dependabot-maven 0.252.0 → 0.254.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9eda01330981f13d84f0ccc0432dc7126fabce81d38af8a72b7975fc1b305eef
-  data.tar.gz: fa16fe7931d168f511e11c06408d89089d549a6259c6d207867178d4ced847db
+  metadata.gz: 9d270322f7ca1c92e1ea2916f509e05d06ba98659b63a0088fdf3fe3332508f6
+  data.tar.gz: 1ba11c4b4f7d2610974ae2372c9631ce341d048a585d77794eac98f991018937
 SHA512:
-  metadata.gz: 31180e2eb6818db21a6022435a992627d1a7ae091e86869bd1cc9f396b3d91a704537b6f37caad4b66246d58f99f9e87b701e67ac340f2d15677d25f15801d9c
-  data.tar.gz: 8242bdc1e9d8fcc502ba386f8bcb07d832e80a4b76c6a2edad7c5a544a9b0ab5b1be1ee0a9e44485d86162a94f9b9ba82f7c6d3ace559e55e1e48714fe8be3cc
+  metadata.gz: 8c4154672463bc7af35b4000e30cb11d98fdc5bd10f07b76f9c30b20f9d2f8668021d596930e863d4c1679a140a04c85093bb178fdab9e910eda56efe9caa0eb
+  data.tar.gz: c4143032c1f627d0fb96a3b62dc0446195fe3d068fdeac64fc9146a96e34c33e49dea80d35c2d48cf85d6018b5c03d31038fa1e303b550ce8af0685d6501b5a8

data/lib/dependabot/maven/file_parser/property_value_finder.rb

@@ -36,9 +36,10 @@ module Dependabot
           node =
             loop do
               candidate_node =
-                doc.at_xpath("/project/#{nm}") ||
-                doc.at_xpath("/project/properties/#{property_name}") ||
-                doc.at_xpath("/project/profiles/profile/properties/#{property_name}")
+                doc.xpath("/project/#{nm}").last ||
+                doc.xpath("/project/properties/#{property_name}").last ||
+                doc.xpath("/project/profiles/profile/properties/#{property_name}").last
+
               break candidate_node if candidate_node
               break unless nm.match?(DOT_SEPARATOR_REGEX)
 
@@ -47,6 +48,15 @@ module Dependabot
               raise DependencyFileNotEvaluatable, e.message
             end
 
+          # and value is an expression
+          if node && /\$\{(?<expression>.+)\}/.match(node.content.strip)
+            return extract_value_from_expression(
+              expression: node.content.strip,
+              property_name: property_name,
+              callsite_pom: callsite_pom
+            )
+          end
+
           # If we found a property, return it
           return { file: pom.name, node: node, value: node.content.strip } if node
 
@@ -63,6 +73,19 @@ module Dependabot
 
         attr_reader :dependency_files
 
+        def extract_value_from_expression(expression:, property_name:, callsite_pom:)
+          # and the expression is pointing to self then raise the error
+          if expression.eql?("${#{property_name}}")
+            raise Dependabot::DependencyFileNotParseable.new(
+              callsite_pom.name,
+              "Error trying to resolve recursive expression '#{expression}'."
+            )
+          end
+
+          # and the expression is pointing to another tag, then get the value of that tag
+          property_details(property_name: expression.slice(2..-2), callsite_pom: callsite_pom)
+        end
+
         def sanitize_property_name(property_name)
           property_name.sub(/^pom\./, "").sub(/^project\./, "")
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.252.0
+  version: 0.254.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-11 00:00:00.000000000 Z
+date: 2024-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.254.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.254.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 1.9.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -114,70 +114,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.58.0
+        version: 1.63.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.58.0
+        version: 1.63.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.19.0
+        version: 1.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.19.0
+        version: 1.21.0
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.27.1
+        version: 2.29.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.27.1
+        version: 2.29.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
-- !ruby/object:Gem::Dependency
-  name: stackprof
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.16
+        version: 0.8.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.16
+        version: 0.8.1
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -264,7 +250,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.252.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.254.0
 post_install_message: 
 rdoc_options: []
 require_paths: