dependabot-maven 0.156.0 → 0.156.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 397834bcc624f32fe3e64b6aadb46733fbcf1724ffcc04ab93839ead558b255b
-  data.tar.gz: 83934569c012d656cdc3ae1bf59ea78a2b0860fec169bf98c8c321f5c92ff7fe
+  metadata.gz: 4ebd4d764cc21d516057f2eea2ed3a3c9c9cf60e021f23727dcea71953eef008
+  data.tar.gz: ce9d80af606b661c484058443747fbd8562d0115e8bb8e79d3cd2979770a9f35
 SHA512:
-  metadata.gz: 37a7542e15ff370bed475342257915842761642bcc9432d4faef47613facf23dde43575079d11170a2b4c630bf840757b740f618f3c2042d0607fe6c552bdc62
-  data.tar.gz: a7be6d8eb7eb028fd02536cb7e7e3c405caa41623e1f7f489915fda63ae647be0b9552e0b99680f440b72c0f5c217fbb72cdd565b9b68ac87dcb8d764c5e00e0
+  metadata.gz: aa1a507f661c4262c15cd671a5cccdd0144dd8faaefa0cdd92ee576991181927b9dbc152e2b29d577f2c7f1f8b6e5f4985bed767a3860f9d4720e943afe721e0
+  data.tar.gz: 34d69b0917399a322c95730fb896b1aeba6594214aaab03cbfb0137990bf594de330b63d1a9249c941b539f9edffcb83c99b6e8247c55e102b0a404b98ef58c8

data/lib/dependabot/maven/file_fetcher.rb

@@ -25,6 +25,7 @@ module Dependabot
         fetched_files << pom
         fetched_files += child_poms
         fetched_files += relative_path_parents(fetched_files)
+        fetched_files << extensions if extensions
         fetched_files.uniq
       end
 
@@ -32,6 +33,17 @@ module Dependabot
         @pom ||= fetch_file_from_host("pom.xml")
       end
 
+      def extensions
+        return @extensions if defined?(@extensions)
+        return @extensions if defined?(@extensions)
+
+        begin
+          fetch_file_if_present(".mvn/extensions.xml")
+        rescue Dependabot::DependencyFileNotFound
+          nil
+        end
+      end
+
       def child_poms
         recursively_fetch_child_poms(pom, fetched_filenames: ["pom.xml"])
       end

data/lib/dependabot/maven/file_parser.rb

@@ -25,6 +25,7 @@ module Dependabot
                             "dependencies > dependency, "\
                             "extensions > extension"
       PLUGIN_SELECTOR     = "plugins > plugin"
+      EXTENSION_SELECTOR  = "extensions > extension"
 
       # Regex to get the property name from a declaration that uses a property
       PROPERTY_REGEX      = /\$\{(?<property>.*?)\}/.freeze
@@ -32,6 +33,7 @@ module Dependabot
       def parse
         dependency_set = DependencySet.new
         pomfiles.each { |pom| dependency_set += pomfile_dependencies(pom) }
+        extensionfiles.each { |extension| dependency_set += extensionfile_dependencies(extension) }
         dependency_set.dependencies
       end
 
@@ -63,6 +65,25 @@ module Dependabot
         dependency_set
       end
 
+      def extensionfile_dependencies(extension)
+        dependency_set = DependencySet.new
+
+        errors = []
+        doc = Nokogiri::XML(extension.content)
+        doc.remove_namespaces!
+
+        doc.css(EXTENSION_SELECTOR).each do |dependency_node|
+          dep = dependency_from_dependency_node(extension, dependency_node)
+          dependency_set << dep if dep
+        rescue DependencyFileNotEvaluatable => e
+          errors << e
+        end
+
+        raise errors.first if errors.any? && dependency_set.dependencies.none?
+
+        dependency_set
+      end
+
       def dependency_from_dependency_node(pom, dependency_node)
         return unless (name = dependency_name(dependency_node, pom))
         return if internal_dependency_names.include?(name)
@@ -252,6 +273,11 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?("pom.xml") }
       end
 
+      def extensionfiles
+        @extensionfiles ||=
+          dependency_files.select { |f| f.name.end_with?("extensions.xml") }
+      end
+
       def internal_dependency_names
         @internal_dependency_names ||=
           dependency_files.map do |pom|

data/lib/dependabot/maven/file_updater.rb

@@ -11,25 +11,28 @@ module Dependabot
       require_relative "file_updater/property_value_updater"
 
       def self.updated_files_regex
-        [/^pom\.xml$/, %r{/pom\.xml$}]
+        [
+          /^pom\.xml$/, %r{/pom\.xml$},
+          /^extensions.\.xml$/, %r{/extensions\.xml$}
+        ]
       end
 
       def updated_dependency_files
         updated_files = dependency_files.dup
 
         # Loop through each of the changed requirements, applying changes to
-        # all pomfiles for that change. Note that the logic is different here
-        # to other languages because Java has property inheritance across
-        # files
+        # all pom and extensions files for that change. Note that the logic
+        # is different here to other package managers because Maven has property
+        # inheritance across files
         dependencies.each do |dependency|
-          updated_files = update_pomfiles_for_dependency(
-            pomfiles: updated_files,
+          updated_files = update_files_for_dependency(
+            original_files: updated_files,
             dependency: dependency
           )
         end
 
-        updated_files.select! { |f| f.name.end_with?("pom.xml") }
-        updated_files.reject! { |f| original_pomfiles.include?(f) }
+        updated_files.select! { |f| f.name.end_with?("pom.xml") || f.name.end_with?("extensions.xml") }
+        updated_files.reject! { |f| dependency_files.include?(f) }
 
         raise "No files changed!" if updated_files.none?
         raise "Updated a supporting POM!" if updated_files.any? { |f| f.name.end_with?("pom_parent.xml") }
@@ -43,15 +46,15 @@ module Dependabot
         raise "No pom.xml!" unless get_original_file("pom.xml")
       end
 
-      def update_pomfiles_for_dependency(pomfiles:, dependency:)
-        files = pomfiles.dup
+      def update_files_for_dependency(original_files:, dependency:)
+        files = original_files.dup
 
         # The UpdateChecker ensures the order of requirements is preserved
         # when updating, so we can zip them together in new/old pairs.
         reqs = dependency.requirements.zip(dependency.previous_requirements).
                reject { |new_req, old_req| new_req == old_req }
 
-        # Loop through each changed requirement and update the pomfiles
+        # Loop through each changed requirement and update the files
         reqs.each do |new_req, old_req|
           raise "Bad req match" unless new_req[:file] == old_req[:file]
           next if new_req[:requirement] == old_req[:requirement]
@@ -62,9 +65,9 @@ module Dependabot
             files[files.index(pom)] =
               remove_property_suffix_in_pom(dependency, pom, old_req)
           else
-            pom = files.find { |f| f.name == new_req.fetch(:file) }
-            files[files.index(pom)] =
-              update_version_in_pom(dependency, pom, old_req, new_req)
+            file = files.find { |f| f.name == new_req.fetch(:file) }
+            files[files.index(file)] =
+              update_version_in_file(dependency, file, old_req, new_req)
           end
         end
 
@@ -82,25 +85,25 @@ module Dependabot
           )
       end
 
-      def update_version_in_pom(dependency, pom, previous_req, requirement)
-        updated_content = pom.content
+      def update_version_in_file(dependency, file, previous_req, requirement)
+        updated_content = file.content
 
-        original_pom_declarations(dependency, previous_req).each do |old_dec|
+        original_file_declarations(dependency, previous_req).each do |old_dec|
           updated_content = updated_content.gsub(
             old_dec,
-            updated_pom_declaration(old_dec, previous_req, requirement)
+            updated_file_declaration(old_dec, previous_req, requirement)
           )
         end
 
-        raise "Expected content to change!" if updated_content == pom.content
+        raise "Expected content to change!" if updated_content == file.content
 
-        updated_file(file: pom, content: updated_content)
+        updated_file(file: file, content: updated_content)
       end
 
       def remove_property_suffix_in_pom(dep, pom, req)
         updated_content = pom.content
 
-        original_pom_declarations(dep, req).each do |old_declaration|
+        original_file_declarations(dep, req).each do |old_declaration|
           updated_content = updated_content.gsub(old_declaration) do |old_dec|
             version_string =
               old_dec.match(%r{(?<=\<version\>).*(?=\</version\>)})
@@ -116,7 +119,7 @@ module Dependabot
         updated_file(file: pom, content: updated_content)
       end
 
-      def original_pom_declarations(dependency, requirement)
+      def original_file_declarations(dependency, requirement)
         declaration_finder(dependency, requirement).declaration_strings
       end
 
@@ -132,7 +135,7 @@ module Dependabot
           )
       end
 
-      def updated_pom_declaration(old_declaration, previous_req, requirement)
+      def updated_file_declaration(old_declaration, previous_req, requirement)
         original_req_string = previous_req.fetch(:requirement)
 
         old_declaration.gsub(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.156.0
+  version: 0.156.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-23 00:00:00.000000000 Z
+date: 2021-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.156.0
+        version: 0.156.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.156.0
+        version: 0.156.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.18.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.18.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement