dependabot-maven 0.387.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 314453cc4debe64902cd26e93c292c78b633bcd1be4f4d04444e1ed4ad5b0230
-  data.tar.gz: 92caf114f8fd30d9c2bf6a4cf0ffa6005633415053397d916e268ab87aec68cb
+  metadata.gz: 951a20d7fac5dc6beedafd9b643fe65bb72871db3acfa313b2d3e60feb3a9f21
+  data.tar.gz: cdaa999ecefd1c4d258fffe994e693ed6e513517d9cf8a19c2636d836efc92ad
 SHA512:
-  metadata.gz: 46daf2dfb1595c48b0ae22f3299d4d3b0de65ab0e0a58db731237320c1f91acc2e73e159be3652320a24e6c915456db93f5adbcd32953a7207cf235feb9952ba
-  data.tar.gz: 5d7ab6749020ae57b53d0b4d0b8a52309acccbdafbd57202eb0c55ccd014b76b30a7cb2e6b61d1fc868f4807a3f202ae17f6b068c062d8b73f07a1530b400e83
+  metadata.gz: 848e06c949c709f137dcc6dfea9846c3e70e92459cb55630e1d8e299d78c24f7a2c85cc4db37d6e6968a2e09e34f97d8a4a94c09b473196813f67768ba80898e
+  data.tar.gz: 673d58a9c21b555e0ee4161bea4a8bfe05d1dea29c3c8b7be907067b781e85ccc6ec2c2432b8063a876aaa4394fb4fb227c8f14397ef9d7fc54348aca1d6f808

data/lib/dependabot/maven/shared/shared_version_finder.rb

@@ -5,7 +5,7 @@ require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 require "dependabot/package/package_latest_version_finder"
-
+require "date"
 module Dependabot
   module Maven
     module Shared
@@ -68,6 +68,9 @@ module Dependabot
 
           return true if upgrade_to_stable?(current, candidate)
 
+          # If either version contains a date, consider them compatible
+          return true if contains_date?(current) || contains_date?(candidate)
+
           suffix_compatible?(current, candidate)
         end
 
@@ -178,6 +181,8 @@ module Dependabot
 
           return true if contains_git_sha?(current_suffix) || contains_git_sha?(candidate_suffix)
 
+          return true if contains_date?(current_suffix) || contains_date?(candidate_suffix)
+
           # If both versions share the exact suffix or no suffix, they are compatible
           current_suffix == candidate_suffix
         end
@@ -236,6 +241,57 @@ module Dependabot
             git_sha?(version.gsub(/[-._]/, ""))
         end
 
+        # Determines whether a version string contains a date.
+        #
+        # This method checks if any part of a version string (when split by common
+        # delimiters like '-', '.', or '_') is a valid date.
+        #
+        # @example Standard delimiter-separated dates
+        #   contains_date?("2025-12-16-05-04") # => true
+        #   contains_date?("2025_12_16_05_04") # => true
+        #   contains_date?("1.0-2025_12_16_05_04") # => true
+        # @example Compact date formats
+        #   contains_date?("20251216") # => true
+        #
+        #   contains_date?("1.2.3-alpha")          # => false
+        #   contains_date?("abcdef123")            # => false
+        sig { params(version: T.nilable(String)).returns(T::Boolean) }
+        def contains_date?(version)
+          return false unless version
+
+          parts = T.let(T.cast(version.scan(/\d+/), T::Array[String]).map(&:to_i), T::Array[Integer])
+
+          case parts.length
+          when 2
+            # Example: "2024.1"
+            year, month = parts
+            valid_date_parts?(year, month, 1)
+          when 3
+            # Example: https://github.com/relizaio/versioning/releases/tag/versioning-2026.01.7
+            year, month, day = parts
+            valid_date_parts?(year, month, day)
+          when 4, 5
+            # Examples:
+            # https://github.com/relizaio/versioning/releases/tag/2019.05.Stable.3
+            # 2025_12_16_05_04 used in https://github.com/dependabot/dependabot-core/issues/14084
+            year, month, day, = parts
+            # Just validate the date part ignoring the build number
+            valid_date_parts?(year, month, day)
+          else
+            false
+          end
+        end
+
+        sig { params(year: T.nilable(Integer), month: T.nilable(Integer), day: T.nilable(Integer)).returns(T::Boolean) }
+        def valid_date_parts?(year, month, day)
+          # Require 4-digit year to avoid matching short version numbers like "1.2.3"
+          return false unless year && year > 999
+          return false unless month&.between?(1, 12)
+          return false unless day&.between?(1, 31)
+
+          Date.valid_date?(year, month, day)
+        end
+
         # Determines whether two versions are compatible based on pre-release status.
         #
         # Two versions are considered compatible if both are pre-release versions.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.387.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -292,7 +292,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib