dependabot-maven 0.359.0 → 0.360.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b56d56076dd7572742ae5c219bee76cbb08a7eb9f951984f0c05bef88314b85
-  data.tar.gz: c9fe660bf51ea3c9789b16a32a57e2e911d6446f22e02eb4feff93e99fb33ad0
+  metadata.gz: d2135816e7a3379a06d7aaf84692d986627bbfb4627ab263a150107a4feaee4e
+  data.tar.gz: c1deca188041924a4946ad4b33012c31a237e9a5432bd01968bed1a89f34d723
 SHA512:
-  metadata.gz: b6c158bfbf352a1307dc8f2112ae2716eca87aad75888a0292350609139d22f1ecf6d703bb9d13d1fd74f04c6e04afff9beb4ba37aa6410993547c232b0cad63
-  data.tar.gz: 4e3a49fff8493d1d906193f35d5ff2662e7f9b57418717f71fb56a2ff8a59000aba2c87f99e74cb5d04a7a7ec9352114b27987fbc2860def70221f575b16f371
+  metadata.gz: 06ff61a92d1358576a2e96b386ce1290f4edaf80e3d876e3d7cdeeae1f7b91859ef2ccfabdf354bc0a198b0098d71ade0864b1a949144b018591e8424407a170
+  data.tar.gz: f91ad820a970652221fa8cf621b7978ff6db67f79d1763b8bd562a9012388c59c2c1cb0ab47ed1c4deb338d3e56aaa823e7d36a81fe212e0ebfcb14ab9e950fe

data/lib/dependabot/maven/package/package_details_fetcher.rb

@@ -135,7 +135,7 @@ module Dependabot
             xml = dependency_metadata(repository_details)
             next [] if xml.nil?
 
-            break extract_metadata_from_xml(xml, url)
+            extract_metadata_from_xml(xml, url)
           end
 
           raise PrivateSourceAuthenticationFailure, forbidden_urls.first if version_details.none? && forbidden_urls.any?

data/lib/dependabot/maven/shared/shared_version_finder.rb

@@ -68,12 +68,86 @@ module Dependabot
           current_suffix = extract_version_suffix(current_version_string)
           candidate_suffix = extract_version_suffix(candidate_version_string)
 
+          if jre_or_jdk?(current_suffix) && jre_or_jdk?(candidate_suffix)
+            return compatible_java_runtime?(T.must(current_suffix), T.must(candidate_suffix))
+          end
+
           # If both versions share the exact suffix or no suffix, they are compatible
           current_suffix == candidate_suffix
         end
 
         private
 
+        # Determines whether two Java runtime suffixes are compatible.
+        #
+        # Compatibility rules:
+        # - Both suffixes must be present and parseable.
+        # - Java major versions must match (e.g., jdk8 != jdk11).
+        # - JDK → JRE is NOT compatible (runtime capability downgrade).
+        # - JRE → JDK is compatible (the JDK includes the JRE).
+        # - JRE → JRE and JDK → JDK are compatible when versions match.
+        # @example
+        #   compatible_java_runtime?("jre8", "jre8")   # => true   (same version, JRE → JRE)
+        #   compatible_java_runtime?("jdk8", "jdk8")   # => true   (same version, JDK → JDK)
+        #   compatible_java_runtime?("jre8", "jdk8")   # => true   (JRE → JDK is compatible)
+        #   compatible_java_runtime?("jdk8", "jre8")   # => false  (JDK → JRE is NOT compatible)
+        #   compatible_java_runtime?("jre8", "jre11")  # => false  (version mismatch)
+        #   compatible_java_runtime?("jdk8", "jdk11")  # => false  (version mismatch)
+        sig do
+          params(
+            current_suffix: String,
+            candidate_suffix: String
+          ).returns(T::Boolean)
+        end
+        def compatible_java_runtime?(current_suffix, candidate_suffix)
+          current_major_version = java_major_version(current_suffix)
+          candidate_major_version = java_major_version(candidate_suffix)
+          return false unless current_major_version == candidate_major_version
+
+          is_downgrade = jdk?(current_suffix) && jre?(candidate_suffix)
+
+          !is_downgrade
+        end
+
+        # Extracts the major Java version number from a JRE/JDK version suffix.
+        #
+        # @example
+        #   java_major_version("jre8")  # => 8
+        #   java_major_version("jdk17") # => 17
+        sig { params(jre_jdk_suffix: String).returns(Integer) }
+        def java_major_version(jre_jdk_suffix)
+          jre_jdk_suffix[/\d+/].to_i
+        end
+
+        sig { params(version: T.nilable(String)).returns(T::Boolean) }
+        def jre_or_jdk?(version)
+          jre?(version) || jdk?(version)
+        end
+
+        # Matches if the current version is a JRE version suffix.
+        #
+        # @example
+        #   jre?( "jre8") # => true
+        #   jre?("jdk8") # => false
+        sig { params(version: T.nilable(String)).returns(T::Boolean) }
+        def jre?(version)
+          return false unless version
+
+          version.match?(/\A(jre)\d+\z/i)
+        end
+
+        # Matches if the current version is a JDK version suffix.
+        #
+        # @example
+        #   jdk?("jre8")  # => false
+        #   jdk?("jdk8") # => true
+        sig { params(version: T.nilable(String)).returns(T::Boolean) }
+        def jdk?(version)
+          return false unless version
+
+          version.match?(/\A(jdk)\d+\z/i)
+        end
+
         # Extracts the qualifier/suffix from a Maven version string.
         #
         # Maven versions consist of numeric parts and optional string qualifiers.
@@ -96,6 +170,14 @@ module Dependabot
             # e.g., "beta-1" and "beta_1" are treated the same
             suffix = suffix.tr("-", "_")
 
+            # Special case for JDK/JRE suffixes
+            # e.g., "13.2.1.jre8" or "13.2.1-jdk8"
+            # In Java, these suffixes often indicate compatibility with specific Java runtimes
+            # and are meaningful in version comparisons as we should not mix versions built for different runtimes.
+            # For example, "1.0.0.jdk8" should not be considered the same as "1.0.0.jdk11"
+            # because they target different Java versions.
+            return suffix if jre_or_jdk?(suffix)
+
             # Ignore purely numeric suffixes (e.g., "-1", "_2")
             # e.g., "1.0.0-1" or "1.0.0_2" are not considered to have a meaningful suffix
             return nil if suffix.match?(/^_?\d+$/)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.359.0
+  version: 0.360.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.359.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.360.0
 rdoc_options: []
 require_paths:
 - lib