dependabot-maven 0.118.4 → 0.118.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0088a0eec99945aa2daf48a12086a6e9e3fbe80962a76723e1138eaa501a8c7
-  data.tar.gz: abbf5ae6535360383b8bc72bb50c09d90ff01b2904ca63a647524f41f6c8d79f
+  metadata.gz: aa3fbd7ab792af94cd4c0f2f30b48ce35078661d89804cb7f85e5a07816b3fc9
+  data.tar.gz: 9c7464a40e84e2c2de981946a1e8bd6b16b3916e70ae619ffd382a206eb06e00
 SHA512:
-  metadata.gz: 79c3f3eb6e170677d135ecb857b2940d569238216923b09eeaa7bb9f7447da95f1c535a97eeb825e70f326c34c3780fb41bbd43b978248fa848ff510e5c9d086
-  data.tar.gz: 14914d79cc71be63be4fefbc51fa6150e7d433b4b17658d0b060a3c7c470123ee9031c171cb667940b8408f28c45046bb30692396aa046ca369e5424c3286c35
+  metadata.gz: 7d171938aa95f48287331abc61024f87fd9f6f4bcfdea89585d8848f4369f21e6177d78010dda3f4a5a642e859cef304de9c210f3e8afb1058597a0db287a40f
+  data.tar.gz: bdcdca70375e89e4963f6238a1c19829bf6316da87a4825e2ac98a32b051062fa5c23679891ea6189c082a4fca406f0cae6066fdca69ce86f412b189de7d8937

data/lib/dependabot/maven.rb

@@ -22,7 +22,7 @@ Dependabot::Dependency.
   register_display_name_builder(
     "maven",
     lambda { |name|
-      artifact_id = name.split(":").last
+      _group_id, artifact_id, _classifier = name.split(":")
       %w(bom library).include?(artifact_id) ? name : artifact_id
     }
   )

data/lib/dependabot/maven/file_parser.rb

@@ -104,7 +104,7 @@ module Dependabot
         return unless dependency_node.at_xpath("./groupId")
         return unless dependency_node.at_xpath("./artifactId")
 
-        [
+        name = [
           evaluated_value(
             dependency_node.at_xpath("./groupId").content.strip,
             pom
@@ -114,6 +114,15 @@ module Dependabot
             pom
           )
         ].join(":")
+
+        if dependency_node.at_xpath("./classifier")
+          name += ":#{evaluated_value(
+            dependency_node.at_xpath('./classifier').content.strip,
+            pom
+          )}"
+        end
+
+        name
       end
 
       def plugin_name(dependency_node, pom)
@@ -185,7 +194,6 @@ module Dependabot
         return unless dependency_node.at_xpath("./version")
 
         version_content = dependency_node.at_xpath("./version").content.strip
-
         return unless version_content.match?(PROPERTY_REGEX)
 
         version_content.

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -57,6 +57,11 @@ module Dependabot
               evaluated_value(node.at_xpath("./*/artifactId").content.strip)
             ].compact.join(":")
 
+            if node.at_xpath("./*/classifier")
+              node_name += ":#{evaluated_value(node.at_xpath('./*/classifier').
+                content.strip)}"
+            end
+
             next false unless node_name == dependency_name
             next false unless packaging_type_matches?(node)
             next false unless scope_matches?(node)

data/lib/dependabot/maven/metadata_finder.rb

@@ -23,8 +23,7 @@ module Dependabot
         tmp_source = look_up_source_in_pom(parent)
         return unless tmp_source
 
-        artifact = dependency.name.split(":").last
-        return tmp_source if tmp_source.repo.end_with?(artifact)
+        return tmp_source if tmp_source.repo.end_with?(dependency_artifact_id)
         return tmp_source if repo_has_subdir_for_dep?(tmp_source)
       end
 
@@ -34,14 +33,13 @@ module Dependabot
           return @repo_has_subdir_for_dep[tmp_source]
         end
 
-        artifact = dependency.name.split(":").last
         fetcher =
           FileFetchers::Base.new(source: tmp_source, credentials: credentials)
 
         @repo_has_subdir_for_dep[tmp_source] =
           fetcher.send(:repo_contents, raise_errors: false).
           select { |f| f.type == "dir" }.
-          any? { |f| artifact.end_with?(f.name) }
+          any? { |f| dependency_artifact_id.end_with?(f.name) }
       rescue Dependabot::BranchNotFound
         tmp_source.branch = nil
         retry
@@ -96,18 +94,17 @@ module Dependabot
 
         github_urls.find do |url|
           repo = Source.from_url(url).repo
-          repo.end_with?(dependency.name.split(":").last)
+          repo.end_with?(dependency_artifact_id)
         end
       end
 
       def dependency_pom_file
         return @dependency_pom_file unless @dependency_pom_file.nil?
 
-        artifact_id = dependency.name.split(":").last
         response = Excon.get(
           "#{maven_repo_dependency_url}/"\
           "#{dependency.version}/"\
-          "#{artifact_id}-#{dependency.version}.pom",
+          "#{dependency_artifact_id}-#{dependency.version}.pom",
           headers: auth_details,
           idempotent: true,
           **SharedHelpers.excon_defaults
@@ -118,6 +115,12 @@ module Dependabot
         @dependency_pom_file = Nokogiri::XML("")
       end
 
+      def dependency_artifact_id
+        _group_id, artifact_id, _classifier = dependency.name.split(":")
+
+        artifact_id
+      end
+
       def parent_pom_file(pom)
         doc = pom.dup
         doc.remove_namespaces!

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -13,6 +13,8 @@ module Dependabot
       class VersionFinder
         TYPE_SUFFICES = %w(jre android java).freeze
 
+        MAVEN_RANGE_REGEX = /[\(\[].*,.*[\)\]]/.freeze
+
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)
@@ -94,7 +96,7 @@ module Dependabot
           filtered = possible_versions
 
           ignored_versions.each do |req|
-            ignore_req = Maven::Requirement.new(req.split(","))
+            ignore_req = Maven::Requirement.new(parse_requirement_string(req))
             filtered =
               filtered.
               reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
@@ -107,6 +109,12 @@ module Dependabot
           filtered
         end
 
+        def parse_requirement_string(string)
+          return string if string.match?(MAVEN_RANGE_REGEX)
+
+          string.split(",").map(&:strip)
+        end
+
         def filter_vulnerable_versions(possible_versions)
           versions_array = possible_versions
 
@@ -173,6 +181,7 @@ module Dependabot
                 **Dependabot::SharedHelpers.excon_defaults
               )
               check_response(response, repository_details.fetch("url"))
+
               Nokogiri::XML(response.body)
             rescue URI::InvalidURIError
               Nokogiri::XML("")
@@ -248,7 +257,7 @@ module Dependabot
         end
 
         def dependency_metadata_url(repository_url)
-          group_id, artifact_id = dependency.name.split(":")
+          group_id, artifact_id, _classifier = dependency.name.split(":")
 
           "#{repository_url}/"\
           "#{group_id.tr('.', '/')}/"\
@@ -257,15 +266,16 @@ module Dependabot
         end
 
         def dependency_files_url(repository_url, version)
-          group_id, artifact_id = dependency.name.split(":")
+          group_id, artifact_id, classifier = dependency.name.split(":")
           type = dependency.requirements.first.
                  dig(:metadata, :packaging_type)
 
+          actual_classifier = classifier.nil? ? "" : "-#{classifier}"
           "#{repository_url}/"\
           "#{group_id.tr('.', '/')}/"\
           "#{artifact_id}/"\
           "#{version}/"\
-          "#{artifact_id}-#{version}.#{type}"
+          "#{artifact_id}-#{version}#{actual_classifier}.#{type}"
         end
 
         def version_class

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.118.4
+  version: 0.118.10
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-19 00:00:00.000000000 Z
+date: 2020-08-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.4
+        version: 0.118.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.4
+        version: 0.118.10
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -94,34 +94,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.4'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.4'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.85.0
+        version: 0.88.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -191,7 +177,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Maven support for dependabot