dependabot-maven 0.186.0 → 0.188.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61ab699462cbc06e09d9c3c6113fb95eb17c1030e6b5ae58cca38c29587dad95
-  data.tar.gz: 0f38d30e897042f4162bd8312631102d5559ab52c6b47c03a3e1e4c49492b732
+  metadata.gz: ccaf493779afc2e54115765bd41bb153d65401f941e174f91257c3bd34399fe9
+  data.tar.gz: '0793762045558772c01bc66d6f58866f042c03c8d567fa12307dabcbc9daf7a7'
 SHA512:
-  metadata.gz: 87663a8e69059757e84b3a77e5763b98c752e079f35b7b4bfc950b53bd8b36181ceaf6d6e299740c5ea6be7df6af2c01e7dac45dc493eb8420b603ff78c588f0
-  data.tar.gz: 4f22b87deedb78e29d9b3ebe97eb8aecea546aa8d1ec40f5ed4c2e37b44a4c25a7858700a986e835f59070c3d3d44b54652e8ba166137d06635de50980a06594
+  metadata.gz: e4255cf908f7a521bd8ffd4622b7db8cb5946b1cf50a238418d316b6c3206c1be0cd92182344b8a8f2475a0d64acf857a568fa21e27f8ed7571e58944df35976
+  data.tar.gz: ea779730300a9ad74ff0d8509ecdac7ce1d50d1c09d9f941e5e939dc66b616734a44e5688a08aaff4f6ad95e4623911a8e54ee8b5e02a3a35fffe6c6d9629ef4

data/lib/dependabot/maven/file_parser/repositories_finder.rb

@@ -113,6 +113,11 @@ module Dependabot
             @maven_responses[url] ||= Excon.get(
               url,
               idempotent: true,
+              # We attempt to find dependencies in private repos before failing over to the CENTRAL_REPO_URL,
+              # but this can burn a lot of a job's time against slow servers due to our `read_timeout` being 20 seconds.
+              #
+              # In order to avoid the overall job timing out, we only make one retry attempt
+              retry_limit: 1,
               **SharedHelpers.excon_defaults
             )
             next unless @maven_responses[url].status == 200

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -23,8 +23,9 @@ module Dependabot
 
         def update_possible?
           return false unless target_version
+          return @update_possible if defined?(@update_possible)
 
-          @update_possible ||=
+          @update_possible =
             dependencies_using_property.all? do |dep|
               next false if includes_property_reference?(updated_version(dep))
 

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -25,6 +25,7 @@ module Dependabot
           @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
           @forbidden_urls      = []
+          @dependency_metadata = {}
         end
 
         def latest_version_details
@@ -154,25 +155,28 @@ module Dependabot
         end
 
         def dependency_metadata(repository_details)
-          @dependency_metadata ||= {}
-          @dependency_metadata[repository_details.hash] ||=
-            begin
-              response = Excon.get(
-                dependency_metadata_url(repository_details.fetch("url")),
-                idempotent: true,
-                **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
-              )
-              check_response(response, repository_details.fetch("url"))
+          repository_key = repository_details.hash
+          return @dependency_metadata[repository_key] if @dependency_metadata.key?(repository_key)
 
-              Nokogiri::XML(response.body)
-            rescue URI::InvalidURIError
-              Nokogiri::XML("")
-            rescue Excon::Error::Socket, Excon::Error::Timeout,
-                   Excon::Error::TooManyRedirects
-              raise if central_repo_urls.include?(repository_details["url"])
+          @dependency_metadata[repository_key] = fetch_dependency_metadata(repository_details)
+        end
 
-              Nokogiri::XML("")
-            end
+        def fetch_dependency_metadata(repository_details)
+          response = Excon.get(
+            dependency_metadata_url(repository_details.fetch("url")),
+            idempotent: true,
+            **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
+          )
+          check_response(response, repository_details.fetch("url"))
+
+          Nokogiri::XML(response.body)
+        rescue URI::InvalidURIError
+          Nokogiri::XML("")
+        rescue Excon::Error::Socket, Excon::Error::Timeout,
+               Excon::Error::TooManyRedirects
+          raise if central_repo_urls.include?(repository_details["url"])
+
+          Nokogiri::XML("")
         end
 
         def check_response(response, repository_url)
@@ -184,7 +188,7 @@ module Dependabot
         end
 
         def repositories
-          return @repositories if @repositories
+          return @repositories if defined?(@repositories)
 
           details = pom_repository_details + credentials_repository_details
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.186.0
+  version: 0.188.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-10 00:00:00.000000000 Z
+date: 2022-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.186.0
+        version: 0.188.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.186.0
+        version: 0.188.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.28.2
+        version: 1.29.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.28.2
+        version: 1.29.1
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement