dependabot-maven 0.185.0 → 0.187.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e6e56504755b06a5228556bebd5f99ff12da300764bf62c8439e2dd3a2df128
-  data.tar.gz: 4cb80f57ac4b7dd12c3aa83a8b16514f98187308bab69b99612c22cac44d957c
+  metadata.gz: 3e4a577221aad5a220aac8de3764283bec0f886a6b815a927152747f26cc4c5b
+  data.tar.gz: f620d6868318bf81a7ca22457f156188b7d3e9e8aca5ac920114bcd0f6741db0
 SHA512:
-  metadata.gz: bd6b2ac11841359a778ea209144d5c6a75fbb9189930d6ef97340fa896e74bf62810e46c0144fe8c75a44d6f90e0a6f725449261f9817db29aff2bd94fe63ea3
-  data.tar.gz: cda8cf2ca53f7725fceed8a903967d20429e3ecf11227566d918c1538fb6d9e61a612ea3797118291a0758cec62cea046fe8558903395fff35ac9522e31c002f
+  metadata.gz: 92c8af63d0d1977d0cb91dcc8c49d962c36d03af91a32961f9bb6106998d24e6e6208d6cd5479156e1e295edcc061754f6defe07aa31a322590cb8f9e99069ac
+  data.tar.gz: 3f186435480485bf3bddb03881b0929f00e35a61224bd4f3fde2e0937d989295e3f8cee0a02c8dd7cd3255d233c4829986b0a3e6cdf44f23bc4d6f31fc2810c6

data/lib/dependabot/maven/file_parser/repositories_finder.rb

@@ -113,6 +113,11 @@ module Dependabot
             @maven_responses[url] ||= Excon.get(
               url,
               idempotent: true,
+              # We attempt to find dependencies in private repos before failing over to the CENTRAL_REPO_URL,
+              # but this can burn a lot of a job's time against slow servers due to our `read_timeout` being 20 seconds.
+              #
+              # In order to avoid the overall job timing out, we only make one retry attempt
+              retry_limit: 1,
               **SharedHelpers.excon_defaults
             )
             next unless @maven_responses[url].status == 200

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -23,8 +23,9 @@ module Dependabot
 
         def update_possible?
           return false unless target_version
+          return @update_possible if defined?(@update_possible)
 
-          @update_possible ||=
+          @update_possible =
             dependencies_using_property.all? do |dep|
               next false if includes_property_reference?(updated_version(dep))
 

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -25,6 +25,7 @@ module Dependabot
           @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
           @forbidden_urls      = []
+          @dependency_metadata = {}
         end
 
         def latest_version_details
@@ -154,25 +155,28 @@ module Dependabot
         end
 
         def dependency_metadata(repository_details)
-          @dependency_metadata ||= {}
-          @dependency_metadata[repository_details.hash] ||=
-            begin
-              response = Excon.get(
-                dependency_metadata_url(repository_details.fetch("url")),
-                idempotent: true,
-                **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
-              )
-              check_response(response, repository_details.fetch("url"))
+          repository_key = repository_details.hash
+          return @dependency_metadata[repository_key] if @dependency_metadata.key?(repository_key)
 
-              Nokogiri::XML(response.body)
-            rescue URI::InvalidURIError
-              Nokogiri::XML("")
-            rescue Excon::Error::Socket, Excon::Error::Timeout,
-                   Excon::Error::TooManyRedirects
-              raise if central_repo_urls.include?(repository_details["url"])
+          @dependency_metadata[repository_key] = fetch_dependency_metadata(repository_details)
+        end
 
-              Nokogiri::XML("")
-            end
+        def fetch_dependency_metadata(repository_details)
+          response = Excon.get(
+            dependency_metadata_url(repository_details.fetch("url")),
+            idempotent: true,
+            **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
+          )
+          check_response(response, repository_details.fetch("url"))
+
+          Nokogiri::XML(response.body)
+        rescue URI::InvalidURIError
+          Nokogiri::XML("")
+        rescue Excon::Error::Socket, Excon::Error::Timeout,
+               Excon::Error::TooManyRedirects
+          raise if central_repo_urls.include?(repository_details["url"])
+
+          Nokogiri::XML("")
         end
 
         def check_response(response, repository_url)
@@ -184,7 +188,7 @@ module Dependabot
         end
 
         def repositories
-          return @repositories if @repositories
+          return @repositories if defined?(@repositories)
 
           details = pom_repository_details + credentials_repository_details
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.185.0
+  version: 0.187.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.185.0
+        version: 0.187.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.185.0
+        version: 0.187.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement