dependabot-maven 0.380.0 → 0.381.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c60264678a505d63a80aab010d67f409dbdc4dddac58701489efe8382cfff0a
-  data.tar.gz: 1c052a45257a63bf5d4ed6d5b760c60471a68cfef49c7db082c1a261952241b0
+  metadata.gz: be7ae98668076c1a36917baffcfd6383f090552ceac52e34ea058f40917f6878
+  data.tar.gz: 634c128308da3630f6666dc2bd9f47d4737c52b23f6290216aa36de8111b39aa
 SHA512:
-  metadata.gz: 663229493a0b49552fb623ca0414b30ae057c9cc023fb91268638efa911b5a00a8f3987c6095facbd86a88e205730087d176904aa457755bbf63f931ec41f16f
-  data.tar.gz: efb9c45145cf52afc442537ac2ad0ac1895f99667f44b6e293cec26d2fde299f0e8d8de55cf2e47d9051237b928cf0d79f92e1990ba99aeb8e5f447642d976a5
+  metadata.gz: 97b36d606f3efdc8db7269d34be8d024d554b75c4f5ea357e1593aa026b899cc4a69d7f9f4eb7eeb3461fa06c065aa6517fc0b862d28c39e5a2220f0956b2a86
+  data.tar.gz: 34cad0af96100c6ae9414d021171765e1dd6c56eaab50e74d11f5af187207a708d82ed77ea9d1a1ab1630b7fb396ba703149a11c823a88cd6708c3fcba37b0f7

data/lib/dependabot/maven/pom.xml

@@ -10,7 +10,7 @@
   -->
 
   <properties>
-    <maven-dependency-plugin.version>3.10.0</maven-dependency-plugin.version>
+    <maven-dependency-plugin.version>3.11.0</maven-dependency-plugin.version>
   </properties>
 
   <dependencies>

data/lib/dependabot/maven/shared/shared_version_finder.rb

@@ -26,23 +26,19 @@ module Dependabot
         /ix
 
         # Common Maven pre-release qualifiers.
-        # They often indicate versions that are not yet stable but that are released to the public for testing.
+        # Indicate versions not yet stable but released for testing.
         # Examples: 1.0.0-RC1, 2.0.0-ALPHA2, 3.1.0-BETA, 4.0.0-DEV5, etc.
         # See https://maven.apache.org/guides/mini/guide-naming-conventions.html#version-identifier
         MAVEN_PRE_RELEASE_QUALIFIERS = /
             # Must be at start OR preceded by a delimiter
             (?: \A | [-._])(
-              # --- Qualifiers that usually REQUIRE a number ---
-              # Examples: "RC1", "BETA2", "M3", "ALPHA-1", "EAP.2"
-              # The number differentiates multiple pre-releases; a version like "1.0.0-RC"
-              (?i)(?:RC|CR|M|MILESTONE|ALPHA|BETA|EA|EAP)(?:[-._]?\d+)?
-              |
-              # --- Qualifiers that do NOT usually have numbers ---
-              DEV|
-              PREVIEW|
-              PRERELEASE|
-              EXPERIMENTAL|
-              UNSTABLE
+              # Pre-release qualifiers, each with an optional numeric suffix
+              # (e.g., RC1, BETA2, DEV, PREVIEW1)
+              (?:
+                RC | CR | M | MILESTONE | ALPHA | BETA | EA | EAP |
+                DEV | PREVIEW | PRERELEASE | EXPERIMENTAL | UNSTABLE
+              )
+              (?:[-._]?\d+)?
             )$
           /ix
 
@@ -109,9 +105,17 @@ module Dependabot
 
         sig { returns(T::Boolean) }
         def wants_prerelease?
-          return false unless dependency.numeric_version
-
-          dependency.numeric_version&.prerelease? || false
+          return true if dependency.numeric_version&.prerelease?
+
+          dependency.requirements.any? do |req|
+            req_string = T.cast(req.fetch(:requirement), T.nilable(String)).to_s
+            req_string.split(",").any? do |segment|
+              normalized = segment.strip.gsub(/\A[\[\(]\s*/, "")
+                                  .gsub(/\s*[\]\)]\z/, "")
+              normalized.match?(MAVEN_PRE_RELEASE_QUALIFIERS) ||
+                normalized.match?(MAVEN_SNAPSHOT_QUALIFIER)
+            end
+          end
         end
 
         sig { returns(T::Boolean) }

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -41,6 +41,7 @@ module Dependabot
           @target_version   = T.let(target_version_details&.fetch(:version), T.nilable(Dependabot::Maven::Version))
           @source_url       = T.let(target_version_details&.fetch(:source_url), T.nilable(String))
           @update_cooldown = update_cooldown
+          @property_value_finder = T.let(nil, T.nilable(Dependabot::Maven::FileParser::PropertyValueFinder))
         end
 
         sig { returns(T::Boolean) }
@@ -79,7 +80,7 @@ module Dependabot
                 name: dep.name,
                 version: updated_version(dep),
                 requirements: updated_requirements(dep),
-                previous_version: dep.version,
+                previous_version: previous_version(dep),
                 previous_requirements: dep.requirements,
                 package_manager: dep.package_manager
               )
@@ -159,13 +160,9 @@ module Dependabot
 
         sig { params(dep: Dependabot::Dependency).returns(T.nilable(String)) }
         def version_string(dep)
-          declaring_requirement =
-            dep.requirements
-               .find { |r| r.dig(:metadata, :property_name) == property_name }
-
           Maven::FileUpdater::DeclarationFinder.new(
             dependency: dep,
-            declaring_requirement: T.must(declaring_requirement),
+            declaring_requirement: declaring_property_requirement(dep),
             dependency_files: dependency_files
           ).declaration_nodes.first&.at_css("version")&.content
         end
@@ -185,6 +182,45 @@ module Dependabot
           T.must(version_string(dep)).gsub("${#{property_name}}", T.must(target_version).to_s)
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(String) }
+        def previous_version(dep)
+          T.must(version_string(dep)).gsub("${#{property_name}}", current_property_value(dep))
+        end
+
+        sig { params(dep: Dependabot::Dependency).returns(String) }
+        def current_property_value(dep)
+          declaring_requirement = declaring_property_requirement(dep)
+          callsite_pom = dependency_files.find { |f| f.name == declaring_requirement.fetch(:file) }
+          unless callsite_pom
+            raise DependencyFileNotEvaluatable,
+                  "POM not found: #{declaring_requirement.fetch(:file)} for property #{property_name}"
+          end
+
+          property_value =
+            property_value_finder
+            .property_details(property_name: property_name, callsite_pom: callsite_pom)
+            &.fetch(:value)
+
+          return property_value if property_value.is_a?(String)
+
+          raise DependencyFileNotEvaluatable, "Property not found: #{property_name}"
+        end
+
+        sig { params(dep: Dependabot::Dependency).returns(T::Hash[Symbol, T.untyped]) }
+        def declaring_property_requirement(dep)
+          declaring_requirement =
+            dep.requirements.find do |r|
+              next false unless r.dig(:metadata, :property_name) == property_name
+
+              r.dig(:metadata, :property_source) == property_source
+            end
+
+          return declaring_requirement if declaring_requirement
+
+          raise DependencyFileNotEvaluatable,
+                "Requirement not found for property #{property_name} from #{property_source || 'unknown source'}"
+        end
+
         sig { params(dep: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements(dep)
           @updated_requirements ||= T.let({}, T.nilable(T::Hash[String, T::Array[T::Hash[Symbol, T.untyped]]]))
@@ -196,6 +232,15 @@ module Dependabot
               properties_to_update: [property_name]
             ).updated_requirements
         end
+
+        sig { returns(Dependabot::Maven::FileParser::PropertyValueFinder) }
+        def property_value_finder
+          @property_value_finder ||=
+            Dependabot::Maven::FileParser::PropertyValueFinder.new(
+              dependency_files: dependency_files,
+              credentials: credentials
+            )
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.380.0
+  version: 0.381.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
 rdoc_options: []
 require_paths:
 - lib