dependabot-gradle 0.312.0 → 0.313.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 621540584e386591761665df154e0c16ff5335ffe212355fcb9075e5d8f9bfe2
-  data.tar.gz: 55d0c4313b53bfe228973dcd660d6d0b719788a96531ab1bdec60e9ebe99bbe8
+  metadata.gz: 4226dd4d48a3901cf8ed98892067b901e1a9ab048e72596d939e9b7d4d416226
+  data.tar.gz: 102eabde5d58e0f40278382bfff3197cf31476ff37b53295be697033992fd1fd
 SHA512:
-  metadata.gz: b29fc92a8d63fcff1c84491049698dd9b99a4003055f44d41ea82fa360d936ab0b8613252789638365520dff403a216b20b641bd0c6c63e961f09311069a3c82
-  data.tar.gz: '08784e7dac80ac6f5f647d29b738bf9f013fc2a695ef340515a6260f11290b100212d96407249dfcf5960c5a20d14e9feaaeb41d6aa0775f693c7b34c802fd3c'
+  metadata.gz: e5de5020a56e21ceb8b6b6bbca4c755abea5ccabf012a82bbe22fd4bfb3586f4246b2262a5bae43869b21b7271f0c26d44130fbc49f69ae5d7039bf616494da0
+  data.tar.gz: ac6abd8571f5457ee58d7474eb4e79cf414a11ff9ee94adb57c8e8e27b610f792e6c4d9f21344d15129b8835b8c1dfb8d02fa056a19a07b531f53b9917463677

data/lib/dependabot/gradle/package/package_details_fetcher.rb

@@ -0,0 +1,368 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/shared_helpers"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/gradle/file_parser/repositories_finder"
+require "dependabot/gradle/update_checker"
+require "dependabot/gradle/version"
+require "dependabot/gradle/requirement"
+require "dependabot/maven/utils/auth_headers_finder"
+require "sorbet-runtime"
+require "dependabot/gradle/metadata_finder"
+
+module Dependabot
+  module Gradle
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        CENTRAL_REPO_URL = "https://repo.maven.apache.org/maven2"
+        KOTLIN_PLUGIN_REPO_PREFIX = "org.jetbrains.kotlin"
+        TYPE_SUFFICES = %w(jre android java native_mt agp).freeze
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            forbidden_urls: T.nilable(T::Array[String])
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, forbidden_urls:)
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+          @forbidden_urls = forbidden_urls
+
+          @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @google_version_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @dependency_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :credentials
+
+        sig { returns(T.nilable(T::Array[String])) }
+        attr_reader :forbidden_urls
+
+        # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
+        sig do
+          returns(T::Array[T::Hash[String, T.untyped]])
+        end
+        def fetch_available_versions
+          release_date_info = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
+          package_releases = T.let([], T::Array[T::Hash[String, T.untyped]])
+
+          version_details =
+            repositories.map do |repository_details|
+              url = repository_details.fetch("url")
+
+              next google_version_details if url == Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO
+
+              dependency_metadata(repository_details).css("versions > version")
+                                                     .select { |node| version_class.correct?(node.content) }
+                                                     .map { |node| version_class.new(node.content) }
+                                                     .map do |version|
+                { version: version, source_url: url }
+              end
+            end.flatten.compact
+
+          version_details = version_details.sort_by { |details| details.fetch(:version) }
+          release_date_info = release_details
+
+          version_details.map do |info|
+            version = info[:version]&.to_s
+
+            package_releases << {
+              version: Gradle::Version.new(version),
+              released_at: release_date_info.none? ? nil : (release_date_info[version]&.fetch(:release_date) || nil),
+              source_url: info[:source_url]
+            }
+          end
+          if version_details.none? && T.must(forbidden_urls).any?
+            raise PrivateSourceAuthenticationFailure,
+                  T.must(forbidden_urls).first
+          end
+          # version_details
+
+          package_releases
+        end
+        # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity
+
+        sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
+        def release_details
+          release_date_info = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
+
+          begin
+            repositories.map do |repository_details|
+              url = repository_details.fetch("url")
+              next unless url == Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
+
+              release_info_metadata(repository_details).css("a[title]").each do |link|
+                version_string = link["title"]
+                version = version_string.gsub(%r{/$}, "")
+                raw_date_text = link.next.text.strip.split("\n").last.strip
+
+                release_date = begin
+                  Time.parse(raw_date_text)
+                rescue StandardError
+                  nil
+                end
+
+                next unless version && version_class.correct?(version)
+
+                release_date_info[version] = {
+                  release_date: release_date
+                }
+              end
+            end
+
+            release_date_info
+          rescue StandardError
+            Dependabot.logger.error("Failed to get release date")
+            {}
+          end
+        end
+
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        def repositories
+          return @repositories if @repositories
+
+          details = if plugin?
+                      T.must(plugin_repository_details) +
+                        credentials_repository_details
+                    else
+                      dependency_repository_details +
+                        credentials_repository_details
+                    end
+
+          @repositories =
+            details.reject do |repo|
+              next if repo["auth_headers"]
+
+              # Reject this entry if an identical one with non-empty auth_headers exists
+              details.any? { |r| r["url"] == repo["url"] && r["auth_headers"] != {} }
+            end
+        end
+
+        sig { returns(T.any(T::Array[T::Hash[String, T.untyped]], NilClass)) }
+        def google_version_details
+          url = Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO
+          group_id, artifact_id = group_and_artifact_ids
+
+          dependency_metadata_url = "#{Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO}/" \
+                                    "#{T.must(group_id).tr('.', '/')}/" \
+                                    "group-index.xml"
+
+          @google_version_details ||=
+            begin
+              response = Dependabot::RegistryClient.get(url: dependency_metadata_url)
+              Nokogiri::XML(response.body)
+            end
+
+          xpath = "/#{group_id}/#{artifact_id}"
+          return unless @google_version_details.at_xpath(xpath)
+
+          @google_version_details.at_xpath(xpath)
+                                 .attributes.fetch("versions")
+                                 .value.split(",")
+                                 .select { |v| version_class.correct?(v) }
+                                 .map { |v| version_class.new(v) }
+                                 .map { |version| { version: version, source_url: url } }
+        rescue Nokogiri::XML::XPath::SyntaxError
+          nil
+        end
+
+        sig { params(repository_details: T::Hash[T.untyped, T.untyped]).returns(T.untyped) }
+        def dependency_metadata(repository_details)
+          @dependency_metadata ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+          @dependency_metadata[repository_details.hash] ||=
+            begin
+              response = Dependabot::RegistryClient.get(
+                url: dependency_metadata_url(repository_details.fetch("url")),
+                headers: repository_details.fetch("auth_headers")
+              )
+
+              check_response(response, repository_details.fetch("url"))
+              Nokogiri::XML(response.body)
+            rescue URI::InvalidURIError
+              Nokogiri::XML("")
+            rescue Excon::Error::Socket, Excon::Error::Timeout,
+                   Excon::Error::TooManyRedirects
+              raise if central_repo_urls.include?(repository_details["url"])
+
+              Nokogiri::XML("")
+            end
+        end
+
+        sig { params(repository_details: T::Hash[T.untyped, T.untyped]).returns(T.untyped) }
+        def release_info_metadata(repository_details)
+          @release_info_metadata ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+          @release_info_metadata[repository_details.hash] ||=
+            begin
+              response = Dependabot::RegistryClient.get(
+                url: dependency_metadata_url(repository_details.fetch("url")).gsub("maven-metadata.xml", ""),
+                headers: repository_details.fetch("auth_headers")
+              )
+
+              check_response(response, repository_details.fetch("url"))
+              Nokogiri::XML(response.body)
+            rescue URI::InvalidURIError
+              Nokogiri::XML("")
+            rescue Excon::Error::Socket, Excon::Error::Timeout,
+                   Excon::Error::TooManyRedirects
+              raise if central_repo_urls.include?(repository_details["url"])
+
+              Nokogiri::XML("")
+            end
+        end
+
+        sig { returns(T.untyped) }
+        def repository_urls
+          plugin? ? plugin_repository_details : dependency_repository_details
+        end
+
+        sig { params(response: T.untyped, repository_url: T.untyped).returns(T.nilable(T::Array[T.untyped])) }
+        def check_response(response, repository_url)
+          return unless response.status == 401 || response.status == 403
+          return if T.must(@forbidden_urls).include?(repository_url)
+          return if central_repo_urls.include?(repository_url)
+
+          T.must(@forbidden_urls) << repository_url
+        end
+
+        sig { returns(T::Array[T.untyped]) }
+        def credentials_repository_details
+          credentials
+            .select { |cred| cred["type"] == "maven_repository" }
+            .map do |cred|
+            {
+              "url" => cred.fetch("url").gsub(%r{/+$}, ""),
+              "auth_headers" => auth_headers(cred.fetch("url").gsub(%r{/+$}, ""))
+            }
+          end
+        end
+
+        sig { returns(T::Array[T.untyped]) }
+        def dependency_repository_details
+          requirement_files =
+            dependency.requirements
+                      .map { |r| r.fetch(:file) }
+                      .map { |nm| dependency_files.find { |f| f.name == nm } }
+
+          @dependency_repository_details ||=
+            requirement_files.flat_map do |target_file|
+              Gradle::FileParser::RepositoriesFinder.new(
+                dependency_files: dependency_files,
+                target_dependency_file: target_file
+              ).repository_urls
+                                                    .map do |url|
+                { "url" => url, "auth_headers" => {} }
+              end
+            end.uniq
+        end
+
+        sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+        def plugin_repository_details
+          [{
+            "url" => Gradle::FileParser::RepositoriesFinder::GRADLE_PLUGINS_REPO,
+            "auth_headers" => {}
+          }] + dependency_repository_details
+        end
+
+        sig { params(comparison_version: T.untyped).returns(T::Boolean) }
+        def matches_dependency_version_type?(comparison_version)
+          return true unless dependency.version
+
+          current_type = T.must(dependency.version)
+                          .gsub("native-mt", "native_mt")
+                          .split(/[.\-]/)
+                          .find do |type|
+            Dependabot::Gradle::UpdateChecker::VersionFinder::TYPE_SUFFICES.find { |s| type.include?(s) }
+          end
+
+          version_type = comparison_version.to_s
+                                           .gsub("native-mt", "native_mt")
+                                           .split(/[.\-]/)
+                                           .find do |type|
+            Dependabot::Gradle::UpdateChecker::VersionFinder::TYPE_SUFFICES.find { |s| type.include?(s) }
+          end
+
+          current_type == version_type
+        end
+
+        sig { returns(T::Array[T.untyped]) }
+        def pom
+          filename = T.must(dependency.requirements.first).fetch(:file)
+          dependency_files.find { |f| f.name == filename }
+        end
+
+        sig { params(repository_url: T.untyped).returns(String) }
+        def dependency_metadata_url(repository_url)
+          group_id, artifact_id = group_and_artifact_ids
+          group_id = "#{Dependabot::Gradle::MetadataFinder::KOTLIN_PLUGIN_REPO_PREFIX}.#{group_id}" if kotlin_plugin?
+
+          "#{repository_url}/" \
+            "#{T.must(group_id).tr('.', '/')}/" \
+            "#{artifact_id}/" \
+            "maven-metadata.xml"
+        end
+
+        sig { returns(T::Array[String]) }
+        def group_and_artifact_ids
+          if kotlin_plugin?
+            [dependency.name,
+             "#{Dependabot::Gradle::MetadataFinder::KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"]
+          elsif plugin?
+            [dependency.name, "#{dependency.name}.gradle.plugin"]
+          else
+            dependency.name.split(":")
+          end
+        end
+
+        sig { returns(T::Boolean) }
+        def plugin?
+          dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
+        end
+
+        sig { returns(T.nilable(T::Boolean)) }
+        def kotlin_plugin?
+          plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
+        end
+
+        sig { returns(T::Array[String]) }
+        def central_repo_urls
+          central_url_without_protocol =
+            Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
+            .gsub(%r{^.*://}, "")
+
+          %w(http:// https://).map { |p| p + central_url_without_protocol }
+        end
+
+        sig { returns(T.class_of(Dependabot::Version)) }
+        def version_class
+          dependency.version_class
+        end
+
+        sig { returns(Dependabot::Maven::Utils::AuthHeadersFinder) }
+        def auth_headers_finder
+          @auth_headers_finder ||= T.let(Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials),
+                                         T.nilable(Dependabot::Maven::Utils::AuthHeadersFinder))
+        end
+
+        sig { params(maven_repo_url: String).returns(T::Hash[String, String]) }
+        def auth_headers(maven_repo_url)
+          auth_headers_finder.auth_headers(maven_repo_url)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -10,43 +10,80 @@ require "dependabot/gradle/version"
 require "dependabot/gradle/requirement"
 require "dependabot/maven/utils/auth_headers_finder"
 require "sorbet-runtime"
+require "dependabot/gradle/package/package_details_fetcher"
+require "dependabot/package/package_latest_version_finder"
 
 module Dependabot
   module Gradle
     class UpdateChecker
-      class VersionFinder
+      class VersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
         KOTLIN_PLUGIN_REPO_PREFIX = "org.jetbrains.kotlin"
         TYPE_SUFFICES = %w(jre android java native_mt agp).freeze
 
+        sig do
+          params(dependency: Dependabot::Dependency, dependency_files: T::Array[Dependabot::DependencyFile],
+                 credentials: T::Array[Dependabot::Credential], ignored_versions: T::Array[String],
+                 security_advisories: T::Array[Dependabot::SecurityAdvisory], raise_on_ignored: T::Boolean,
+                 cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)).void
+        end
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
-                       security_advisories:)
+                       ignored_versions:,
+                       security_advisories:, raise_on_ignored: false, cooldown_options: nil)
+          @security_advisories = security_advisories
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
-          @ignored_versions    = ignored_versions
           @raise_on_ignored    = raise_on_ignored
-          @security_advisories = security_advisories
-          @forbidden_urls      = []
+          @forbidden_urls      = T.let([], T::Array[T.untyped])
+          @ignored_versions    = ignored_versions
+
+          super(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            cooldown_options: cooldown_options,
+            raise_on_ignored: raise_on_ignored,
+            options: {}
+          )
         end
 
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
         def latest_version_details
-          possible_versions = versions
+          possible_versions = package_release(versions)
 
-          possible_versions = filter_prereleases(possible_versions)
+          possible_versions = filter_prerelease_versions(possible_versions)
           possible_versions = filter_date_based_versions(possible_versions)
           possible_versions = filter_version_types(possible_versions)
           possible_versions = filter_ignored_versions(possible_versions)
 
-          possible_versions.last
+          possible_versions = filter_cooldown_versions(possible_versions)
+
+          return unless possible_versions.any?
+
+          version_max = possible_versions.max_by(&:version)&.version
+
+          url = possible_versions.select do |v| # rubocop:disable Performance/Detect
+            v.version.to_s == version_max.to_s
+          end.last&.url
+
+          { version: version_max,
+            source_url: url }
         end
 
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_gradle)
+        end
+
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
         def lowest_security_fix_version_details
-          possible_versions = versions
+          possible_versions = package_release(versions)
 
-          possible_versions = filter_prereleases(possible_versions)
+          possible_versions = filter_prerelease_versions(possible_versions)
           possible_versions = filter_date_based_versions(possible_versions)
           possible_versions = filter_version_types(possible_versions)
           possible_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(possible_versions,
@@ -54,51 +91,53 @@ module Dependabot
           possible_versions = filter_ignored_versions(possible_versions)
           possible_versions = filter_lower_versions(possible_versions)
 
-          possible_versions.first
-        end
+          return unless possible_versions.any?
 
-        def versions
-          version_details =
-            repositories.map do |repository_details|
-              url = repository_details.fetch("url")
-              next google_version_details if url == Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO
+          version_min = possible_versions.min_by(&:version)&.version
 
-              dependency_metadata(repository_details).css("versions > version")
-                                                     .select { |node| version_class.correct?(node.content) }
-                                                     .map { |node| version_class.new(node.content) }
-                                                     .map { |version| { version: version, source_url: url } }
-            end.flatten.compact
+          url = possible_versions.select do |v| # rubocop:disable Performance/Detect
+            v.version.to_s == version_min.to_s
+          end.last&.url
 
-          raise PrivateSourceAuthenticationFailure, forbidden_urls.first if version_details.none? && forbidden_urls.any?
+          { version: version_min,
+            source_url: url }
+        end
 
-          version_details.sort_by { |details| details.fetch(:version) }
+        sig { returns(T.any(T::Array[T::Hash[String, T.untyped]], T::Array[T::Hash[Symbol, T.untyped]])) }
+        def versions
+          Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            forbidden_urls: forbidden_urls
+          ).fetch_available_versions
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[T.untyped]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[T.untyped]) }
         attr_reader :credentials
-        attr_reader :ignored_versions
+
+        sig { returns(T.nilable(T::Array[String])) }
         attr_reader :forbidden_urls
-        attr_reader :security_advisories
 
-        sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
-        def filter_prereleases(possible_versions)
-          return possible_versions if wants_prerelease?
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
 
-          filtered = possible_versions.reject { |v| v.fetch(:version).prerelease? }
-          if possible_versions.count > filtered.count
-            Dependabot.logger.info("Filtered out #{possible_versions.count - filtered.count} pre-release versions")
-          end
-          filtered
-        end
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
 
         sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_date_based_versions(possible_versions)
           return possible_versions if wants_date_based_version?
 
-          filtered = possible_versions.reject { |v| v.fetch(:version) > version_class.new(1900) }
+          filtered = possible_versions.reject { |release| release.version > version_class.new(1900) }
           if possible_versions.count > filtered.count
             Dependabot.logger.info("Filtered out #{possible_versions.count - filtered.count} date-based versions")
           end
@@ -107,15 +146,39 @@ module Dependabot
 
         sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_version_types(possible_versions)
-          filtered = possible_versions.select { |v| matches_dependency_version_type?(v.fetch(:version)) }
+          filtered = possible_versions.select { |release| matches_dependency_version_type?(release.version) }
           if possible_versions.count > filtered.count
             diff = possible_versions.count - filtered.count
-            classifier = dependency.version.split(/[.\-]/).last
+            classifier = T.must(dependency.version).split(/[.\-]/).last
             Dependabot.logger.info("Filtered out #{diff} non-#{classifier} classifier versions")
           end
           filtered
         end
 
+        sig { params(version: T::Array[T.untyped]).returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def package_release(version)
+          package_releases = []
+
+          version.map do |info|
+            package_releases << Dependabot::Package::PackageRelease.new(
+              version: info[:version],
+              released_at: info[:released_at],
+              url: info[:source_url]
+            )
+          end
+          package_releases
+        end
+
+        sig { returns(Package::PackageDetailsFetcher) }
+        def package_details_fetcher
+          @package_details_fetcher ||= T.let(Package::PackageDetailsFetcher.new(
+                                               dependency: dependency,
+                                               dependency_files: dependency_files,
+                                               credentials: credentials,
+                                               forbidden_urls: []
+                                             ), T.nilable(Dependabot::Gradle::Package::PackageDetailsFetcher))
+        end
+
         sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_ignored_versions(possible_versions)
           filtered = possible_versions
@@ -124,7 +187,7 @@ module Dependabot
             ignore_requirements = Gradle::Requirement.requirements_array(req)
             filtered =
               filtered
-              .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v.fetch(:version)) } }
+              .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v.version) } }
           end
 
           if @raise_on_ignored && filter_lower_versions(filtered).empty? &&
@@ -140,149 +203,82 @@ module Dependabot
           filtered
         end
 
-        sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
-        def filter_lower_versions(possible_versions)
-          return possible_versions unless dependency.numeric_version
-
-          possible_versions.select do |v|
-            v.fetch(:version) > dependency.numeric_version
-          end
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
         end
+        def filter_cooldown_versions(releases)
+          return releases unless cooldown_enabled?
 
-        def wants_prerelease?
-          return false unless dependency.numeric_version
+          Dependabot.logger.info("Initializing cooldown filter")
 
-          dependency.numeric_version.prerelease?
-        end
+          sorted_releases = releases.sort_by(&:version).reverse
 
-        def wants_date_based_version?
-          return false unless dependency.numeric_version
-
-          dependency.numeric_version >= version_class.new(100)
-        end
+          filtered_versions = []
+          cooldown_filtered_versions = 0
 
-        def google_version_details
-          url = Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO
-          group_id, artifact_id = group_and_artifact_ids
+          # Iterate through the sorted versions lazily, filtering out cooldown versions
+          sorted_releases.each do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_versions += 1
 
-          dependency_metadata_url = "#{Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO}/" \
-                                    "#{group_id.tr('.', '/')}/" \
-                                    "group-index.xml"
-
-          @google_version_details ||=
-            begin
-              response = Dependabot::RegistryClient.get(url: dependency_metadata_url)
-              Nokogiri::XML(response.body)
+              next
             end
 
-          xpath = "/#{group_id}/#{artifact_id}"
-          return unless @google_version_details.at_xpath(xpath)
-
-          @google_version_details.at_xpath(xpath)
-                                 .attributes.fetch("versions")
-                                 .value.split(",")
-                                 .select { |v| version_class.correct?(v) }
-                                 .map { |v| version_class.new(v) }
-                                 .map { |version| { version: version, source_url: url } }
-        rescue Nokogiri::XML::XPath::SyntaxError
-          nil
-        end
-
-        def dependency_metadata(repository_details)
-          @dependency_metadata ||= {}
-          @dependency_metadata[repository_details.hash] ||=
-            begin
-              response = Dependabot::RegistryClient.get(
-                url: dependency_metadata_url(repository_details.fetch("url")),
-                headers: repository_details.fetch("auth_headers")
-              )
-              check_response(response, repository_details.fetch("url"))
-              Nokogiri::XML(response.body)
-            rescue URI::InvalidURIError
-              Nokogiri::XML("")
-            rescue Excon::Error::Socket, Excon::Error::Timeout,
-                   Excon::Error::TooManyRedirects
-              raise if central_repo_urls.include?(repository_details["url"])
-
-              Nokogiri::XML("")
-            end
-        end
+            filtered_versions << release
+            break
+          end
 
-        def repository_urls
-          plugin? ? plugin_repository_details : dependency_repository_details
+          Dependabot.logger.info("Filtered out #{cooldown_filtered_versions} version(s) due to cooldown")
+          filtered_versions
         end
 
-        def check_response(response, repository_url)
-          return unless response.status == 401 || response.status == 403
-          return if @forbidden_urls.include?(repository_url)
-          return if central_repo_urls.include?(repository_url)
-
-          @forbidden_urls << repository_url
-        end
+        sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          unless release.released_at
+            Dependabot.logger.info("Release date not available for version #{release.version}")
+            return false
+          end
 
-        def repositories
-          return @repositories if @repositories
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
+          days = cooldown_days_for(current_version, release.version)
 
-          details = if plugin?
-                      plugin_repository_details +
-                        credentials_repository_details
-                    else
-                      dependency_repository_details +
-                        credentials_repository_details
-                    end
+          # Calculate the number of seconds passed since the release
+          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_days = passed_seconds / DAY_IN_SECONDS
 
-          @repositories =
-            details.reject do |repo|
-              next if repo["auth_headers"]
+          if passed_days < days
+            Dependabot.logger.info("Version #{release.version}, Release date: #{release.released_at}." \
+                                   " Days since release: #{passed_days} (cooldown days: #{days})")
+          end
 
-              # Reject this entry if an identical one with non-empty auth_headers exists
-              details.any? { |r| r["url"] == repo["url"] && r["auth_headers"] != {} }
-            end
+          # Check if the release is within the cooldown period
+          passed_seconds < days * DAY_IN_SECONDS
         end
 
-        def credentials_repository_details
-          credentials
-            .select { |cred| cred["type"] == "maven_repository" }
-            .map do |cred|
-            {
-              "url" => cred.fetch("url").gsub(%r{/+$}, ""),
-              "auth_headers" => auth_headers(cred.fetch("url").gsub(%r{/+$}, ""))
-            }
-          end
-        end
+        sig { returns(T::Boolean) }
+        def wants_prerelease?
+          return false unless dependency.numeric_version
 
-        def dependency_repository_details
-          requirement_files =
-            dependency.requirements
-                      .map { |r| r.fetch(:file) }
-                      .map { |nm| dependency_files.find { |f| f.name == nm } }
-
-          @dependency_repository_details ||=
-            requirement_files.flat_map do |target_file|
-              Gradle::FileParser::RepositoriesFinder.new(
-                dependency_files: dependency_files,
-                target_dependency_file: target_file
-              ).repository_urls
-                                                    .map do |url|
-                { "url" => url, "auth_headers" => {} }
-              end
-            end.uniq
+          T.must(dependency.numeric_version).prerelease?
         end
 
-        def plugin_repository_details
-          [{
-            "url" => Gradle::FileParser::RepositoriesFinder::GRADLE_PLUGINS_REPO,
-            "auth_headers" => {}
-          }] + dependency_repository_details
+        sig { returns(T::Boolean) }
+        def wants_date_based_version?
+          return false unless dependency.numeric_version
+
+          T.must(dependency.numeric_version) >= version_class.new(100)
         end
 
+        sig { params(comparison_version: T.untyped).returns(T::Boolean) }
         def matches_dependency_version_type?(comparison_version)
           return true unless dependency.version
 
-          current_type = dependency.version
-                                   .gsub("native-mt", "native_mt")
-                                   .split(/[.\-]/)
-                                   .find do |type|
+          current_type = T.must(dependency.version)
+                          .gsub("native-mt", "native_mt")
+                          .split(/[.\-]/)
+                          .find do |type|
             TYPE_SUFFICES.find { |s| type.include?(s) }
           end
 
@@ -296,58 +292,12 @@ module Dependabot
           current_type == version_type
         end
 
-        def pom
-          filename = dependency.requirements.first.fetch(:file)
-          dependency_files.find { |f| f.name == filename }
-        end
-
-        def dependency_metadata_url(repository_url)
-          group_id, artifact_id = group_and_artifact_ids
-          group_id = "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{group_id}" if kotlin_plugin?
-
-          "#{repository_url}/" \
-            "#{group_id.tr('.', '/')}/" \
-            "#{artifact_id}/" \
-            "maven-metadata.xml"
-        end
-
-        def group_and_artifact_ids
-          if kotlin_plugin?
-            [dependency.name, "#{KOTLIN_PLUGIN_REPO_PREFIX}.#{dependency.name}.gradle.plugin"]
-          elsif plugin?
-            [dependency.name, "#{dependency.name}.gradle.plugin"]
-          else
-            dependency.name.split(":")
-          end
-        end
-
-        def plugin?
-          dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
-        end
-
-        def kotlin_plugin?
-          plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
-        end
-
-        def central_repo_urls
-          central_url_without_protocol =
-            Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
-            .gsub(%r{^.*://}, "")
-
-          %w(http:// https://).map { |p| p + central_url_without_protocol }
-        end
-
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
-
-        def auth_headers_finder
-          @auth_headers_finder ||= Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials)
-        end
-
-        def auth_headers(maven_repo_url)
-          auth_headers_finder.auth_headers(maven_repo_url)
-        end
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
       end
     end
   end

data/lib/dependabot/gradle/update_checker.rb

@@ -123,6 +123,7 @@ module Dependabot
             credentials: credentials,
             ignored_versions: ignored_versions,
             raise_on_ignored: raise_on_ignored,
+            cooldown_options: update_cooldown,
             security_advisories: security_advisories
           )
       end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.312.0
+  version: 0.313.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-05-09 00:00:00.000000000 Z
+date: 2025-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.312.0
+        version: 0.313.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.312.0
+        version: 0.313.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.312.0
+        version: 0.313.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.312.0
+        version: 0.313.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,6 +266,7 @@ files:
 - lib/dependabot/gradle/file_updater/property_value_updater.rb
 - lib/dependabot/gradle/language.rb
 - lib/dependabot/gradle/metadata_finder.rb
+- lib/dependabot/gradle/package/package_details_fetcher.rb
 - lib/dependabot/gradle/package_manager.rb
 - lib/dependabot/gradle/requirement.rb
 - lib/dependabot/gradle/update_checker.rb
@@ -278,7 +279,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.312.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.313.0
 rdoc_options: []
 require_paths:
 - lib