dependabot-maven 0.237.0 → 0.238.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7edac94e52e42ac0557bf77616a30a33dc20bd0d2d14817a74acdbc4082c155f
-  data.tar.gz: ada3140145eaab44180812c4fd0f8255d8350a8e3341eb1d5b93be9c7d1238c5
+  metadata.gz: c129341dcfa0cc4b30dbdc362f0112e79b1e0609d05f598683afa1872755c1d9
+  data.tar.gz: ac4222bc51ef3cc93c35b288f0a21beeb5eba70f5eca078fa18be2e15f799ec2
 SHA512:
-  metadata.gz: 38ec5482781048d76cf0e2e5565f1667fee52ba8a88821290a6f773cf785974bf6b1e2f43e59de89263616f1847e4af0a9af157f60139adbb189707862325306
-  data.tar.gz: 3cdb003135571004f1e14a198d4cf15af379cee0d6fe253ebca47cffa56748735a68ebeb6913fb2596eec37fa83e71cc98a0941d2483d2b99b99113256b5e2d0
+  metadata.gz: 640576ba6d9272e82ea389e744e2bf7c49dc96931c78a1c64083a691fbfc6194dba62d1887d5da9adad9b832a9bd04c6ca20085293f9467b047a12b74c40ded7
+  data.tar.gz: b347c0d29775ade3853165190f275620a499feb04ebeb07b0909480226b0b13a43ac37a5982e7c0ffaad1b2911741d7ceb2d16a6be0272d218f2046d6488e66f

data/lib/dependabot/maven/file_parser/property_value_finder.rb

@@ -91,7 +91,8 @@ module Dependabot
         def parent_repository_urls(pom)
           repositories_finder.repository_urls(
             pom: pom,
-            exclude_inherited: true
+            exclude_inherited: true,
+            exclude_snapshots: false
           )
         end
 

data/lib/dependabot/maven/file_parser/repositories_finder.rb

@@ -43,7 +43,7 @@ module Dependabot
         end
 
         # Collect all repository URLs from this POM and its parents
-        def repository_urls(pom:, exclude_inherited: false)
+        def repository_urls(pom:, exclude_inherited: false, exclude_snapshots: true)
           entries = gather_repository_urls(pom: pom, exclude_inherited: exclude_inherited)
           ids = Set.new
           @known_urls += entries.map do |entry|
@@ -54,7 +54,8 @@ module Dependabot
           end
           @known_urls = @known_urls.uniq.compact
 
-          urls = urls_from_credentials + @known_urls.map { |entry| entry[:url] }
+          urls = urls_from_credentials + @known_urls.reject { |entry| exclude_snapshots && entry[:snapshots] }
+                                                    .map { |entry| entry[:url] }
           urls += [central_repo_url] unless @known_urls.any? { |entry| entry[:id] == super_pom[:id] }
           urls.uniq
         end
@@ -69,14 +70,35 @@ module Dependabot
           { url: central_repo_url, id: "central" }
         end
 
+        def serialize_mvn_repo(entry)
+          {
+            url: entry.at_css("url").content.strip,
+            id: entry.at_css("id").content.strip,
+            snapshots: entry.at_css("snapshots > enabled")&.content&.strip,
+            releases: entry.at_css("releases > enabled")&.content&.strip
+          }
+        end
+
+        def snapshot_repo(entry)
+          entry[:releases] == "false" && (entry[:snapshots].nil? || entry[:snapshots] == "true")
+        end
+
+        def serialize_urls(entry, pom)
+          {
+            url: evaluated_value(entry[:url], pom).gsub(%r{/$}, ""),
+            id: entry[:id],
+            snapshots: snapshot_repo(entry)
+          }
+        end
+
         def gather_repository_urls(pom:, exclude_inherited: false)
           repos_in_pom =
             Nokogiri::XML(pom.content)
                     .css(REPOSITORY_SELECTOR)
-                    .map { |node| { url: node.at_css("url").content.strip, id: node.at_css("id").content.strip } }
+                    .map { |node| serialize_mvn_repo(node) }
                     .reject { |entry| contains_property?(entry[:url]) && !evaluate_properties? }
                     .select { |entry| entry[:url].start_with?("http") }
-                    .map { |entry| { url: evaluated_value(entry[:url], pom).gsub(%r{/$}, ""), id: entry[:id] } }
+                    .map { |entry| serialize_urls(entry, pom) }
 
           return repos_in_pom if exclude_inherited
 

data/lib/dependabot/maven/metadata_finder.rb

@@ -4,7 +4,7 @@
 require "nokogiri"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
-require "dependabot/file_fetchers/base"
+require "dependabot/maven/file_fetcher"
 require "dependabot/maven/file_parser"
 require "dependabot/maven/file_parser/repositories_finder"
 require "dependabot/maven/utils/auth_headers_finder"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.237.0
+  version: 0.238.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-11-21 00:00:00.000000000 Z
+date: 2023-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.238.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.237.0
+        version: 0.238.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -236,7 +236,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
 post_install_message: 
 rdoc_options: []
 require_paths: