dependabot-maven 0.393.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fff231d12e4c6ebdbdbf645bcc82c18a7b895ecc870ddb6aba549e4296f0ead6
-  data.tar.gz: a0c24d6534e7bd9c48e7256bd6f03176713f75173f523ac75a8f389b022cc7ff
+  metadata.gz: e771ade81b0e14fc4b4dde7ae91ff62750cd0d015fb09016ea7c4a1805203263
+  data.tar.gz: 00c53d8f9d349c4d40a63036dbd67a7ab335e24edf97e9c0202b00d2825c7714
 SHA512:
-  metadata.gz: 96a5bc8b3c845098794cec76a15763afde0d7b1d31caec84daf558d031a560fbd954d068b115dc9c0ba3a43806619d1d104f68b2d07ecd98c161c1d6bf3e99d1
-  data.tar.gz: fa5d05a001407b8dcfc41c530caacb1b547c60a42831ca9bfdb6aa6ec6983c1d63178c5d4429a8450aaedbac1f51ad48c747d3f4c4e498054b2564842fe55f93
+  metadata.gz: e9c86ff9efd776b81e573960f89f3bc9759632f3084122137c51169299e7c6a2863af14abbd6efd9acacf91b4c097f204bd5edcd70ceb602c47ea7bbca532018
+  data.tar.gz: 9a6075fdf110e0110ee8bd5abc720768d118d67c6ce657d708769800bbc9f43d1eb431158353fba492a437add83cdcfaf3240ac1d6dea3fa97a587912d354fc9

data/lib/dependabot/maven/file_parser/wrapper_mojo.rb

@@ -4,6 +4,7 @@
 # Parses maven-wrapper.properties and emits Dependency objects for the two
 # tracked Maven coordinates: org.apache.maven:apache-maven (the maven distribution)
 # and org.apache.maven.wrapper:maven-wrapper (the wrapper plugin).
+require "uri"
 require "dependabot/dependency_requirement"
 require "dependabot/maven/file_parser"
 require "dependabot/maven/distributions"
@@ -39,7 +40,8 @@ module Dependabot
           #  - wrapperVersion property (>=3.3.1),
           #  - version segment of wrapperUrl JAR filename (<3.3.0), or
           #  - comment in the mvnw script body (3.3.0 only, see MWRAPPER-120 and MWRAPPER-134).
-          # This field is mandatory and raises if none of the sources yield a version.
+          # When none of the sources yield a version, load_properties returns nil and the
+          # wrapper is skipped, so this field is only ever set to a resolved version.
           const :wrapper_version, String
 
           # The full JAR URL from the wrapperUrl property
@@ -65,7 +67,21 @@ module Dependabot
         DIST_URL_VERSION_REGEX = %r{
           /apache-maven-(?<version>[^/?#]+)-(?:bin|src)\.(?:zip|tar\.gz)(?:[?#].*)?\z
         }x
-        class UnparseableDistributionUrl < RuntimeError; end
+
+        # Apache Maven Wrapper JAR as it appears in a wrapperUrl path. Anchored to the artifact
+        # directory, a numeric version directory, and a `maven-wrapper-<version>.jar` filename whose
+        # version equals that directory (via the \k<version> backreference), mirroring Maven's
+        # mandatory repository layout. This rejects foreign JARs sharing the directory (e.g.
+        # .../maven-wrapper/3.3.4/foreign-3.3.4.jar), non-artifact filenames
+        # (.../3.3.4/maven-wrapper-foreign.jar) and mismatched coordinates
+        # (.../3.3.4/maven-wrapper-9.9.9.jar). Matched on the path only (not the host, query, or
+        # fragment) so wrappers proxied through private registries are still recognised, while
+        # wrappers from other vendors (e.g. legacy io.takari) are not. Applied in apache_wrapper_url?.
+        WRAPPER_COORDINATE_REGEX = %r{
+          /org/apache/maven/wrapper/maven-wrapper/    # Apache Maven Wrapper artifact directory
+          (?<version>\d+\.\d+(?:\.\d+)?(?:-\w+)*)/     # version directory
+          maven-wrapper-\k<version>\.jar\z            # artifact JAR named for that same version
+        }xi
 
         sig do
           params(
@@ -77,23 +93,11 @@ module Dependabot
           content = properties_file.content
           return [] unless content
 
-          distribution_url = get_property_value(content, "distributionUrl")
-          if distribution_url&.include?("mvnd")
-            Dependabot.logger.warn("Maven daemon (mvnd) distribution is not supported, skipping wrapper update")
-            return []
-          end
-
-          begin
-            props = load_properties(content, script_files: script_files)
-          rescue UnparseableDistributionUrl => e
-            Dependabot.logger.warn("#{e.message}, skipping wrapper update")
-            return []
-          end
-
-          if props.wrapper_url&.include?("takari")
-            Dependabot.logger.warn("The Takari distribution is not supported, skipping wrapper update")
-            return []
-          end
+          # load_properties returns nil for wrappers we cannot safely update (missing
+          # mandatory data or an unsupported vendor/distribution). The reason is logged there,
+          # and we skip the wrapper without disrupting ordinary POM dependency parsing.
+          props = load_properties(content, script_files: script_files)
+          return [] unless props
 
           file_name = properties_file.name
           has_debug_scripts = debug_scripts?(script_files)
@@ -252,35 +256,65 @@ module Dependabot
           script_files.any? { |f| debug_scripts.any? { |s| f.name.end_with?(s) } }
         end
 
-        sig { params(content: String, script_files: T::Array[DependencyFile]).returns(WrapperProperties) }
+        sig { params(content: String, script_files: T::Array[DependencyFile]).returns(T.nilable(WrapperProperties)) }
         def self.load_properties(content, script_files: [])
-          distribution_url = get_property_value!(content, "distributionUrl")
+          distribution_url = get_property_value(content, "distributionUrl")
+          return skip_wrapper("distributionUrl property is missing") unless distribution_url
+
+          return skip_wrapper("Maven daemon (mvnd) distribution is not supported") if distribution_url.include?("mvnd")
+
           distribution_version = extract_distribution_version(distribution_url)
-          distribution_sha256_sum = get_property_value(content, "distributionSha256Sum")
+          return skip_wrapper("could not extract Maven version from distributionUrl") unless distribution_version
+
           wrapper_url = get_property_value(content, "wrapperUrl")
-          wrapper_sha256_sum = get_property_value(content, "wrapperSha256Sum")
-          distribution_type = resolve_distribution_type(content, wrapper_url)
+          if wrapper_url && !apache_wrapper_url?(wrapper_url)
+            return skip_wrapper("wrapperUrl is not an Apache Maven Wrapper")
+          end
+
           wrapper_version = resolve_wrapper_version(content, wrapper_url, script_files)
+          unless wrapper_version
+            return skip_wrapper(
+              "could not determine Maven Wrapper version from wrapperVersion, wrapperUrl, or script files"
+            )
+          end
 
           WrapperProperties.new(
             distribution_url: distribution_url,
             distribution_version: distribution_version,
-            distribution_sha256_sum: distribution_sha256_sum,
-            wrapper_sha256_sum: wrapper_sha256_sum,
+            distribution_sha256_sum: get_property_value(content, "distributionSha256Sum"),
+            wrapper_sha256_sum: get_property_value(content, "wrapperSha256Sum"),
             wrapper_version: wrapper_version,
             wrapper_url: wrapper_url,
-            distribution_type: distribution_type
+            distribution_type: resolve_distribution_type(content, wrapper_url)
           )
         end
 
-        sig { params(content: String).returns(String) }
+        # Signals that the wrapper cannot be updated: logs the reason and returns nil so the
+        # caller treats the wrapper as absent rather than aborting the whole Maven parse.
+        sig { params(reason: String).returns(NilClass) }
+        def self.skip_wrapper(reason)
+          Dependabot.logger.warn("#{reason}, skipping Maven Wrapper update")
+          nil
+        end
+
+        sig { params(content: String).returns(T.nilable(String)) }
         def self.extract_distribution_version(content)
           match = content.match(DIST_URL_VERSION_REGEX)
-          unless match && match[:version]
-            raise UnparseableDistributionUrl, "Could not extract Maven version from distributionUrl"
-          end
+          match && match[:version]
+        end
 
-          T.must(match[:version])
+        # True when the wrapperUrl points at the Apache Maven Wrapper artifact. The coordinate is
+        # matched against the URL path only (never the query or fragment) so that a non-Apache JAR
+        # cannot slip through the allowlist by carrying the coordinate in a `?redirect=...` query.
+        # A malformed URL that cannot be parsed is treated as not-Apache.
+        sig { params(url: String).returns(T::Boolean) }
+        def self.apache_wrapper_url?(url)
+          path = URI.parse(url).path
+          return false unless path
+
+          path.match?(WRAPPER_COORDINATE_REGEX)
+        rescue URI::InvalidURIError
+          false
         end
 
         sig { params(content: String, target_key: String).returns(T.nilable(String)) }
@@ -324,15 +358,6 @@ module Dependabot
           end
         end
 
-        sig { params(content: String, target_key: String).returns(String) }
-        def self.get_property_value!(content, target_key)
-          value = get_property_value(content, target_key)
-
-          raise "Missing mandatory property: #{target_key}" if value.nil?
-
-          value
-        end
-
         private_class_method :build_distribution_dependency
         private_class_method :build_wrapper_dependency
         private_class_method :build_distribution_requirements
@@ -353,7 +378,7 @@ module Dependabot
             content: String,
             wrapper_url: T.nilable(String),
             script_files: T::Array[DependencyFile]
-          ).returns(String)
+          ).returns(T.nilable(String))
         end
         def self.resolve_wrapper_version(content, wrapper_url, script_files)
           version = get_property_value(content, "wrapperVersion")
@@ -367,10 +392,6 @@ module Dependabot
             version = load_wrapper_version_from_scripts(script_files)
           end
 
-          if version.nil?
-            raise "Could not determine Maven Wrapper version from wrapperVersion, wrapperUrl, or script files"
-          end
-
           version
         end
 
@@ -401,6 +422,8 @@ module Dependabot
         private_class_method :resolve_wrapper_version
         private_class_method :parse_version_from_wrapper_url
         private_class_method :load_wrapper_version_from_scripts
+        private_class_method :skip_wrapper
+        private_class_method :apache_wrapper_url?
       end
     end
   end

data/lib/dependabot/maven/file_parser.rb

@@ -17,7 +17,7 @@ require "dependabot/errors"
 # - http://maven.apache.org/pom.html
 module Dependabot
   module Maven
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class FileParser < Dependabot::FileParsers::Base
       extend T::Sig
 
@@ -658,7 +658,6 @@ module Dependabot
         doc.css(PLUGIN_SELECTOR, PLUGIN_ARTIFACT_ITEMS_SELECTOR)
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end
 

data/lib/dependabot/maven/file_updater/wrapper_updater.rb

@@ -222,6 +222,7 @@ module Dependabot
             wrapper_plugin_version: wrapper_version,
             env: build_env,
             distribution_type: distribution_type,
+            registry_base: resolved_registry_base,
             extra_args: extra_args,
             cwd: wrapper_dir
           )
@@ -288,8 +289,10 @@ module Dependabot
         end
 
         # Builds the environment hash passed to the native wrapper command.
-        # Sets the proxy host and, for a private/mirror registry, MVNW_REPOURL. Registry auth is
-        # injected by Dependabot's proxy, so no username/password is set here (core never receives them).
+        # Sets only the proxy host. Registry routing is handled by the native
+        # helper's generated settings mirror (see `resolved_registry_base`), and
+        # registry auth is injected by Dependabot's proxy, so no username/password
+        # is set here (core never receives them).
         sig { returns(T::Hash[String, String]) }
         def build_env
           env = T.let({}, T::Hash[String, String])
@@ -299,9 +302,6 @@ module Dependabot
             env["PROXY_HOST"] = proxy_url.host.to_s
           end
 
-          registry_base, cred = resolve_registry_base_and_credential
-          env.merge!(build_registry_env(registry_base, cred))
-
           if Dependabot.logger.debug?
             env["MVNW_VERBOSE"] = "true"
             Dependabot.logger.debug "build_env result: #{env}"
@@ -310,51 +310,18 @@ module Dependabot
           env
         end
 
-        sig do
-          returns([T.nilable(String), T.nilable(Dependabot::Credential)])
-        end
-        def resolve_registry_base_and_credential
-          properties = wrapper_properties_file&.content.to_s
-          dist_url = effective_distribution_url(properties)
-          Dependabot.logger.debug "Effective distribution URL: #{dist_url}"
-
-          registry_base_regex = %r{^(https?://[^/]+(?:/[^/]+)*)/org/apache/maven/apache-maven/}
-          registry_base = dist_url&.match(registry_base_regex)&.captures&.first
-          Dependabot.logger.debug "Extracted registry base: #{registry_base || '(none)'}"
-
-          cred = maven_registry_credential(registry_base)
-          Dependabot.logger.debug "Matched credential: #{cred ? "url=#{cred.fetch('url', '(none)')}" : '(none)'}"
-
-          [registry_base, cred]
-        end
-
-        sig do
-          params(registry_base: T.nilable(String), cred: T.nilable(Dependabot::Credential))
-            .returns(T::Hash[String, String])
-        end
-        def build_registry_env(registry_base, cred)
-          if registry_base
-            { "MVNW_REPOURL" => registry_base }
-          elsif cred&.replaces_base?
-            { "MVNW_REPOURL" => cred.fetch("url").chomp("/") }
-          else
-            {}
-          end
-        end
-
-        sig { params(registry_base: T.nilable(String)).returns(T.nilable(Dependabot::Credential)) }
-        def maven_registry_credential(registry_base)
-          maven_creds = @credentials.select { |c| c["type"] == "maven_repository" }
-
-          if registry_base
-            url_matches = maven_creds.select do |c|
-              cred_url = c.fetch("url", "").chomp("/")
-              !cred_url.empty? && registry_base.start_with?(cred_url)
-            end
-            return url_matches.max_by { |c| c.fetch("url", "").length } if url_matches.any?
-          end
-
-          maven_creds.find(&:replaces_base?)
+        # The registry that actually served the release we're updating to. `source_url` on the
+        # resolved requirement is `release.url` from version resolution
+        # (base_version_finder: `{ version: release.version, source_url: release.url }`), so it is
+        # the one place `mvn` is guaranteed to find this version. The native regeneration mirrors
+        # plugin/distribution resolution there instead of falling back to Central and hanging behind
+        # a no-egress registry. Nil only when no version resolved, leaving the Central default.
+        #
+        # A trailing slash is stripped so Maven appends the artifact path to a canonical base
+        # (`base/org/...`, not `base//org/...`) and registries don't 301-redirect every request.
+        sig { returns(T.nilable(String)) }
+        def resolved_registry_base
+          dependency.requirements.filter_map { |req| req.metadata_string("source_url") }.first&.chomp("/")
         end
 
         sig { params(buildfile: DependencyFile).returns(String) }

data/lib/dependabot/maven/native_helpers.rb

@@ -3,9 +3,12 @@
 
 require "fileutils"
 require "open3"
+require "tempfile"
 require "uri"
 require "sorbet-runtime"
 require "nokogiri"
+require "dependabot/errors"
+require "dependabot/command_helpers"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -13,6 +16,30 @@ module Dependabot
     module NativeHelpers
       extend T::Sig
 
+      # Matches Maven's "Could not transfer artifact" failures, capturing the
+      # repository URL and HTTP status so we can classify auth vs. other errors.
+      TRANSFER_FAILURE_REGEX =
+        %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
+
+      # Matches Maven's "Plugin ... could not be resolved" failures, used to
+      # detect when the wrapper plugin itself is unavailable behind the proxy.
+      WRAPPER_PLUGIN_UNRESOLVED_REGEX =
+        /Plugin org\.apache\.maven\.plugins:maven-wrapper-plugin[^ ]* .*could not be resolved/
+
+      # Upper bound on the length of the Maven error summary included in raised errors,
+      # to avoid oversized error payloads while retaining the relevant failure detail.
+      MAX_ERROR_SUMMARY_LENGTH = 2_000
+
+      # Matches ANSI/VT100 control sequences. Maven can be configured to emit colored
+      # output (e.g. `-Dstyle.color=always`), wrapping markers like `[ERROR]` in escape
+      # codes; we strip these so classification and the surfaced summary see plain text.
+      ANSI_ESCAPE_REGEX = %r{\e\[[0-9;?]*[ -/]*[@-~]}
+
+      # Bounded inactivity timeout for the wrapper download. `run_shell_command`'s watchdog
+      # resets on output, and with transfer progress restored a healthy download keeps it
+      # alive, so this only trips on genuine silence — well below the 900s DEFAULT.
+      WRAPPER_DOWNLOAD_TIMEOUT = CommandHelpers::TIMEOUTS::LONG_RUNNING
+
       pom_path = File.join(__dir__, "pom.xml")
 
       version = File.open(pom_path) do |f|
@@ -43,9 +70,8 @@ module Dependabot
 
       sig { params(output: String).void }
       def self.handle_tool_error(output)
-        if (match = output.match(
-          %r{Could not transfer artifact (?<artifact>[^ ]+) from/to (?<repository_name>[^ ]+) \((?<repository_url>[^ ]+)\): status code: (?<status_code>[0-9]+)} # rubocop:disable Layout/LineLength
-        )) && (match[:status_code] == "403" || match[:status_code] == "401")
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
           raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
         end
 
@@ -67,21 +93,32 @@ module Dependabot
           wrapper_plugin_version: String,
           env: T::Hash[String, String],
           distribution_type: String,
+          registry_base: T.nilable(String),
           extra_args: T::Array[String],
           cwd: T.nilable(String)
         ).void
       end
-      def self.run_mvnw_wrapper(version:, wrapper_plugin_version:, env:, distribution_type:, extra_args: [], cwd: nil)
+      def self.run_mvnw_wrapper(
+        version:,
+        wrapper_plugin_version:,
+        env:,
+        distribution_type:,
+        registry_base: nil,
+        extra_args: [],
+        cwd: nil
+      )
         # Use the fully-qualified plugin goal so the exact plugin version is
         # invoked regardless of the project's plugin group configuration.
         plugin_goal = "org.apache.maven.plugins:maven-wrapper-plugin:" \
                       "#{wrapper_plugin_version}:wrapper"
 
+        # Do NOT add `--no-transfer-progress`: Maven's transfer progress is the liveness signal
+        # that keeps `run_shell_command`'s inactivity watchdog alive during a large download.
+        # Suppressing it made a healthy-but-slow fetch look hung and get killed at the timeout.
         standard_args = [
           plugin_goal,
           "-Dmaven=#{version}",
-          "-Dtype=#{distribution_type}",
-          "--no-transfer-progress"
+          "-Dtype=#{distribution_type}"
         ] + extra_args
 
         # Pass the argument vector directly instead of a pre-joined shell string.
@@ -91,7 +128,118 @@ module Dependabot
         # to parse. An argument vector is executed without an intermediate shell.
         cmd = ["mvn"] + standard_args
         run_cwd = cwd && cwd != "." ? cwd : nil
-        SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+
+        # Route the native `mvn`'s plugin/distribution resolution to the registry that served the
+        # resolved version via a generated settings mirror; without it `mvn` falls back to Central
+        # and hangs behind a no-egress registry. Absent when no version resolved, leaving the baked
+        # Central default. The bounded timeout is explained on WRAPPER_DOWNLOAD_TIMEOUT.
+        settings_file = registry_base && wrapper_settings_file(registry_base)
+        settings_args = settings_file ? ["-s", T.must(settings_file.path)] : []
+        begin
+          output = SharedHelpers.run_shell_command(
+            cmd + settings_args,
+            env: env,
+            cwd: run_cwd,
+            timeout: WRAPPER_DOWNLOAD_TIMEOUT
+          )
+        ensure
+          settings_file&.close! # deletes the temp file
+        end
+        Dependabot.logger.info("mvn wrapper output: STDOUT:#{output}")
+        output
+      rescue SharedHelpers::HelperSubprocessFailed => e
+        # `run_shell_command` raises HelperSubprocessFailed on a non-zero exit, and the
+        # updater sanitizes that into an opaque `SubprocessFailed` that only reports the
+        # command and hides the real Maven output. Log the full output and re-raise a
+        # classified Dependabot error so operators get an actionable message, mirroring
+        # the `run_mvn_dependency_tree_plugin` path.
+        Dependabot.logger.warn("mvn wrapper command failed:\n#{e.message}")
+        handle_wrapper_error(e)
+      end
+
+      # Writes a temporary Maven settings file that keeps the proxy block and adds a
+      # mirror pointing every external repository at the resolved base. Registry
+      # auth still flows through the Dependabot proxy; no credentials are written here.
+      # The caller is responsible for deleting the returned file (via `close!`).
+      sig { params(registry_base: String).returns(Tempfile) }
+      def self.wrapper_settings_file(registry_base)
+        file = Tempfile.new(["dependabot-mvn-wrapper-settings", ".xml"])
+        file.write(wrapper_settings_xml(registry_base))
+        file.close
+        file
+      end
+
+      # Builds the settings XML used for the wrapper invocation: the same proxy block as
+      # the baked settings (auth is injected by the proxy) plus a `mirrorOf=external:*`
+      # mirror so plugin, transitive POM, and distribution resolution all route through
+      # the resolved base instead of Central.
+      sig { params(registry_base: String).returns(String) }
+      def self.wrapper_settings_xml(registry_base)
+        <<~XML
+          <settings>
+            <proxies>
+              <proxy>
+                <id>dependabot-proxy</id>
+                <active>true</active>
+                <protocol>http</protocol>
+                <host>${env.PROXY_HOST}</host>
+                <port>1080</port>
+              </proxy>
+            </proxies>
+            <mirrors>
+              <mirror>
+                <id>dependabot-wrapper-mirror</id>
+                <mirrorOf>external:*</mirrorOf>
+                <url>#{registry_base.encode(xml: :text)}</url>
+              </mirror>
+            </mirrors>
+          </settings>
+        XML
+      end
+
+      # Classifies a failed Maven Wrapper invocation into an actionable Dependabot
+      # error. Known auth and plugin-resolution failures are mapped to their specific
+      # error types, and genuine Maven diagnostics are surfaced via MisconfiguredTooling.
+      # `run_shell_command` also reports inactivity timeouts and a missing `mvn`
+      # executable as HelperSubprocessFailed; those carry no Maven `[ERROR]` markers, so
+      # we re-raise the original error and let it follow normal unknown-error routing
+      # instead of mislabelling infrastructure/runtime failures as tooling misconfigurations.
+      sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
+      def self.handle_wrapper_error(error)
+        # Strip ANSI color codes up front so classification and the surfaced summary see
+        # plain text even when Maven is configured to emit colored output.
+        output = error.message.gsub(ANSI_ESCAPE_REGEX, "")
+
+        if (match = output.match(TRANSFER_FAILURE_REGEX)) &&
+           (match[:status_code] == "403" || match[:status_code] == "401")
+          raise Dependabot::PrivateSourceAuthenticationFailure, match[:repository_url]
+        end
+
+        if output.match?(WRAPPER_PLUGIN_UNRESOLVED_REGEX)
+          raise Dependabot::DependencyFileNotResolvable, "Could not resolve the Maven Wrapper plugin."
+        end
+
+        # Only reclassify when Maven emitted its own `[ERROR]` diagnostics. Otherwise the
+        # failure is not a Maven misconfiguration (e.g. timeout or missing executable), so
+        # re-raise the original error; its full output is already in the job log.
+        summary = mvn_error_summary(output)
+        raise error unless summary
+
+        raise Dependabot::MisconfiguredTooling.new("Maven Wrapper", summary)
+      end
+
+      # Extracts Maven's own `[ERROR]` lines from the combined tool output so that raised
+      # errors surface the relevant failure reason without leaking unrelated build noise or
+      # arbitrary subprocess output (which may contain sensitive file contents or paths) into
+      # the reported error. Returns nil when Maven produced no `[ERROR]` diagnostics, and caps
+      # the length to keep error payloads reasonable.
+      sig { params(output: String).returns(T.nilable(String)) }
+      def self.mvn_error_summary(output)
+        error_lines = output.lines.map(&:chomp).select { |line| line.include?("[ERROR]") }
+        return nil if error_lines.empty?
+
+        summary = error_lines.join("\n")
+        summary.length > MAX_ERROR_SUMMARY_LENGTH ? "#{summary[0, MAX_ERROR_SUMMARY_LENGTH]}..." : summary
       end
     end
   end

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -134,9 +134,7 @@ module Dependabot
         sig { returns(String) }
         def property_name
           @property_name ||= T.let(
-            dependency.requirements
-                      .find { |r| r.metadata_string("property_name") }
-                      &.metadata_string("property_name"),
+            property_requirement.metadata_string("property_name"),
             T.nilable(String)
           )
 
@@ -148,13 +146,33 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def property_source
           @property_source ||= T.let(
-            dependency.requirements
-                      .find { |r| r.metadata_string("property_name") == property_name }
-                      &.metadata_string("property_source"),
+            property_requirement.metadata_string("property_source"),
             T.nilable(String)
           )
         end
 
+        sig { returns(Dependabot::DependencyRequirement) }
+        def property_requirement
+          property_requirements = dependency.requirements.select { |r| r.metadata_string("property_name") }
+          matching_requirement = property_requirements.find do |requirement|
+            normalized_requirement_version(requirement) == dependency.version
+          end
+          requirement = matching_requirement || property_requirements.first
+
+          raise "No requirement with a property name!" unless requirement
+
+          requirement
+        end
+
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
+        def normalized_requirement_version(requirement)
+          requirement_string = requirement.requirement_string
+          return unless requirement_string
+          return if requirement_string.include?(",")
+
+          requirement_string.gsub(/[\(\)\[\]]/, "").strip
+        end
+
         sig { params(string: String).returns(T::Boolean) }
         def includes_property_reference?(string)
           string.match?(Maven::FileParser::PROPERTY_REGEX)

data/lib/dependabot/maven/update_checker/requirements_updater.rb

@@ -86,13 +86,13 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        # Bumps a wrapper (maven-wrapper.properties) requirement. As well as the requirement
-        # string, it updates the fields the FileUpdater actually reads so a real update regenerates
-        # the *new* release rather than the old one:
-        #   - distributionUrl  -> metadata[:distribution_version] and the versioned source url
-        #   - wrapperVersion   -> metadata[:wrapper_version]
-        # The wrapperUrl tag-along requirement (present only on the distribution dependency) is left
-        # otherwise untouched, since bumping the distribution does not change the wrapper JAR.
+        # Bumps a wrapper (maven-wrapper.properties) requirement to the resolved version, keeping the
+        # fields the FileUpdater reads in sync so it regenerates the *new* release, not the old one:
+        #   - distributionUrl -> metadata[:distribution_version] + the versioned source url
+        #   - wrapperVersion  -> metadata[:wrapper_version]
+        #   - both            -> metadata[:source_url] (registry that served the version, so the
+        #                        FileUpdater can mirror the native `mvn` there)
+        #   - wrapperUrl      -> left untouched (tag-along; bumping the distribution doesn't move it)
         sig do
           params(req: Dependabot::DependencyRequirement)
             .returns(Dependabot::DependencyRequirement)
@@ -105,15 +105,32 @@ module Dependabot
           when "distributionUrl"
             updated = Dependabot::DependencyRequirement.create(req.merge(requirement: new_version))
             updated = merge_metadata_version(updated, :distribution_version, new_version)
-            merge_source_url(updated, old_version, new_version)
+            updated = merge_source_url(updated, old_version, new_version)
+            merge_registry_source_url(updated)
           when "wrapperVersion"
             updated = Dependabot::DependencyRequirement.create(req.merge(requirement: new_version))
-            merge_metadata_version(updated, :wrapper_version, new_version)
+            updated = merge_metadata_version(updated, :wrapper_version, new_version)
+            merge_registry_source_url(updated)
           else
             req
           end
         end
 
+        # Stamps the registry that served the resolved version (source_url = release.url) onto the
+        # wrapper requirement metadata, so the FileUpdater can mirror the native `mvn` regeneration
+        # to the same registry the version was resolved and vetted against. Nil when no version
+        # resolved (no key added), leaving the wrapper's Central default.
+        sig do
+          params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement)
+        end
+        def merge_registry_source_url(req)
+          base = source_url
+          return req unless base
+
+          metadata = req.metadata || {}
+          Dependabot::DependencyRequirement.create(req.merge(metadata: metadata.merge(source_url: base)))
+        end
+
         sig do
           params(req: Dependabot::DependencyRequirement, key: Symbol, new_version: String)
             .returns(Dependabot::DependencyRequirement)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -183,28 +183,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib