dependabot-maven 0.273.0 → 0.275.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f08c5e84b1da70a3eff170ddc26f9a0689289f6af5f946e8c24abce650abcb1b
-  data.tar.gz: 66700800b05beb9203efea9a988d257750d77b9a2d8a3292d3e33705f71f6b6b
+  metadata.gz: 34e834338532d9b5075b9da8b125fd68ab0c799b626d20ba78c68f6a7caec872
+  data.tar.gz: 4847822f6792330975b50649d4bc62c695dff89273546f2e40147423fe85a266
 SHA512:
-  metadata.gz: 92f7317b42482d14f9925ac02875e01f31d5829213f941a5ad304c663efd1d9a3a8b352e8fb3f78d959f7f9443524004ee47e10f3868029a7dffeb14ac5ad43c
-  data.tar.gz: 3ec8922cb53fc85dd657c2f23557349c240154887339b7dee95ec1ad24d9e508c95555f332dba5f0d38a6200d32f62b096f832fa37d965dcc3c19de9dbc03435
+  metadata.gz: 642aacea8f45cee1f8ff1ed81c91c96569a2334895587bf57480dd2b283cad662c7e376759f51b70958df3e4f0267d0801e215d7e4c45033c788c63d225495a3
+  data.tar.gz: d0b825961255e3ed2acc27f3e8b735598ba2e24830438d1c4cd00eaabb6202d6f29989a683983efee2b6cc6cf1304f69cabf177db04300d585eebb0f5c851e3b

data/lib/dependabot/maven/new_version.rb

@@ -0,0 +1,71 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/maven/version_parser"
+require "dependabot/version"
+require "dependabot/utils"
+
+# See https://maven.apache.org/pom.html#Version_Order_Specification for details.
+
+module Dependabot
+  module Maven
+    class NewVersion
+      extend T::Sig
+      extend T::Helpers
+
+      PRERELEASE_QUALIFIERS = T.let([
+        Dependabot::Maven::VersionParser::ALPHA,
+        Dependabot::Maven::VersionParser::BETA,
+        Dependabot::Maven::VersionParser::MILESTONE,
+        Dependabot::Maven::VersionParser::RC,
+        Dependabot::Maven::VersionParser::SNAPSHOT
+      ].freeze, T::Array[Integer])
+
+      sig { returns(Dependabot::Maven::TokenBucket) }
+      attr_accessor :token_bucket
+
+      sig { params(version: String).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.empty?
+
+        Dependabot::Maven::VersionParser.parse(version.to_s).to_a.any?
+      rescue Dependabot::BadRequirementError
+        Dependabot.logger.info("Malformed version string - #{version}")
+        false
+      end
+
+      sig { params(version: String).void }
+      def initialize(version)
+        @version_string = T.let(version, String)
+        @token_bucket = T.let(Dependabot::Maven::VersionParser.parse(version), Dependabot::Maven::TokenBucket)
+      end
+
+      sig { returns(String) }
+      def inspect
+        "#<#{self.class} #{version_string}>"
+      end
+
+      sig { returns(String) }
+      def to_s
+        version_string
+      end
+
+      sig { returns(T::Boolean) }
+      def prerelease?
+        token_bucket.to_a.flatten.any? do |token|
+          token.is_a?(Integer) && token.negative?
+        end
+      end
+
+      sig { params(other: ::Dependabot::Maven::NewVersion).returns(Integer) }
+      def <=>(other)
+        T.must(token_bucket <=> other.token_bucket)
+      end
+
+      private
+
+      sig { returns(String) }
+      attr_reader :version_string
+    end
+  end
+end

data/lib/dependabot/maven/token_bucket.rb

@@ -0,0 +1,99 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/maven/version_parser"
+
+# See https://maven.apache.org/pom.html#Version_Order_Specification for details
+#
+module Dependabot
+  module Maven
+    class TokenBucket < T::Struct
+      extend T::Sig
+      extend T::Helpers
+      include Comparable
+
+      prop :tokens, T::Array[T.untyped]
+      prop :addition, T.nilable(TokenBucket)
+
+      sig { returns(T::Array[T.untyped]) }
+      def to_a
+        return tokens if addition.nil?
+
+        tokens.clone.append(addition.to_a)
+      end
+
+      sig { params(other: TokenBucket).returns(T.nilable(Integer)) }
+      def <=>(other)
+        cmp = compare_tokens(tokens, other.tokens)
+        return cmp unless cmp&.zero?
+
+        compare_additions(addition, other.addition)
+      end
+
+      sig do
+        params(
+          first: T::Array[T.any(String, Integer)],
+          second: T::Array[T.any(String, Integer)]
+        ).returns(T.nilable(Integer))
+      end
+      def compare_tokens(first, second)
+        max_idx = [first.size, second.size].max - 1
+        (0..max_idx).each do |idx|
+          cmp = compare_token_pair(first[idx], second[idx])
+          return cmp unless T.must(cmp).zero?
+        end
+        0
+      end
+
+      sig do
+        params(
+          first: T.nilable(T.any(String, Integer)),
+          second: T.nilable(T.any(String, Integer))
+        ).returns(T.nilable(Integer))
+      end
+      def compare_token_pair(first = 0, second = 0) # rubocop:disable Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity
+        first ||= 0
+        second ||= 0
+
+        if first.is_a?(Integer) && second.is_a?(String)
+          return first <= 0 ? -1 : 1
+        end
+
+        if first.is_a?(String) && second.is_a?(Integer)
+          return second <= 0 ? 1 : -1
+        end
+
+        if first == Dependabot::Maven::VersionParser::SP &&
+           second.is_a?(String) && second != Dependabot::Maven::VersionParser::SP
+          return -1
+        end
+
+        if second == Dependabot::Maven::VersionParser::SP &&
+           first.is_a?(String) && first != Dependabot::Maven::VersionParser::SP
+          return 1
+        end
+
+        if first.is_a?(Integer) && second.is_a?(Integer)
+          first <=> second
+        elsif first.is_a?(String) && second.is_a?(String)
+          first <=> second
+        end
+      end
+
+      sig do
+        params(first: T.nilable(TokenBucket), second: T.nilable(TokenBucket)).returns(T.nilable(Integer))
+      end
+      def compare_additions(first, second)
+        return 0 if first.nil? && second.nil?
+
+        (first || empty_addition) <=> (second || empty_addition)
+      end
+
+      sig { returns(TokenBucket) }
+      def empty_addition
+        TokenBucket.new(tokens: [])
+      end
+    end
+  end
+end

data/lib/dependabot/maven/version_parser.rb

@@ -0,0 +1,139 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "strscan"
+require "dependabot/maven/token_bucket"
+
+# See https://maven.apache.org/pom.html#Version_Order_Specification for details
+#
+module Dependabot
+  module Maven
+    class VersionParser
+      extend T::Sig
+      extend T::Helpers
+
+      ALPHA = -5
+      BETA = -4
+      MILESTONE = -3
+      RC = -2
+      SNAPSHOT = -1
+      SP = "sp"
+
+      sig { params(version: T.nilable(String)).returns(TokenBucket) }
+      def self.parse(version)
+        raise BadRequirementError, "Malformed version string - string is nil" if version.nil?
+        raise BadRequirementError, "Malformed version string - string is empty" if version.empty?
+
+        new(version).parse
+      end
+
+      sig { params(version: String).void }
+      def initialize(version)
+        @version = version
+        @token_bucket = T.let(TokenBucket.new(tokens: []), T.nilable(TokenBucket))
+        @parse_result = T.let(@token_bucket, T.nilable(TokenBucket))
+        @scanner = T.let(StringScanner.new(version.downcase), StringScanner)
+      end
+
+      sig { returns(TokenBucket) }
+      def parse
+        parse_version(false)
+
+        # no tokens: version is just one of the tokens we split on e.g '.' or '-'
+        raise BadRequirementError, "Malformed version string - #{version}" if parse_result.to_a.empty?
+
+        T.must(parse_result)
+      end
+
+      private
+
+      sig { returns(StringScanner) }
+      attr_reader :scanner
+
+      sig { returns(String) }
+      attr_reader :version
+
+      sig { returns(T.nilable(TokenBucket)) }
+      attr_reader :parse_result
+
+      sig { params(token: T.nilable(T.any(String, Integer))).void }
+      def parse_addition(token = nil)
+        @token_bucket&.addition = TokenBucket.new(tokens: [token].compact)
+        @token_bucket = @token_bucket&.addition
+
+        scanner.skip(/-+/)
+        parse_version(true)
+      end
+
+      sig { params(number_begins_partition: T.nilable(T::Boolean)).void }
+      def parse_version(number_begins_partition) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/MethodLength,Metrics/PerceivedComplexity
+        # skip leading v if any
+        scanner.skip(/v/)
+
+        until scanner.eos?
+          if (s = scanner.scan(/\d+/))
+            if number_begins_partition
+              parse_addition(s.to_i)
+            else
+              T.must(@token_bucket).tokens << s.to_i
+            end
+
+          elsif (s = scanner.match?(/a\d+/))
+            # aN is equivalent to alpha-N
+            scanner.skip("a")
+            parse_addition(ALPHA)
+
+          elsif (s = scanner.match?(/b\d+/))
+            # bN is equivalent to beta-N
+            scanner.skip("b")
+            parse_addition(BETA)
+
+          elsif (s = scanner.match?(/m\d+/))
+            # mN is equivalent to milestone-N
+            scanner.skip("m")
+            parse_addition(MILESTONE)
+
+          elsif (s = scanner.scan(/(alpha|beta|milestone|rc|cr|sp|ga|final|release|snapshot)[a-z]+/))
+            # process "alpha" and others as normal lexical tokens if they're followed by a letter
+            parse_addition(s)
+
+          elsif (s = scanner.scan("alpha"))
+            # handle alphaN, alpha-X, alpha.X, or ending alpha
+            parse_addition(ALPHA)
+
+          elsif (s = scanner.scan("beta"))
+            parse_addition(BETA)
+          elsif (s = scanner.scan("milestone"))
+            parse_addition(MILESTONE)
+
+          elsif (s = scanner.scan(/(rc|cr)/))
+            parse_addition(RC)
+
+          elsif (s = scanner.scan("snapshot"))
+            parse_addition(SNAPSHOT)
+
+          elsif (s = scanner.scan(/ga|final|release/))
+            parse_addition
+
+          elsif (s = scanner.scan("sp"))
+            parse_addition(SP)
+
+          # `+` is parsed as an addition as stated in maven version spec
+          elsif (s = scanner.scan(/[a-z_+]+/))
+            parse_addition(s)
+
+          elsif (s = scanner.scan("."))
+            number_begins_partition = false
+
+          elsif (s = scanner.scan("-"))
+            number_begins_partition = true
+
+          else
+            raise BadRequirementError, "Malformed version string - #{version}"
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.273.0
+  version: 0.275.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-29 00:00:00.000000000 Z
+date: 2024-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.273.0
+        version: 0.275.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.273.0
+        version: 0.275.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -252,19 +252,22 @@ files:
 - lib/dependabot/maven/file_updater/declaration_finder.rb
 - lib/dependabot/maven/file_updater/property_value_updater.rb
 - lib/dependabot/maven/metadata_finder.rb
+- lib/dependabot/maven/new_version.rb
 - lib/dependabot/maven/requirement.rb
+- lib/dependabot/maven/token_bucket.rb
 - lib/dependabot/maven/update_checker.rb
 - lib/dependabot/maven/update_checker/property_updater.rb
 - lib/dependabot/maven/update_checker/requirements_updater.rb
 - lib/dependabot/maven/update_checker/version_finder.rb
 - lib/dependabot/maven/utils/auth_headers_finder.rb
 - lib/dependabot/maven/version.rb
+- lib/dependabot/maven/version_parser.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.273.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
 post_install_message: 
 rdoc_options: []
 require_paths: