dependabot-maven 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e291e2478cd805665628ff741f4bf0b36a80c9297c20aa4219080f32155f30a3
-  data.tar.gz: f155a760998f79499829ce17fecea84c3a288f96ee302e70774d2dee66824b64
+  metadata.gz: d7384e20ca998f4af49001eb34de080505f3abff092e4faa921424ad6b65299e
+  data.tar.gz: 3c7f12c0289d6a8e811d0d51c6d24af81a319e59ba722fe773d623433ddb6ab9
 SHA512:
-  metadata.gz: a3249ddd53286a0e01e1f88a3ab7e07baada7d595a0888f4138d410503847b1a0306e6f575e426c55fb5630d3851e63db59744ee7c97ab70e8e27178d996a175
-  data.tar.gz: d54dcd4d6c97f470cd22f871e4b8532cdf9cfc47ada811ffb2d98854e0f7867d2422310e8f5097dc573102b628e4d8b666c8c9a024376b76f60e63c2794d714a
+  metadata.gz: f8da50ec13cdb3fead27bd2e0c20e019650a8f38a9817be6fb17f8ec5ceef8b7ffb19b7e6805a7f40787de1c4d029d7692e35149a1fc10901d2f48d043c4a02b
+  data.tar.gz: f6f258473e1bff627f213be788e692c6ddfaced18172fdc6910307f504c12554ed88b5447163932e4d909b9be856aaa5921669e1f572de0e81c3ff6d865781a5

data/lib/dependabot/maven/distributions.rb

@@ -0,0 +1,31 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/dependency_requirement"
+
+module Dependabot
+  module Maven
+    module Distributions
+      extend T::Sig
+
+      # Used to distinguish wrapper requirements (which live in maven-wrapper.properties)
+      # from regular POM requirements (which live in pom.xml)
+      DISTRIBUTION_DEPENDENCY_TYPE = "maven-distribution"
+
+      # Maven and the maven-wrapper plugin release independently with separate cadences.
+      # Tracking them as distinct dependencies allows users to update each on their own
+      # schedule. Users who prefer batched updates can use grouped updates.
+
+      MAVEN_DISTRIBUTION_PACKAGE = "org.apache.maven:apache-maven"
+      MAVEN_WRAPPER_PACKAGE      = "org.apache.maven.wrapper:maven-wrapper"
+
+      sig { params(requirements: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
+      def self.distribution_requirements?(requirements)
+        # Returns true if any requirement came from a maven-wrapper.properties
+        # file rather than a pom.xml. Used as the primary guard throughout the
+        # updater pipeline to short-circuit non-wrapper paths.
+        requirements.any? { |req| req.source_string("type") == DISTRIBUTION_DEPENDENCY_TYPE }
+      end
+    end
+  end
+end

data/lib/dependabot/maven/file_fetcher.rb

@@ -1,12 +1,15 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "base64"
 require "nokogiri"
 require "sorbet-runtime"
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 require "dependabot/file_filtering"
+require "dependabot/experiments"
+require "dependabot/maven/file_parser/wrapper_mojo"
 
 module Dependabot
   module Maven
@@ -17,6 +20,14 @@ module Dependabot
       MODULE_SELECTOR = "project > modules > module, " \
                         "profile > modules > module"
 
+      WRAPPER_PROPERTIES_RELATIVE = ".mvn/wrapper/maven-wrapper.properties"
+      WRAPPER_JAR_RELATIVE        = ".mvn/wrapper/maven-wrapper.jar"
+      WRAPPER_DOWNLOADER_RELATIVE = ".mvn/wrapper/MavenWrapperDownloader.java"
+
+      WRAPPER_UNIX_SCRIPTS    = %w(mvnw mvnwDebug).freeze
+      WRAPPER_WINDOWS_SCRIPTS = %w(mvnw.cmd mvnwDebug.cmd).freeze
+      WRAPPER_ALL_SCRIPTS     = T.let((WRAPPER_UNIX_SCRIPTS + WRAPPER_WINDOWS_SCRIPTS).freeze, T::Array[String])
+
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.include?("pom.xml")
@@ -31,10 +42,13 @@ module Dependabot
       def fetch_files
         fetched_files = []
         fetched_files << pom
-        fetched_files += child_poms
+        poms = child_poms
+        fetched_files += poms
         fetched_files += relative_path_parents(fetched_files)
         fetched_files += targetfiles
         fetched_files << extensions if extensions
+        # Pass already-fetched poms so all_wrapper_files does not re-fetch them.
+        fetched_files += all_wrapper_files([T.must(pom)] + poms)
 
         # Filter excluded files from final collection
         filtered_files = fetched_files.uniq.reject do |file|
@@ -46,6 +60,63 @@ module Dependabot
 
       private
 
+      sig { params(dir: String).returns(T::Array[DependencyFile]) }
+      def wrapper_files_for_dir(dir)
+        return [] unless Dependabot::Experiments.enabled?(:maven_wrapper_updater)
+
+        # Strip leading "./" from root-level paths
+        properties_path = File.join(dir, WRAPPER_PROPERTIES_RELATIVE).delete_prefix("./")
+        properties = fetch_file_if_present(properties_path)
+        return [] unless properties
+
+        files = T.let([properties], T::Array[DependencyFile])
+        WRAPPER_ALL_SCRIPTS.each do |script|
+          script_path = dir == "." ? script : File.join(dir, script)
+          f = fetch_file_if_present(script_path)
+          f.mode = DependencyFile::Mode::EXECUTABLE if f && WRAPPER_UNIX_SCRIPTS.include?(script)
+          files << f if f
+        end
+
+        content = T.must(properties.content)
+        wrapper_url = FileParser::WrapperMojo.get_property_value(content, "wrapperUrl")
+        dist_type = FileParser::WrapperMojo.resolve_distribution_type(content, wrapper_url)
+        files + fetch_wrapper_artifact_files(dir, dist_type)
+      rescue Dependabot::DependencyFileNotFound
+        []
+      end
+
+      sig { params(dir: String, dist_type: String).returns(T::Array[DependencyFile]) }
+      def fetch_wrapper_artifact_files(dir, dist_type)
+        case dist_type
+        when "bin", "script"
+          jar_path = File.join(dir, WRAPPER_JAR_RELATIVE).delete_prefix("./")
+          jar = fetch_file_if_present(jar_path)
+          return [] unless jar
+
+          jar.content = Base64.encode64(T.must(jar.content)) if jar.content
+          jar.content_encoding = DependencyFile::ContentEncoding::BASE64
+          [jar]
+        when "source"
+          dl_path = File.join(dir, WRAPPER_DOWNLOADER_RELATIVE).delete_prefix("./")
+          downloader = fetch_file_if_present(dl_path)
+          downloader ? [downloader] : []
+        else
+          []
+        end
+      end
+
+      sig { params(poms: T::Array[DependencyFile]).returns(T::Array[DependencyFile]) }
+      def all_wrapper_files(poms)
+        seen_dirs = T.let(Set.new, T::Set[String])
+        poms.filter_map do |pom_file|
+          dir = File.dirname(pom_file.name)
+          next if seen_dirs.include?(dir)
+
+          seen_dirs << dir
+          wrapper_files_for_dir(dir)
+        end.flatten
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def pom
         @pom ||= T.let(fetch_file_from_host("pom.xml"), T.nilable(Dependabot::DependencyFile))

data/lib/dependabot/maven/file_parser/wrapper_mojo.rb

@@ -0,0 +1,407 @@
+# typed: strong
+# frozen_string_literal: true
+
+# Parses maven-wrapper.properties and emits Dependency objects for the two
+# tracked Maven coordinates: org.apache.maven:apache-maven (the maven distribution)
+# and org.apache.maven.wrapper:maven-wrapper (the wrapper plugin).
+require "dependabot/dependency_requirement"
+require "dependabot/maven/file_parser"
+require "dependabot/maven/distributions"
+
+module Dependabot
+  module Maven
+    class FileParser
+      # Model of the Maven Wrapper plugin's WrapperMojo goal. Mirrors the
+      # properties recognized by the upstream plugin:
+      # https://github.com/apache/maven-wrapper/blob/master/maven-wrapper-plugin/src/main/java/org/apache/maven/plugins/wrapper/WrapperMojo.java
+      class WrapperMojo
+        extend T::Sig
+
+        class WrapperProperties < T::Struct
+          # Resolved distributionUrl value (the raw value from the properties file).
+          # This value is mandatory
+          const :distribution_url, String
+          # The Maven Version extracted from the distributionUrl, e.g. "3.9.9"
+          const :distribution_version, String
+
+          # Value of distributionSha256Sum, or nil when the property is absent.
+          # Checksum verification is not mandatory
+          # Tracked as a second requirement on the Apache Maven dependency so the
+          # checksum is updated atomically with the version.
+          const :distribution_sha256_sum, T.nilable(String)
+
+          # Value of wrapperSha256Sum, or nil when the property is absent.
+          # Used to verify the wrapper JAR download
+          const :wrapper_sha256_sum, T.nilable(String)
+
+          # Version of the Maven Wrapper plugin, e.g. "3.3.4".
+          # Sourced from the first strategy that succeeds:
+          #  - wrapperVersion property (>=3.3.1),
+          #  - version segment of wrapperUrl JAR filename (<3.3.0), or
+          #  - comment in the mvnw script body (3.3.0 only, see MWRAPPER-120 and MWRAPPER-134).
+          # This field is mandatory and raises if none of the sources yield a version.
+          const :wrapper_version, String
+
+          # The full JAR URL from the wrapperUrl property
+          # (e.g. "https://.../maven-wrapper-3.3.3.jar"), used to compute the
+          # new download URL for wrapperSha256Sum recomputation.
+          # Present in both old-format (wrapperUrl only) and new-format (wrapperVersion + wrapperUrl) files.
+          # nil only when the version was read from the mvnw script body (very old wrappers).
+          const :wrapper_url, T.nilable(String)
+
+          # Value of distributionType, controlling which binary artifacts are committed
+          # alongside the wrapper scripts:
+          #  - "bin" (JAR present),
+          #  - "script" (JAR present),
+          #  - "only-script" (no JAR),
+          #  - "source" (MavenWrapperDownloader.java present).
+          # Defaults to "bin" when the property is absent, matching pre-3.3.0 behavior.
+          const :distribution_type, String
+        end
+
+        # Extracts the version from a distributionUrl value (the resolved URL,
+        # not the raw properties line). Match the standard artifact filename so
+        # custom mirrors do not need to preserve Maven Central's directory layout.
+        DIST_URL_VERSION_REGEX = %r{
+          /apache-maven-(?<version>[^/?#]+)-(?:bin|src)\.(?:zip|tar\.gz)(?:[?#].*)?\z
+        }x
+        class UnparseableDistributionUrl < RuntimeError; end
+
+        sig do
+          params(
+            properties_file: DependencyFile,
+            script_files: T::Array[DependencyFile]
+          ).returns(T::Array[Dependency])
+        end
+        def self.resolve_dependencies(properties_file, script_files: [])
+          content = properties_file.content
+          return [] unless content
+
+          distribution_url = get_property_value(content, "distributionUrl")
+          if distribution_url&.include?("mvnd")
+            Dependabot.logger.warn("Maven daemon (mvnd) distribution is not supported, skipping wrapper update")
+            return []
+          end
+
+          begin
+            props = load_properties(content, script_files: script_files)
+          rescue UnparseableDistributionUrl => e
+            Dependabot.logger.warn("#{e.message}, skipping wrapper update")
+            return []
+          end
+
+          if props.wrapper_url&.include?("takari")
+            Dependabot.logger.warn("The Takari distribution is not supported, skipping wrapper update")
+            return []
+          end
+
+          file_name = properties_file.name
+          has_debug_scripts = debug_scripts?(script_files)
+          deps = [build_distribution_dependency(file_name, props, props.distribution_version, has_debug_scripts)]
+          deps << build_wrapper_dependency(
+            file_name, props, props.distribution_version, props.wrapper_version, has_debug_scripts
+          )
+          deps.compact
+        end
+
+        sig do
+          params(
+            file_name: String,
+            props: WrapperProperties,
+            dist_version: String,
+            has_debug_scripts: T::Boolean
+          ).returns(Dependency)
+        end
+        def self.build_distribution_dependency(file_name, props, dist_version, has_debug_scripts)
+          Dependency.new(
+            name: Distributions::MAVEN_DISTRIBUTION_PACKAGE,
+            version: dist_version,
+            requirements: build_distribution_requirements(file_name, props, dist_version, has_debug_scripts),
+            package_manager: "maven"
+          )
+        end
+
+        sig do
+          params(
+            file_name: String,
+            props: WrapperProperties,
+            dist_version: String,
+            has_debug_scripts: T::Boolean
+          ).returns(T::Array[Dependabot::DependencyRequirement])
+        end
+        def self.build_distribution_requirements(file_name, props, dist_version, has_debug_scripts)
+          metadata = T.let(
+            {
+              packaging_type: "pom",
+              wrapper_version: props.wrapper_version,
+              distribution_type: props.distribution_type,
+              distribution_version: dist_version,
+              include_debug_script: has_debug_scripts
+            },
+            Dependabot::DependencyRequirement::ObjectHash
+          )
+          metadata[:distribution_sha256_sum] = props.distribution_sha256_sum if props.distribution_sha256_sum
+
+          main_req = Dependabot::DependencyRequirement.create(
+            {
+              requirement: dist_version,
+              file: file_name,
+              source: {
+                type: Distributions::DISTRIBUTION_DEPENDENCY_TYPE,
+                url: props.distribution_url,
+                property: "distributionUrl"
+              },
+              groups: [],
+              # The Apache Maven distribution is not a JAR, but a POM is available
+              # We can use this POM to query for new versions using the existing update checker for maven
+              metadata: metadata
+            }
+          )
+
+          requirements = T.let([main_req], T::Array[Dependabot::DependencyRequirement])
+          requirements.concat(build_wrapper_url_requirement(file_name, props))
+          requirements
+        end
+
+        sig do
+          params(
+            file_name: String,
+            props: WrapperProperties
+          ).returns(T::Array[Dependabot::DependencyRequirement])
+        end
+        def self.build_wrapper_url_requirement(file_name, props)
+          return [] unless props.wrapper_url
+
+          Dependabot.logger.debug "wrapperUrl is present #{props.wrapper_url} version=#{props.wrapper_version}"
+          metadata = T.let({}, Dependabot::DependencyRequirement::ObjectHash)
+          metadata[:wrapper_sha256_sum] = props.wrapper_sha256_sum if props.wrapper_sha256_sum
+
+          req = Dependabot::DependencyRequirement.create(
+            {
+              requirement: props.wrapper_version,
+              file: file_name,
+              source: {
+                type: Distributions::DISTRIBUTION_DEPENDENCY_TYPE,
+                property: "wrapperUrl",
+                url: props.wrapper_url
+              },
+              groups: []
+            }
+          )
+          req[:metadata] = metadata if metadata.any?
+          [req]
+        end
+
+        sig do
+          params(
+            file_name: String,
+            props: WrapperProperties,
+            dist_version: String,
+            wrapper_version: String,
+            has_debug_scripts: T::Boolean
+          ).returns(Dependency)
+        end
+        def self.build_wrapper_dependency(file_name, props, dist_version, wrapper_version, has_debug_scripts)
+          metadata = T.let(
+            {
+              packaging_type: "pom",
+              distribution_version: dist_version,
+              wrapper_version: wrapper_version,
+              distribution_type: props.distribution_type,
+              include_debug_script: has_debug_scripts
+            },
+            Dependabot::DependencyRequirement::ObjectHash
+          )
+          Dependency.new(
+            name: Distributions::MAVEN_WRAPPER_PACKAGE,
+            version: props.wrapper_version,
+            requirements: [
+              Dependabot::DependencyRequirement.create(
+                {
+                  requirement: props.wrapper_version,
+                  file: file_name,
+                  source: {
+                    type: Distributions::DISTRIBUTION_DEPENDENCY_TYPE,
+                    property: "wrapperVersion"
+                  },
+                  groups: [],
+                  metadata: metadata
+                }
+              )
+            ],
+            package_manager: "maven"
+          )
+        end
+
+        # Resolves the distribution type, matching the maven-wrapper-plugin's own precedence:
+        # an explicit distributionType wins; otherwise the plugin defaults to "only-script" (since
+        # 3.2.0). Legacy pre-3.3.0 files omit distributionType but carry a wrapperUrl pointing at the
+        # maven-wrapper JAR, which means a JAR-based ("bin") setup, so we keep that for them.
+        # https://maven.apache.org/tools/wrapper/maven-wrapper-plugin/wrapper-mojo.html
+        sig { params(content: String, wrapper_url: T.nilable(String)).returns(String) }
+        def self.resolve_distribution_type(content, wrapper_url)
+          explicit = get_property_value(content, "distributionType")
+          return explicit if explicit
+
+          wrapper_url ? "bin" : "only-script"
+        end
+
+        sig { params(script_files: T::Array[DependencyFile]).returns(T::Boolean) }
+        def self.debug_scripts?(script_files)
+          debug_scripts = %w(mvnwDebug mvnwDebug.cmd)
+          script_files.any? { |f| debug_scripts.any? { |s| f.name.end_with?(s) } }
+        end
+
+        sig { params(content: String, script_files: T::Array[DependencyFile]).returns(WrapperProperties) }
+        def self.load_properties(content, script_files: [])
+          distribution_url = get_property_value!(content, "distributionUrl")
+          distribution_version = extract_distribution_version(distribution_url)
+          distribution_sha256_sum = get_property_value(content, "distributionSha256Sum")
+          wrapper_url = get_property_value(content, "wrapperUrl")
+          wrapper_sha256_sum = get_property_value(content, "wrapperSha256Sum")
+          distribution_type = resolve_distribution_type(content, wrapper_url)
+          wrapper_version = resolve_wrapper_version(content, wrapper_url, script_files)
+
+          WrapperProperties.new(
+            distribution_url: distribution_url,
+            distribution_version: distribution_version,
+            distribution_sha256_sum: distribution_sha256_sum,
+            wrapper_sha256_sum: wrapper_sha256_sum,
+            wrapper_version: wrapper_version,
+            wrapper_url: wrapper_url,
+            distribution_type: distribution_type
+          )
+        end
+
+        sig { params(content: String).returns(String) }
+        def self.extract_distribution_version(content)
+          match = content.match(DIST_URL_VERSION_REGEX)
+          unless match && match[:version]
+            raise UnparseableDistributionUrl, "Could not extract Maven version from distributionUrl"
+          end
+
+          T.must(match[:version])
+        end
+
+        sig { params(content: String, target_key: String).returns(T.nilable(String)) }
+        def self.get_property_value(content, target_key)
+          # 1. Handle Java line continuations (the backslash edge case)
+          # We join lines ending in \ before splitting into an array
+          normalized_content = content.gsub(/\\\n\s*/, "")
+
+          # 2. Escape the key for Regex safety
+          escaped_key = Regexp.escape(target_key)
+
+          # Start of line -> Key -> optional space -> delimiter (= or :) -> value.
+          # Bounded to spaces/tabs (not \s) so the per-line match can't backtrack polynomially.
+          pattern = /^[ \t]*#{escaped_key}[ \t]*[=:][ \t]*(.*)$/
+
+          normalized_content.lines.each do |line|
+            next if line.start_with?("#", "!") # Skip Java comments
+
+            if (match = line.match(pattern))
+              return decode_property_value(T.must(match[1]).strip)
+            end
+          end
+          nil
+        end
+
+        # Decodes Java properties escapes so URLs are usable by URI parsing, registry matching, and
+        # HTTP clients. Maven commonly writes URL schemes as `https\://` in legacy wrapper files.
+        sig { params(value: String).returns(String) }
+        def self.decode_property_value(value)
+          value.gsub(/\\(?:u(?<unicode>[0-9a-fA-F]{4})|(?<escaped>.))/) do
+            unicode = Regexp.last_match(:unicode)
+            next [unicode.hex].pack("U") if unicode
+
+            case Regexp.last_match(:escaped)
+            when "t" then "\t"
+            when "n" then "\n"
+            when "r" then "\r"
+            when "f" then "\f"
+            else Regexp.last_match(:escaped)
+            end
+          end
+        end
+
+        sig { params(content: String, target_key: String).returns(String) }
+        def self.get_property_value!(content, target_key)
+          value = get_property_value(content, target_key)
+
+          raise "Missing mandatory property: #{target_key}" if value.nil?
+
+          value
+        end
+
+        private_class_method :build_distribution_dependency
+        private_class_method :build_wrapper_dependency
+        private_class_method :build_distribution_requirements
+        private_class_method :build_wrapper_url_requirement
+        private_class_method :decode_property_value
+
+        # Matches the human-readable banner embedded in mvnw / mvnw.cmd, e.g.:
+        #   "Apache Maven Wrapper startup script, version 3.3.2"
+        #   "Apache Maven Wrapper startup batch script, version 3.3.2"
+        SCRIPT_VERSION_REGEX = /
+          Apache \s Maven \s Wrapper \s startup \s (?:batch \s)?
+          script, \s version \s
+          (?<version>\d+\.\d+(?:\.\d+)?)
+        /x
+
+        sig do
+          params(
+            content: String,
+            wrapper_url: T.nilable(String),
+            script_files: T::Array[DependencyFile]
+          ).returns(String)
+        end
+        def self.resolve_wrapper_version(content, wrapper_url, script_files)
+          version = get_property_value(content, "wrapperVersion")
+          return version if version
+
+          version = parse_version_from_wrapper_url(wrapper_url) if wrapper_url
+          return version if version
+
+          if script_files.any?
+            Dependabot.logger.warn "Maven Wrapper with no wrapperVersion or wrapperUrl in properties file"
+            version = load_wrapper_version_from_scripts(script_files)
+          end
+
+          if version.nil?
+            raise "Could not determine Maven Wrapper version from wrapperVersion, wrapperUrl, or script files"
+          end
+
+          version
+        end
+
+        sig { params(url: String).returns(T.nilable(String)) }
+        def self.parse_version_from_wrapper_url(url)
+          match = url.match(/-(?<version>\d+\.\d+(?:\.\d+)?(?:-\w+)*)(?:-bin)?\.jar/)
+          match&.[](:version)
+        end
+
+        # Extracts the Maven Wrapper version declared in the mvnw / mvnw.cmd
+        # shell scripts. Unix scripts (mvnw) are checked before Windows scripts (mvnw.cmd)
+        # if neither contains the banner, nil is returned and the caller falls back to other sources.
+        sig { params(script_files: T::Array[DependencyFile]).returns(T.nilable(String)) }
+        def self.load_wrapper_version_from_scripts(script_files)
+          # Preferred order: Unix script first, Windows script as fallback.
+          windows_scripts, unix_scripts = script_files.partition { |f| f.name.end_with?(".cmd") }
+          unix_scripts.chain(windows_scripts).each do |file|
+            next unless file.content
+
+            T.must(file.content).each_line do |line|
+              m = line.match(SCRIPT_VERSION_REGEX)
+              return m[:version] if m
+            end
+          end
+          nil
+        end
+
+        private_class_method :resolve_wrapper_version
+        private_class_method :parse_version_from_wrapper_url
+        private_class_method :load_wrapper_version_from_scripts
+      end
+    end
+  end
+end