dependabot-maven 0.374.0 → 0.376.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bd97fa23973923f5d775a2a7f4ffa266de0eb6cadd1a419ce9e1b899a5a1c22
-  data.tar.gz: f463dd53e46376f2fb8c8d46d7af7f99b63eb6c5634063c20157a3e0a0bc3844
+  metadata.gz: f6766c6eea0f8880538a54f48a87617d19e881622583b8324da63019adaedac9
+  data.tar.gz: 31573e51f96b69b76573cfd8b4576268e5c98de779ffacce88023dcb8317e4e0
 SHA512:
-  metadata.gz: 63999b4d27a25fac55a369bbb9e9c1565179cf0bc1e1585150eac23879cb2e6d5d30ffe663d084c8a4fe46696b4fd64b52b8540819eaf86e376604a0c34ffdf4
-  data.tar.gz: ef9a00f454fcf6661d1d3e0e33e16d1d43b141801ef9af125798887cf93531ce4bf34b4632641c58bba6841e2b47111462ac3a840d1a04bb6b8017fbc3dbb841
+  metadata.gz: b64dfca75c231cd7dfabc9c37b951006607472e64cd110d5b99ebb992cfd4fce84c72eecfc522df7c04b65ec5983befbeb4f9dc354a87d7914b1bbbef63802be
+  data.tar.gz: 2ea4854da94ac4236c9afdcbaee148e93049b8233ccf5d3bfc569e47240ae30172415adf239c10acaaef358eb0dc9a3ef7a4ffa8fe5d59b6b122fa9ee497a945

data/lib/dependabot/maven/shared/base_version_finder.rb

@@ -0,0 +1,105 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/maven/shared/shared_version_finder"
+
+module Dependabot
+  module Maven
+    module Shared
+      # Intermediate class for ecosystems (Maven, SBT) that use a package_details-based
+      # release pipeline with HEAD-check verification. Gradle uses its own filter chain
+      # and inherits directly from SharedVersionFinder.
+      class BaseVersionFinder < SharedVersionFinder
+        extend T::Sig
+        extend T::Helpers
+
+        abstract!
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def releases
+          (package_details&.releases || []).reverse
+        end
+
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+        def latest_version_details
+          release = fetch_latest_release
+          release&.version ? { version: release.version, source_url: release.url } : nil
+        end
+
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+        def lowest_security_fix_version_details
+          release = fetch_lowest_security_fix_release
+          release&.version ? { version: release.version, source_url: release.url } : nil
+        end
+
+        protected
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_latest_version(language_version: nil)
+          fetch_latest_release(language_version: language_version)&.version
+        end
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_latest_version_with_no_unlock(language_version:)
+          fetch_latest_release(language_version: language_version)&.version
+        end
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_lowest_security_fix_version(language_version: nil)
+          fetch_lowest_security_fix_release(language_version: language_version)&.version
+        end
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Package::PackageRelease))
+        end
+        def fetch_latest_release(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
+          possible_releases = filter_prerelease_versions(releases)
+          possible_releases = filter_date_based_versions(possible_releases)
+          possible_releases = filter_version_types(possible_releases)
+          possible_releases = filter_ignored_versions(possible_releases)
+          possible_releases = filter_by_cooldown(possible_releases)
+          possible_releases_reverse = possible_releases.reverse
+
+          possible_releases_reverse.find do |r|
+            released?(r.version)
+          end
+        end
+
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Package::PackageRelease))
+        end
+        def fetch_lowest_security_fix_release(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
+          possible_releases = filter_prerelease_versions(releases)
+          possible_releases = filter_date_based_versions(possible_releases)
+          possible_releases = filter_version_types(possible_releases)
+          possible_releases = Dependabot::UpdateCheckers::VersionFilters
+                              .filter_vulnerable_versions(
+                                possible_releases,
+                                security_advisories
+                              )
+          possible_releases = filter_ignored_versions(possible_releases)
+          possible_releases = filter_lower_versions(possible_releases)
+
+          possible_releases.find { |r| released?(r.version) }
+        end
+
+        private
+
+        sig { abstract.params(version: Dependabot::Version).returns(T::Boolean) }
+        def released?(version); end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/shared/shared_package_details_fetcher.rb

@@ -66,7 +66,7 @@ module Dependabot
           "#{dependency_base_url(repository_url)}/#{MAVEN_METADATA_XML}"
         end
 
-        # URL for a specific artifact file (JAR/POM).
+        # URL for a specific artifact file (JAR/AAR/etc).
         #
         # Example:
         #   "https://repo.maven.apache.org/maven2/com/google/guava/guava/23.6-jre/guava-23.6-jre.jar"
@@ -81,6 +81,15 @@ module Dependabot
           "#{base_url}/#{version}/#{artifact_id}-#{version}#{actual_classifier}.#{type}"
         end
 
+        # URL for the POM file of a specific version.
+        # Every published Maven artifact has a .pom file regardless of packaging type.
+        sig { params(repository_url: String, version: Dependabot::Version).returns(String) }
+        def dependency_pom_url(repository_url, version)
+          _, artifact_id = dependency_parts
+          base_url = dependency_base_url(repository_url)
+          "#{base_url}/#{version}/#{artifact_id}-#{version}.pom"
+        end
+
         # -- Metadata Fetching (XML) --
 
         # Fetches and parses maven-metadata.xml from a repository.
@@ -127,8 +136,11 @@ module Dependabot
         def fetch_dependency_metadata_from_html(repository_details)
           url = repository_details.fetch(URL_KEY)
           headers = repository_details.fetch(AUTH_HEADERS_KEY)
+          # Add trailing slash for directory listing
+          base_directory_url = dependency_base_url(url)
+          base_directory_url += "/" unless base_directory_url.end_with?("/")
           response = Dependabot::RegistryClient.get(
-            url: dependency_base_url(url),
+            url: base_directory_url,
             headers: headers
           )
           check_response(response, url)
@@ -151,26 +163,44 @@ module Dependabot
         def extract_version_details_from_html(html_doc)
           versions_detail_hash = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
 
-          html_doc.css("a[title]").each do |link|
-            version_string = link["title"]
-            version = version_string.gsub(%r{/$}, "")
-
-            raw_date_text = link.next.text.strip.split("\n").last.strip
-
-            release_date = begin
-              Time.parse(raw_date_text)
-            rescue StandardError
-              nil
-            end
-
+          html_doc.css("a[href]").each do |link|
+            version = extract_version_from_link(link)
             next unless version && version_class.correct?(version)
 
+            release_date = extract_release_date_from_link(link)
+
             versions_detail_hash[version] = { release_date: release_date }
           end
 
           versions_detail_hash
         end
 
+        sig { params(link: Nokogiri::XML::Element).returns(T.nilable(String)) }
+        def extract_version_from_link(link)
+          href = link["href"]&.strip
+          return unless href&.end_with?("/")
+
+          identifier = [link["title"], link.text, href].find { |value| value && !value.strip.empty? }
+          return unless identifier
+
+          version = identifier.strip.gsub(%r{/$}, "")
+          return if ["..", "."].include?(version)
+
+          version
+        end
+
+        sig { params(link: Nokogiri::XML::Element).returns(T.nilable(Time)) }
+        def extract_release_date_from_link(link)
+          raw_date_text = link.next&.text.to_s
+          date_match = raw_date_text.match(/\b(?:\d{4}-\d{2}-\d{2}|\d{2}-[A-Za-z]{3}-\d{4}) \d{2}:\d{2}\b/)
+
+          return Time.parse(date_match[0]) if date_match
+
+          Time.parse(raw_date_text.strip)
+        rescue StandardError
+          nil
+        end
+
         # -- Response Checking & Error Handling --
 
         # Tracks forbidden URLs when receiving 401/403 responses (except for central repo).
@@ -304,7 +334,20 @@ module Dependabot
                 url: dependency_files_url(url, version),
                 headers: headers
               )
-              response.status < 400
+              next true if response.status < 400
+
+              # When the artifact file returns 404, fall back to checking the .pom file.
+              # This handles artifacts with non-jar packaging (e.g., aar, bundle) where
+              # the consumer POM omits <type>, causing the parser to default to "jar".
+              # Only fall back when there's no classifier (classifier artifacts are specific).
+              next false unless response.status == 404
+              next false if dependency.requirements.first&.dig(:metadata, :classifier)
+
+              pom_response = Dependabot::RegistryClient.head(
+                url: dependency_pom_url(url, version),
+                headers: headers
+              )
+              pom_response.status < 400
             rescue Excon::Error::Socket, Excon::Error::Timeout,
                    Excon::Error::TooManyRedirects
               false

data/lib/dependabot/maven/shared/shared_property_value_updater.rb

@@ -0,0 +1,87 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency_file"
+
+module Dependabot
+  module Maven
+    module Shared
+      # Shared base for text-based property value updaters (Gradle, SBT).
+      # Subclasses must override `property_value_finder` to return the
+      # ecosystem-specific PropertyValueFinder instance.
+      #
+      # Maven's PropertyValueUpdater is XML-based and does not share this class.
+      class SharedPropertyValueUpdater
+        extend T::Sig
+        extend T::Helpers
+
+        abstract!
+
+        sig { params(dependency_files: T::Array[DependencyFile]).void }
+        def initialize(dependency_files:)
+          @dependency_files = T.let(dependency_files, T::Array[DependencyFile])
+        end
+
+        sig do
+          params(
+            property_name: String,
+            callsite_buildfile: DependencyFile,
+            previous_value: String,
+            updated_value: String
+          ).returns(T::Array[DependencyFile])
+        end
+        def update_files_for_property_change(
+          property_name:,
+          callsite_buildfile:,
+          previous_value:,
+          updated_value:
+        )
+          declaration_details = property_value_finder.property_details(
+            property_name: property_name,
+            callsite_buildfile: callsite_buildfile
+          )
+          raise "Property '#{property_name}' not found" unless declaration_details
+
+          declaration_string = T.let(declaration_details.fetch(:declaration_string), String)
+          filename = T.let(declaration_details.fetch(:file), String)
+
+          file_to_update = T.must(dependency_files.find { |f| f.name == filename })
+          updated_content = T.must(file_to_update.content).sub(
+            declaration_string,
+            declaration_string.sub(
+              previous_value_regex(previous_value),
+              updated_value
+            )
+          )
+
+          updated_files = dependency_files.dup
+          updated_files[T.must(updated_files.index(file_to_update))] =
+            update_file(file: file_to_update, content: updated_content)
+
+          updated_files
+        end
+
+        private
+
+        sig { returns(T::Array[DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { abstract.returns(T.untyped) }
+        def property_value_finder; end
+
+        sig { params(previous_value: String).returns(Regexp) }
+        def previous_value_regex(previous_value)
+          /(?<=['"])#{Regexp.quote(previous_value)}(?=['"])/
+        end
+
+        sig { params(file: DependencyFile, content: String).returns(DependencyFile) }
+        def update_file(file:, content:)
+          updated_file = file.dup
+          updated_file.content = content
+          updated_file
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/shared/shared_version_finder.rb

@@ -11,6 +11,9 @@ module Dependabot
     module Shared
       class SharedVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
+        extend T::Helpers
+
+        abstract!
 
         # Regex to match common Maven release qualifiers that indicate stable releases.
         # See https://github.com/apache/maven/blob/848fbb4bf2d427b72bdb2471c22fced7ebd9a7a1/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java#L315-L320
@@ -123,6 +126,11 @@ module Dependabot
           dependency.version_class
         end
 
+        sig { returns(T::Boolean) }
+        def cooldown_enabled?
+          true
+        end
+
         private
 
         # Determines whether two versions have compatible suffixes.
@@ -405,11 +413,6 @@ module Dependabot
 
           suffix.empty? ? nil : suffix
         end
-
-        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
-        def package_details
-          raise NotImplementedError, "Subclasses must implement `package_details`"
-        end
       end
     end
   end

data/lib/dependabot/maven/update_checker/requirements_updater.rb

@@ -60,6 +60,8 @@ module Dependabot
             next req if property_name && !properties_to_update.include?(property_name)
 
             new_req = update_requirement(req[:requirement])
+            next req if new_req == req[:requirement]
+
             req.merge(requirement: new_req, source: updated_source)
           end
         end

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -6,13 +6,13 @@ require "dependabot/package/release_cooldown_options"
 require "dependabot/update_checkers/version_filters"
 require "dependabot/maven/package/package_details_fetcher"
 require "dependabot/maven/update_checker"
-require "dependabot/maven/shared/shared_version_finder"
+require "dependabot/maven/shared/base_version_finder"
 require "sorbet-runtime"
 
 module Dependabot
   module Maven
     class UpdateChecker
-      class VersionFinder < Dependabot::Maven::Shared::SharedVersionFinder
+      class VersionFinder < Dependabot::Maven::Shared::BaseVersionFinder
         extend T::Sig
 
         sig do
@@ -52,92 +52,13 @@ module Dependabot
           @package_details ||= package_details_fetcher.fetch
         end
 
-        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
-        def releases
-          (package_details&.releases || []).reverse
-        end
-
-        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
-        def latest_version_details
-          release = fetch_latest_release
-          release&.version ? { version: release.version, source_url: release.url } : nil
-        end
-
-        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
-        def lowest_security_fix_version_details
-          release = fetch_lowest_security_fix_release
-          release&.version ? { version: release.version, source_url: release.url } : nil
-        end
-
-        protected
-
-        sig { returns(T::Boolean) }
-        def cooldown_enabled?
-          true
-        end
-
-        sig do
-          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-            .returns(T.nilable(Dependabot::Version))
-        end
-        def fetch_latest_version(language_version: nil)
-          fetch_latest_release(language_version: language_version)&.version
-        end
-
-        sig do
-          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-            .returns(T.nilable(Dependabot::Version))
-        end
-        def fetch_latest_version_with_no_unlock(language_version:)
-          fetch_latest_release(language_version: language_version)&.version
-        end
-
-        sig do
-          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-            .returns(T.nilable(Dependabot::Version))
-        end
-        def fetch_lowest_security_fix_version(language_version: nil)
-          fetch_lowest_security_fix_release(language_version: language_version)&.version
-        end
-
-        sig do
-          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-            .returns(T.nilable(Dependabot::Package::PackageRelease))
-        end
-        def fetch_latest_release(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
-          possible_releases = filter_prerelease_versions(releases)
-          possible_releases = filter_date_based_versions(possible_releases)
-          possible_releases = filter_version_types(possible_releases)
-          possible_releases = filter_ignored_versions(possible_releases)
-          possible_releases = filter_by_cooldown(possible_releases)
-          possible_releases_reverse = possible_releases.reverse
-
-          possible_releases_reverse.find do |r|
-            package_details_fetcher.released?(r.version)
-          end
-        end
-
-        sig do
-          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
-            .returns(T.nilable(Dependabot::Package::PackageRelease))
-        end
-        def fetch_lowest_security_fix_release(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
-          possible_releases = filter_prerelease_versions(releases)
-          possible_releases = filter_date_based_versions(possible_releases)
-          possible_releases = filter_version_types(possible_releases)
-          possible_releases = Dependabot::UpdateCheckers::VersionFilters
-                              .filter_vulnerable_versions(
-                                possible_releases,
-                                security_advisories
-                              )
-          possible_releases = filter_ignored_versions(possible_releases)
-          possible_releases = filter_lower_versions(possible_releases)
+        private
 
-          possible_releases.find { |r| package_details_fetcher.released?(r.version) }
+        sig { override.params(version: Dependabot::Version).returns(T::Boolean) }
+        def released?(version)
+          package_details_fetcher.released?(version)
         end
 
-        private
-
         sig { returns(Package::PackageDetailsFetcher) }
         def package_details_fetcher
           @package_details_fetcher ||= Package::PackageDetailsFetcher.new(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.374.0
+  version: 0.376.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.374.0
+        version: 0.376.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.374.0
+        version: 0.376.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -272,8 +272,10 @@ files:
 - lib/dependabot/maven/package_manager.rb
 - lib/dependabot/maven/pom.xml
 - lib/dependabot/maven/requirement.rb
+- lib/dependabot/maven/shared/base_version_finder.rb
 - lib/dependabot/maven/shared/shared_metadata_finder.rb
 - lib/dependabot/maven/shared/shared_package_details_fetcher.rb
+- lib/dependabot/maven/shared/shared_property_value_updater.rb
 - lib/dependabot/maven/shared/shared_requirement.rb
 - lib/dependabot/maven/shared/shared_version_finder.rb
 - lib/dependabot/maven/token_bucket.rb
@@ -289,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.374.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.376.0
 rdoc_options: []
 require_paths:
 - lib