dependabot-maven 0.100.2 → 0.101.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f2d0036b079ac0be68cb1cf101254b36fdfb0c03eea8fcb9a0012f240c2a2dc
-  data.tar.gz: 99bb4c64a1e031083df32ce2bc788c626a1eb8903b93694d1f5981f72a01b454
+  metadata.gz: 27c69d7d84a08f4d94c75a949acc1b5bca08dd1f7901409bc2fd010cb564e079
+  data.tar.gz: 8de19800adf49d3a979e09b34c19e91fdd86469f3efc5a5aea454100b2f2d810
 SHA512:
-  metadata.gz: 8bf5a8be2a6e0dcd0216afb45a2060d9a7631d4496d351bc1bdf4830617904dbada0c2ef1441e7f366de57625455cc5fbec5356083381b4c7925ca4637bb50db
-  data.tar.gz: 57153a9893005510226d0991dbbfa53fa9432e538f7ecae28f645159a4075f2762cea4fba351e289c6f1a7f607de1ad9c764636974f6176c62d148d5458d143a
+  metadata.gz: ee3ae831be414918bb16d5ee59a73dd82498af645308a1e6a71364a91f775d362e8c7646dba24124cc06ad861e46db0695bea4798dbee8f83c1a119f16f46615
+  data.tar.gz: 6ffc68ba6d6ee390decdd92e9e462c6f4e7f2302bbd67f09928b31c73360cfdbd582034ff284902e40eebc27aa3ccc91b5c6002bd5d9927cd02556aae659d778

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -32,7 +32,8 @@ module Dependabot
                 dependency: dep,
                 dependency_files: dependency_files,
                 credentials: credentials,
-                ignored_versions: ignored_versions
+                ignored_versions: ignored_versions,
+                security_advisories: []
               ).versions.map { |v| v.fetch(:version) }
 
               versions.include?(updated_version(dep)) || versions.none?

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -14,41 +14,37 @@ module Dependabot
         TYPE_SUFFICES = %w(jre android java).freeze
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @dependency_files = dependency_files
-          @credentials      = credentials
-          @ignored_versions = ignored_versions
-          @forbidden_urls   = []
+                       ignored_versions:, security_advisories:)
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
+          @forbidden_urls      = []
         end
 
         def latest_version_details
           possible_versions = versions
 
-          unless wants_prerelease?
-            possible_versions =
-              possible_versions.
-              reject { |v| v.fetch(:version).prerelease? }
-          end
+          possible_versions = filter_prereleases(possible_versions)
+          possible_versions = filter_date_based_versions(possible_versions)
+          possible_versions = filter_version_types(possible_versions)
+          possible_versions = filter_ignored_versions(possible_versions)
 
-          unless wants_date_based_version?
-            possible_versions =
-              possible_versions.
-              reject { |v| v.fetch(:version) > version_class.new(1900) }
-          end
+          possible_versions.reverse.find { |v| released?(v.fetch(:version)) }
+        end
 
-          possible_versions =
-            possible_versions.
-            select { |v| matches_dependency_version_type?(v.fetch(:version)) }
+        def lowest_security_fix_version_details
+          possible_versions = versions
 
-          ignored_versions.each do |req|
-            ignore_req = Maven::Requirement.new(req.split(","))
-            possible_versions =
-              possible_versions.
-              reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
-          end
+          possible_versions = filter_prereleases(possible_versions)
+          possible_versions = filter_date_based_versions(possible_versions)
+          possible_versions = filter_version_types(possible_versions)
+          possible_versions = filter_ignored_versions(possible_versions)
+          possible_versions = filter_vulnerable_versions(possible_versions)
+          possible_versions = filter_lower_versions(possible_versions)
 
-          possible_versions.reverse.find { |v| released?(v.fetch(:version)) }
+          possible_versions.find { |v| released?(v.fetch(:version)) }
         end
 
         def versions
@@ -72,7 +68,56 @@ module Dependabot
         private
 
         attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions, :forbidden_urls
+                    :ignored_versions, :forbidden_urls, :security_advisories
+
+        def filter_prereleases(possible_versions)
+          return possible_versions if wants_prerelease?
+
+          possible_versions.reject { |v| v.fetch(:version).prerelease? }
+        end
+
+        def filter_date_based_versions(possible_versions)
+          return possible_versions if wants_date_based_version?
+
+          possible_versions.
+            reject { |v| v.fetch(:version) > version_class.new(1900) }
+        end
+
+        def filter_version_types(possible_versions)
+          possible_versions.
+            select { |v| matches_dependency_version_type?(v.fetch(:version)) }
+        end
+
+        def filter_ignored_versions(possible_versions)
+          versions_array = possible_versions
+
+          ignored_versions.each do |req|
+            ignore_req = Maven::Requirement.new(req.split(","))
+            versions_array =
+              versions_array.
+              reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
+          end
+
+          versions_array
+        end
+
+        def filter_vulnerable_versions(possible_versions)
+          versions_array = possible_versions
+
+          security_advisories.each do |advisory|
+            versions_array =
+              versions_array.
+              reject { |v| advisory.vulnerable?(v.fetch(:version)) }
+          end
+
+          versions_array
+        end
+
+        def filter_lower_versions(possible_versions)
+          possible_versions.select do |v|
+            v.fetch(:version) > version_class.new(dependency.version)
+          end
+        end
 
         def wants_prerelease?
           return false unless dependency.version
@@ -89,23 +134,27 @@ module Dependabot
         end
 
         def released?(version)
-          repositories.any? do |repository_details|
-            url = repository_details.fetch("url")
-            response = Excon.get(
-              dependency_files_url(url, version),
-              user: repository_details.fetch("username"),
-              password: repository_details.fetch("password"),
-              idempotent: true,
-              **SharedHelpers.excon_defaults
-            )
-
-            artifact_id = dependency.name.split(":").last
-            type = dependency.requirements.first.
-                   dig(:metadata, :packaging_type)
-            response.body.include?("#{artifact_id}-#{version}.#{type}")
-          rescue Excon::Error::Socket, Excon::Error::Timeout
-            false
-          end
+          @released_check ||= {}
+          return @released_check[version] if @released_check.key?(version)
+
+          @released_check[version] =
+            repositories.any? do |repository_details|
+              url = repository_details.fetch("url")
+              response = Excon.get(
+                dependency_files_url(url, version),
+                user: repository_details.fetch("username"),
+                password: repository_details.fetch("password"),
+                idempotent: true,
+                **SharedHelpers.excon_defaults
+              )
+
+              artifact_id = dependency.name.split(":").last
+              type = dependency.requirements.first.
+                     dig(:metadata, :packaging_type)
+              response.body.include?("#{artifact_id}-#{version}.#{type}")
+            rescue Excon::Error::Socket, Excon::Error::Timeout
+              false
+            end
         end
 
         def dependency_metadata(repository_details)

data/lib/dependabot/maven/update_checker.rb

@@ -26,6 +26,12 @@ module Dependabot
         latest_version
       end
 
+      def lowest_resolvable_security_fix_version
+        return nil if version_comes_from_multi_dependency_property?
+
+        lowest_security_fix_version_details&.fetch(:version)
+      end
+
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Maven has a single dependency file (the pom.xml).
         #
@@ -44,8 +50,8 @@ module Dependabot
 
         RequirementsUpdater.new(
           requirements: dependency.requirements,
-          latest_version: latest_version&.to_s,
-          source_url: latest_version_details&.fetch(:source_url),
+          latest_version: preferred_resolvable_version&.to_s,
+          source_url: preferred_version_details&.fetch(:source_url),
           properties_to_update: property_names
         ).updated_requirements
       end
@@ -89,17 +95,29 @@ module Dependabot
         super
       end
 
+      def preferred_version_details
+        return lowest_security_fix_version_details if vulnerable?
+
+        latest_version_details
+      end
+
       def latest_version_details
         @latest_version_details ||= version_finder.latest_version_details
       end
 
+      def lowest_security_fix_version_details
+        @lowest_security_fix_version_details ||=
+          version_finder.lowest_security_fix_version_details
+      end
+
       def version_finder
         @version_finder ||=
           VersionFinder.new(
             dependency: dependency,
             dependency_files: dependency_files,
             credentials: credentials,
-            ignored_versions: ignored_versions
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories
           )
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.100.2
+  version: 0.101.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.100.2
+        version: 0.101.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.100.2
+        version: 0.101.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement