dependabot-gradle 0.106.25 → 0.106.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 671f6bb68662b1c15a2d2671db49fa0853ae1f58cbf0b94d098362fcc73d2ba3
-  data.tar.gz: 71841bb8d4a68544dc650bda42991a59513fa2b3883db73452fb9bdd2999c422
+  metadata.gz: f74231dc9851ed070e4894bce3287deb5c2e14d5f000e8aa409f6f64ac3bfeda
+  data.tar.gz: 1854ade31354c0a66f760b08f59130a95ff88315d0ecb7596b618e5e18f4a2ce
 SHA512:
-  metadata.gz: 78184073e2334564499a4efa3da4639f20a08c6f7a1b1d3cb83bfba8021e4b139c87ccdbe07610c72a6795184d93a2b764c8b1721cdb3d7b79405f2ed85b0e24
-  data.tar.gz: aef8bd63a1d0c9ab36f5727216a920f72890844677296463e2b1c351501870723316f61f791d44802df9f9e80d9acffdc6a24a43478a95dcb63fc2542b48ed0a
+  metadata.gz: a526f34ee922989f179f65be71488d081ec01ea5be50da7f3f16c62a079e5d7f4763bebe278e8bcae5de7eba3a6af076c2689a6a29e14f4246bca8010cbf20a1
+  data.tar.gz: 20dec11595a1344c112ac180886ac91edbe55cfc42e6013026965735277f8139dc307d6d951f9c9c1cf4f17167a11e420b7183f84d3c7e21ee272a4cf85f0a41

data/lib/dependabot/gradle/file_parser.rb

@@ -8,6 +8,9 @@ require "dependabot/shared_helpers"
 # The best Gradle documentation is at:
 # - https://docs.gradle.org/current/dsl/org.gradle.api.artifacts.dsl.
 #   DependencyHandler.html
+#
+# In addition, documentation on plugins is at:
+# - https://docs.gradle.org/current/userguide/plugins.html
 module Dependabot
   module Gradle
     class FileParser < Dependabot::FileParsers::Base
@@ -29,6 +32,9 @@ module Dependabot
       DEPENDENCY_SET_DECLARATION_REGEX =
         /(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/.freeze
       DEPENDENCY_SET_ENTRY_REGEX = /entry\s+['"](?<name>#{PART})['"]/.freeze
+      PLUGIN_BLOCK_DECLARATION_REGEX = /(?:^|\s)plugins\s*\{/.freeze
+      PLUGIN_BLOCK_ENTRY_REGEX =
+        /id\s+"(?<id>#{PART})"\s+version\s+"(?<version>#{VSN_PART})"/.freeze
 
       def parse
         dependency_set = DependencySet.new
@@ -53,6 +59,7 @@ module Dependabot
         dependency_set += shortform_buildfile_dependencies(buildfile)
         dependency_set += keyword_arg_buildfile_dependencies(buildfile)
         dependency_set += dependency_set_dependencies(buildfile)
+        dependency_set += plugin_dependencies(buildfile)
 
         dependency_set
       end
@@ -125,6 +132,34 @@ module Dependabot
         dependency_set
       end
 
+      def plugin_dependencies(buildfile)
+        dependency_set = DependencySet.new
+
+        plugin_blocks = []
+
+        prepared_content(buildfile).scan(PLUGIN_BLOCK_DECLARATION_REGEX) do
+          mch = Regexp.last_match
+          plugin_blocks <<
+            mch.post_match[0..closing_bracket_index(mch.post_match)]
+        end
+
+        plugin_blocks.each do |blk|
+          blk.lines.each do |line|
+            name    = line.match(/id\s+['"](?<id>#{PART})['"]/)&.
+                      named_captures&.fetch("id")
+            version = line.match(/version\s+['"](?<version>#{VSN_PART})['"]/)&.
+                      named_captures&.fetch("version")
+            next unless name && version
+
+            details = { name: name, group: "plugins", version: version }
+            dep = dependency_from(details_hash: details, buildfile: buildfile)
+            dependency_set << dep if dep
+          end
+        end
+
+        dependency_set
+      end
+
       def argument_from_string(string, arg_name)
         string.
           match(map_value_regex(arg_name))&.
@@ -137,7 +172,14 @@ module Dependabot
         name    = evaluated_value(details_hash[:name], buildfile)
         version = evaluated_value(details_hash[:version], buildfile)
 
-        dependency_name = "#{group}:#{name}"
+        dependency_name =
+          if group == "plugins" then name
+          else "#{group}:#{name}"
+          end
+        groups =
+          if group == "plugins" then ["plugins"]
+          else []
+          end
 
         # If we can't evaluate a property they we won't be able to
         # update this dependency
@@ -150,7 +192,7 @@ module Dependabot
             requirement: version,
             file: buildfile.name,
             source: nil,
-            groups: [],
+            groups: groups,
             metadata: dependency_metadata(details_hash, in_dependency_set)
           }],
           package_manager: "gradle"

data/lib/dependabot/gradle/file_updater.rb

@@ -128,8 +128,14 @@ module Dependabot
         buildfile.content.lines.find do |line|
           line = evaluate_properties(line, buildfile)
           line = line.gsub(%r{(?<=^|\s)//.*$}, "")
-          next false unless line.include?(dependency.name.split(":").first)
-          next false unless line.include?(dependency.name.split(":").last)
+
+          if dependency.name.include?(":")
+            next false unless line.include?(dependency.name.split(":").first)
+            next false unless line.include?(dependency.name.split(":").last)
+          else
+            name_regex = /id\s+['"]#{Regexp.quote(dependency.name)}['"]/
+            next false unless line.match?(name_regex)
+          end
 
           line.include?(requirement.fetch(:requirement))
         end

data/lib/dependabot/gradle/metadata_finder.rb

@@ -99,7 +99,11 @@ module Dependabot
       def dependency_pom_file
         return @dependency_pom_file unless @dependency_pom_file.nil?
 
-        artifact_id = dependency.name.split(":").last
+        artifact_id =
+          if plugin? then "#{dependency.name}.gradle.plugin"
+          else dependency.name.split(":").last
+          end
+
         response = Excon.get(
           "#{maven_repo_dependency_url}/"\
           "#{dependency.version}/"\
@@ -146,11 +150,18 @@ module Dependabot
       end
 
       def maven_repo_dependency_url
-        group_id, artifact_id = dependency.name.split(":")
+        group_id, artifact_id =
+          if plugin? then [dependency.name, "#{dependency.name}.gradle.plugin"]
+          else dependency.name.split(":")
+          end
 
         "#{maven_repo_url}/#{group_id.tr('.', '/')}/#{artifact_id}"
       end
 
+      def plugin?
+        dependency.requirements.any? { |r| r.fetch(:groups) == ["plugins"] }
+      end
+
       def auth_details
         cred =
           credentials.select { |c| c["type"] == "maven_repository" }.

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -12,6 +12,7 @@ module Dependabot
     class UpdateChecker
       class VersionFinder
         GOOGLE_MAVEN_REPO = "https://maven.google.com"
+        GRADLE_PLUGINS_REPO = "https://plugins.gradle.org/m2"
         TYPE_SUFFICES = %w(jre android java).freeze
 
         def initialize(dependency:, dependency_files:, ignored_versions:,
@@ -177,12 +178,16 @@ module Dependabot
         end
 
         def repository_urls
+          plugin? ? plugin_repository_urls : dependency_repository_urls
+        end
+
+        def dependency_repository_urls
           requirement_files =
             dependency.requirements.
             map { |r| r.fetch(:file) }.
             map { |nm| dependency_files.find { |f| f.name == nm } }
 
-          @repository_urls ||=
+          @dependency_repository_urls ||=
             requirement_files.flat_map do |target_file|
               Gradle::FileParser::RepositoriesFinder.new(
                 dependency_files: dependency_files,
@@ -191,6 +196,10 @@ module Dependabot
             end.uniq
         end
 
+        def plugin_repository_urls
+          [GRADLE_PLUGINS_REPO] + dependency_repository_urls
+        end
+
         def matches_dependency_version_type?(comparison_version)
           return true unless dependency.version
 
@@ -211,7 +220,12 @@ module Dependabot
         end
 
         def dependency_metadata_url(repository_url)
-          group_id, artifact_id = dependency.name.split(":")
+          group_id, artifact_id =
+            if plugin?
+              [dependency.name, "#{dependency.name}.gradle.plugin"]
+            else
+              dependency.name.split(":")
+            end
 
           "#{repository_url}/"\
           "#{group_id.tr('.', '/')}/"\
@@ -219,6 +233,10 @@ module Dependabot
           "maven-metadata.xml"
         end
 
+        def plugin?
+          dependency.requirements.any? { |r| r.fetch(:groups) == ["plugins"] }
+        end
+
         def version_class
           Gradle::Version
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.106.25
+  version: 0.106.26
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.25
+        version: 0.106.26
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.25
+        version: 0.106.26
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement