dependabot-maven 0.252.0 → 0.253.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9eda01330981f13d84f0ccc0432dc7126fabce81d38af8a72b7975fc1b305eef
-  data.tar.gz: fa16fe7931d168f511e11c06408d89089d549a6259c6d207867178d4ced847db
+  metadata.gz: dffeeb577c7b7a40d973acfd880896eff96c5b06bde35bf6bdf6904e0b587ab6
+  data.tar.gz: 5825f235221a9007c013b2294e99bba05aa0fe24956d4cc3eb8fd4e2b388e00e
 SHA512:
-  metadata.gz: 31180e2eb6818db21a6022435a992627d1a7ae091e86869bd1cc9f396b3d91a704537b6f37caad4b66246d58f99f9e87b701e67ac340f2d15677d25f15801d9c
-  data.tar.gz: 8242bdc1e9d8fcc502ba386f8bcb07d832e80a4b76c6a2edad7c5a544a9b0ab5b1be1ee0a9e44485d86162a94f9b9ba82f7c6d3ace559e55e1e48714fe8be3cc
+  metadata.gz: 559d5b3d18e8c9d31896ea2e97eacbeedde63fa1526bdb8544c296f73ce42486b7fbed3f2a7fa0edbe92ae5306b7e672baef38b07df05c84ab8a9c92e750e7f0
+  data.tar.gz: 684113129ad6e6c864495899db78f1177385230c1af2b6b2b2df92f195605d69201d7fb98810079b0b22d0d58df76d97b67fc79da844012cf24f95499e91aee5

data/lib/dependabot/maven/file_parser/property_value_finder.rb

@@ -36,9 +36,10 @@ module Dependabot
           node =
             loop do
               candidate_node =
-                doc.at_xpath("/project/#{nm}") ||
-                doc.at_xpath("/project/properties/#{property_name}") ||
-                doc.at_xpath("/project/profiles/profile/properties/#{property_name}")
+                doc.xpath("/project/#{nm}").last ||
+                doc.xpath("/project/properties/#{property_name}").last ||
+                doc.xpath("/project/profiles/profile/properties/#{property_name}").last
+
               break candidate_node if candidate_node
               break unless nm.match?(DOT_SEPARATOR_REGEX)
 
@@ -47,6 +48,15 @@ module Dependabot
               raise DependencyFileNotEvaluatable, e.message
             end
 
+          # and value is an expression
+          if node && node.content.strip.start_with?("${")
+            return extract_value_from_expression(
+              expression: node.content.strip,
+              property_name: property_name,
+              callsite_pom: callsite_pom
+            )
+          end
+
           # If we found a property, return it
           return { file: pom.name, node: node, value: node.content.strip } if node
 
@@ -63,6 +73,19 @@ module Dependabot
 
         attr_reader :dependency_files
 
+        def extract_value_from_expression(expression:, property_name:, callsite_pom:)
+          # and the expression is pointing to self then raise the error
+          if expression.eql?("${#{property_name}}")
+            raise Dependabot::DependencyFileNotParseable.new(
+              callsite_pom.name,
+              "Error trying to resolve recursive expression '#{expression}'."
+            )
+          end
+
+          # and the expression is pointing to another tag, then get the value of that tag
+          property_details(property_name: expression.slice(2..-2), callsite_pom: callsite_pom)
+        end
+
         def sanitize_property_name(property_name)
           property_name.sub(/^pom\./, "").sub(/^project\./, "")
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.252.0
+  version: 0.253.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-11 00:00:00.000000000 Z
+date: 2024-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.253.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.253.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -164,20 +164,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.7.3
-- !ruby/object:Gem::Dependency
-  name: stackprof
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.16
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -264,7 +250,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.252.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.253.0
 post_install_message: 
 rdoc_options: []
 require_paths: