dependabot-gradle 0.215.0 → 0.216.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e223088cfb853514d78488b2466529cf5982f0ed6428d8bbaf0b4bb6382571f
-  data.tar.gz: d4b4f1ebe4ea8083103c0b8814375ec6daa7a88a55cb2383cc108a8f861521b0
+  metadata.gz: 47c7fa3d422bfa791f48a4f796897838fc7948ac78d2129399da2a55aa2170ad
+  data.tar.gz: c33eac27a234ce45bbbbfa43068cc886e52f5efc1eda40f85f00fafecb17220c
 SHA512:
-  metadata.gz: 912a17930c34b96e1d45bdf69c7f6ede34ed850a2daf160f55e3d03f55fe37617bbdda7d71e987c1e0cec48a55274e123b4d85734b7fea8262abc47b40ae5a6c
-  data.tar.gz: ed3aca0dd819d82bdcecc6abf7d76f96fccdedcb0384e3f04c50e2e1e7c214df4d40ef90b67325b34773d0841fc8de23038412ab0e02decc583aec244300c5df
+  metadata.gz: dc31a67dafd54796e734cba8d2d7f4663e67632d3ceecb0546c91099b267ddcb95d6684a3fa15c96ad2fbe0ad8065255f78979a105991c119b42934d0040c827
+  data.tar.gz: 8a1c09a283fe04c81bf6c6ee76367a78130ef5badd7f77938f718a9a88b07e7ed085b207e8fc872a676f41b41ee1c55e9030a00ca28c42f140fe8ee3cbc3aacf

data/lib/dependabot/gradle/file_fetcher.rb

@@ -14,6 +14,10 @@ module Dependabot
       SUPPORTED_SETTINGS_FILE_NAMES =
         %w(settings.gradle settings.gradle.kts).freeze
 
+      # For now Gradle only supports libray .toml files in the main gradle folder
+      SUPPORTED_VERSION_CATALOG_FILE_PATH =
+        %w(/gradle/libs.versions.toml).freeze
+
       def self.required_files_in?(filenames)
         filenames.any? do |filename|
           SUPPORTED_BUILD_FILE_NAMES.include?(filename)
@@ -33,7 +37,7 @@ module Dependabot
       end
 
       def all_buildfiles_in_build(root_dir)
-        files = [buildfile(root_dir), settings_file(root_dir)].compact
+        files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir)].compact
         files += subproject_buildfiles(root_dir)
         files += dependency_script_plugins(root_dir)
         files + included_builds(root_dir).
@@ -82,6 +86,15 @@ module Dependabot
         end
       end
 
+      def version_catalog_file(root_dir)
+        return nil unless root_dir == "."
+
+        gradle_toml_file(root_dir)
+      rescue Dependabot::DependencyFileNotFound
+        # Catalog file is optional for Gradle
+        nil
+      end
+
       # rubocop:disable Metrics/PerceivedComplexity
       def dependency_script_plugins(root_dir)
         return [] unless buildfile(root_dir)
@@ -127,6 +140,10 @@ module Dependabot
         file
       end
 
+      def gradle_toml_file(dir)
+        find_first(dir, SUPPORTED_VERSION_CATALOG_FILE_PATH)
+      end
+
       def settings_file(dir)
         find_first(dir, SUPPORTED_SETTINGS_FILE_NAMES)
       end

data/lib/dependabot/gradle/file_parser/property_value_finder.rb

@@ -86,7 +86,7 @@ module Dependabot
           all_files = [callsite_buildfile, top_level_buildfile].concat(
             FileParser.find_includes(callsite_buildfile, dependency_files),
             FileParser.find_includes(top_level_buildfile, dependency_files)
-          )
+          ).compact
           all_files.each do |file|
             details = properties(file).fetch(property_name, nil)
             return details if details

data/lib/dependabot/gradle/file_parser.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "toml-rb"
+
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
@@ -44,7 +46,12 @@ module Dependabot
         script_plugin_files.each do |plugin_file|
           dependency_set += buildfile_dependencies(plugin_file)
         end
-        dependency_set.dependencies
+        version_catalog_file.each do |toml_file|
+          dependency_set += version_catalog_dependencies(toml_file)
+        end
+        dependency_set.dependencies.reject do |dependency|
+          dependency.version == "latest.integration" || dependency.version == "latest.release"
+        end
       end
 
       def self.find_include_names(buildfile)
@@ -62,6 +69,65 @@ module Dependabot
 
       private
 
+      def version_catalog_dependencies(toml_file)
+        dependency_set = DependencySet.new
+        parsed_toml_file = parsed_toml_file(toml_file)
+        dependency_set += version_catalog_library_dependencies(parsed_toml_file, toml_file)
+        dependency_set += version_catalog_plugin_dependencies(parsed_toml_file, toml_file)
+        dependency_set
+      end
+
+      def version_catalog_library_dependencies(parsed_toml_file, toml_file)
+        dependencies_for_declarations(parsed_toml_file["libraries"], toml_file, :details_for_library_dependency)
+      end
+
+      def version_catalog_plugin_dependencies(parsed_toml_file, toml_file)
+        dependencies_for_declarations(parsed_toml_file["plugins"], toml_file, :details_for_plugin_dependency)
+      end
+
+      def dependencies_for_declarations(declarations, toml_file, details_getter)
+        dependency_set = DependencySet.new
+        return dependency_set unless declarations
+
+        declarations.each do |_mod, declaration|
+          group, name, version = send(details_getter, declaration)
+
+          # Only support basic version and reference formats for now,
+          # refrain from updating anything else as it's likely to be a very deliberate choice.
+          next unless Gradle::Version.correct?(version) || (version.is_a?(Hash) && version.key?("ref"))
+
+          version_details = Gradle::Version.correct?(version) ? version : "$" + version["ref"]
+          details = { group: group, name: name, version: version_details }
+          dependency = dependency_from(details_hash: details, buildfile: toml_file)
+          next unless dependency
+
+          dependency_set << dependency
+        end
+        dependency_set
+      end
+
+      def details_for_library_dependency(declaration)
+        return declaration.split(":") if declaration.is_a?(String)
+
+        if declaration["module"]
+          [*declaration["module"].split(":"), declaration["version"]]
+        else
+          [declaration["group"], declaration["name"], declaration["version"]]
+        end
+      end
+
+      def details_for_plugin_dependency(declaration)
+        return ["plugins", *declaration.split(":")] if declaration.is_a?(String)
+
+        ["plugins", declaration["id"], declaration["version"]]
+      end
+
+      def parsed_toml_file(file)
+        TomlRB.parse(file.content)
+      rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
+        raise Dependabot::DependencyFileNotParseable, file.path
+      end
+
       def map_value_regex(key)
         /(?:^|\s|,|\()#{Regexp.quote(key)}(\s*=|:)\s*['"](?<value>[^'"]+)['"]/
       end
@@ -160,7 +226,7 @@ module Dependabot
           blk.lines.each do |line|
             name_regex = /(id|kotlin)(\s+#{PLUGIN_ID_REGEX}|\(#{PLUGIN_ID_REGEX}\))/o
             name = line.match(name_regex)&.named_captures&.fetch("id")
-            version_regex = /version\s+['"]?(?<version>#{VSN_PART})['"]?/o
+            version_regex = /version\s+(?<version>['"]?#{VSN_PART}['"]?)/o
             version = format_plugin_version(line.match(version_regex)&.named_captures&.fetch("version"))
             next unless name && version
 
@@ -174,7 +240,7 @@ module Dependabot
       end
 
       def format_plugin_version(version)
-        version&.match?(/^\w+$/) ? "$#{version}" : version
+        quoted?(version) ? unquote(version) : "$#{version}"
       end
 
       def extra_groups(line)
@@ -314,6 +380,12 @@ module Dependabot
         end
       end
 
+      def version_catalog_file
+        @version_catalog_file ||= dependency_files.select do |f|
+          f.name.end_with?("libs.versions.toml")
+        end
+      end
+
       def script_plugin_files
         @script_plugin_files ||=
           buildfiles.flat_map do |buildfile|
@@ -331,6 +403,14 @@ module Dependabot
           SUPPORTED_BUILD_FILE_NAMES.include?(f.name)
         end
       end
+
+      def quoted?(string)
+        string&.match?(/^['"].*['"]$/)
+      end
+
+      def unquote(string)
+        string[1..-2]
+      end
     end
   end
 end

data/lib/dependabot/gradle/file_updater.rb

@@ -112,32 +112,38 @@ module Dependabot
 
       def update_version_in_buildfile(dependency, buildfile, previous_req,
                                       requirement)
+        original_content = buildfile.content.dup
+
         updated_content =
-          buildfile.content.gsub(
-            original_buildfile_declaration(dependency, previous_req),
-            updated_buildfile_declaration(
-              dependency,
-              previous_req,
-              requirement
+          original_buildfile_declarations(dependency, previous_req).reduce(original_content) do |content, declaration|
+            content.gsub(
+              declaration,
+              updated_buildfile_declaration(
+                declaration,
+                previous_req,
+                requirement
+              )
             )
-          )
+          end
 
         raise "Expected content to change!" if updated_content == buildfile.content
 
         updated_file(file: buildfile, content: updated_content)
       end
 
-      def original_buildfile_declaration(dependency, requirement)
+      def original_buildfile_declarations(dependency, requirement)
         # This implementation is limited to declarations that appear on a
         # single line.
         buildfile = buildfiles.find { |f| f.name == requirement.fetch(:file) }
-        buildfile.content.lines.find do |line|
+        buildfile.content.lines.select do |line|
           line = evaluate_properties(line, buildfile)
           line = line.gsub(%r{(?<=^|\s)//.*$}, "")
 
           if dependency.name.include?(":")
             next false unless line.include?(dependency.name.split(":").first)
             next false unless line.include?(dependency.name.split(":").last)
+          elsif requirement.fetch(:file).end_with?(".toml")
+            next false unless line.include?(dependency.name)
           else
             name_regex_value = /['"]#{Regexp.quote(dependency.name)}['"]/
             name_regex = /(id|kotlin)(\s+#{name_regex_value}|\(#{name_regex_value}\))/
@@ -171,10 +177,10 @@ module Dependabot
           new(dependency_files: dependency_files)
       end
 
-      def updated_buildfile_declaration(dependency, previous_req, requirement)
+      def updated_buildfile_declaration(original_buildfile_declaration, previous_req, requirement)
         original_req_string = previous_req.fetch(:requirement)
 
-        original_buildfile_declaration(dependency, previous_req).gsub(
+        original_buildfile_declaration.gsub(
           original_req_string,
           requirement.fetch(:requirement)
         )

data/lib/dependabot/gradle/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
+require "dependabot/version"
 require "dependabot/utils"
-require "rubygems_version_patch"
 
 # Java versions use dots and dashes when tokenising their versions.
 # Gem::Version converts a "-" to ".pre.", so we override the `to_s` method.
@@ -10,7 +10,7 @@ require "rubygems_version_patch"
 
 module Dependabot
   module Gradle
-    class Version < Gem::Version
+    class Version < Dependabot::Version
       NULL_VALUES = %w(0 final ga).freeze
       PREFIXED_TOKEN_HIERARCHY = {
         "." => { qualifier: 1, number: 4 },

data/lib/dependabot/gradle.rb

@@ -22,6 +22,6 @@ Dependabot::Dependency.
     "gradle",
     lambda { |name|
       artifact_id = name.split(":").last
-      %w(bom library).include?(artifact_id) ? name : artifact_id
+      name.length <= 100 ? name : artifact_id
     }
   )

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.215.0
+  version: 0.216.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-07 00:00:00.000000000 Z
+date: 2023-04-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.215.0
+        version: 0.216.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.215.0
+        version: 0.216.1
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.215.0
+        version: 0.216.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.215.0
+        version: 0.216.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.7.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.7.1
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.2.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -100,70 +100,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.50.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.39.0
+        version: 1.50.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.15.0
+        version: 1.17.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.15.0
+        version: 1.17.1
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.21.0
+        version: 0.22.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.21.0
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement
@@ -196,33 +196,34 @@ dependencies:
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: '6.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.1.0
+        version: '6.1'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
+        version: '3.18'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
-description: Automated dependency management for Ruby, JavaScript, Python, PHP, Elixir,
-  Rust, Java, .NET, Elm and Go
-email: support@dependabot.com
+        version: '3.18'
+description: Dependabot-Gradle provides support for bumping Gradle packages via Dependabot.
+  If you want support for multiple package managers, you probably want the meta-gem
+  dependabot-omnibus.
+email: opensource@github.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -246,7 +247,9 @@ files:
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
-metadata: {}
+metadata:
+  issue_tracker_uri: https://github.com/dependabot/dependabot-core/issues
+  changelog_uri: https://github.com/dependabot/dependabot-core/blob/main/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -262,8 +265,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.1.0
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.26
 signing_key: 
 specification_version: 4
-summary: Gradle support for dependabot
+summary: Provides Dependabot support for Gradle
 test_files: []