dependabot-maven 0.118.3 → 0.118.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57c3d6578720bd9d102d72f095e96f9526c96ad26c3f26e9bf9800fae9d82a83
-  data.tar.gz: 2c8bb7210b3bdf57ddb5f8b5a941c7ac4943b08b8da8f9a2bd2ef5969b95c9f9
+  metadata.gz: 6f6faec3fcfa89189a62ab833d48e9d3f41910f80d973992de45886992e5f5d0
+  data.tar.gz: c3ac903e8befdb282eb57a7002754633bc11ad57587518c618bd0ac0c4d25638
 SHA512:
-  metadata.gz: 576b996b863295860894ead54d1c5fa943b232e78f2e37a7e47ec5ed2aca5fe0d6e68daa2afc9e21e129679f6b79b618fba86b0cca3a9abf2d6d6a4e59ce8b19
-  data.tar.gz: ab3f78c545843852a9d9b02e4507435e80fb47a577808a5b5774812279193e7b9c572cf8f420601454bff1d13541aa6123fe97214f3bdb7ddcc482a77884207f
+  metadata.gz: 84bed592396b9c0412c02c6b00bfb754c50e64ba372825b2841cb9949a8cd6cc460df4d5fed5909539ef5293c809ebb518095abf763df509f5f2b23c7e7f5bf9
+  data.tar.gz: 34dbbb17827cd184930675aeeae2b970802fcfa4b47e545dda68b358a0fcb4ee8637e2af957f07085643ad7946ecf6d7f12e6d10076254e5f944fb55268e5e66

data/lib/dependabot/maven.rb

@@ -22,7 +22,7 @@ Dependabot::Dependency.
   register_display_name_builder(
     "maven",
     lambda { |name|
-      artifact_id = name.split(":").last
+      _group_id, artifact_id, _classifier = name.split(":")
       %w(bom library).include?(artifact_id) ? name : artifact_id
     }
   )

data/lib/dependabot/maven/file_parser.rb

@@ -104,7 +104,7 @@ module Dependabot
         return unless dependency_node.at_xpath("./groupId")
         return unless dependency_node.at_xpath("./artifactId")
 
-        [
+        name = [
           evaluated_value(
             dependency_node.at_xpath("./groupId").content.strip,
             pom
@@ -114,6 +114,15 @@ module Dependabot
             pom
           )
         ].join(":")
+
+        if dependency_node.at_xpath("./classifier")
+          name += ":#{evaluated_value(
+            dependency_node.at_xpath('./classifier').content.strip,
+            pom
+          )}"
+        end
+
+        name
       end
 
       def plugin_name(dependency_node, pom)
@@ -185,7 +194,6 @@ module Dependabot
         return unless dependency_node.at_xpath("./version")
 
         version_content = dependency_node.at_xpath("./version").content.strip
-
         return unless version_content.match?(PROPERTY_REGEX)
 
         version_content.

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -57,6 +57,11 @@ module Dependabot
               evaluated_value(node.at_xpath("./*/artifactId").content.strip)
             ].compact.join(":")
 
+            if node.at_xpath("./*/classifier")
+              node_name += ":#{evaluated_value(node.at_xpath('./*/classifier').
+                content.strip)}"
+            end
+
             next false unless node_name == dependency_name
             next false unless packaging_type_matches?(node)
             next false unless scope_matches?(node)

data/lib/dependabot/maven/metadata_finder.rb

@@ -23,8 +23,7 @@ module Dependabot
         tmp_source = look_up_source_in_pom(parent)
         return unless tmp_source
 
-        artifact = dependency.name.split(":").last
-        return tmp_source if tmp_source.repo.end_with?(artifact)
+        return tmp_source if tmp_source.repo.end_with?(dependency_artifact_id)
         return tmp_source if repo_has_subdir_for_dep?(tmp_source)
       end
 
@@ -34,14 +33,13 @@ module Dependabot
           return @repo_has_subdir_for_dep[tmp_source]
         end
 
-        artifact = dependency.name.split(":").last
         fetcher =
           FileFetchers::Base.new(source: tmp_source, credentials: credentials)
 
         @repo_has_subdir_for_dep[tmp_source] =
           fetcher.send(:repo_contents, raise_errors: false).
           select { |f| f.type == "dir" }.
-          any? { |f| artifact.end_with?(f.name) }
+          any? { |f| dependency_artifact_id.end_with?(f.name) }
       rescue Dependabot::BranchNotFound
         tmp_source.branch = nil
         retry
@@ -96,18 +94,17 @@ module Dependabot
 
         github_urls.find do |url|
           repo = Source.from_url(url).repo
-          repo.end_with?(dependency.name.split(":").last)
+          repo.end_with?(dependency_artifact_id)
         end
       end
 
       def dependency_pom_file
         return @dependency_pom_file unless @dependency_pom_file.nil?
 
-        artifact_id = dependency.name.split(":").last
         response = Excon.get(
           "#{maven_repo_dependency_url}/"\
           "#{dependency.version}/"\
-          "#{artifact_id}-#{dependency.version}.pom",
+          "#{dependency_artifact_id}-#{dependency.version}.pom",
           headers: auth_details,
           idempotent: true,
           **SharedHelpers.excon_defaults
@@ -118,6 +115,12 @@ module Dependabot
         @dependency_pom_file = Nokogiri::XML("")
       end
 
+      def dependency_artifact_id
+        _group_id, artifact_id, _classifier = dependency.name.split(":")
+
+        artifact_id
+      end
+
       def parent_pom_file(pom)
         doc = pom.dup
         doc.remove_namespaces!

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -13,6 +13,8 @@ module Dependabot
       class VersionFinder
         TYPE_SUFFICES = %w(jre android java).freeze
 
+        MAVEN_RANGE_REGEX = /[\(\[].*,.*[\)\]]/.freeze
+
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)
@@ -94,7 +96,7 @@ module Dependabot
           filtered = possible_versions
 
           ignored_versions.each do |req|
-            ignore_req = Maven::Requirement.new(req.split(","))
+            ignore_req = Maven::Requirement.new(parse_requirement_string(req))
             filtered =
               filtered.
               reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
@@ -107,6 +109,12 @@ module Dependabot
           filtered
         end
 
+        def parse_requirement_string(string)
+          return string if string.match?(MAVEN_RANGE_REGEX)
+
+          string.split(",").map(&:strip)
+        end
+
         def filter_vulnerable_versions(possible_versions)
           versions_array = possible_versions
 
@@ -173,6 +181,7 @@ module Dependabot
                 **Dependabot::SharedHelpers.excon_defaults
               )
               check_response(response, repository_details.fetch("url"))
+
               Nokogiri::XML(response.body)
             rescue URI::InvalidURIError
               Nokogiri::XML("")
@@ -248,7 +257,7 @@ module Dependabot
         end
 
         def dependency_metadata_url(repository_url)
-          group_id, artifact_id = dependency.name.split(":")
+          group_id, artifact_id, _classifier = dependency.name.split(":")
 
           "#{repository_url}/"\
           "#{group_id.tr('.', '/')}/"\
@@ -257,15 +266,16 @@ module Dependabot
         end
 
         def dependency_files_url(repository_url, version)
-          group_id, artifact_id = dependency.name.split(":")
+          group_id, artifact_id, classifier = dependency.name.split(":")
           type = dependency.requirements.first.
                  dig(:metadata, :packaging_type)
 
+          actual_classifier = classifier.nil? ? "" : "-#{classifier}"
           "#{repository_url}/"\
           "#{group_id.tr('.', '/')}/"\
           "#{artifact_id}/"\
           "#{version}/"\
-          "#{artifact_id}-#{version}.#{type}"
+          "#{artifact_id}-#{version}#{actual_classifier}.#{type}"
         end
 
         def version_class

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.118.3
+  version: 0.118.8
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-18 00:00:00.000000000 Z
+date: 2020-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.3
+        version: 0.118.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.3
+        version: 0.118.8
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement