dependabot-linguist 0.217.0 → 0.303.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. checksums.yaml +4 -4
  2. data/.nvmrc +1 -0
  3. data/.rubocop.yml +100 -7
  4. data/.ruby-version +1 -0
  5. data/CONTRIBUTING.md +2 -0
  6. data/Gemfile.lock +261 -145
  7. data/Makefile +90 -18
  8. data/README.md +32 -4
  9. data/SECURITY.md +1 -0
  10. data/dependabot-linguist.gemspec +19 -11
  11. data/lib/dependabot/linguist/dependabot_patch.rb +2 -2
  12. data/lib/dependabot/linguist/file_fetchers/bundler.rb +1 -1
  13. data/lib/dependabot/linguist/file_fetchers/git_submodules.rb +4 -4
  14. data/lib/dependabot/linguist/file_fetchers/go_modules.rb +1 -1
  15. data/lib/dependabot/linguist/language.rb +3 -3
  16. data/lib/dependabot/linguist/languages_to_ecosystems/contexts.rb +24 -21
  17. data/lib/dependabot/linguist/languages_to_ecosystems/contexts_applied.rb +1 -1
  18. data/lib/dependabot/linguist/languages_to_ecosystems/languages.yaml +672 -42
  19. data/lib/dependabot/linguist/languages_to_ecosystems/manager_ecosystem_maps.rb +33 -21
  20. data/lib/dependabot/linguist/languages_to_patch.txt +1 -0
  21. data/lib/dependabot/linguist/linguist_patch.rb +1 -1
  22. data/lib/dependabot/linguist/repository.rb +5 -1
  23. data/lib/dependabot/linguist/version.rb +1 -1
  24. metadata +62 -20
data/README.md CHANGED
@@ -2,10 +2,16 @@
2
2
  Use [linguist](https://github.com/github/linguist) to check the contents of a **local** repository, and then scan for [dependabot-core](https://github.com/dependabot/dependabot-core) ecosystems relevant to those languages! With the list of [ecosystems](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem) present in a repository, add a [dependabot.y[a]ml](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates) ([configuration file](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)).
3
3
  ## Getting Started
4
4
  ### [Linguist dependencies](https://github.com/github/linguist#dependencies);
5
- Before installing this gem, which will install the [github-linguist gem](https://rubygems.org/gems/github-linguist), linguists dependencies should be installed. A number of these are enabling [rugged](https://rubygems.org/gems/rugged), so they can't be "ignored" like [dependabot's setup](https://github.com/dependabot/dependabot-core#setup), which _can_ be ignored for the purpose of **this** gem, which only intends to use the [file fetchers](https://github.com/dependabot/dependabot-core/blob/v0.217.0/common/lib/dependabot/file_fetchers/README.md).
5
+ Before installing this gem, which will install the [github-linguist gem](https://rubygems.org/gems/github-linguist), linguists dependencies should be installed. A number of these are enabling [rugged](https://rubygems.org/gems/rugged), so they can't be "ignored" like [dependabot's setup](https://github.com/dependabot/dependabot-core#setup), which _can_ be ignored for the purpose of **this** gem, which only intends to use the [file fetchers](https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/README.md).
6
6
  ```bash
7
7
  sudo apt-get install build-essential cmake pkg-config libicu-dev zlib1g-dev libcurl4-openssl-dev libssl-dev ruby-dev
8
8
  ```
9
+ ### Dependabot dependencies;
10
+ The `npm`/`yarn` module requires [`corepack`](https://www.npmjs.com/package/corepack), so it will be necessary to install, either with npm or yarn. Ensuring you have the _right version_ of `corepack` is important. Your best bet is to ensure you have the latest version.
11
+ ```bash
12
+ nvm install 22 && nvm use 22 && npm i -g corepack@latest
13
+ # you'll need to `nvm use 22` to load that node before running this gem
14
+ ```
9
15
  ### Install _this_
10
16
  [To install the latest from RubyGems](https://rubygems.org/gems/dependabot-linguist);
11
17
  ```sh
@@ -22,12 +28,12 @@ bundle add dependabot-linguist
22
28
  ```
23
29
  Or add the following line to your `Gemfile` manually
24
30
  ```ruby
25
- gem "dependabot-linguist", ">= 0.217.0
31
+ gem "dependabot-linguist", ">= 0.303.0
26
32
  ```
27
33
  [Add the GitHub hosted gem](https://github.com/Skenvy/dependabot-linguist/packages/1704407);
28
34
  ```ruby
29
35
  source "https://rubygems.pkg.github.com/skenvy" do
30
- gem "dependabot-linguist", ">= 0.217.0"
36
+ gem "dependabot-linguist", ">= 0.303.0"
31
37
  end
32
38
  ```
33
39
  ### Setup external CLIs
@@ -89,9 +95,31 @@ ignore:
89
95
  ```
90
96
  ## [RDoc generated docs](https://skenvy.github.io/dependabot-linguist/)
91
97
  ## Developing
98
+ ### Install Ruby
99
+ You will need to install [rvm](https://rvm.io/) and one of its [ruby binaries](https://rvm.io/binaries/).
100
+
101
+ You'll also need to set the `RVM_DIR` in your shell profile e.g. [like this](https://github.com/Skenvy/dotfiles/blob/1de61272c588a30b634a03a7d304ef51e40c72f1/.bash_login#L17). RVM will set some basic initialisation in your shell profile, but changing what it sets to instead use `RVM_DIR` like this allows you to install it somewhere other than the default.
102
+
103
+ The `make setup` in [first time setup](#the-first-time-setup) will install the intended development version for you, but it might not be a precompiled binary, depending on your OS and architecture ~ if it isn't precompiled, contributing your time in compiling to [publish the binary for rvm](https://github.com/rvm/rvm/issues/4921) is probably more worth your time than this lol.
104
+
105
+ RVM is locally how we manage proctoring the ruby environment. It is not on the [github runners](https://github.com/actions/runner-images), so the make invocations in the workflows set the RVM proctors empty. If you want to manage your own ruby installs you can set `_=''` on each `make ...`.
106
+
107
+ You should also read the requirements for the gems this uses, see [Linguist dependencies](#linguist-dependencies) and [Dependabot dependencies](#dependabot-dependencies). `Linguist`'s can be acquired with `make preinit` done once.
108
+ ### Install Corepack
109
+ [Dependabot dependencies](#dependabot-dependencies) are managed in this project via [`nvm`](https://github.com/nvm-sh/nvm), so `corepack` can be loaded into every subshell the `Makefile` spawns. If you don't want to install `nvm` but would rather manage your own `corepack` install, set `__=''` on each `make ...`.
110
+
111
+ For the currently targetted version of `dependabot` that this is using, the existing reference versions of `corepack` are;
112
+ * [bun/Dockerfile](https://github.com/dependabot/dependabot-core/blob/v0.303.0/bun/Dockerfile#L4)
113
+ * [npm_and_yarn/Dockerfile](https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/Dockerfile#L4)
114
+
115
+ Both currently (as of writing) set their `corepack` version to `0.31.0`. However, it's possible for the changes in versions in `corepack` to outstrip the rate of changes of this gem, so don't rely on _this_ to determine what the most suitable version of `corepack` is.
116
+
117
+ > [!CAUTION]
118
+ > `make setup` / `initialise` / `initialise_corepack` will install to your _global_ `node`. If you're using the recommended `nvm` then each `node` install can be treated eseentially ephemeral. If you aren't using `nvm`, this might hijack your global `corepack` install.
92
119
  ### The first time setup
120
+ If you have `rvm` and `nvm` installed and you have `apt`, you should be able to;
93
121
  ```sh
94
- git clone https://github.com/Skenvy/dependabot-linguist.git && cd dependabot-linguist && make setup
122
+ git clone https://github.com/Skenvy/dependabot-linguist.git && cd dependabot-linguist && make preinit && make setup
95
123
  ```
96
124
  ### Iterative development
97
125
  The majority of `make` recipes for this are just wrapping a `bundle` invocation of `rake`.
data/SECURITY.md CHANGED
@@ -4,6 +4,7 @@ The `<major>.<minor>.*` versions of this are pinned to the **supported** `<major
4
4
  * Support version `0.212.0`, centric to [dependabot-common@0.212.0](https://rubygems.org/gems/dependabot-common/versions/0.212.0)
5
5
  * This is because this is the last version to support a Ruby version of `2.7.0`.
6
6
  * Support version `0.217.0`, centric to [dependabot-common@0.217.0](https://rubygems.org/gems/dependabot-common/versions/0.217.0)
7
+ * Version `0.303.0` is a partial update to [dependabot-common@0.303.0](https://rubygems.org/gems/dependabot-common/versions/0.303.0)
7
8
 
8
9
  Bugs present in only the most recent pinned minor version may be patched and contribute to successive patch versions. If a bug exists in an older version and no longer exists in a newer version, it is suggested to update to the newer version. As the underlying package this wraps, dependabot[-omnibus], is a live service, it makes sense for this to only roll forward.
9
10
  ## Reporting a Vulnerability
data/dependabot-linguist.gemspec CHANGED
@@ -12,11 +12,12 @@ Gem::Specification.new do |spec|
12
12
  spec.description = "Use linguist to check the contents of a repository,
13
13
  and then scan for dependabot-core ecosystems relevant to those languages!"
14
14
  spec.homepage = "https://skenvy.github.io/dependabot-linguist"
15
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/common/dependabot-common.gemspec#L23-L24
15
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/dependabot-common.gemspec#L23-L24
16
16
  spec.required_ruby_version = ">= 3.1.0"
17
17
  spec.required_rubygems_version = ">= 3.3.7"
18
18
  spec.metadata["homepage_uri"] = spec.homepage
19
19
  spec.metadata["source_code_uri"] = "https://github.com/Skenvy/dependabot-linguist/tree/main/"
20
+ spec.metadata["github_repo"] = "https://github.com/Skenvy/dependabot-linguist"
20
21
 
21
22
  spec.require_paths = ["lib"]
22
23
  spec.files = Dir.chdir(__dir__) do
@@ -27,17 +28,24 @@ Gem::Specification.new do |spec|
27
28
  spec.bindir = "exe"
28
29
  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
29
30
 
30
- spec.add_dependency "rugged", "1.6.3"
31
- spec.add_dependency "github-linguist", "7.25.0"
31
+ spec.add_dependency "rugged", "1.9.0"
32
+ spec.add_dependency "github-linguist", "9.0.0"
32
33
  # All ecosystem gems from https://rubygems.org/profiles/dependabot can be
33
- # required via https://rubygems.org/gems/dependabot-omnibus/versions/0.217.0
34
+ # required via https://rubygems.org/gems/dependabot-omnibus/versions/0.303.0
34
35
  # which will include all dependencies of omnibus (16 ecosystems and common).
35
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/omnibus/dependabot-omnibus.gemspec#L29-L45
36
- spec.add_dependency "dependabot-omnibus", "0.217.0"
36
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/omnibus/dependabot-omnibus.gemspec#L29-L52
37
+ spec.add_dependency "dependabot-omnibus", "0.303.0"
38
+ # We can't update from this json version without getting some weird
39
+ # uninitialized constant Dependabot::FileFetchers::Base::OpenStruct
40
+ # ~= https://github.com/ruby/json/compare/v2.7.1...v2.7.2 but idk
41
+ # But also dependabot-* >= 0.238.0 introduce requiring json < 2.7
42
+ spec.add_dependency "json", "2.6.3"
43
+ # stringio (>= 0) leads to ambiguous spec so lock it too.
44
+ spec.add_dependency "stringio", "3.1.5"
37
45
 
38
- # spec.add_development_dependency "aruba", "~> 2.1" # TODO
39
- spec.add_development_dependency "rake", "~> 13.0"
40
- spec.add_development_dependency "rdoc", "~> 6.0"
41
- spec.add_development_dependency "rspec", "~> 3.12"
42
- spec.add_development_dependency "rubocop", "~> 1.37"
46
+ spec.add_development_dependency "aruba", "~> 2.3"
47
+ spec.add_development_dependency "rake", "~> 13.2"
48
+ spec.add_development_dependency "rdoc", "~> 6.12"
49
+ spec.add_development_dependency "rspec", "~> 3.13"
50
+ spec.add_development_dependency "rubocop", "~> 1.73"
43
51
  end
data/lib/dependabot/linguist/dependabot_patch.rb CHANGED
@@ -12,8 +12,8 @@
12
12
  #########################################################################################
13
13
 
14
14
  # Direct the requiring of the files that patch dependabot via this.
15
- # The current target version for dependabot is 0.217.0
16
- # https://github.com/dependabot/dependabot-core/tree/v0.217.0
15
+ # The current target version for dependabot is 0.303.0
16
+ # https://github.com/dependabot/dependabot-core/tree/v0.303.0
17
17
 
18
18
  require_relative "file_fetchers/bundler"
19
19
  require_relative "file_fetchers/go_modules"
data/lib/dependabot/linguist/file_fetchers/bundler.rb CHANGED
@@ -37,7 +37,7 @@ require "dependabot/bundler"
37
37
  module Dependabot
38
38
  module Bundler
39
39
  class FileFetcher
40
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L148-L150
40
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L162-L165
41
41
  def path_gemspec_paths
42
42
  swap_bundle_gemfile = ENV.fetch("BUNDLE_GEMFILE", nil)
43
43
  repo_dir_gemfile = "#{@repo_contents_path}#{source.directory}/Gemfile"
data/lib/dependabot/linguist/file_fetchers/git_submodules.rb CHANGED
@@ -36,9 +36,9 @@
36
36
  # So we need to be more cautious with this and check it first.
37
37
 
38
38
  # Dependabot::FileFetchers::Base.load_cloned_file_if_present
39
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/common/lib/dependabot/file_fetchers/base.rb#L135-L155
39
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/base.rb#L218-L240
40
40
  # Dependabot::FileFetchers::Base.fetch_file_if_present
41
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/common/lib/dependabot/file_fetchers/base.rb#L111-L133
41
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/common/lib/dependabot/file_fetchers/base.rb#L194-L216
42
42
 
43
43
  require "dependabot/errors"
44
44
  require "dependabot/git_submodules"
@@ -48,13 +48,13 @@ require "dependabot/git_submodules"
48
48
  module Dependabot
49
49
  module GitSubmodules
50
50
  class FileFetcher
51
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L21-L26
51
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L26-L32
52
52
  def fetch_files
53
53
  raise(Dependabot::DependencyFileNotFound, Pathname.new(File.join(directory, ".gitmodules")).cleanpath.to_path) if gitmodules_file.nil?
54
54
  [gitmodules_file]
55
55
  end
56
56
 
57
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L28-L30
57
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L36-L43
58
58
  def gitmodules_file
59
59
  @gitmodules_file ||= fetch_file_if_present(".gitmodules")
60
60
  end
data/lib/dependabot/linguist/file_fetchers/go_modules.rb CHANGED
@@ -27,7 +27,7 @@ require "dependabot/go_modules"
27
27
  module Dependabot
28
28
  module GoModules
29
29
  class FileFetcher
30
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L30-L50
30
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L33-L46
31
31
  def fetch_files
32
32
  raise(Dependabot::DependencyFileNotFound, Pathname.new(File.join(directory, "go.mod")).cleanpath.to_path) if go_mod.nil?
33
33
  fetched_files = [go_mod]
data/lib/dependabot/linguist/language.rb CHANGED
@@ -25,14 +25,14 @@
25
25
  # Patching either Linguist::LazyBlob::git_attributes or
26
26
  # Linguist::LazyBlob::vendored? would be too cumbersome.
27
27
  # It also seems easier than duplicating the vendor patterns from
28
- # https://github.com/github/linguist/blob/v7.25.0/lib/linguist/vendor.yml
28
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/vendor.yml
29
29
 
30
30
  require "linguist"
31
31
 
32
32
  # rubocop:disable Style/Documentation
33
33
 
34
34
  module Linguist
35
- # https://github.com/github/linguist/blob/v7.25.0/lib/linguist/language.rb
35
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/language.rb
36
36
 
37
37
  class Language
38
38
  def ungroup_language
@@ -58,7 +58,7 @@ module Linguist
58
58
  end
59
59
 
60
60
  module BlobHelper
61
- # https://github.com/github/linguist/blob/v7.25.0/lib/linguist/blob_helper.rb#L220
61
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/blob_helper.rb#L220
62
62
  VendoredRegexp = Regexp.new(VendoredRegexp.source.gsub("(^|/)\\.gitmodules$|", "").gsub("|(^|/)\\.github/", ""))
63
63
  end
64
64
  end
data/lib/dependabot/linguist/languages_to_ecosystems/contexts.rb CHANGED
@@ -8,7 +8,7 @@
8
8
  # as it's source directory is not the directory it is valid to "fetch" from.
9
9
 
10
10
  # For a list of "linguist languages", see
11
- # https://github.com/github/linguist/blob/v7.25.0/lib/linguist/languages.yml
11
+ # https://github.com/github/linguist/blob/v9.0.0/lib/linguist/languages.yml
12
12
 
13
13
  require_relative "manager_ecosystem_maps"
14
14
 
@@ -61,7 +61,7 @@ module Dependabot
61
61
 
62
62
  ##
63
63
  CONTEXT_RULES[PackageManagers::BUNDLER][ContextRule::FETCH_FILES] = [
64
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L22-L24
64
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/bundler/lib/dependabot/bundler/file_fetcher.rb#L22-L32
65
65
  "Gemfile.lock", # Gemfile.lock
66
66
  "Ruby" # Gemfile or .gemspec
67
67
  ]
@@ -70,7 +70,7 @@ module Dependabot
70
70
 
71
71
  ##
72
72
  CONTEXT_RULES[PackageManagers::CARGO][ContextRule::FETCH_FILES] = [
73
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/cargo/lib/dependabot/cargo/file_fetcher.rb#L19-L21
73
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/cargo/lib/dependabot/cargo/file_fetcher.rb#L20-L26
74
74
  "TOML" # Cargo.toml and Cargo.lock
75
75
  ]
76
76
  CONTEXT_RULES[PackageManagers::CARGO][ContextRule::PRIMARY_LANGUAGES] = ["Rust"]
@@ -78,7 +78,8 @@ module Dependabot
78
78
 
79
79
  ##
80
80
  CONTEXT_RULES[PackageManagers::COMPOSER][ContextRule::FETCH_FILES] = [
81
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/composer/lib/dependabot/composer/file_fetcher.rb#L16-L18
81
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/composer/lib/dependabot/composer/file_fetcher.rb#L18-L24
82
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/composer/lib/dependabot/composer/package_manager.rb#L16
82
83
  "JSON" # composer.json and composer.lock
83
84
  ]
84
85
  CONTEXT_RULES[PackageManagers::COMPOSER][ContextRule::PRIMARY_LANGUAGES] = ["PHP"]
@@ -86,7 +87,7 @@ module Dependabot
86
87
 
87
88
  ##
88
89
  CONTEXT_RULES[PackageManagers::DOCKER][ContextRule::FETCH_FILES] = [
89
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/docker/lib/dependabot/docker/file_fetcher.rb#L19-L21
90
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/docker/lib/dependabot/docker/file_fetcher.rb#L19-L28
90
91
  "Dockerfile", # Dockerfile
91
92
  "YAML" # .yaml, if kubernetes option is set
92
93
  ]
@@ -95,7 +96,7 @@ module Dependabot
95
96
 
96
97
  ##
97
98
  CONTEXT_RULES[PackageManagers::HEX][ContextRule::FETCH_FILES] = [
98
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/hex/lib/dependabot/hex/file_fetcher.rb#L19-L21
99
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/hex/lib/dependabot/hex/file_fetcher.rb#L20-L28
99
100
  "Elixir" # mix.lock and mix.exs by extension
100
101
  ]
101
102
  CONTEXT_RULES[PackageManagers::HEX][ContextRule::PRIMARY_LANGUAGES] = ["Elixir"]
@@ -103,7 +104,8 @@ module Dependabot
103
104
 
104
105
  ##
105
106
  CONTEXT_RULES[PackageManagers::ELM_PACKAGE][ContextRule::FETCH_FILES] = [
106
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/elm/lib/dependabot/elm/file_fetcher.rb#L13-L15
107
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/elm/lib/dependabot/elm/file_fetcher.rb#L14-L22
108
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/elm/lib/dependabot/elm/package_manager.rb#L14
107
109
  "JSON" # elm-package.json or an elm.json, only seeks via .json extension though.
108
110
  ]
109
111
  CONTEXT_RULES[PackageManagers::ELM_PACKAGE][ContextRule::PRIMARY_LANGUAGES] = ["Elm"]
@@ -111,7 +113,7 @@ module Dependabot
111
113
 
112
114
  ##
113
115
  CONTEXT_RULES[PackageManagers::GIT_SUBMODULE][ContextRule::FETCH_FILES] = [
114
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L15-L17
116
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/git_submodules/lib/dependabot/git_submodules/file_fetcher.rb#L16-L24
115
117
  "Git Config" # ".gitmodules"
116
118
  ]
117
119
  CONTEXT_RULES[PackageManagers::GIT_SUBMODULE][ContextRule::PRIMARY_LANGUAGES] = []
@@ -119,7 +121,7 @@ module Dependabot
119
121
 
120
122
  ##
121
123
  CONTEXT_RULES[PackageManagers::GITHUB_ACTIONS][ContextRule::FETCH_FILES] = [
122
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/github_actions/lib/dependabot/github_actions/file_fetcher.rb#L15-L17
124
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/github_actions/lib/dependabot/github_actions/file_fetcher.rb#L16-L24
123
125
  # "YAML", but this is handled without linguist
124
126
  ]
125
127
  CONTEXT_RULES[PackageManagers::GITHUB_ACTIONS][ContextRule::PRIMARY_LANGUAGES] = []
@@ -127,7 +129,7 @@ module Dependabot
127
129
 
128
130
  ##
129
131
  CONTEXT_RULES[PackageManagers::GO_MODULES][ContextRule::FETCH_FILES] = [
130
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L13-L15
132
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/go_modules/lib/dependabot/go_modules/file_fetcher.rb#L14-L22
131
133
  "Go Checksums", # go.sum
132
134
  "Go Module" # go.mod
133
135
  ]
@@ -135,7 +137,7 @@ module Dependabot
135
137
  CONTEXT_RULES[PackageManagers::GO_MODULES][ContextRule::RELEVANT_LANGUAGES] = []
136
138
 
137
139
  CONTEXT_RULES[PackageManagers::GRADLE][ContextRule::FETCH_FILES] = [
138
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/gradle/lib/dependabot/gradle/file_fetcher.rb#L27-L29
140
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/gradle/lib/dependabot/gradle/file_fetcher.rb#L44-L54
139
141
  "Gradle", # for any `.gradle` file
140
142
  "Kotlin" # for any `.kts` file"
141
143
  ]
@@ -145,7 +147,7 @@ module Dependabot
145
147
  ]
146
148
 
147
149
  CONTEXT_RULES[PackageManagers::MAVEN][ContextRule::FETCH_FILES] = [
148
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/maven/lib/dependabot/maven/file_fetcher.rb#L17-L19
150
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/maven/lib/dependabot/maven/file_fetcher.rb#L19-L27
149
151
  "Maven POM" # for `pom.xml` files
150
152
  ]
151
153
  CONTEXT_RULES[PackageManagers::MAVEN][ContextRule::PRIMARY_LANGUAGES] = []
@@ -155,7 +157,7 @@ module Dependabot
155
157
 
156
158
  ##
157
159
  CONTEXT_RULES[PackageManagers::NPM][ContextRule::FETCH_FILES] = [
158
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L31-L33
160
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L35-L43
159
161
  "JSON", # "package.json" or "package-lock.json" or "npm-shrinkwrap.json" but only by extension
160
162
  "NPM Config" # ".npmrc"
161
163
  ]
@@ -164,7 +166,7 @@ module Dependabot
164
166
 
165
167
  ##
166
168
  CONTEXT_RULES[PackageManagers::NUGET][ContextRule::FETCH_FILES] = [
167
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/nuget/lib/dependabot/nuget/file_fetcher.rb#L20-L22
169
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/nuget/lib/dependabot/nuget/file_fetcher.rb#L17-L25
168
170
  "XML" # .csproj, .vbproj and .fsproj
169
171
  # Nothing looks for a packages.config
170
172
  ]
@@ -173,8 +175,9 @@ module Dependabot
173
175
 
174
176
  ##
175
177
  CONTEXT_RULES[PackageManagers::PIP][ContextRule::FETCH_FILES] = [
176
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
178
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
177
179
  # Besides the other pip related package managers, there is no language for `requirements` files. RIP.
180
+ "Pip Requirements", # Added in https://github.com/github-linguist/linguist/pull/6739 to specifically match what this pkg mngr is about
178
181
  "Text" # for `.txt`
179
182
  ]
180
183
  CONTEXT_RULES[PackageManagers::PIP][ContextRule::PRIMARY_LANGUAGES] = ["Python"]
@@ -182,7 +185,7 @@ module Dependabot
182
185
 
183
186
  ##
184
187
  CONTEXT_RULES[PackageManagers::PIPENV][ContextRule::FETCH_FILES] = [
185
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
188
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
186
189
  "JSON", # Pipfile.lock
187
190
  "TOML" # Pipfile
188
191
  ]
@@ -191,7 +194,7 @@ module Dependabot
191
194
 
192
195
  ##
193
196
  CONTEXT_RULES[PackageManagers::PIP_COMPILE][ContextRule::FETCH_FILES] = [
194
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
197
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
195
198
  # Already captured by the other pip related package manager paths
196
199
  ]
197
200
  CONTEXT_RULES[PackageManagers::PIP_COMPILE][ContextRule::PRIMARY_LANGUAGES] = ["Python"]
@@ -199,7 +202,7 @@ module Dependabot
199
202
 
200
203
  ##
201
204
  CONTEXT_RULES[PackageManagers::POETRY][ContextRule::FETCH_FILES] = [
202
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/python/lib/dependabot/python/file_fetcher.rb#L35-L38
205
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/python/lib/dependabot/python/file_fetcher.rb#L26-L46
203
206
  # pyproject.lock has none and setup.py is vague.
204
207
  "TOML" # poetry.lock and pyproject.toml by extension
205
208
  ]
@@ -208,7 +211,7 @@ module Dependabot
208
211
 
209
212
  ##
210
213
  CONTEXT_RULES[PackageManagers::PUB][ContextRule::FETCH_FILES] = [
211
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/pub/lib/dependabot/pub/file_fetcher.rb#L15-L17
214
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/pub/lib/dependabot/pub/file_fetcher.rb#L16-L24
212
215
  "YAML" # pubspec.yaml, but only by extension.
213
216
  ]
214
217
  CONTEXT_RULES[PackageManagers::PUB][ContextRule::PRIMARY_LANGUAGES] = ["Dart"]
@@ -216,7 +219,7 @@ module Dependabot
216
219
 
217
220
  ##
218
221
  CONTEXT_RULES[PackageManagers::TERRAFORM][ContextRule::FETCH_FILES] = [
219
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/terraform/lib/dependabot/terraform/file_fetcher.rb#L19-L21
222
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/terraform/lib/dependabot/terraform/file_fetcher.rb#L21-L29
220
223
  "HCL" # .tf and .hcl
221
224
  ]
222
225
  CONTEXT_RULES[PackageManagers::TERRAFORM][ContextRule::PRIMARY_LANGUAGES] = []
@@ -224,7 +227,7 @@ module Dependabot
224
227
 
225
228
  ##
226
229
  CONTEXT_RULES[PackageManagers::YARN][ContextRule::FETCH_FILES] = [
227
- # https://github.com/dependabot/dependabot-core/blob/v0.217.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L31-L33
230
+ # https://github.com/dependabot/dependabot-core/blob/v0.303.0/npm_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb#L35-L43
228
231
  "YAML" # yarn.lock
229
232
  ]
230
233
  CONTEXT_RULES[PackageManagers::YARN][ContextRule::PRIMARY_LANGUAGES] = ["JavaScript", "TypeScript"]
data/lib/dependabot/linguist/languages_to_ecosystems/contexts_applied.rb CHANGED
@@ -21,7 +21,7 @@ module Dependabot
21
21
  LANGUAGE_TO_PACKAGE_MANAGER = languages.to_h { |name, _| [name, nil] }.tap do |this|
22
22
  # Now apply the context rules to "this"
23
23
  CONTEXT_RULES.each do |package_manager, context_map|
24
- context_map.each do |_context_rule, linguist_languages|
24
+ context_map.each_value do |linguist_languages|
25
25
  linguist_languages.each do |linguist_language|
26
26
  if this[linguist_language].nil?
27
27
  this[linguist_language] = [package_manager]