file_fetcher.rb
 - lib/dependabot/go_modules/file_parser.rb
@@ -273,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.363.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.364.0
 rdoc_options: []
 require_paths:
 - lib