dependabot-maven 0.278.0 → 0.280.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d73dfbfce3413f3d179bf73f68859d6dad38f3f25edfdda6326c3968f40cdddc
-  data.tar.gz: 78defdf21de9734aadb0885c6aa1d44ba5fff411ce02bd0566612332c6a7ba94
+  metadata.gz: 669e3997e249e8535406a9d5d9e0c7acde26c6b44f2d8ee0b56ef7b6bc731147
+  data.tar.gz: 448771065c86241d417f1a62ed0e35192c3c3fe217f3ff748d668b82dbf2a557
 SHA512:
-  metadata.gz: c7bf8160553aa4585f8cca47812067fb364bb659f05ac56ccfc257c68e50778bf8cf9871c951b0d791bb4062ae164fa452de02da4a44ba7b21b28b0ce470cac5
-  data.tar.gz: fdfbc1d3c0d84fa6d760034e14b6defa7d2c224f0f49e6668370265d8f3a6ce031f5b43791359d899548a69a0ec9ecf7ac64c04c3fdcff326de25f71c7734c59
+  metadata.gz: e73590f9ac4791ab3a853fab6eadda290aea9f4749e4d5cee786c95257d85d781d74fbf1d662e0b9095e1dce69f18d30f37e806db60bdaf5df0ffaa74f7ebb99
+  data.tar.gz: 7e13ff18fd4fcbe3127d4cf6740537f076dd571bbcd87b14eeb8c726bf568f29a7f1f0a11779b232f9cc0702d0d9bd327bd7cc113876050317d9d190760eadae

data/lib/dependabot/maven/update_checker/requirements_updater.rb

@@ -50,12 +50,8 @@ module Dependabot
         attr_reader :properties_to_update
 
         def update_requirement(req_string)
-          if req_string.include?(".+")
-            update_dynamic_requirement(req_string)
-          else
-            # Since range requirements are excluded this must be exact
-            update_exact_requirement(req_string)
-          end
+          # Since range requirements are excluded this must be exact
+          update_exact_requirement(req_string)
         end
 
         def update_exact_requirement(req_string)
@@ -64,16 +60,6 @@ module Dependabot
           req_string.gsub(old_version.to_s, latest_version.to_s)
         end
 
-        # This is really only a Gradle thing, but Gradle relies on this
-        # RequirementsUpdater too
-        def update_dynamic_requirement(req_string)
-          precision = req_string.split(".").take_while { |s| s != "+" }.count
-
-          version_parts = latest_version.segments.first(precision)
-
-          version_parts.join(".") + ".+"
-        end
-
         def version_class
           Maven::Version
         end

data/lib/dependabot/maven/version.rb

@@ -1,192 +1,119 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "dependabot/maven/version_parser"
 require "dependabot/version"
 require "dependabot/utils"
 
-# Java versions use dots and dashes when tokenising their versions.
-# Gem::Version converts a "-" to ".pre.", so we override the `to_s` method.
-#
 # See https://maven.apache.org/pom.html#Version_Order_Specification for details.
 
 module Dependabot
   module Maven
     class Version < Dependabot::Version
-      NULL_VALUES = %w(0 final ga).freeze
-      PREFIXED_TOKEN_HIERARCHY = {
-        "." => { qualifier: 1, number: 4 },
-        "-" => { qualifier: 2, number: 3 },
-        "+" => { qualifier: 3, number: 2 }
-      }.freeze
-      NAMED_QUALIFIERS_HIERARCHY = {
-        "a" => 1, "alpha"     => 1,
-        "b" => 2, "beta"      => 2,
-        "m" => 3, "milestone" => 3,
-        "rc" => 4, "cr" => 4, "pr" => 4, "pre" => 4,
-        "snapshot" => 5, "dev" => 5,
-        "ga" => 6, "" => 6, "final" => 6,
-        "sp" => 7
-      }.freeze
+      extend T::Sig
+      extend T::Helpers
+
+      PRERELEASE_QUALIFIERS = T.let([
+        Dependabot::Maven::VersionParser::ALPHA,
+        Dependabot::Maven::VersionParser::BETA,
+        Dependabot::Maven::VersionParser::MILESTONE,
+        Dependabot::Maven::VersionParser::RC,
+        Dependabot::Maven::VersionParser::SNAPSHOT
+      ].freeze, T::Array[Integer])
+
       VERSION_PATTERN =
         "[0-9a-zA-Z]+" \
         '(?>\.[0-9a-zA-Z]*)*' \
         '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?'
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
+      sig { returns(Dependabot::Maven::TokenBucket) }
+      attr_accessor :token_bucket
+
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
-        return false if version.nil?
+        return false if version.to_s.empty?
 
-        version.to_s.match?(ANCHORED_VERSION_PATTERN)
+        Dependabot::Maven::VersionParser.parse(version.to_s).to_a.any?
+      rescue ArgumentError
+        Dependabot.logger.info("Malformed version string #{version}")
+        false
       end
 
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
-        @version_string = version.to_s
+        raise BadRequirementError, "Malformed version string - string is nil" if version.nil?
+
+        @version_string = T.let(version.to_s, String)
+        @token_bucket = T.let(Dependabot::Maven::VersionParser.parse(version_string), Dependabot::Maven::TokenBucket)
         super(version.to_s.tr("_", "-"))
       end
 
+      sig { returns(String) }
       def inspect
-        "#<#{self.class} #{@version_string}>"
+        "#<#{self.class} #{version_string}>"
       end
 
+      sig { returns(String) }
       def to_s
-        @version_string
+        version_string
       end
 
+      sig { returns(T::Boolean) }
       def prerelease?
-        tokens.any? do |token|
-          next true if token == "eap"
-          next false unless NAMED_QUALIFIERS_HIERARCHY[token]
-
-          NAMED_QUALIFIERS_HIERARCHY[token] < 6
+        token_bucket.to_a.flatten.any? do |token|
+          token.is_a?(Integer) && token.negative?
         end
       end
 
+      sig { params(other: VersionParameter).returns(Integer) }
       def <=>(other)
-        version = stringify_version(@version_string)
-        version = fill_tokens(version)
-        version = trim_version(version)
-
-        other_version = stringify_version(other)
-        other_version = fill_tokens(other_version)
-        other_version = trim_version(other_version)
-
-        version, other_version = convert_dates(version, other_version)
-
-        prefixed_tokens = split_into_prefixed_tokens(version)
-        other_prefixed_tokens = split_into_prefixed_tokens(other_version)
-
-        prefixed_tokens, other_prefixed_tokens =
-          pad_for_comparison(prefixed_tokens, other_prefixed_tokens)
-
-        prefixed_tokens.count.times.each do |index|
-          comp = compare_prefixed_token(
-            prefix: prefixed_tokens[index][0],
-            token: prefixed_tokens[index][1..-1] || "",
-            other_prefix: other_prefixed_tokens[index][0],
-            other_token: other_prefixed_tokens[index][1..-1] || ""
-          )
-          return comp unless comp.zero?
-        end
-
-        0
+        other = Dependabot::Maven::Version.new(other.to_s) unless other.is_a? Dependabot::Maven::Version
+        T.must(token_bucket <=> T.cast(other, Dependabot::Maven::Version).token_bucket)
       end
 
-      private
-
-      def tokens
-        @tokens ||=
-          begin
-            version = @version_string.to_s.downcase
-            version = fill_tokens(version)
-            version = trim_version(version)
-            split_into_prefixed_tokens(version).map { |t| t[1..-1] }
-          end
-      end
+      sig { override.returns(T::Array[String]) }
+      def ignored_patch_versions
+        parts = token_bucket.tokens # e.g [1,2,3] if version is 1.2.3-alpha3
+        return [] if parts.empty? # for non-semver versions
 
-      def stringify_version(version)
-        version = version.to_s.downcase
+        version_parts = parts.fill("0", parts.length...2)
+        # the a0 is so we can get the next earliest prerelease patch version
+        upper_parts = version_parts.first(1) + [version_parts[1].to_i + 1] + ["a0"]
+        lower_bound = "> #{to_semver}"
+        upper_bound = "< #{upper_parts.join('.')}"
 
-        # Not technically correct, but pragmatic
-        version.gsub(/^v(?=\d)/, "")
+        ["#{lower_bound}, #{upper_bound}"]
       end
 
-      def fill_tokens(version)
-        # Add separators when transitioning from digits to characters
-        version = version.gsub(/(\d)([A-Za-z])/, '\1-\2')
-        version = version.gsub(/([A-Za-z])(\d)/, '\1-\2')
+      sig { override.returns(T::Array[String]) }
+      def ignored_minor_versions
+        parts = token_bucket.tokens # e.g [1,2,3] if version is 1.2.3-alpha3
+        return [] if parts.empty? # for non-semver versions
 
-        # Replace empty tokens with 0
-        version = version.gsub(/([\.\-])([\.\-])/, '\10\2')
-        version = version.gsub(/^([\.\-])/, '0\1')
-        version.gsub(/([\.\-])$/, '\10')
-      end
+        version_parts = parts.fill("0", parts.length...2)
+        lower_parts = version_parts.first(1) + [version_parts[1].to_i + 1] + ["a0"]
+        upper_parts = version_parts.first(0) + [version_parts[0].to_i + 1] + ["a0"]
+        lower_bound = ">= #{lower_parts.join('.')}"
+        upper_bound = "< #{upper_parts.join('.')}"
 
-      def trim_version(version)
-        version.split("-").filter_map do |v|
-          parts = v.split(".")
-          parts = parts[0..-2] while NULL_VALUES.include?(parts&.last)
-          parts&.join(".")
-        end.reject(&:empty?).join("-")
+        ["#{lower_bound}, #{upper_bound}"]
       end
 
-      def convert_dates(version, other_version)
-        default = [version, other_version]
-        return default unless version.match?(/^\d{4}-?\d{2}-?\d{2}$/)
-        return default unless other_version.match?(/^\d{4}-?\d{2}-?\d{2}$/)
+      sig { override.returns(T::Array[String]) }
+      def ignored_major_versions
+        version_parts = token_bucket.tokens # e.g [1,2,3] if version is 1.2.3-alpha3
+        return [] if version_parts.empty? # for non-semver versions
 
-        [version.delete("-"), other_version.delete("-")]
-      end
+        lower_parts = [version_parts[0].to_i + 1] + ["a0"] # earliest next major version prerelease
+        lower_bound = ">= #{lower_parts.join('.')}"
 
-      def split_into_prefixed_tokens(version)
-        ".#{version}".split(/(?=[\-\.\+])/)
+        [lower_bound]
       end
 
-      def pad_for_comparison(prefixed_tokens, other_prefixed_tokens)
-        prefixed_tokens = prefixed_tokens.dup
-        other_prefixed_tokens = other_prefixed_tokens.dup
-
-        longest = [prefixed_tokens, other_prefixed_tokens].max_by(&:count)
-        shortest = [prefixed_tokens, other_prefixed_tokens].min_by(&:count)
-
-        longest.count.times do |index|
-          next unless shortest[index].nil?
-
-          shortest[index] = longest[index].start_with?(".") ? ".0" : "-"
-        end
-
-        [prefixed_tokens, other_prefixed_tokens]
-      end
-
-      def compare_prefixed_token(prefix:, token:, other_prefix:, other_token:)
-        token_type = token.match?(/^\d+$/) ? :number : :qualifier
-        other_token_type = other_token.match?(/^\d+$/) ? :number : :qualifier
-
-        hierarchy = PREFIXED_TOKEN_HIERARCHY.fetch(prefix).fetch(token_type)
-        other_hierarchy =
-          PREFIXED_TOKEN_HIERARCHY.fetch(other_prefix).fetch(other_token_type)
-
-        hierarchy_comparison = hierarchy <=> other_hierarchy
-        return hierarchy_comparison unless hierarchy_comparison.zero?
-
-        compare_token(token: token, other_token: other_token)
-      end
-
-      def compare_token(token:, other_token:)
-        if (token_hierarchy = NAMED_QUALIFIERS_HIERARCHY[token])
-          return -1 unless NAMED_QUALIFIERS_HIERARCHY[other_token]
-
-          return token_hierarchy <=> NAMED_QUALIFIERS_HIERARCHY[other_token]
-        end
-
-        return 1 if NAMED_QUALIFIERS_HIERARCHY[other_token]
-
-        if token.match?(/\A\d+\z/) && other_token.match?(/\A\d+\z/)
-          token = token.to_i
-          other_token = other_token.to_i
-        end
+      private
 
-        token <=> other_token
-      end
+      sig { returns(String) }
+      attr_reader :version_string
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.278.0
+  version: 0.280.0
 platform: ruby
 authors:
 - Dependabot
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-26 00:00:00.000000000 Z
+date: 2024-10-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.278.0
+        version: 0.280.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.278.0
+        version: 0.280.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.1
+        version: 0.8.5
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -252,7 +252,6 @@ files:
 - lib/dependabot/maven/file_updater/declaration_finder.rb
 - lib/dependabot/maven/file_updater/property_value_updater.rb
 - lib/dependabot/maven/metadata_finder.rb
-- lib/dependabot/maven/new_version.rb
 - lib/dependabot/maven/requirement.rb
 - lib/dependabot/maven/token_bucket.rb
 - lib/dependabot/maven/update_checker.rb
@@ -267,8 +266,8 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.278.0
-post_install_message: 
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.280.0
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -284,7 +283,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 3.1.0
 requirements: []
 rubygems_version: 3.5.9
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Provides Dependabot support for Maven
 test_files: []

data/lib/dependabot/maven/new_version.rb

@@ -1,71 +0,0 @@
-# typed: strict
-# frozen_string_literal: true
-
-require "dependabot/maven/version_parser"
-require "dependabot/version"
-require "dependabot/utils"
-
-# See https://maven.apache.org/pom.html#Version_Order_Specification for details.
-
-module Dependabot
-  module Maven
-    class NewVersion
-      extend T::Sig
-      extend T::Helpers
-
-      PRERELEASE_QUALIFIERS = T.let([
-        Dependabot::Maven::VersionParser::ALPHA,
-        Dependabot::Maven::VersionParser::BETA,
-        Dependabot::Maven::VersionParser::MILESTONE,
-        Dependabot::Maven::VersionParser::RC,
-        Dependabot::Maven::VersionParser::SNAPSHOT
-      ].freeze, T::Array[Integer])
-
-      sig { returns(Dependabot::Maven::TokenBucket) }
-      attr_accessor :token_bucket
-
-      sig { params(version: String).returns(T::Boolean) }
-      def self.correct?(version)
-        return false if version.empty?
-
-        Dependabot::Maven::VersionParser.parse(version.to_s).to_a.any?
-      rescue Dependabot::BadRequirementError
-        Dependabot.logger.info("Malformed version string - #{version}")
-        false
-      end
-
-      sig { params(version: String).void }
-      def initialize(version)
-        @version_string = T.let(version, String)
-        @token_bucket = T.let(Dependabot::Maven::VersionParser.parse(version), Dependabot::Maven::TokenBucket)
-      end
-
-      sig { returns(String) }
-      def inspect
-        "#<#{self.class} #{version_string}>"
-      end
-
-      sig { returns(String) }
-      def to_s
-        version_string
-      end
-
-      sig { returns(T::Boolean) }
-      def prerelease?
-        token_bucket.to_a.flatten.any? do |token|
-          token.is_a?(Integer) && token.negative?
-        end
-      end
-
-      sig { params(other: ::Dependabot::Maven::NewVersion).returns(Integer) }
-      def <=>(other)
-        T.must(token_bucket <=> other.token_bucket)
-      end
-
-      private
-
-      sig { returns(String) }
-      attr_reader :version_string
-    end
-  end
-end