dependabot-gradle 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0d3b612852682c36ce3d0d29211249cd1b7e1a115e24c4a1578095eac1ca6ad
-  data.tar.gz: '081d98ee31543ed861252a52278c594d71ee08d041db794325f1f080b3dfae4f'
+  metadata.gz: 5217463d5379b1769d013ce040af9eac03e0eb47e524505c86e1d3d67fc6de48
+  data.tar.gz: 739c83f7271742fe92942c8394c874c06c3d3b470003f6f636703d7ec76eeee6
 SHA512:
-  metadata.gz: '0018bf3c1476bddff7bf4871dfec0c31556f2b9e57a517db8e1c14aa8a86d3b73441a9a91f0aebddd6c2049087414e432c1517fd3cd2f6ee76596103753c6a86'
-  data.tar.gz: 1f2006691565c7ba348cd2256250f941ec5f27a982c1cda3b2669d362b6522c3765a1a9c4839f76302d8c577bae454be330906a7778b2b8f7a491c73db1791d2
+  metadata.gz: 2745a7a32084148fd05b96a323c0cc8ec428af6b06de8a8e12ad756b11c27f18f967f97475aa1eb1a143ffffe70e1ca06ca090651d4ed8b7ec85c9f9722b9ebf
+  data.tar.gz: 9273e6463194c037fab4594e48e92db6d727e1c7316501b43cca19930e6244aa2c9bdb3acff72e50f42fdb54b815d495381782ec1b527eac8d2d96dadba2441f

data/lib/dependabot/gradle/file_parser.rb

@@ -44,6 +44,7 @@ module Dependabot
       DEPENDENCY_SET_ENTRY_REGEX = /entry\s+['"](?<name>#{PART})['"]/o
       PLUGIN_BLOCK_DECLARATION_REGEX = /(?:^|\s)plugins\s*\{/
       PLUGIN_ID_REGEX = /['"](?<id>#{PART})['"]/o
+      DEPENDENCY_SUBSTITUTION_DECLARATION_REGEX = /\bdependencySubstitution\s*\{/
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
@@ -85,6 +86,153 @@ module Dependabot
                   .filter_map { |f| dependency_files.find { |bf| bf.name == f } }
       end
 
+      # Replaces the contents of string literals and comments with spaces,
+      # preserving the overall length and newline positions. This lets callers
+      # locate structural `{`/`}` braces without being confused by braces that
+      # appear inside quoted strings (e.g. `because("see issue {")`), Groovy
+      # slashy/dollar-slashy strings (`/.../`, `$/.../$`) or comments.
+      #
+      # `kotlin` selects the build-file dialect: Kotlin (`.gradle.kts`) allows
+      # nested block comments but has no slashy strings, whereas Groovy
+      # (`.gradle`) has slashy strings but non-nested block comments.
+      sig { params(content: String, kotlin: T::Boolean).returns(String) }
+      def self.mask_literals_and_comments(content, kotlin: false)
+        masked = content.dup
+        index = 0
+        length = content.length
+
+        while index < length
+          stop = literal_or_comment_end(content, index, length, kotlin: kotlin)
+          if stop
+            mask_region!(masked, content, index, stop)
+            index = stop
+          else
+            index += 1
+          end
+        end
+
+        masked
+      end
+
+      # Returns the index just past a string literal or comment that starts at
+      # `index`, or `nil` when `index` is not the start of one.
+      sig { params(content: String, index: Integer, length: Integer, kotlin: T::Boolean).returns(T.nilable(Integer)) }
+      def self.literal_or_comment_end(content, index, length, kotlin: false) # rubocop:disable Metrics/PerceivedComplexity
+        three = content[index, 3]
+        two = content[index, 2]
+        char = T.must(content[index])
+
+        if three == '"""' || three == "'''"
+          close = content.index(three, index + 3)
+          close ? close + 3 : length
+        elsif !kotlin && two == "$/"
+          dollar_slashy_string_end(content, index, length)
+        elsif char == '"' || char == "'"
+          single_quote_string_end(content, index, char, length)
+        elsif two == "//"
+          content.index("\n", index) || length
+        elsif two == "/*"
+          block_comment_end(content, index, length, nested: kotlin)
+        elsif !kotlin && char == "/" && slashy_string_start?(content, index)
+          slashy_string_end(content, index, length)
+        end
+      end
+
+      # Finds the index just past the closing `*/` of a block comment starting at
+      # `start_index`. Kotlin (`.gradle.kts`) permits nested `/*`/`*/` pairs;
+      # Groovy closes at the first `*/`.
+      sig { params(content: String, start_index: Integer, length: Integer, nested: T::Boolean).returns(Integer) }
+      def self.block_comment_end(content, start_index, length, nested: false)
+        depth = 1
+        stop = start_index + 2
+        while stop < length
+          pair = content[stop, 2]
+          if nested && pair == "/*"
+            depth += 1
+            stop += 2
+          elsif pair == "*/"
+            depth -= 1
+            stop += 2
+            return stop if depth.zero?
+          else
+            stop += 1
+          end
+        end
+        length
+      end
+
+      # Finds the index just past the closing quote of a single-quoted (`'` or
+      # `"`) string literal starting at `start_index`, honouring backslash escapes.
+      sig { params(content: String, start_index: Integer, quote: String, length: Integer).returns(Integer) }
+      def self.single_quote_string_end(content, start_index, quote, length)
+        stop = start_index + 1
+        while stop < length
+          char = content[stop]
+          if char == "\\"
+            stop += 2
+          elsif char == quote
+            return stop + 1
+          else
+            stop += 1
+          end
+        end
+        stop
+      end
+
+      # Finds the index just past the closing `/` of a Groovy slashy string
+      # (`/.../`) starting at `start_index`. Only `\/` escapes the delimiter.
+      sig { params(content: String, start_index: Integer, length: Integer).returns(Integer) }
+      def self.slashy_string_end(content, start_index, length)
+        stop = start_index + 1
+        while stop < length
+          if content[stop] == "\\" && content[stop + 1] == "/"
+            stop += 2
+          elsif content[stop] == "/"
+            return stop + 1
+          else
+            stop += 1
+          end
+        end
+        stop
+      end
+
+      # Finds the index just past the closing `/$` of a Groovy dollar-slashy
+      # string (`$/.../$`) starting at `start_index`. `$$` and `$/` are escapes.
+      sig { params(content: String, start_index: Integer, length: Integer).returns(Integer) }
+      def self.dollar_slashy_string_end(content, start_index, length)
+        stop = start_index + 2
+        while stop < length
+          pair = content[stop, 2]
+          if pair == "$$" || pair == "$/"
+            stop += 2
+          elsif pair == "/$"
+            return stop + 2
+          else
+            stop += 1
+          end
+        end
+        stop
+      end
+
+      # A `/` begins a slashy string (rather than a division operator) only when
+      # a value is expected, i.e. the previous non-space character is not the end
+      # of an identifier, number, or closing bracket.
+      sig { params(content: String, index: Integer).returns(T::Boolean) }
+      def self.slashy_string_start?(content, index)
+        position = index - 1
+        position -= 1 while position >= 0 && (content[position] == " " || content[position] == "\t")
+        return true if position.negative?
+
+        !T.must(content[position]).match?(/[\w)\]}]/)
+      end
+
+      sig { params(masked: String, original: String, start_index: Integer, stop_index: Integer).void }
+      def self.mask_region!(masked, original, start_index, stop_index)
+        (start_index...stop_index).each do |position|
+          masked[position] = original[position] == "\n" ? "\n" : " "
+        end
+      end
+
       sig { returns(Ecosystem) }
       def ecosystem
         @ecosystem ||= T.let(
@@ -510,11 +658,22 @@ module Dependabot
 
       sig { params(buildfile: Dependabot::DependencyFile).returns(String) }
       def prepared_content(buildfile)
+        # Remove any dependencySubstitution blocks first, before the comment
+        # regexes below run. The coordinates inside `substitute module(...) using
+        # module(...)` rules are substitution targets, not real dependency
+        # declarations, and must not be updated. Braces inside strings/comments
+        # are masked so the matching closing brace is located correctly, and each
+        # block is deleted by its exact offsets. Doing this before the comment
+        # stripping keeps string literals intact so the masker can see them.
+        prepared_content = remove_dependency_substitution_blocks(
+          T.must(buildfile.content),
+          kotlin: buildfile.name.end_with?(".kts")
+        )
+
         # Remove any comments
-        prepared_content =
-          T.must(buildfile.content)
-           .gsub(%r{(?<=^|\s)//.*$}, "\n")
-           .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
+        prepared_content = prepared_content
+                           .gsub(%r{(?<=^|\s)//.*$}, "\n")
+                           .gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
 
         # Remove the dependencyVerification section added by Gradle Witness
         # (TODO: Support updating this in the FileUpdater)
@@ -527,6 +686,21 @@ module Dependabot
         prepared_content
       end
 
+      sig { params(content: String, kotlin: T::Boolean).returns(String) }
+      def remove_dependency_substitution_blocks(content, kotlin: false)
+        result = content.dup
+        masked = FileParser.mask_literals_and_comments(content, kotlin: kotlin)
+        block_ranges = T.let([], T::Array[T::Range[Integer]])
+        masked.to_enum(:scan, DEPENDENCY_SUBSTITUTION_DECLARATION_REGEX).each do
+          mtch = T.must(Regexp.last_match)
+          start_index = mtch.begin(0)
+          end_index = mtch.end(0) + closing_bracket_index(T.must(masked[mtch.end(0)..]))
+          block_ranges << (start_index..end_index)
+        end
+        block_ranges.reverse_each { |range| result[range] = "" }
+        result
+      end
+
       sig { params(string: String).returns(Integer) }
       def closing_bracket_index(string)
         closes_required = 1

data/lib/dependabot/gradle/file_updater.rb

@@ -19,6 +19,12 @@ module Dependabot
 
       SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
 
+      # Matches the start of a Gradle dependency substitution block, e.g.
+      #   resolutionStrategy.dependencySubstitution {
+      # Coordinates inside such a block are substitution targets, not real
+      # dependency declarations, and must never be rewritten.
+      SUBSTITUTION_BLOCK_START_REGEX = /\bdependencySubstitution\s*\{/
+
       sig { override.returns(T::Array[::Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = buildfiles.dup
@@ -254,31 +260,70 @@ module Dependabot
         # single line.
         file = T.must(requirement.file)
         buildfile = T.must(buildfiles.find { |f| f.name == file })
+        content = T.must(buildfile.content)
+        substitution_ranges = substitution_block_line_ranges(content, kotlin: file.end_with?(".kts"))
+
+        content.lines.each_with_index.filter_map do |line, index|
+          next if substitution_ranges.any? { |range| range.cover?(index) }
 
-        T.must(buildfile.content).lines.select do |line|
-          line = evaluate_properties(line, buildfile)
-          line = line.gsub(%r{(?<=^|\s)//.*$}, "")
+          evaluated = evaluate_properties(line, buildfile)
+          evaluated = evaluated.gsub(%r{(?<=^|\s)//.*$}, "")
 
           if dependency.name.include?(":")
             dep_parts = dependency.name.split(":")
-            next false unless line.include?(T.must(dep_parts.first)) || line.include?(T.must(dep_parts.last))
+            next unless evaluated.include?(T.must(dep_parts.first)) || evaluated.include?(T.must(dep_parts.last))
           elsif file.end_with?(".properties")
             property = requirement.source_string("property")
-            next false unless property && line.start_with?(property)
+            next unless property && evaluated.start_with?(property)
           elsif file.end_with?(".toml")
-            next false unless line.include?(dependency.name)
+            next unless evaluated.include?(dependency.name)
           else
             name_regex_value = /['"]#{Regexp.quote(dependency.name)}['"]/
             name_regex = /(id|kotlin)(\s+#{name_regex_value}|\(#{name_regex_value}\))/
-            next false unless line.match?(name_regex)
+            next unless evaluated.match?(name_regex)
           end
 
-          line.include?(T.must(requirement.requirement_string))
+          line if evaluated.include?(T.must(requirement.requirement_string))
         end
       end
       # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
 
+      # Returns the (0-based) line-index ranges covered by dependencySubstitution
+      # blocks, so lines inside them can be excluded regardless of formatting.
+      # Braces inside strings/comments are masked so the matching closing brace
+      # is located correctly.
+      sig { params(content: String, kotlin: T::Boolean).returns(T::Array[T::Range[Integer]]) }
+      def substitution_block_line_ranges(content, kotlin: false)
+        ranges = T.let([], T::Array[T::Range[Integer]])
+        masked = Gradle::FileParser.mask_literals_and_comments(content, kotlin: kotlin)
+
+        masked.to_enum(:scan, SUBSTITUTION_BLOCK_START_REGEX).each do
+          match = T.must(Regexp.last_match)
+          start_offset = match.begin(0)
+          close_offset = match.end(0) + closing_bracket_index(T.must(masked[match.end(0)..]))
+
+          start_line = T.must(masked[0...start_offset]).count("\n")
+          end_line = T.must(masked[0..close_offset]).count("\n")
+          ranges << (start_line..end_line)
+        end
+
+        ranges
+      end
+
+      sig { params(string: String).returns(Integer) }
+      def closing_bracket_index(string)
+        closes_required = 1
+
+        string.chars.each_with_index do |char, index|
+          closes_required += 1 if char == "{"
+          closes_required -= 1 if char == "}"
+          return index if closes_required.zero?
+        end
+
+        0
+      end
+
       sig { params(string: String, buildfile: Dependabot::DependencyFile).returns(String) }
       def evaluate_properties(string, buildfile)
         result = string.dup

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -192,19 +192,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib