dependabot-gradle 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ac1e839adfadf5980755d1f36ee58e4e26a71c16369ad5e9e4cc67be22c3bd8
-  data.tar.gz: bd6a1439e622474c62d724cac0161f953c41451b8509b0b84abde59aeb8c3cf6
+  metadata.gz: 5c86b62e9663f82774e2b9c71c9c6adcd6b81283d2b0c80331e9eb5952aff4df
+  data.tar.gz: 0713bcd3034a64e93ade1f7598632ba5d3b081a392c631e7b6f0afe71f90de54
 SHA512:
-  metadata.gz: 1409526fb930d1d9aca7f2beeea6c3f4d60b2029b14341ba0c6e3c65479246ad4579467f6f877ec76b14069558954a1364b5475ff9b72e384ea4e77752ed1298
-  data.tar.gz: 4a188fc94783c49e1900f67d4390309876d6080ad41b5ab5ef4f527b7f730291d285c6d34e23ec23880f7a23b0c7b4709326a572eddda702bd33847e9ab74b47
+  metadata.gz: 56cd5b5d7860377e56469318fa7546991a70214529d6bc53f96ca0d7ce7f7767d30f73473995a213f64a5b50b933f79905e17b1ddfbc66a080e7f9990e70efea
+  data.tar.gz: 5e9da8492fc2fb8c540829c1c10ff7a3e1689f5bba13be4dace1f9f5a664b17a358448e98aeb7456fd198e8f482be8c1c07f93596bea2e5dc90b753ded32f682

data/lib/dependabot/gradle/file_fetcher.rb

@@ -82,8 +82,12 @@ module Dependabot
 
       private
 
-      sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
-      def all_buildfiles_in_build(root_dir)
+      # Builds can include themselves or each other (e.g. `includeBuild(".")` or a child build
+      # that includes its parent with `includeBuild("..")`), so each build is only visited once.
+      sig { params(root_dir: String, visited: T::Set[String]).returns(T::Array[DependencyFile]) }
+      def all_buildfiles_in_build(root_dir, visited = Set.new)
+        return [] unless visited.add?(root_dir)
+
         files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir), lockfile(root_dir),
                  properties_file(root_dir)]
                 .compact
@@ -94,7 +98,7 @@ module Dependabot
         files += convention_plugin_source_files(files, root_dir)
 
         files + included_builds(root_dir)
-                .flat_map { |dir| all_buildfiles_in_build(dir) }
+                .flat_map { |dir| all_buildfiles_in_build(dir, visited) }
       end
 
       # Only fetch source trees for *nested* project directories (e.g. "build-logic/convention"

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -146,13 +146,13 @@ module Dependabot
           end
 
           repository_blocks.each do |block|
-            repository_urls << GOOGLE_MAVEN_REPO if block.match?(/\sgoogle\(/)
+            repository_urls << GOOGLE_MAVEN_REPO if block.match?(/\sgoogle(?:\(|\s*\{)/)
 
-            repository_urls << central_repo_url if block.match?(/\smavenCentral\(/)
+            repository_urls << central_repo_url if block.match?(/\smavenCentral(?:\(|\s*\{)/)
 
-            repository_urls << "https://jcenter.bintray.com/" if block.match?(/\sjcenter\(/)
+            repository_urls << "https://jcenter.bintray.com/" if block.match?(/\sjcenter(?:\(|\s*\{)/)
 
-            repository_urls << GRADLE_PLUGINS_REPO if block.match?(/\sgradlePluginPortal\(/)
+            repository_urls << GRADLE_PLUGINS_REPO if block.match?(/\sgradlePluginPortal(?:\(|\s*\{)/)
 
             block.scan(MAVEN_REPO_REGEX) do
               repository_urls << T.must(T.must(Regexp.last_match).named_captures.fetch("url"))

data/lib/dependabot/gradle/file_parser.rb

@@ -41,7 +41,8 @@ module Dependabot
       DEPENDENCY_DECLARATION_REGEX = /(?:\(|\s)\s*['"](?<declaration>#{PART}:#{PART}:#{VSN_PART})['"]/o
 
       DEPENDENCY_SET_DECLARATION_REGEX = /(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/
-      DEPENDENCY_SET_ENTRY_REGEX = /entry\s+['"](?<name>#{PART})['"]/o
+      DEPENDENCY_SET_COORDINATES_REGEX = /\A\s*['"](?<group>#{PART}):(?<version>#{VSN_PART})['"]\s*\z/o
+      DEPENDENCY_SET_ENTRY_REGEX = /\bentry(?:\s+|\s*\(\s*)['"](?<name>#{PART})['"]/o
       PLUGIN_BLOCK_DECLARATION_REGEX = /(?:^|\s)plugins\s*\{/
       PLUGIN_ID_REGEX = /['"](?<id>#{PART})['"]/o
       DEPENDENCY_SUBSTITUTION_DECLARATION_REGEX = /\bdependencySubstitution\s*\{/
@@ -466,9 +467,7 @@ module Dependabot
         end
 
         dependency_set_blocks.each do |blk|
-          arguments = T.must(blk[:arguments])
-          group   = argument_from_string(arguments, "group")
-          version = argument_from_string(arguments, "version")
+          group, version = dependency_set_group_and_version(T.must(blk[:arguments]))
 
           next unless group && version
 
@@ -485,6 +484,18 @@ module Dependabot
         dependency_set
       end
 
+      # Groovy builds usually declare `dependencySet(group: 'g', version: 'v')`, while the Kotlin DSL only
+      # supports the `dependencySet("g:v")` coordinates form (which Groovy accepts as well).
+      sig { params(arguments: String).returns([T.nilable(String), T.nilable(String)]) }
+      def dependency_set_group_and_version(arguments)
+        group   = argument_from_string(arguments, "group")
+        version = argument_from_string(arguments, "version")
+        return [group, version] if group && version
+
+        coordinates = arguments.match(DEPENDENCY_SET_COORDINATES_REGEX)
+        [coordinates&.[](:group), coordinates&.[](:version)]
+      end
+
       sig { params(buildfile: Dependabot::DependencyFile).returns(DependencySet) }
       def plugin_dependencies(buildfile)
         dependency_set = DependencySet.new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib