dependabot-maven 0.142.1 → 0.143.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (4) hide show
  1. checksums.yaml +4 -4
  2. data/lib/dependabot/maven/requirement.rb +12 -2
  3. data/lib/dependabot/maven/update_checker/version_finder.rb +2 -10
  4. metadata +6 -6
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: b0dda89c54d1009061768bd30fefb3c3a89b857531f82e2b83f00bd418868b17
4
- data.tar.gz: 5707c57ed18a85f120c239c4b4790643bec81423f2d83a9a901f101a3a926eb0
3
+ metadata.gz: ceef68bb9cd96abacaebefb8f54a6a0aa493f1cf01eb6abef56f05c68a15aeeb
4
+ data.tar.gz: 0b83dd0fabb5c31cc1eca98ca4688dd0a450eb3082719b434534a6bb4776a615
5
5
  SHA512:
6
- metadata.gz: 97324b29b6eb06f883fa281626929f5b7619bdf47cc8f362b91880951b2e4609482bb62b5faa7a007834e54e90be111aa48dac7f454efdcd9637ff2ec08b2995
7
- data.tar.gz: c21caa8d4f49150f18de90bd88de20a0bbd46999389b5fd19c3dc4b019b29dcac5900f8037e78d0ae6abbf3fda357245103ed5f2271cb64e184cf2d2e6d1e6a7
6
+ metadata.gz: 277181d30fddd6aebc0d2f7493b0aca2a0d7590a18a1edf42ee56277ab3d529a3f8d02c79f58e15a063a8d6a43d81554acbc5a6fe1c37a15ce00a3b36211045f
7
+ data.tar.gz: 25d7d938d1fece4c7a0d0b3ba6a04166a46aa61c8f9ffce43f5aa10014e8791c43a8dd69a533c3426a19820eb9133d84daed6ac71b023ad4e1a5021fbe7461cc
data/lib/dependabot/maven/requirement.rb CHANGED
@@ -7,6 +7,7 @@ module Dependabot
7
7
  module Maven
8
8
  class Requirement < Gem::Requirement
9
9
  quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
10
+ OR_SYNTAX = /(?<=\]|\)),/.freeze
10
11
  PATTERN_RAW =
11
12
  "\\s*(#{quoted})?\\s*(#{Maven::Version::VERSION_PATTERN})\\s*"
12
13
  PATTERN = /\A#{PATTERN_RAW}\z/.freeze
@@ -32,7 +33,14 @@ module Dependabot
32
33
 
33
34
  def initialize(*requirements)
34
35
  requirements = requirements.flatten.flat_map do |req_string|
35
- convert_java_constraint_to_ruby_constraint(req_string)
36
+ # NOTE: Support ruby-style version requirements that are created from
37
+ # PR ignore conditions
38
+ version_reqs = req_string.split(",").map(&:strip)
39
+ if version_reqs.all? { |s| Gem::Requirement::PATTERN.match?(s) }
40
+ version_reqs
41
+ else
42
+ convert_java_constraint_to_ruby_constraint(req_string)
43
+ end
36
44
  end
37
45
 
38
46
  super(requirements)
@@ -46,7 +54,9 @@ module Dependabot
46
54
  private
47
55
 
48
56
  def self.split_java_requirement(req_string)
49
- req_string.split(/(?<=\]|\)),/).flat_map do |str|
57
+ return [req_string] unless req_string.match?(OR_SYNTAX)
58
+
59
+ req_string.split(OR_SYNTAX).flat_map do |str|
50
60
  next str if str.start_with?("(", "[")
51
61
 
52
62
  exacts, *rest = str.split(/,(?=\[|\()/)
data/lib/dependabot/maven/update_checker/version_finder.rb CHANGED
@@ -14,8 +14,6 @@ module Dependabot
14
14
  class VersionFinder
15
15
  TYPE_SUFFICES = %w(jre android java).freeze
16
16
 
17
- MAVEN_RANGE_REGEX = /[\(\[].*,.*[\)\]]/.freeze
18
-
19
17
  def initialize(dependency:, dependency_files:, credentials:,
20
18
  ignored_versions:, security_advisories:,
21
19
  raise_on_ignored: false)
@@ -95,10 +93,10 @@ module Dependabot
95
93
  filtered = possible_versions
96
94
 
97
95
  ignored_versions.each do |req|
98
- ignore_req = Maven::Requirement.new(parse_requirement_string(req))
96
+ ignore_requirements = Maven::Requirement.requirements_array(req)
99
97
  filtered =
100
98
  filtered.
101
- reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
99
+ reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v.fetch(:version)) } }
102
100
  end
103
101
 
104
102
  raise AllVersionsIgnored if @raise_on_ignored && filtered.empty? && possible_versions.any?
@@ -106,12 +104,6 @@ module Dependabot
106
104
  filtered
107
105
  end
108
106
 
109
- def parse_requirement_string(string)
110
- return string if string.match?(MAVEN_RANGE_REGEX)
111
-
112
- string.split(",").map(&:strip)
113
- end
114
-
115
107
  def filter_vulnerable_versions(possible_versions)
116
108
  versions_array = possible_versions
117
109
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dependabot-maven
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.142.1
4
+ version: 0.143.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Dependabot
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-04-16 00:00:00.000000000 Z
11
+ date: 2021-04-21 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 0.142.1
19
+ version: 0.143.0
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 0.142.1
26
+ version: 0.143.0
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: byebug
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
100
100
  requirements:
101
101
  - - "~>"
102
102
  - !ruby/object:Gem::Version
103
- version: 1.12.0
103
+ version: 1.13.0
104
104
  type: :development
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - "~>"
109
109
  - !ruby/object:Gem::Version
110
- version: 1.12.0
110
+ version: 1.13.0
111
111
  - !ruby/object:Gem::Dependency
112
112
  name: simplecov
113
113
  requirement: !ruby/object:Gem::Requirement