dependabot-gradle 0.140.2 → 0.142.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4b962e2796076fb9174d2a207537fe4202e27c32b45db4700bf3da4e8d62f63
-  data.tar.gz: de64ce53a58fffc75573ec68358dd7a14b7297994056994bf594e93a4f280e7f
+  metadata.gz: a5b6fa770d8e9599a20a080b3e22415f6a0e209e24966ef047e6b9e6ed6c9ef4
+  data.tar.gz: b6c8a40691d1676ae740596ff973875345306e59650faeb222f8fe1671c466b7
 SHA512:
-  metadata.gz: 5aba5a2830fc95685b5bbb156e1140af663c2426d8d8ac4f6ec66801d49307c679b350c65454eb699783640d2aa91127d1349bc7d0d1133ac6d4687dc89d4770
-  data.tar.gz: 3fb597a9635f44916b4fab0de75c801ce131dc10b0c4d09a8625051c742835457a6f17266ac6f7e1a4820a692741844042c7902bab4f1d0eb041a6a3e983a8e8
+  metadata.gz: e3b7a3d703fe107086bdf6277654cf13d2adfa1ea33414977d2f1a97d6eac5499b9982b5d0a9a5e2bf9b81644a09fb8f98ebd8c3543314eb0f3c4b580c7875b3
+  data.tar.gz: 94e957eb4160eb1a20f9faeef7ef5f58e4d1adb4d6d2982878a2662247ffb17747aaa73e307121a9af3c4acebea6a624d2c644161f483a797910a90bd0f9d601

data/lib/dependabot/gradle/metadata_finder.rb

@@ -5,6 +5,7 @@ require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/file_fetchers/base"
 require "dependabot/gradle/file_parser/repositories_finder"
+require "dependabot/maven/utils/auth_headers_finder"
 
 module Dependabot
   module Gradle
@@ -112,7 +113,7 @@ module Dependabot
           "#{dependency.version}/"\
           "#{artifact_id}-#{dependency.version}.pom",
           idempotent: true,
-          **SharedHelpers.excon_defaults(headers: auth_details)
+          **SharedHelpers.excon_defaults(headers: auth_headers)
         )
 
         @dependency_pom_file = Nokogiri::XML(response.body)
@@ -135,7 +136,7 @@ module Dependabot
           "#{version}/"\
           "#{artifact_id}-#{version}.pom",
           idempotent: true,
-          **SharedHelpers.excon_defaults(headers: auth_details)
+          **SharedHelpers.excon_defaults(headers: auth_headers)
         )
 
         Nokogiri::XML(response.body)
@@ -170,21 +171,8 @@ module Dependabot
         plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
       end
 
-      def auth_details
-        cred =
-          credentials.select { |c| c["type"] == "maven_repository" }.
-          find do |c|
-            cred_url = c.fetch("url").gsub(%r{/+$}, "")
-            next false unless cred_url == maven_repo_url
-
-            c.fetch("username", nil)
-          end
-
-        return {} unless cred
-
-        token = cred.fetch("username") + ":" + cred.fetch("password")
-        encoded_token = Base64.encode64(token).delete("\n")
-        { "Authorization" => "Basic #{encoded_token}" }
+      def auth_headers
+        @auth_headers ||= Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials).auth_headers(maven_repo_url)
       end
     end
   end

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -6,6 +6,7 @@ require "dependabot/gradle/file_parser/repositories_finder"
 require "dependabot/gradle/update_checker"
 require "dependabot/gradle/version"
 require "dependabot/gradle/requirement"
+require "dependabot/maven/utils/auth_headers_finder"
 
 module Dependabot
   module Gradle
@@ -184,10 +185,8 @@ module Dependabot
             begin
               response = Excon.get(
                 dependency_metadata_url(repository_details.fetch("url")),
-                user: repository_details.fetch("username"),
-                password: repository_details.fetch("password"),
                 idempotent: true,
-                **SharedHelpers.excon_defaults
+                **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
               )
               check_response(response, repository_details.fetch("url"))
               Nokogiri::XML(response.body)
@@ -226,10 +225,10 @@ module Dependabot
 
           @repositories =
             details.reject do |repo|
-              next if repo["password"]
+              next if repo["auth_headers"]
 
-              # Reject this entry if an identical one with a password exists
-              details.any? { |r| r["url"] == repo["url"] && r["password"] }
+              # Reject this entry if an identical one with non-empty auth_headers exists
+              details.any? { |r| r["url"] == repo["url"] && r["auth_headers"] != {} }
             end
         end
 
@@ -239,8 +238,7 @@ module Dependabot
             map do |cred|
             {
               "url" => cred.fetch("url").gsub(%r{/+$}, ""),
-              "username" => cred.fetch("username", nil),
-              "password" => cred.fetch("password", nil)
+              "auth_headers" => auth_headers(cred.fetch("url").gsub(%r{/+$}, ""))
             }
           end
         end
@@ -258,7 +256,7 @@ module Dependabot
                 target_dependency_file: target_file
               ).repository_urls.
                 map do |url|
-                  { "url" => url, "username" => nil, "password" => nil }
+                  { "url" => url, "auth_headers" => {} }
                 end
             end.uniq
         end
@@ -266,8 +264,7 @@ module Dependabot
         def plugin_repository_details
           [{
             "url" => GRADLE_PLUGINS_REPO,
-            "username" => nil,
-            "password" => nil
+            "auth_headers" => {}
           }] + dependency_repository_details
         end
 
@@ -333,6 +330,14 @@ module Dependabot
         def version_class
           Gradle::Version
         end
+
+        def auth_headers_finder
+          @auth_headers_finder ||= Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials)
+        end
+
+        def auth_headers(maven_repo_url)
+          auth_headers_finder.auth_headers(maven_repo_url)
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.140.2
+  version: 0.142.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-08 00:00:00.000000000 Z
+date: 2021-04-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.140.2
+        version: 0.142.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.140.2
+        version: 0.142.1
+- !ruby/object:Gem::Dependency
+  name: dependabot-maven
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.142.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.142.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -220,7 +234,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: Gradle support for dependabot