dependabot-nix 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09f3dd2c398997b22338a69338bdd464270f86f03a2e7656f4ddb342a79a813d'
-  data.tar.gz: d768ac393fc688222704845e790a73c69fcb030b50e31543719a24546fafbaf7
+  metadata.gz: 30993355e24373bb5b160eee7028eee8357d502fd1e8843feb0a5d51b9510066
+  data.tar.gz: 373aa7fc524757879a45305546cfe4385dc6f8c0bfa365036318a7f9f3101a73
 SHA512:
-  metadata.gz: 18250664fddb5c46b30a64c6881632cdce5be47017a0ef03ae3b0531f8b24392917b54e94b5cc03699ce057910da2202a0648ef8b10c635070cc3b822ff46bbe
-  data.tar.gz: 59099630207f6355731b75ff3e15154d3708d4b6bb5163dc88e1093364d1fce992370b79b88663956c79339f85e418cccabea808c8f080adbd959ed277406d6d
+  metadata.gz: 7d7de3c9cc3b6c0bf5a5fea4f3cdcc5ef73aeb80d68baa4da6866cd62e4abde74a400a0a9599338d8569bfe7baf9038bb883bfb5c1a3714b098aa4b9985375e0
+  data.tar.gz: 8029256ca587c7d66216d1d902b8155c70b1df3384585d52aef6d7637a509d490d1554edb38920da273ce682c8d6cd9e567ca91908bb6d6b114e2fa75a05dfaf

data/lib/dependabot/nix/file_parser.rb

@@ -1,7 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "json"
 require "sorbet-runtime"
 
 require "dependabot/dependency"
@@ -9,6 +8,7 @@ require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
 require "dependabot/nix/channel"
+require "dependabot/nix/lockfile"
 require "dependabot/nix/package_manager"
 
 module Dependabot
@@ -32,22 +32,17 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
-        lock_content = JSON.parse(T.must(flake_lock.content))
+        lockfile = Lockfile.new(T.must(flake_lock.content))
 
-        lock_version = lock_content["version"]
+        lock_version = lockfile.version
         if lock_version != SUPPORTED_LOCK_VERSION
           Dependabot.logger.warn(
             "flake.lock version #{lock_version.inspect} differs from expected #{SUPPORTED_LOCK_VERSION}"
           )
         end
 
-        root_name = lock_content.fetch("root", "root")
-        nodes = lock_content.fetch("nodes", {})
-        root_node = nodes.fetch(root_name, {})
-        root_inputs = root_node.fetch("inputs", {})
-
-        root_inputs.filter_map do |input_name, node_label|
-          node = resolve_node(node_label, nodes)
+        lockfile.root_input_names.filter_map do |input_name|
+          node = lockfile.input_node(input_name)
           next unless node
 
           build_dependency(input_name, node)
@@ -67,60 +62,6 @@ module Dependabot
 
       private
 
-      # Resolves a node_label to its node in the lock file.
-      # node_label is either a string (direct reference) or an array ("follows" path
-      # that must be walked through nested inputs maps).
-      sig do
-        params(
-          node_label: T.any(String, T::Array[String]),
-          nodes: T::Hash[String, T.untyped]
-        ).returns(T.nilable(T::Hash[String, T.untyped]))
-      end
-      def resolve_node(node_label, nodes)
-        return nodes[node_label] unless node_label.is_a?(Array)
-        return nil if node_label.empty?
-
-        # Walk the "follows" path: e.g. ["nixpkgs", "flake-utils"] means
-        # follow root -> nixpkgs node -> its inputs -> flake-utils
-        resolved_label = resolve_follows_path(node_label, nodes)
-        resolved_label ? nodes[resolved_label] : nil
-      end
-
-      # Walks a "follows" path through nested inputs to find the final node label.
-      sig do
-        params(
-          path: T::Array[String],
-          nodes: T::Hash[String, T.untyped]
-        ).returns(T.nilable(String))
-      end
-      def resolve_follows_path(path, nodes)
-        current_node_label = T.let(nil, T.nilable(String))
-
-        path.each_with_index do |segment, index|
-          # For the first segment, look up in the root's inputs via nodes directly
-          target = if index.zero?
-                     # The first segment references a top-level node by name
-                     segment
-                   else
-                     # Subsequent segments look up inputs within the current node
-                     node = nodes[T.must(current_node_label)]
-                     return nil unless node.is_a?(Hash)
-
-                     inputs = node.fetch("inputs", nil)
-                     return nil unless inputs.is_a?(Hash)
-
-                     label = inputs[segment]
-                     return nil unless label.is_a?(String)
-
-                     label
-                   end
-
-          current_node_label = target
-        end
-
-        current_node_label
-      end
-
       sig do
         params(
           input_name: String,
@@ -218,7 +159,7 @@ module Dependabot
           "https://#{host}/#{locked['owner']}/#{locked['repo']}"
         when "sourcehut"
           host = locked["host"] || DEFAULT_HOSTS["sourcehut"]
-          "https://#{host}/~#{locked['owner']}/#{locked['repo']}"
+          "https://#{host}/#{locked['owner']}/#{locked['repo']}"
         when "git"
           locked["url"]
         end

data/lib/dependabot/nix/file_updater/flake_ref_builder.rb

@@ -0,0 +1,132 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "uri"
+require "sorbet-runtime"
+
+require "dependabot/nix/file_updater"
+
+module Dependabot
+  module Nix
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class FlakeRefBuilder
+        extend T::Sig
+
+        ARCHIVE_TYPES = %w(github gitlab sourcehut).freeze
+        ARCHIVE_PATH_KEYS = %w(type owner repo ref rev).freeze
+        GIT_URL_KEYS = %w(type url rev).freeze
+        LOCKED_ONLY_KEYS = %w(lastModified narHash revCount).freeze
+        SCP_STYLE_URL = /\A(?<user>[^@]+)@(?<host>[^:]+):(?<path>.+)\z/
+
+        sig { params(source: T::Hash[String, Object], revision: String).void }
+        def initialize(source:, revision:)
+          @source = source
+          @revision = revision
+        end
+
+        sig { returns(String) }
+        def to_s
+          source_type = required_string("type")
+
+          if ARCHIVE_TYPES.include?(source_type)
+            archive_reference(source_type)
+          elsif source_type == "git"
+            git_reference
+          else
+            raise ArgumentError, "Nix flake source type #{source_type.inspect} is not supported"
+          end
+        end
+
+        private
+
+        sig { returns(T::Hash[String, Object]) }
+        attr_reader :source
+
+        sig { returns(String) }
+        attr_reader :revision
+
+        sig { params(source_type: String).returns(String) }
+        def archive_reference(source_type)
+          owner = encode_path_segment(required_string("owner"))
+          repo = encode_path_segment(required_string("repo"))
+          base = "#{source_type}:#{owner}/#{repo}/#{encode_path_segment(revision)}"
+
+          append_query(base, query_attributes(excluding: ARCHIVE_PATH_KEYS))
+        end
+
+        sig { returns(String) }
+        def git_reference
+          uri = URI.parse(normalized_git_url(required_string("url")))
+          query = URI.decode_www_form(uri.query || "").to_h
+          query.merge!(query_attributes(excluding: GIT_URL_KEYS))
+          query["rev"] = revision
+          uri.query = encoded_query(query)
+          uri.to_s
+        end
+
+        sig { params(url: String).returns(String) }
+        def normalized_git_url(url)
+          return url if url.match?(/\Agit(?:\+[^:]+)?:/)
+
+          if (match = SCP_STYLE_URL.match(url))
+            return "git+ssh://#{match[:user]}@#{match[:host]}/#{match[:path]}"
+          end
+
+          uri = URI.parse(url)
+          raise ArgumentError, "git source URL #{url.inspect} must include a scheme" unless uri.scheme
+
+          "git+#{url}"
+        end
+
+        sig { params(excluding: T::Array[String]).returns(T::Hash[String, String]) }
+        def query_attributes(excluding:)
+          attributes = T.let({}, T::Hash[String, String])
+          source.each do |key, value|
+            next if excluding.include?(key) || LOCKED_ONLY_KEYS.include?(key) || value.nil?
+
+            attributes[key] = query_value(value)
+          end
+          attributes
+        end
+
+        sig { params(base: String, query: T::Hash[String, String]).returns(String) }
+        def append_query(base, query)
+          return base if query.empty?
+
+          "#{base}?#{encoded_query(query)}"
+        end
+
+        sig { params(query: T::Hash[String, String]).returns(String) }
+        def encoded_query(query)
+          URI.encode_www_form(query.sort)
+        end
+
+        sig { params(value: Object).returns(String) }
+        def query_value(value)
+          case value
+          when true then "1"
+          when false then "0"
+          when String, Integer then value.to_s
+          else
+            raise ArgumentError, "Nix flake source attribute value #{value.inspect} is not supported"
+          end
+        end
+
+        sig { params(value: String).returns(String) }
+        def encode_path_segment(value)
+          URI.encode_www_form_component(value)
+             .gsub("+", "%20")
+             .gsub("%7E", "~")
+        end
+
+        sig { params(key: String).returns(String) }
+        def required_string(key)
+          value = source[key]
+          return value if value.is_a?(String) && !value.empty?
+
+          raise ArgumentError, "Nix flake source is missing attribute #{key.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/nix/file_updater.rb

@@ -1,6 +1,7 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "json"
 require "sorbet-runtime"
 
 require "dependabot/errors"
@@ -8,12 +9,15 @@ require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
 require "dependabot/nix/flake_nix_parser"
+require "dependabot/nix/lockfile"
 
 module Dependabot
   module Nix
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      require_relative "file_updater/flake_ref_builder"
+
       # Nix's CLI restricts flake input attribute path elements to this regex.
       # see `flakeIdRegex` in nix/src/libflake/include/nix/flake/flakeref.hh
       FLAKE_ID_REGEX = /\A[a-zA-Z][a-zA-Z0-9_-]*\z/
@@ -26,6 +30,7 @@ module Dependabot
         updated_files << updated_file(file: flake_nix, content: updated_flake_nix_content) if updated_flake_nix_content
 
         updated_lockfile_content = update_flake_lock(updated_flake_nix_content)
+        validate_updated_revision(updated_lockfile_content)
 
         if updated_lockfile_content == flake_lock.content
           raise Dependabot::DependencyFileContentNotChanged,
@@ -53,18 +58,17 @@ module Dependabot
         return unless old_ref
         return if old_ref == new_ref
 
-        FlakeNixParser.update_input_ref(T.must(flake_nix.content), dependency.name, new_ref)
+        updated_content = FlakeNixParser.update_input_ref(T.must(flake_nix.content), dependency.name, new_ref)
+        return updated_content if updated_content
+
+        raise Dependabot::DependencyFileNotResolvable,
+              "Cannot update the ref for flake input '#{dependency.name}' in flake.nix"
       end
 
       sig { params(updated_nix_content: T.nilable(String)).returns(String) }
       def update_flake_lock(updated_nix_content)
-        unless dependency.name.match?(FLAKE_ID_REGEX)
-          raise Dependabot::DependencyFileNotResolvable,
-                "Cannot update flake input '#{dependency.name}': Nix requires input names to start " \
-                "with a letter and contain only letters, digits, underscores, or hyphens " \
-                "(pattern: [a-zA-Z][a-zA-Z0-9_-]*). " \
-                "Rename the input in flake.nix to update it via Dependabot."
-        end
+        lockfile = Lockfile.new(T.must(flake_lock.content))
+        input_path = validated_input_path(lockfile)
 
         SharedHelpers.in_a_temporary_repo_directory(
           flake_lock.directory,
@@ -74,14 +78,105 @@ module Dependabot
           File.write("flake.lock", T.must(flake_lock.content))
 
           SharedHelpers.run_shell_command(
-            "nix flake update #{dependency.name}",
-            fingerprint: "nix flake update <input_name>"
+            update_command(lockfile, input_path),
+            fingerprint: command_fingerprint
           )
 
           File.read("flake.lock")
         end
       end
 
+      sig { params(lockfile: Lockfile, input_path: String).returns(SharedHelpers::Command) }
+      def update_command(lockfile, input_path)
+        if git_dependency?
+          source = updated_git_source(lockfile)
+          revision = dependency.version
+          unless source && revision
+            raise Dependabot::DependencyFileNotResolvable,
+                  "Cannot update flake input '#{dependency.name}' because its source metadata " \
+                  "or target revision is missing"
+          end
+
+          exact_ref = build_exact_flake_ref(source, revision)
+          # `nix flake lock` writes the override but keeps the input's original branch or tag.
+          ["nix", "flake", "lock", "--override-input", input_path, exact_ref]
+        elsif tarball_dependency?
+          ["nix", "flake", "update", input_path]
+        else
+          raise Dependabot::DependencyFileNotResolvable,
+                "Cannot update flake input '#{dependency.name}' because its dependency source type is not supported"
+        end
+      end
+
+      sig { params(lockfile: Lockfile).returns(T.nilable(T::Hash[String, Object])) }
+      def updated_git_source(lockfile)
+        original_source = lockfile.original_source(dependency.name)
+        return unless original_source
+
+        source = if original_source["type"] == "indirect"
+                   lockfile.locked_source(dependency.name)
+                 else
+                   original_source
+                 end
+        return unless source
+
+        ref = new_source_ref
+        ref ? source.merge("ref" => ref) : source
+      end
+
+      sig { returns(String) }
+      def command_fingerprint
+        if git_dependency?
+          "nix flake lock --override-input <input_path> <flake_ref>"
+        else
+          "nix flake update <input_name>"
+        end
+      end
+
+      sig { params(source: T::Hash[String, Object], revision: String).returns(String) }
+      def build_exact_flake_ref(source, revision)
+        FlakeRefBuilder.new(source: source, revision: revision).to_s
+      rescue ArgumentError, URI::InvalidURIError => e
+        raise Dependabot::DependencyFileNotResolvable,
+              "Cannot update flake input '#{dependency.name}': #{e.message}"
+      end
+
+      sig { params(lockfile: Lockfile).returns(String) }
+      def validated_input_path(lockfile)
+        path = lockfile.input_path(dependency.name)
+        unless path&.all? { |segment| segment.match?(FLAKE_ID_REGEX) }
+          raise Dependabot::DependencyFileNotResolvable,
+                "Cannot update flake input '#{dependency.name}': each Nix input path segment must match " \
+                "[a-zA-Z][a-zA-Z0-9_-]*"
+        end
+
+        path.join("/")
+      end
+
+      sig { params(content: String).void }
+      def validate_updated_revision(content)
+        expected_revision = dependency.version
+        actual_revision = Lockfile.new(content).locked_revision(dependency.name)
+        return if expected_revision && actual_revision == expected_revision
+
+        raise Dependabot::DependencyFileNotResolvable,
+              "Expected flake input '#{dependency.name}' to lock revision " \
+              "#{expected_revision.inspect}, but Nix generated #{actual_revision.inspect}"
+      rescue JSON::ParserError => e
+        raise Dependabot::DependencyFileNotResolvable,
+              "Nix generated an invalid flake.lock for '#{dependency.name}': #{e.message}"
+      end
+
+      sig { returns(T::Boolean) }
+      def git_dependency?
+        dependency.requirements.first&.source_string("type") == "git"
+      end
+
+      sig { returns(T::Boolean) }
+      def tarball_dependency?
+        dependency.requirements.first&.source_string("type") == "tarball"
+      end
+
       sig { returns(T.nilable(String)) }
       def new_source_ref
         dependency.requirements.first&.source_string("ref")

data/lib/dependabot/nix/flake_nix_parser.rb

@@ -1,16 +1,14 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "uri"
 require "sorbet-runtime"
 
 require "dependabot/nix/channel"
 
 module Dependabot
   module Nix
-    # Parses flake.nix content to locate input URL declarations and extract
-    # their components (scheme, owner, repo, ref). Only handles the shorthand
-    # URL schemes (github:, gitlab:, sourcehut:) since those are the ones
-    # where the ref appears inline in the URL string.
+    # Parses flake.nix input URL declarations and updates their refs.
     class FlakeNixParser
       extend T::Sig
 
@@ -33,6 +31,9 @@ module Dependabot
       }x
       private_constant :INDIRECT_URL_PATTERN
 
+      GENERIC_GIT_SCHEME = /\Agit(?:\+[a-zA-Z][a-zA-Z0-9+.-]*)?\z/
+      private_constant :GENERIC_GIT_SCHEME
+
       # Matches an input URL assignment tied to a specific input name.
       # Covers the common syntactic forms:
       #   inputs.NAME.url = "URL";
@@ -66,9 +67,31 @@ module Dependabot
 
         build_shorthand_input(url_str, match) ||
           build_tarball_input(url_str, match) ||
+          build_git_input(url_str, match) ||
           build_indirect_input(url_str, match)
       end
 
+      sig { params(url_str: String, match: T::Hash[Symbol, T.untyped]).returns(T.nilable(InputUrl)) }
+      def build_git_input(url_str, match)
+        uri = URI.parse(url_str)
+        return unless uri.scheme&.match?(GENERIC_GIT_SCHEME)
+
+        ref = URI.decode_www_form(uri.query || "").find { |key, _value| key == "ref" }&.last
+
+        InputUrl.new(
+          full_url: url_str,
+          scheme: "git",
+          owner: "",
+          repo: "",
+          ref: ref,
+          query: uri.query,
+          match_start: match[:url_start],
+          match_end: match[:url_end]
+        )
+      rescue URI::InvalidURIError
+        nil
+      end
+
       sig { params(new_ref: String).returns(T.nilable(String)) }
       def update_ref(new_ref)
         input_url = find
@@ -216,12 +239,23 @@ module Dependabot
         when "tarball"
           old_channel = T.must(input_url.ref)
           input_url.full_url.sub("/#{old_channel}/", "/#{new_ref}/")
+        when "git"
+          update_git_ref(input_url.full_url, new_ref)
         else
           base = "#{input_url.scheme}:#{input_url.owner}/#{input_url.repo}/#{new_ref}"
           input_url.query ? "#{base}?#{input_url.query}" : base
         end
       end
 
+      sig { params(url: String, new_ref: String).returns(String) }
+      def update_git_ref(url, new_ref)
+        uri = URI.parse(url)
+        query = URI.decode_www_form(uri.query || "")
+        query.each { |parameter| parameter[1] = new_ref if parameter.first == "ref" }
+        uri.query = URI.encode_www_form(query)
+        uri.to_s
+      end
+
       # Represents a parsed flake input URL from flake.nix
       class InputUrl < T::Struct
         const :full_url, String

data/lib/dependabot/nix/lockfile.rb

@@ -0,0 +1,134 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+module Dependabot
+  module Nix
+    class Lockfile
+      extend T::Sig
+
+      Node = T.type_alias { T::Hash[String, Object] }
+
+      sig { params(content: String).void }
+      def initialize(content)
+        @data = T.let(T.cast(JSON.parse(content), Node), Node)
+      end
+
+      sig { returns(T.nilable(Integer)) }
+      def version
+        value = @data["version"]
+        value if value.is_a?(Integer)
+      end
+
+      sig { returns(T::Array[String]) }
+      def root_input_names
+        root_inputs.keys
+      end
+
+      sig { params(input_name: String).returns(T.nilable(T::Array[String])) }
+      def input_path(input_name)
+        reference = root_inputs[input_name]
+        return [input_name] if reference.is_a?(String)
+        return unless string_array?(reference)
+
+        T.cast(reference, T::Array[String])
+      end
+
+      sig { params(input_name: String).returns(T.nilable(Node)) }
+      def input_node(input_name)
+        label = resolve_reference(root_inputs[input_name], T.let(Set.new, T::Set[String]))
+        return unless label
+
+        node = nodes[label]
+        node if node.is_a?(Hash)
+      end
+
+      sig { params(input_name: String).returns(T.nilable(Node)) }
+      def original_source(input_name)
+        original = input_node(input_name)&.fetch("original", nil)
+        original if original.is_a?(Hash)
+      end
+
+      sig { params(input_name: String).returns(T.nilable(Node)) }
+      def locked_source(input_name)
+        locked = input_node(input_name)&.fetch("locked", nil)
+        locked if locked.is_a?(Hash)
+      end
+
+      sig { params(input_name: String).returns(T.nilable(String)) }
+      def locked_revision(input_name)
+        locked = locked_source(input_name)
+        return unless locked
+
+        revision = locked["rev"]
+        revision if revision.is_a?(String)
+      end
+
+      private
+
+      sig { returns(Node) }
+      def nodes
+        value = @data["nodes"]
+        value.is_a?(Hash) ? value : {}
+      end
+
+      sig { returns(Node) }
+      def root_inputs
+        root_name = @data["root"]
+        root_name = "root" unless root_name.is_a?(String)
+
+        root_node = nodes[root_name]
+        return {} unless root_node.is_a?(Hash)
+
+        inputs = root_node["inputs"]
+        inputs.is_a?(Hash) ? inputs : {}
+      end
+
+      sig { params(reference: Object, visited_paths: T::Set[String]).returns(T.nilable(String)) }
+      def resolve_reference(reference, visited_paths)
+        return reference if reference.is_a?(String)
+        return unless string_array?(reference)
+
+        path = T.cast(reference, T::Array[String])
+        path_key = path.join("\0")
+        return if visited_paths.include?(path_key)
+
+        visited_paths.add(path_key)
+        resolve_path(path, visited_paths)
+      end
+
+      sig { params(path: T::Array[String], visited_paths: T::Set[String]).returns(T.nilable(String)) }
+      def resolve_path(path, visited_paths)
+        first_segment = path.first
+        return unless first_segment
+
+        reference = T.let(root_inputs[first_segment], Object)
+
+        index = T.let(1, Integer)
+        while index < path.length
+          segment = path.fetch(index)
+          label = resolve_reference(reference, visited_paths)
+          return unless label
+
+          node = nodes[label]
+          return unless node.is_a?(Hash)
+
+          inputs = node["inputs"]
+          return unless inputs.is_a?(Hash)
+
+          reference = T.let(inputs[segment], Object)
+          index += 1
+        end
+
+        resolve_reference(reference, visited_paths)
+      end
+
+      sig { params(value: Object).returns(T::Boolean) }
+      def string_array?(value)
+        value.is_a?(Array) && !value.empty? && value.all?(String)
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nix
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -246,8 +246,10 @@ files:
 - lib/dependabot/nix/file_fetcher.rb
 - lib/dependabot/nix/file_parser.rb
 - lib/dependabot/nix/file_updater.rb
+- lib/dependabot/nix/file_updater/flake_ref_builder.rb
 - lib/dependabot/nix/flake_nix_parser.rb
 - lib/dependabot/nix/ignore_filter.rb
+- lib/dependabot/nix/lockfile.rb
 - lib/dependabot/nix/metadata_finder.rb
 - lib/dependabot/nix/package/package_details_fetcher.rb
 - lib/dependabot/nix/package_manager.rb
@@ -263,7 +265,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib