dependabot-gradle 0.358.0 → 0.359.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b3efdf29f36a95768b05a29a60b6cdbcaf2a696dafa04c051f8179937ba1954
-  data.tar.gz: 685201b8c62c994f7f8e8577257a89ac5ec973d7607d2898cc3fa30aa2c85f53
+  metadata.gz: 53581bbcb12f37896f77216a05d65f0cc77d06f743af92fbcff4cae4c8dcebc9
+  data.tar.gz: 87f54434460054f754c71a16b45d2f322239992c73900969fbd0084c13a69175
 SHA512:
-  metadata.gz: a59d0c482811f8c9ecd86cc68b48b41010797935e8812780bde0ed2e07df140f06ac242cd16e343b07fab76c9573cb9d479cdbe89b006a03810f8a457b44925a
-  data.tar.gz: c7dcfc491316407a4fb5934068e2529649d113af388f87f1df244e6ae8477397e95495f9bc369b968e29ce98bbccfd63fad96743eb7289e83224be3ee631db7b
+  metadata.gz: 7a0ecf08bc4c7aaf853b184404673b4816a6a8f5d57de7f1dba500f8fc071b4ba19255b06b002723262a1087bfa74e79ad0be9a07d230727e8fdbd0da0e4b64c
+  data.tar.gz: b747b17a13d08c8900a62d5d30b2757b79db6e66b626921d8304519a20f3713d4b1e98f3cbac223e46552b1ccea0a03fb0193f73be348dd4cfaf2819b28f6d25

data/lib/dependabot/gradle/file_updater/wrapper_updater.rb

@@ -118,12 +118,21 @@ module Dependabot
           distribution_url = T.let(requirements[0]&.[](:source), T::Hash[Symbol, String])[:url]
           distribution_type = distribution_url&.match(/\b(bin|all)\b/)&.captures&.first
 
-          # --no-validate-url is required to bypass HTTP proxy issues when running ./gradlew
-          # This prevents validation failures during the wrapper update process
-          # Note: This temporarily sets validateDistributionUrl=false in gradle-wrapper.properties
-          # The original value is restored after the wrapper task completes
-          # see method `get_validate_distribution_url_option` for more details
-          args = %W(wrapper --gradle-version #{version} --no-validate-url) # see
+          args = %W(wrapper --gradle-version #{version})
+
+          # Executing the wrapper task with `validateDistributionUrl=true`,
+          # issues a HEAD request to ensure that the file exists and is reachable.
+          # Example: HEAD https://services.gradle.org/distributions/gradle-9.3.0-bin.zip
+          # Unfortunately, Dependabot's proxy does not seem to support something about this request
+          # This causes the validation to fail and the wrapper task to error out
+          # To work around this, we pass `--no-validate-url` to skip the url validation step,
+          # Note: this temporarily sets `validateDistributionUrl=false` in `gradle-wrapper.properties`.
+          # After the wrapper task completes, we restore the original value, since `--no-validate-url` would otherwise
+          # persist the change in the properties file, which is not the behavior we want for users.
+          # TODO: Investigate and fix the root cause of the proxy issue and remove this workaround
+          # See https://github.com/dependabot/dependabot-core/issues/14036
+          args += %w(--no-validate-url)
+
           args += %W(--distribution-type #{distribution_type}) if distribution_type
           args += %W(--gradle-distribution-sha256-sum #{checksum}) if checksum
           args
@@ -174,12 +183,6 @@ module Dependabot
           end
         end
 
-        # This is a consequence of the lack of proper proxy support in Gradle Wrapper
-        # During the update process, Gradle Wrapper logic will try to validate the distribution URL
-        # by performing an HTTP request. If the environment requires a proxy, this validation will fail
-        # We need to add the `--no-validate-url` the commandline args to disable this validation
-        # However, this change is persistent in the `gradle-wrapper.properties` file
-        # To avoid side effects, we read the existing value before the update and restore it afterward
         sig { params(properties_file: T.any(Pathname, String)).returns(T.nilable(String)) }
         def get_validate_distribution_url_option(properties_file)
           return nil unless File.exist?(properties_file)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.358.0
+  version: 0.359.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.358.0
+        version: 0.359.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.358.0
+        version: 0.359.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.358.0
+        version: 0.359.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.358.0
+        version: 0.359.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -285,7 +285,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.358.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.359.0
 rdoc_options: []
 require_paths:
 - lib