dependabot-maven 0.356.0 → 0.357.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 939776aad30eddb24b7f46aba6efaf40a3d2a2283d9b4e7f85dc834324ad8417
-  data.tar.gz: 3c8e2245756dd20c57a9a436f085764e6f3b0640b17dce77d44a1e86b96f12a2
+  metadata.gz: 88f4ec6abad6b9329da21a5d9d1b8a1ac73a541d0fb0437149def4a1cfad73e4
+  data.tar.gz: 99280b25245177eae98b618cba2ca285bf4db099dbe3396c481db91328a4997b
 SHA512:
-  metadata.gz: 13d3ce09d720eacd2726597e773beab4c124ade4bc77e166336250dd59332905e149b58285186d8ec64eccfdfd58af9bf3e2cc02c4caac11e49a5b89b501bfcb
-  data.tar.gz: 485059691e0adca6ed1effa6df241abc34a2fffded27dcb5f67f9f8982e46107a8f177581580d0719db9d5de1e172657f0b03b70a72445b212e459ed38d0c7f1
+  metadata.gz: 010f3bbe4754d3e0128516561cb4f19b290d2d8d3edc1289f9ad89504638662ca922fa30c4cc1859080b4dbcbe33b8161523216a074319c41af0cd2739e87bdd
+  data.tar.gz: 4073e5d61854ad4ac1be44c72f2baef543e5f1f81e90f0c27e6816e03ed9f10de33edf645e4e3b8e1c5115ca8215a9b384634d06ffcbee343d97c641225a9e54

data/lib/dependabot/maven/file_parser.rb

@@ -122,14 +122,16 @@ module Dependabot
         doc = Nokogiri::XML(pom.content)
         doc.remove_namespaces!
 
+        plugin_names = collect_plugin_names(pom, doc)
+
         doc.css(DEPENDENCY_SELECTOR).each do |dependency_node|
-          dep = dependency_from_dependency_node(pom, dependency_node)
+          dep = dependency_from_dependency_node(pom, dependency_node, plugin_names)
           dependency_set << dep if dep
         rescue DependencyFileNotEvaluatable => e
           errors << e
         end
 
-        doc.css(PLUGIN_SELECTOR, PLUGIN_ARTIFACT_ITEMS_SELECTOR).each do |dependency_node|
+        plugin_nodes(doc).each do |dependency_node|
           dep = dependency_from_plugin_node(pom, dependency_node)
           dependency_set << dep if dep
         rescue DependencyFileNotEvaluatable => e
@@ -141,6 +143,18 @@ module Dependabot
         dependency_set
       end
 
+      sig { params(pom: Dependabot::DependencyFile, doc: Nokogiri::XML::Document).returns(T::Set[String]) }
+      def collect_plugin_names(pom, doc)
+        plugin_names = Set.new
+
+        plugin_nodes(doc).each do |plugin_node|
+          name = plugin_name(plugin_node, pom)
+          plugin_names << name if name
+        end
+
+        plugin_names
+      end
+
       sig { params(extension: Dependabot::DependencyFile).returns(DependencySet) }
       def extensionfile_dependencies(extension)
         dependency_set = DependencySet.new
@@ -149,8 +163,10 @@ module Dependabot
         doc = Nokogiri::XML(extension.content)
         doc.remove_namespaces!
 
+        plugin_names = collect_plugin_names(extension, doc)
+
         doc.css(EXTENSION_SELECTOR).each do |dependency_node|
-          dep = dependency_from_dependency_node(extension, dependency_node)
+          dep = dependency_from_dependency_node(extension, dependency_node, plugin_names)
           dependency_set << dep if dep
         rescue DependencyFileNotEvaluatable => e
           errors << e
@@ -169,8 +185,10 @@ module Dependabot
         doc = Nokogiri::XML(target.content)
         doc.remove_namespaces!
 
+        plugin_names = collect_plugin_names(target, doc)
+
         doc.css(TARGET_SELECTOR).each do |dependency_node|
-          dep = dependency_from_dependency_node(target, dependency_node)
+          dep = dependency_from_dependency_node(target, dependency_node, plugin_names)
           dependency_set << dep if dep
         rescue DependencyFileNotEvaluatable => e
           errors << e
@@ -184,14 +202,16 @@ module Dependabot
       sig do
         params(
           pom: Dependabot::DependencyFile,
-          dependency_node: Nokogiri::XML::Element
+          dependency_node: Nokogiri::XML::Element,
+          plugin_names: T::Set[String]
         ).returns(T.nilable(Dependabot::Dependency))
       end
-      def dependency_from_dependency_node(pom, dependency_node)
+      def dependency_from_dependency_node(pom, dependency_node, plugin_names)
         return unless (name = dependency_name(dependency_node, pom))
         return if internal_dependency_names.include?(name)
 
-        build_dependency(pom, dependency_node, name)
+        is_plugin = plugin_names.include?(name)
+        build_dependency(pom, dependency_node, name, is_plugin: is_plugin)
       end
 
       sig do
@@ -204,17 +224,18 @@ module Dependabot
         return unless (name = plugin_name(dependency_node, pom))
         return if internal_dependency_names.include?(name)
 
-        build_dependency(pom, dependency_node, name)
+        build_dependency(pom, dependency_node, name, is_plugin: true)
       end
 
       sig do
         params(
           pom: Dependabot::DependencyFile,
           dependency_node: Nokogiri::XML::Element,
-          name: String
+          name: String,
+          is_plugin: T::Boolean
         ).returns(T.nilable(Dependabot::Dependency))
       end
-      def build_dependency(pom, dependency_node, name)
+      def build_dependency(pom, dependency_node, name, is_plugin:)
         property_details =
           {
             property_name: version_property_name(dependency_node),
@@ -228,7 +249,7 @@ module Dependabot
           requirements: [{
             requirement: dependency_requirement(pom, dependency_node),
             file: pom.name,
-            groups: dependency_groups(pom, dependency_node),
+            groups: dependency_groups(pom, dependency_node, is_plugin: is_plugin),
             source: nil,
             metadata: {
               packaging_type: packaging_type(pom, dependency_node),
@@ -324,8 +345,16 @@ module Dependabot
         version_content.empty? ? nil : version_content
       end
 
-      sig { params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(T::Array[String]) }
-      def dependency_groups(pom, dependency_node)
+      sig do
+        params(
+          pom: Dependabot::DependencyFile,
+          dependency_node: Nokogiri::XML::Element,
+          is_plugin: T::Boolean
+        ).returns(T::Array[String])
+      end
+      def dependency_groups(pom, dependency_node, is_plugin:)
+        return ["plugin"] if is_plugin
+
         dependency_scope(pom, dependency_node) == "test" ? ["test"] : []
       end
 
@@ -531,6 +560,11 @@ module Dependabot
           end
         end
       end
+
+      sig { params(doc: Nokogiri::XML::Document).returns(Nokogiri::XML::NodeSet) }
+      def plugin_nodes(doc)
+        doc.css(PLUGIN_SELECTOR, PLUGIN_ARTIFACT_ITEMS_SELECTOR)
+      end
     end
     # rubocop:enable Metrics/ClassLength
   end

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -86,15 +86,10 @@ module Dependabot
               evaluated_value(node.at_xpath("./*/artifactId").content.strip)
             ].compact.join(":")
 
-            if node.at_xpath("./*/classifier")
-              classifier = evaluated_value(node.at_xpath("./*/classifier").content.strip)
-              dep_classifier = dependency.requirements.first&.dig(:metadata, :classifier)
-              next false if classifier != dep_classifier
-            end
-
+            next false unless classifier_matches?(node)
             next false unless node_name == dependency_name
             next false unless packaging_type_matches?(node)
-            next false unless scope_matches?(node)
+            next false unless declaring_requirement.fetch(:groups) == ["plugin"] || scope_matches?(node)
 
             declaring_requirement_matches?(node)
           end
@@ -140,9 +135,19 @@ module Dependabot
           type == packaging_type(node)
         end
 
+        sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }
+        def classifier_matches?(node)
+          return true unless node.at_xpath("./*/classifier")
+
+          classifier = evaluated_value(node.at_xpath("./*/classifier").content.strip)
+          dep_classifier = dependency.requirements.first&.dig(:metadata, :classifier)
+          classifier == dep_classifier
+        end
+
         sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }
         def scope_matches?(node)
           dependency_type = declaring_requirement.fetch(:groups)
+
           node_type = dependency_scope(node) == "test" ? ["test"] : []
 
           dependency_type == node_type

data/lib/dependabot/maven.rb

@@ -17,7 +17,7 @@ Dependabot::PullRequestCreator::Labeler
 
 require "dependabot/dependency"
 Dependabot::Dependency
-  .register_production_check("maven", ->(groups) { groups != ["test"] })
+  .register_production_check("maven", ->(groups) { groups != ["test"] && groups != ["plugin"] })
 
 Dependabot::Dependency
   .register_display_name_builder(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.356.0
+  version: 0.357.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.356.0
+        version: 0.357.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.356.0
+        version: 0.357.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.356.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.357.0
 rdoc_options: []
 require_paths:
 - lib
@@ -301,7 +301,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Provides Dependabot support for Maven
 test_files: []