dependabot-maven 0.394.0 → 0.396.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '009515ba93dc3e414380b797fe7b3aa17a388d024e5406e74291c901600f1a0c'
-  data.tar.gz: b511053c1259a770b1f7a2d649cf357bec4abcab55ad3aacb34b96ec40482893
+  metadata.gz: f681ccdf35c9bb41f70991513c98aa2c71e0373c848231238cfb3f1fec8d5e66
+  data.tar.gz: 8c079e8daf4de93af87c167b0230c5d42c9046ce23359560ef76dcbb5e181130
 SHA512:
-  metadata.gz: 36c134e6d66d0d445df02dca60b7ae8afe60dd585e7475e8c4668656b22bc6ca3b8917251110772709075112142cc7ffd109564573f5231fcb130adba9aaa2cf
-  data.tar.gz: dd730e81dec85d5abb73e201c832087ac4e0f75a5a09284046b87d203a208415f0588e3f9b04c58a588ecf1a55e7c70673551b20a43fd59a3b27bf1a48ea5d7f
+  metadata.gz: c7c02de0cb8393690544546664a2f1b2a883850c241ab27b23c649b596db5ec41445c1d6904279de15b8aaec7243b7e90c41265b4e37bdf0d4856bd232c3bca1
+  data.tar.gz: b6ea966696ecc770959ec9e187bb3fce67da8cb3ab6186881e60b6cc39826dd6997ecad4722ea7b705efc1b43b953e7e262b92dd9f4e5ff49fb874b22d5a5971

data/lib/dependabot/maven/file_parser/wrapper_mojo.rb

@@ -4,6 +4,7 @@
 # Parses maven-wrapper.properties and emits Dependency objects for the two
 # tracked Maven coordinates: org.apache.maven:apache-maven (the maven distribution)
 # and org.apache.maven.wrapper:maven-wrapper (the wrapper plugin).
+require "uri"
 require "dependabot/dependency_requirement"
 require "dependabot/maven/file_parser"
 require "dependabot/maven/distributions"
@@ -39,7 +40,8 @@ module Dependabot
           #  - wrapperVersion property (>=3.3.1),
           #  - version segment of wrapperUrl JAR filename (<3.3.0), or
           #  - comment in the mvnw script body (3.3.0 only, see MWRAPPER-120 and MWRAPPER-134).
-          # This field is mandatory and raises if none of the sources yield a version.
+          # When none of the sources yield a version, load_properties returns nil and the
+          # wrapper is skipped, so this field is only ever set to a resolved version.
           const :wrapper_version, String
 
           # The full JAR URL from the wrapperUrl property
@@ -65,7 +67,21 @@ module Dependabot
         DIST_URL_VERSION_REGEX = %r{
           /apache-maven-(?<version>[^/?#]+)-(?:bin|src)\.(?:zip|tar\.gz)(?:[?#].*)?\z
         }x
-        class UnparseableDistributionUrl < RuntimeError; end
+
+        # Apache Maven Wrapper JAR as it appears in a wrapperUrl path. Anchored to the artifact
+        # directory, a numeric version directory, and a `maven-wrapper-<version>.jar` filename whose
+        # version equals that directory (via the \k<version> backreference), mirroring Maven's
+        # mandatory repository layout. This rejects foreign JARs sharing the directory (e.g.
+        # .../maven-wrapper/3.3.4/foreign-3.3.4.jar), non-artifact filenames
+        # (.../3.3.4/maven-wrapper-foreign.jar) and mismatched coordinates
+        # (.../3.3.4/maven-wrapper-9.9.9.jar). Matched on the path only (not the host, query, or
+        # fragment) so wrappers proxied through private registries are still recognised, while
+        # wrappers from other vendors (e.g. legacy io.takari) are not. Applied in apache_wrapper_url?.
+        WRAPPER_COORDINATE_REGEX = %r{
+          /org/apache/maven/wrapper/maven-wrapper/    # Apache Maven Wrapper artifact directory
+          (?<version>\d+\.\d+(?:\.\d+)?(?:-\w+)*)/     # version directory
+          maven-wrapper-\k<version>\.jar\z            # artifact JAR named for that same version
+        }xi
 
         sig do
           params(
@@ -77,23 +93,11 @@ module Dependabot
           content = properties_file.content
           return [] unless content
 
-          distribution_url = get_property_value(content, "distributionUrl")
-          if distribution_url&.include?("mvnd")
-            Dependabot.logger.warn("Maven daemon (mvnd) distribution is not supported, skipping wrapper update")
-            return []
-          end
-
-          begin
-            props = load_properties(content, script_files: script_files)
-          rescue UnparseableDistributionUrl => e
-            Dependabot.logger.warn("#{e.message}, skipping wrapper update")
-            return []
-          end
-
-          if props.wrapper_url&.include?("takari")
-            Dependabot.logger.warn("The Takari distribution is not supported, skipping wrapper update")
-            return []
-          end
+          # load_properties returns nil for wrappers we cannot safely update (missing
+          # mandatory data or an unsupported vendor/distribution). The reason is logged there,
+          # and we skip the wrapper without disrupting ordinary POM dependency parsing.
+          props = load_properties(content, script_files: script_files)
+          return [] unless props
 
           file_name = properties_file.name
           has_debug_scripts = debug_scripts?(script_files)
@@ -252,35 +256,65 @@ module Dependabot
           script_files.any? { |f| debug_scripts.any? { |s| f.name.end_with?(s) } }
         end
 
-        sig { params(content: String, script_files: T::Array[DependencyFile]).returns(WrapperProperties) }
+        sig { params(content: String, script_files: T::Array[DependencyFile]).returns(T.nilable(WrapperProperties)) }
         def self.load_properties(content, script_files: [])
-          distribution_url = get_property_value!(content, "distributionUrl")
+          distribution_url = get_property_value(content, "distributionUrl")
+          return skip_wrapper("distributionUrl property is missing") unless distribution_url
+
+          return skip_wrapper("Maven daemon (mvnd) distribution is not supported") if distribution_url.include?("mvnd")
+
           distribution_version = extract_distribution_version(distribution_url)
-          distribution_sha256_sum = get_property_value(content, "distributionSha256Sum")
+          return skip_wrapper("could not extract Maven version from distributionUrl") unless distribution_version
+
           wrapper_url = get_property_value(content, "wrapperUrl")
-          wrapper_sha256_sum = get_property_value(content, "wrapperSha256Sum")
-          distribution_type = resolve_distribution_type(content, wrapper_url)
+          if wrapper_url && !apache_wrapper_url?(wrapper_url)
+            return skip_wrapper("wrapperUrl is not an Apache Maven Wrapper")
+          end
+
           wrapper_version = resolve_wrapper_version(content, wrapper_url, script_files)
+          unless wrapper_version
+            return skip_wrapper(
+              "could not determine Maven Wrapper version from wrapperVersion, wrapperUrl, or script files"
+            )
+          end
 
           WrapperProperties.new(
             distribution_url: distribution_url,
             distribution_version: distribution_version,
-            distribution_sha256_sum: distribution_sha256_sum,
-            wrapper_sha256_sum: wrapper_sha256_sum,
+            distribution_sha256_sum: get_property_value(content, "distributionSha256Sum"),
+            wrapper_sha256_sum: get_property_value(content, "wrapperSha256Sum"),
             wrapper_version: wrapper_version,
             wrapper_url: wrapper_url,
-            distribution_type: distribution_type
+            distribution_type: resolve_distribution_type(content, wrapper_url)
           )
         end
 
-        sig { params(content: String).returns(String) }
+        # Signals that the wrapper cannot be updated: logs the reason and returns nil so the
+        # caller treats the wrapper as absent rather than aborting the whole Maven parse.
+        sig { params(reason: String).returns(NilClass) }
+        def self.skip_wrapper(reason)
+          Dependabot.logger.warn("#{reason}, skipping Maven Wrapper update")
+          nil
+        end
+
+        sig { params(content: String).returns(T.nilable(String)) }
         def self.extract_distribution_version(content)
           match = content.match(DIST_URL_VERSION_REGEX)
-          unless match && match[:version]
-            raise UnparseableDistributionUrl, "Could not extract Maven version from distributionUrl"
-          end
+          match && match[:version]
+        end
 
-          T.must(match[:version])
+        # True when the wrapperUrl points at the Apache Maven Wrapper artifact. The coordinate is
+        # matched against the URL path only (never the query or fragment) so that a non-Apache JAR
+        # cannot slip through the allowlist by carrying the coordinate in a `?redirect=...` query.
+        # A malformed URL that cannot be parsed is treated as not-Apache.
+        sig { params(url: String).returns(T::Boolean) }
+        def self.apache_wrapper_url?(url)
+          path = URI.parse(url).path
+          return false unless path
+
+          path.match?(WRAPPER_COORDINATE_REGEX)
+        rescue URI::InvalidURIError
+          false
         end
 
         sig { params(content: String, target_key: String).returns(T.nilable(String)) }
@@ -324,15 +358,6 @@ module Dependabot
           end
         end
 
-        sig { params(content: String, target_key: String).returns(String) }
-        def self.get_property_value!(content, target_key)
-          value = get_property_value(content, target_key)
-
-          raise "Missing mandatory property: #{target_key}" if value.nil?
-
-          value
-        end
-
         private_class_method :build_distribution_dependency
         private_class_method :build_wrapper_dependency
         private_class_method :build_distribution_requirements
@@ -353,7 +378,7 @@ module Dependabot
             content: String,
             wrapper_url: T.nilable(String),
             script_files: T::Array[DependencyFile]
-          ).returns(String)
+          ).returns(T.nilable(String))
         end
         def self.resolve_wrapper_version(content, wrapper_url, script_files)
           version = get_property_value(content, "wrapperVersion")
@@ -367,10 +392,6 @@ module Dependabot
             version = load_wrapper_version_from_scripts(script_files)
           end
 
-          if version.nil?
-            raise "Could not determine Maven Wrapper version from wrapperVersion, wrapperUrl, or script files"
-          end
-
           version
         end
 
@@ -401,6 +422,8 @@ module Dependabot
         private_class_method :resolve_wrapper_version
         private_class_method :parse_version_from_wrapper_url
         private_class_method :load_wrapper_version_from_scripts
+        private_class_method :skip_wrapper
+        private_class_method :apache_wrapper_url?
       end
     end
   end

data/lib/dependabot/maven/file_parser.rb

@@ -17,7 +17,7 @@ require "dependabot/errors"
 # - http://maven.apache.org/pom.html
 module Dependabot
   module Maven
-    # rubocop:disable Metrics/ClassLength
+    # rubocop:disable-next Metrics/ClassLength
     class FileParser < Dependabot::FileParsers::Base
       extend T::Sig
 
@@ -658,7 +658,6 @@ module Dependabot
         doc.css(PLUGIN_SELECTOR, PLUGIN_ARTIFACT_ITEMS_SELECTOR)
       end
     end
-    # rubocop:enable Metrics/ClassLength
   end
 end
 

data/lib/dependabot/maven/file_updater/wrapper_updater.rb

@@ -222,6 +222,7 @@ module Dependabot
             wrapper_plugin_version: wrapper_version,
             env: build_env,
             distribution_type: distribution_type,
+            registry_base: resolved_registry_base,
             extra_args: extra_args,
             cwd: wrapper_dir
           )
@@ -288,8 +289,10 @@ module Dependabot
         end
 
         # Builds the environment hash passed to the native wrapper command.
-        # Sets the proxy host and, for a private/mirror registry, MVNW_REPOURL. Registry auth is
-        # injected by Dependabot's proxy, so no username/password is set here (core never receives them).
+        # Sets only the proxy host. Registry routing is handled by the native
+        # helper's generated settings mirror (see `resolved_registry_base`), and
+        # registry auth is injected by Dependabot's proxy, so no username/password
+        # is set here (core never receives them).
         sig { returns(T::Hash[String, String]) }
         def build_env
           env = T.let({}, T::Hash[String, String])
@@ -299,9 +302,6 @@ module Dependabot
             env["PROXY_HOST"] = proxy_url.host.to_s
           end
 
-          registry_base, cred = resolve_registry_base_and_credential
-          env.merge!(build_registry_env(registry_base, cred))
-
           if Dependabot.logger.debug?
             env["MVNW_VERBOSE"] = "true"
             Dependabot.logger.debug "build_env result: #{env}"
@@ -310,51 +310,18 @@ module Dependabot
           env
         end
 
-        sig do
-          returns([T.nilable(String), T.nilable(Dependabot::Credential)])
-        end
-        def resolve_registry_base_and_credential
-          properties = wrapper_properties_file&.content.to_s
-          dist_url = effective_distribution_url(properties)
-          Dependabot.logger.debug "Effective distribution URL: #{dist_url}"
-
-          registry_base_regex = %r{^(https?://[^/]+(?:/[^/]+)*)/org/apache/maven/apache-maven/}
-          registry_base = dist_url&.match(registry_base_regex)&.captures&.first
-          Dependabot.logger.debug "Extracted registry base: #{registry_base || '(none)'}"
-
-          cred = maven_registry_credential(registry_base)
-          Dependabot.logger.debug "Matched credential: #{cred ? "url=#{cred.fetch('url', '(none)')}" : '(none)'}"
-
-          [registry_base, cred]
-        end
-
-        sig do
-          params(registry_base: T.nilable(String), cred: T.nilable(Dependabot::Credential))
-            .returns(T::Hash[String, String])
-        end
-        def build_registry_env(registry_base, cred)
-          if registry_base
-            { "MVNW_REPOURL" => registry_base }
-          elsif cred&.replaces_base?
-            { "MVNW_REPOURL" => cred.fetch("url").chomp("/") }
-          else
-            {}
-          end
-        end
-
-        sig { params(registry_base: T.nilable(String)).returns(T.nilable(Dependabot::Credential)) }
-        def maven_registry_credential(registry_base)
-          maven_creds = @credentials.select { |c| c["type"] == "maven_repository" }
-
-          if registry_base
-            url_matches = maven_creds.select do |c|
-              cred_url = c.fetch("url", "").chomp("/")
-              !cred_url.empty? && registry_base.start_with?(cred_url)
-            end
-            return url_matches.max_by { |c| c.fetch("url", "").length } if url_matches.any?
-          end
-
-          maven_creds.find(&:replaces_base?)
+        # The registry that actually served the release we're updating to. `source_url` on the
+        # resolved requirement is `release.url` from version resolution
+        # (base_version_finder: `{ version: release.version, source_url: release.url }`), so it is
+        # the one place `mvn` is guaranteed to find this version. The native regeneration mirrors
+        # plugin/distribution resolution there instead of falling back to Central and hanging behind
+        # a no-egress registry. Nil only when no version resolved, leaving the Central default.
+        #
+        # A trailing slash is stripped so Maven appends the artifact path to a canonical base
+        # (`base/org/...`, not `base//org/...`) and registries don't 301-redirect every request.
+        sig { returns(T.nilable(String)) }
+        def resolved_registry_base
+          dependency.requirements.filter_map { |req| req.metadata_string("source_url") }.first&.chomp("/")
         end
 
         sig { params(buildfile: DependencyFile).returns(String) }

data/lib/dependabot/maven/native_helpers.rb

@@ -3,10 +3,12 @@
 
 require "fileutils"
 require "open3"
+require "tempfile"
 require "uri"
 require "sorbet-runtime"
 require "nokogiri"
 require "dependabot/errors"
+require "dependabot/command_helpers"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -33,6 +35,11 @@ module Dependabot
       # codes; we strip these so classification and the surfaced summary see plain text.
       ANSI_ESCAPE_REGEX = %r{\e\[[0-9;?]*[ -/]*[@-~]}
 
+      # Bounded inactivity timeout for the wrapper download. `run_shell_command`'s watchdog
+      # resets on output, and with transfer progress restored a healthy download keeps it
+      # alive, so this only trips on genuine silence — well below the 900s DEFAULT.
+      WRAPPER_DOWNLOAD_TIMEOUT = CommandHelpers::TIMEOUTS::LONG_RUNNING
+
       pom_path = File.join(__dir__, "pom.xml")
 
       version = File.open(pom_path) do |f|
@@ -86,21 +93,32 @@ module Dependabot
           wrapper_plugin_version: String,
           env: T::Hash[String, String],
           distribution_type: String,
+          registry_base: T.nilable(String),
           extra_args: T::Array[String],
           cwd: T.nilable(String)
         ).void
       end
-      def self.run_mvnw_wrapper(version:, wrapper_plugin_version:, env:, distribution_type:, extra_args: [], cwd: nil)
+      def self.run_mvnw_wrapper(
+        version:,
+        wrapper_plugin_version:,
+        env:,
+        distribution_type:,
+        registry_base: nil,
+        extra_args: [],
+        cwd: nil
+      )
         # Use the fully-qualified plugin goal so the exact plugin version is
         # invoked regardless of the project's plugin group configuration.
         plugin_goal = "org.apache.maven.plugins:maven-wrapper-plugin:" \
                       "#{wrapper_plugin_version}:wrapper"
 
+        # Do NOT add `--no-transfer-progress`: Maven's transfer progress is the liveness signal
+        # that keeps `run_shell_command`'s inactivity watchdog alive during a large download.
+        # Suppressing it made a healthy-but-slow fetch look hung and get killed at the timeout.
         standard_args = [
           plugin_goal,
           "-Dmaven=#{version}",
-          "-Dtype=#{distribution_type}",
-          "--no-transfer-progress"
+          "-Dtype=#{distribution_type}"
         ] + extra_args
 
         # Pass the argument vector directly instead of a pre-joined shell string.
@@ -111,7 +129,22 @@ module Dependabot
         cmd = ["mvn"] + standard_args
         run_cwd = cwd && cwd != "." ? cwd : nil
 
-        output = SharedHelpers.run_shell_command(cmd, env: env, cwd: run_cwd)
+        # Route the native `mvn`'s plugin/distribution resolution to the registry that served the
+        # resolved version via a generated settings mirror; without it `mvn` falls back to Central
+        # and hangs behind a no-egress registry. Absent when no version resolved, leaving the baked
+        # Central default. The bounded timeout is explained on WRAPPER_DOWNLOAD_TIMEOUT.
+        settings_file = registry_base && wrapper_settings_file(registry_base)
+        settings_args = settings_file ? ["-s", T.must(settings_file.path)] : []
+        begin
+          output = SharedHelpers.run_shell_command(
+            cmd + settings_args,
+            env: env,
+            cwd: run_cwd,
+            timeout: WRAPPER_DOWNLOAD_TIMEOUT
+          )
+        ensure
+          settings_file&.close! # deletes the temp file
+        end
         Dependabot.logger.info("mvn wrapper output: STDOUT:#{output}")
         output
       rescue SharedHelpers::HelperSubprocessFailed => e
@@ -124,6 +157,46 @@ module Dependabot
         handle_wrapper_error(e)
       end
 
+      # Writes a temporary Maven settings file that keeps the proxy block and adds a
+      # mirror pointing every external repository at the resolved base. Registry
+      # auth still flows through the Dependabot proxy; no credentials are written here.
+      # The caller is responsible for deleting the returned file (via `close!`).
+      sig { params(registry_base: String).returns(Tempfile) }
+      def self.wrapper_settings_file(registry_base)
+        file = Tempfile.new(["dependabot-mvn-wrapper-settings", ".xml"])
+        file.write(wrapper_settings_xml(registry_base))
+        file.close
+        file
+      end
+
+      # Builds the settings XML used for the wrapper invocation: the same proxy block as
+      # the baked settings (auth is injected by the proxy) plus a `mirrorOf=external:*`
+      # mirror so plugin, transitive POM, and distribution resolution all route through
+      # the resolved base instead of Central.
+      sig { params(registry_base: String).returns(String) }
+      def self.wrapper_settings_xml(registry_base)
+        <<~XML
+          <settings>
+            <proxies>
+              <proxy>
+                <id>dependabot-proxy</id>
+                <active>true</active>
+                <protocol>http</protocol>
+                <host>${env.PROXY_HOST}</host>
+                <port>1080</port>
+              </proxy>
+            </proxies>
+            <mirrors>
+              <mirror>
+                <id>dependabot-wrapper-mirror</id>
+                <mirrorOf>external:*</mirrorOf>
+                <url>#{registry_base.encode(xml: :text)}</url>
+              </mirror>
+            </mirrors>
+          </settings>
+        XML
+      end
+
       # Classifies a failed Maven Wrapper invocation into an actionable Dependabot
       # error. Known auth and plugin-resolution failures are mapped to their specific
       # error types, and genuine Maven diagnostics are surfaced via MisconfiguredTooling.

data/lib/dependabot/maven/shared/base_version_finder.rb

@@ -80,15 +80,19 @@ module Dependabot
           return possible_releases_reverse.find { |r| released?(r.version) } unless cooldown_options
 
           cooldown_filtered_releases = 0
-          latest_release = possible_releases_reverse.find do |release|
-            if in_cooldown_period?(release)
-              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
-              cooldown_filtered_releases += 1
-              next false
+          latest_releases = cooldown_tracker.filter_prefiltered do
+            latest_release = possible_releases_reverse.find do |release|
+              if in_cooldown_period?(release)
+                Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+                cooldown_filtered_releases += 1
+                next false
+              end
+
+              released?(release.version)
             end
-
-            released?(release.version)
+            latest_release ? [latest_release] : []
           end
+          latest_release = latest_releases.first
 
           if cooldown_filtered_releases.positive?
             Dependabot.logger.info(

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -134,9 +134,7 @@ module Dependabot
         sig { returns(String) }
         def property_name
           @property_name ||= T.let(
-            dependency.requirements
-                      .find { |r| r.metadata_string("property_name") }
-                      &.metadata_string("property_name"),
+            property_requirement.metadata_string("property_name"),
             T.nilable(String)
           )
 
@@ -148,13 +146,33 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def property_source
           @property_source ||= T.let(
-            dependency.requirements
-                      .find { |r| r.metadata_string("property_name") == property_name }
-                      &.metadata_string("property_source"),
+            property_requirement.metadata_string("property_source"),
             T.nilable(String)
           )
         end
 
+        sig { returns(Dependabot::DependencyRequirement) }
+        def property_requirement
+          property_requirements = dependency.requirements.select { |r| r.metadata_string("property_name") }
+          matching_requirement = property_requirements.find do |requirement|
+            normalized_requirement_version(requirement) == dependency.version
+          end
+          requirement = matching_requirement || property_requirements.first
+
+          raise "No requirement with a property name!" unless requirement
+
+          requirement
+        end
+
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
+        def normalized_requirement_version(requirement)
+          requirement_string = requirement.requirement_string
+          return unless requirement_string
+          return if requirement_string.include?(",")
+
+          requirement_string.gsub(/[\(\)\[\]]/, "").strip
+        end
+
         sig { params(string: String).returns(T::Boolean) }
         def includes_property_reference?(string)
           string.match?(Maven::FileParser::PROPERTY_REGEX)

data/lib/dependabot/maven/update_checker/requirements_updater.rb

@@ -86,13 +86,13 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        # Bumps a wrapper (maven-wrapper.properties) requirement. As well as the requirement
-        # string, it updates the fields the FileUpdater actually reads so a real update regenerates
-        # the *new* release rather than the old one:
-        #   - distributionUrl  -> metadata[:distribution_version] and the versioned source url
-        #   - wrapperVersion   -> metadata[:wrapper_version]
-        # The wrapperUrl tag-along requirement (present only on the distribution dependency) is left
-        # otherwise untouched, since bumping the distribution does not change the wrapper JAR.
+        # Bumps a wrapper (maven-wrapper.properties) requirement to the resolved version, keeping the
+        # fields the FileUpdater reads in sync so it regenerates the *new* release, not the old one:
+        #   - distributionUrl -> metadata[:distribution_version] + the versioned source url
+        #   - wrapperVersion  -> metadata[:wrapper_version]
+        #   - both            -> metadata[:source_url] (registry that served the version, so the
+        #                        FileUpdater can mirror the native `mvn` there)
+        #   - wrapperUrl      -> left untouched (tag-along; bumping the distribution doesn't move it)
         sig do
           params(req: Dependabot::DependencyRequirement)
             .returns(Dependabot::DependencyRequirement)
@@ -105,15 +105,32 @@ module Dependabot
           when "distributionUrl"
             updated = Dependabot::DependencyRequirement.create(req.merge(requirement: new_version))
             updated = merge_metadata_version(updated, :distribution_version, new_version)
-            merge_source_url(updated, old_version, new_version)
+            updated = merge_source_url(updated, old_version, new_version)
+            merge_registry_source_url(updated)
           when "wrapperVersion"
             updated = Dependabot::DependencyRequirement.create(req.merge(requirement: new_version))
-            merge_metadata_version(updated, :wrapper_version, new_version)
+            updated = merge_metadata_version(updated, :wrapper_version, new_version)
+            merge_registry_source_url(updated)
           else
             req
           end
         end
 
+        # Stamps the registry that served the resolved version (source_url = release.url) onto the
+        # wrapper requirement metadata, so the FileUpdater can mirror the native `mvn` regeneration
+        # to the same registry the version was resolved and vetted against. Nil when no version
+        # resolved (no key added), leaving the wrapper's Central default.
+        sig do
+          params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement)
+        end
+        def merge_registry_source_url(req)
+          base = source_url
+          return req unless base
+
+          metadata = req.metadata || {}
+          Dependabot::DependencyRequirement.create(req.merge(metadata: metadata.merge(source_url: base)))
+        end
+
         sig do
           params(req: Dependabot::DependencyRequirement, key: Symbol, new_version: String)
             .returns(Dependabot::DependencyRequirement)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.396.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.396.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -192,19 +192,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
 rdoc_options: []
 require_paths:
 - lib