dependabot-maven 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5193718aa5e66590c85b1c56c70f9766bd82abff0c171b5ed0aa604c8a07500
-  data.tar.gz: 0d7f6d3afef609648c953e43fbb879e248bbe6373454f4153d59aaf6006b202f
+  metadata.gz: 633af390f012c6aa9704de839340e18485655cffa7ce230467f78f8b6ee2541b
+  data.tar.gz: 7062af128c881f3bfcd9aacffb61957a24700982f86d51db00bf978f8e832d51
 SHA512:
-  metadata.gz: 782b91d868dd0ea8357c3185ef168c72508022ca6cdd37be844695f32bdd3c4bab88a6112a391df57361d6359089fbc236ae5db1500521ad26371bee9dde482b
-  data.tar.gz: 8cccc8d15359d49469ebaa169671d57222cd5531043866ab0cd694b3abee4c32bd66c9ffd78d55476255a5727f8c935347eba7892a0dc0d75bc40ece1e0dc138
+  metadata.gz: 5ece07a1b94981cf48b3b1638b18b1d40da3b4a19b90847641b67d226c1a60053335f1a7b2b9ed6c4007d50f733cbec8b4b19900dbde8b57aa6f15cd01ee8c37
+  data.tar.gz: f7361f3db224e9158d7f6674edeab58f05e4e2e253f366346bad32247886ced22f6dcc8f9948e0894a76cbe4cfa4b3b393ba4e1ce5b18c1bf349acf328f158a2

data/lib/dependabot/maven/file_updater/dependency_management_locator.rb

@@ -0,0 +1,61 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "rexml/parsers/baseparser"
+require "stringio"
+require "dependabot/maven/file_updater"
+
+module Dependabot
+  module Maven
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class DependencyManagementLocator
+        extend T::Sig
+
+        sig { params(content: String).void }
+        def initialize(content)
+          @stream = T.let(StringIO.new(content), StringIO)
+          @parser = T.let(REXML::Parsers::BaseParser.new(@stream), REXML::Parsers::BaseParser)
+        end
+
+        sig { params(project_name: String, element_name: String).returns(T::Range[Integer]) }
+        def replacement_range(project_name:, element_name:)
+          path = T.let([], T::Array[String])
+          element_start = T.let(nil, T.nilable(Integer))
+
+          loop do
+            start = byte_position
+            event = @parser.pull
+            case event.first
+            when :start_element
+              path << event[1]
+              element_start = start if path == [project_name, element_name]
+            when :end_element
+              return T.must(element_start)...byte_position if path == [project_name, element_name]
+              return insertion_range(start) if path == [project_name]
+
+              path.pop
+            when :end_document
+              raise "Could not locate project dependency management in the XML content"
+            end
+          end
+        end
+
+        private
+
+        sig { params(start: Integer).returns(T::Range[Integer]) }
+        def insertion_range(start)
+          raise "Cannot insert dependency management into a self-closing <project> element" if start == byte_position
+
+          start...start
+        end
+
+        # REXML reads ahead and compacts its buffer. Subtract unread bytes from the IO
+        # position, converting the decoded buffer back to the document's encoding.
+        sig { returns(Integer) }
+        def byte_position
+          @stream.pos - @parser.source.buffer.encode(@parser.source.encoding).bytesize
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/file_updater.rb

@@ -15,6 +15,7 @@ module Dependabot
       extend T::Sig
 
       require_relative "file_updater/declaration_finder"
+      require_relative "file_updater/dependency_management_locator"
       require_relative "file_updater/dependency_requirement_scopes"
       require_relative "file_updater/property_value_updater"
       require_relative "file_updater/wrapper_updater"
@@ -219,8 +220,8 @@ module Dependabot
       end
       def add_new_declaration(content, dependency, requirement) # rubocop:disable Metrics/AbcSize
         doc = REXML::Document.new(content)
-        project = doc.get_elements("//project").first
-        raise "<project> element not found in the XML content" unless project
+        project = doc.root
+        raise "<project> element not found in the XML content" unless project&.name == "project"
 
         # Detect indentation of the file from indentation of the project tag children
         indentation_config = detect_indentation_config(project)
@@ -249,18 +250,15 @@ module Dependabot
         # Close all sections with appropriate indentation
         dependencies.add_text("\n#{indentation_config[:levels][:dependency_management]}")
         dependency_management.add_text("\n#{indentation_config[:levels][:base]}") if dependencies_created
-        project.add_text("\n") if dependency_management_created
 
-        # If dependencyManagement was created, replace entire document content with parser output
-        # Unfortunately, this might include unrelated formatting changes sometimes
-        return doc.to_s if dependency_management_created
-
-        # If dependencyManagement was not created, we just replace the existing dependencyManagement element
-        # with the updated one, preserving the rest of the document
-        content.gsub(
-          %r{\<dependencyManagement\>[\s\S]*\</dependencyManagement\>},
-          dependency_management.to_s
+        range = DependencyManagementLocator.new(content).replacement_range(
+          project_name: project.expanded_name,
+          element_name: dependency_management.expanded_name
         )
+        replacement = dependency_management.to_s
+        replacement = "\n#{indentation_config[:levels][:base]}#{replacement}\n" if dependency_management_created
+
+        T.must(content.byteslice(0...range.begin)) + replacement + T.must(content.byteslice(range.end..))
       end
 
       sig do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -266,6 +266,7 @@ files:
 - lib/dependabot/maven/file_parser/wrapper_mojo.rb
 - lib/dependabot/maven/file_updater.rb
 - lib/dependabot/maven/file_updater/declaration_finder.rb
+- lib/dependabot/maven/file_updater/dependency_management_locator.rb
 - lib/dependabot/maven/file_updater/dependency_requirement_scopes.rb
 - lib/dependabot/maven/file_updater/property_value_updater.rb
 - lib/dependabot/maven/file_updater/wrapper_updater.rb
@@ -296,7 +297,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib