dependabot-maven 0.392.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7384e20ca998f4af49001eb34de080505f3abff092e4faa921424ad6b65299e
-  data.tar.gz: 3c7f12c0289d6a8e811d0d51c6d24af81a319e59ba722fe773d623433ddb6ab9
+  metadata.gz: '009515ba93dc3e414380b797fe7b3aa17a388d024e5406e74291c901600f1a0c'
+  data.tar.gz: b511053c1259a770b1f7a2d649cf357bec4abcab55ad3aacb34b96ec40482893
 SHA512:
-  metadata.gz: f8da50ec13cdb3fead27bd2e0c20e019650a8f38a9817be6fb17f8ec5ceef8b7ffb19b7e6805a7f40787de1c4d029d7692e35149a1fc10901d2f48d043c4a02b
-  data.tar.gz: f6f258473e1bff627f213be788e692c6ddfaced18172fdc6910307f504c12554ed88b5447163932e4d909b9be856aaa5921669e1f572de0e81c3ff6d865781a5
+  metadata.gz: 36c134e6d66d0d445df02dca60b7ae8afe60dd585e7475e8c4668656b22bc6ca3b8917251110772709075112142cc7ffd109564573f5231fcb130adba9aaa2cf
+  data.tar.gz: dd730e81dec85d5abb73e201c832087ac4e0f75a5a09284046b87d203a208415f0588e3f9b04c58a588ecf1a55e7c70673551b20a43fd59a3b27bf1a48ea5d7f

data/lib/dependabot/maven/native_helpers.rb

@@ -6,6 +6,7 @@ require "open3"
 require "uri"
 require "sorbet-runtime"
 require "nokogiri"
+require "dependabot/errors"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -13,6 +14,25 @@ module Dependabot
     module NativeHelpers
       extend T::Sig
 
+      # Matches Maven's "Could not transfer artifact" failures, capturing the
+      # repository URL and HTTP status so we can classify auth vs. other errors.
+      TRANSFER_FAILURE_REGEX =
+        %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
+
+      # Matches Maven's "Plugin ... could not be resolved" failures, used to
+      # detect when the wrapper plugin itself is unavailable behind the proxy.
+      WRAPPER_PLUGIN_UNRESOLVED_REGEX =
+        /Plugin org\.apache\.maven\.plugins:maven-wrapper-plugin[^ ]* .*could not be resolved/
+
+      # Upper bound on the length of the Maven error summary included in raised errors,
+      # to avoid oversized error payloads while retaining the relevant failure detail.
+      MAX_ERROR_SUMMARY_LENGTH = 2_000
+
+      # Matches ANSI/VT100 control sequences. Maven can be configured to emit colored
+      # output (e.g. `-Dstyle.color=always`), wrapping markers like `[ERROR]` in escape
+      # codes; we strip these so classification and the surfaced summary see plain text.
+      ANSI_ESCAPE_REGEX = %r{\e\[[0-9;?]*[ -/]*[@-~]}
+
       pom_path = File.join(__dir__, "pom.xml")
 
       version = File.open(pom_path) do |f|
@@ -43,9 +63,8 @@ module Dependabot
 
       sig { params(output: String).void }
       def self.handle_tool_error(output)
-        if (match = output.match(
-          %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
-        )) && (match[:status_code] == "403" || match[:status_code] == "401")
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
           raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
         end
 
@@ -91,7 +110,63 @@ module Dependabot
         # to parse. An argument vector is executed without an intermediate shell.
         cmd = ["mvn"] + standard_args
         run_cwd = cwd && cwd != "." ? cwd : nil
-        SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+
+        output = SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+        Dependabot.logger.info("mvn wrapper output: STDOUT:#{output}")
+        output
+      rescue SharedHelpers::HelperSubprocessFailed => e
+        # `run_shell_command` raises HelperSubprocessFailed on a non-zero exit, and the
+        # updater sanitizes that into an opaque `SubprocessFailed` that only reports the
+        # command and hides the real Maven output. Log the full output and re-raise a
+        # classified Dependabot error so operators get an actionable message, mirroring
+        # the `run_mvn_dependency_tree_plugin` path.
+        Dependabot.logger.warn("mvn wrapper command failed:\n#{e.message}")
+        handle_wrapper_error(e)
+      end
+
+      # Classifies a failed Maven Wrapper invocation into an actionable Dependabot
+      # error. Known auth and plugin-resolution failures are mapped to their specific
+      # error types, and genuine Maven diagnostics are surfaced via MisconfiguredTooling.
+      # `run_shell_command` also reports inactivity timeouts and a missing `mvn`
+      # executable as HelperSubprocessFailed; those carry no Maven `[ERROR]` markers, so
+      # we re-raise the original error and let it follow normal unknown-error routing
+      # instead of mislabelling infrastructure/runtime failures as tooling misconfigurations.
+      sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
+      def self.handle_wrapper_error(error)
+        # Strip ANSI color codes up front so classification and the surfaced summary see
+        # plain text even when Maven is configured to emit colored output.
+        output = error.message.gsub(ANSI_ESCAPE_REGEX, "")
+
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
+          raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
+        end
+
+        if output.match?(WRAPPER_PLUGIN_UNRESOLVED_REGEX)
+          raise Dependabot::DependencyFileNotResolvable, "Could not resolve the Maven Wrapper plugin."
+        end
+
+        # Only reclassify when Maven emitted its own `[ERROR]` diagnostics. Otherwise the
+        # failure is not a Maven misconfiguration (e.g. timeout or missing executable), so
+        # re-raise the original error; its full output is already in the job log.
+        summary = mvn_error_summary(output)
+        raise error unless summary
+
+        raise Dependabot::MisconfiguredTooling.new("Maven Wrapper", summary)
+      end
+
+      # Extracts Maven's own `[ERROR]` lines from the combined tool output so that raised
+      # errors surface the relevant failure reason without leaking unrelated build noise or
+      # arbitrary subprocess output (which may contain sensitive file contents or paths) into
+      # the reported error. Returns nil when Maven produced no `[ERROR]` diagnostics, and caps
+      # the length to keep error payloads reasonable.
+      sig { params(output: String).returns(T.nilable(String)) }
+      def self.mvn_error_summary(output)
+        error_lines = output.lines.map(&:chomp).select { |line| line.include?("[ERROR]") }
+        return nil if error_lines.empty?
+
+        summary = error_lines.join("\n")
+        summary.length > MAX_ERROR_SUMMARY_LENGTH ? "#{summary[0, MAX_ERROR_SUMMARY_LENGTH]}..." : summary
       end
     end
   end

data/lib/dependabot/maven/package/package_details_fetcher.rb

@@ -35,6 +35,8 @@ module Dependabot
           @repository_finder = T.let(nil, T.nilable(Maven::FileParser::RepositoriesFinder))
           @repositories_cache = T.let(nil, T.nilable(T::Array[RepositoryDetails]))
           @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+          @release_date_cache = T.let({}, T::Hash[String, T.nilable(Time)])
+          @fallback_logged = T.let(false, T::Boolean)
         end
 
         sig { override.returns(Dependabot::Dependency) }
@@ -71,6 +73,25 @@ module Dependabot
           fetch.releases
         end
 
+        sig { params(release: Dependabot::Package::PackageRelease).returns(Dependabot::Package::PackageRelease) }
+        def fetch_release_metadata(release:)
+          return release if release.released_at
+
+          url = release.url
+          return release unless url
+
+          cache_key = "#{url}\0#{release.version}"
+          released_at = if @release_date_cache.key?(cache_key)
+                          @release_date_cache[cache_key]
+                        else
+                          @release_date_cache[cache_key] =
+                            fetch_pom_last_modified(repository_url: url, version: release.version)
+                        end
+          return release unless released_at
+
+          build_release_with_date(release, released_at)
+        end
+
         # Assembles the list of Maven repositories to search: credential repos + POM repos.
         sig { override.returns(T::Array[RepositoryDetails]) }
         def repositories
@@ -93,6 +114,83 @@ module Dependabot
 
         private
 
+        sig do
+          params(
+            repository_url: String,
+            version: Dependabot::Version
+          ).returns(T.nilable(Time))
+        end
+        def fetch_pom_last_modified(repository_url:, version:)
+          # release.url is the exact repository URL recorded when the version was
+          # discovered, so an exact match is sufficient (no trailing-slash cleanup).
+          repository_details = repositories.find do |details|
+            self.repository_url(details) == repository_url
+          end
+
+          unless repository_details
+            Dependabot.logger.debug(
+              "No configured repository matches #{repository_url} for #{dependency.name}; " \
+              "skipping POM Last-Modified fallback"
+            )
+            return
+          end
+
+          response = Dependabot::RegistryClient.head(
+            url: dependency_pom_url(repository_url, version),
+            headers: repository_auth_headers(repository_details)
+          )
+          return unless response.status < 400
+
+          last_modified = response.headers["Last-Modified"] || response.headers["last-modified"]
+          return unless last_modified
+
+          released_at = Time.httpdate(last_modified)
+          log_fallback_hit(repository_url: repository_url)
+          Dependabot.logger.debug(
+            "Using POM Last-Modified fallback for #{dependency.name} version #{version} from " \
+            "#{repository_url}: #{released_at}"
+          )
+          released_at
+        rescue StandardError => e
+          Dependabot.logger.debug(
+            "Failed POM Last-Modified fallback for #{dependency.name} version #{version} from " \
+            "#{repository_url}: #{e.message}"
+          )
+          nil
+        end
+
+        sig { params(repository_url: String).void }
+        def log_fallback_hit(repository_url:)
+          return if @fallback_logged
+
+          Dependabot.logger.info(
+            "Using POM Last-Modified fallback release dates for #{dependency.name} from #{repository_url}"
+          )
+          @fallback_logged = true
+        end
+
+        sig do
+          params(
+            release: Dependabot::Package::PackageRelease,
+            released_at: Time
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def build_release_with_date(release, released_at)
+          Dependabot::Package::PackageRelease.new(
+            version: release.version,
+            released_at: released_at,
+            latest: release.latest,
+            yanked: release.yanked,
+            yanked_reason: release.yanked_reason,
+            downloads: release.downloads,
+            url: release.url,
+            package_type: release.package_type,
+            language: release.language,
+            tag: release.tag,
+            details: release.details
+          )
+        end
+
         sig { returns(Maven::FileParser::RepositoriesFinder) }
         def repository_finder
           return @repository_finder if @repository_finder

data/lib/dependabot/maven/shared/base_version_finder.rb

@@ -75,12 +75,31 @@ module Dependabot
           possible_releases = filter_date_based_versions(possible_releases)
           possible_releases = filter_version_types(possible_releases)
           possible_releases = filter_ignored_versions(possible_releases)
-          possible_releases = filter_by_cooldown(possible_releases)
           possible_releases_reverse = possible_releases.reverse
 
-          possible_releases_reverse.find do |r|
-            released?(r.version)
+          return possible_releases_reverse.find { |r| released?(r.version) } unless cooldown_options
+
+          cooldown_filtered_releases = 0
+          latest_release = possible_releases_reverse.find do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_releases += 1
+              next false
+            end
+
+            released?(release.version)
           end
+
+          if cooldown_filtered_releases.positive?
+            Dependabot.logger.info(
+              "Filtered out #{cooldown_filtered_releases} version(s) due to cooldown"
+            )
+          end
+
+          latest_release ||= current_version_fallback_release(
+            possible_releases_reverse, cooldown_filtered_releases
+          )
+          latest_release
         end
 
         sig do
@@ -104,6 +123,34 @@ module Dependabot
 
         private
 
+        # When every candidate was filtered out by cooldown, stay on the current
+        # version (if released) instead of reporting no latest version at all.
+        sig do
+          params(
+            possible_releases: T::Array[Dependabot::Package::PackageRelease],
+            cooldown_filtered_releases: Integer
+          ).returns(T.nilable(Dependabot::Package::PackageRelease))
+        end
+        def current_version_fallback_release(possible_releases, cooldown_filtered_releases)
+          return if possible_releases.empty?
+          return unless cooldown_filtered_releases == possible_releases.length
+
+          current_version_str = dependency.version
+          return unless current_version_str
+
+          Dependabot.logger.info(
+            "All versions filtered by cooldown for #{dependency.name}, " \
+            "falling back to current version #{current_version_str}"
+          )
+
+          current_release = Dependabot::Package::PackageRelease.new(
+            version: version_class.new(current_version_str),
+            released_at: nil,
+            tag: nil
+          )
+          current_release if released?(current_release.version)
+        end
+
         sig { abstract.params(version: Dependabot::Version).returns(T::Boolean) }
         def released?(version); end
       end

data/lib/dependabot/maven/shared/shared_metadata_finder.rb

@@ -67,11 +67,24 @@ module Dependabot
 
         sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Dependabot::Source)) }
         def look_up_source_in_pom(pom)
-          potential_source_urls = [
-            pom.at_css("project > url")&.content,
-            pom.at_css("project > scm > url")&.content,
-            pom.at_css("project > issueManagement > url")&.content
-          ].compact
+          source_selectors =
+            if Dependabot::Experiments.enabled?(:prioritize_scm_source)
+              # Prefer scm url, followed by project url, and finally issue management url (#2084)
+              [
+                "project > scm > url",
+                "project > url",
+                "project > issueManagement > url"
+              ]
+            else
+              [
+                "project > url",
+                "project > scm > url",
+                "project > issueManagement > url"
+              ]
+            end
+          potential_source_urls = source_selectors.filter_map do |selector|
+            pom.at_css(selector)&.content
+          end
 
           source_url = potential_source_urls.find { |url| Source.from_url(url) }
           source_url ||= source_from_anywhere_in_pom(pom)

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -58,6 +58,20 @@ module Dependabot
           @package_details ||= package_details_fetcher.fetch
         end
 
+        protected
+
+        sig { override.params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          return super if release.released_at
+          return false if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(
+            cooldown_options,
+            dependency.name,
+            cooldown_enabled: cooldown_enabled?
+          )
+
+          super(package_details_fetcher.fetch_release_metadata(release: release))
+        end
+
         private
 
         sig { override.params(version: Dependabot::Version).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -183,14 +183,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib