dependabot-nuget 0.144.0 → 0.145.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a731ee180bd0babe744617aa48644496bcfc970079816896a62488bac0f2faa
-  data.tar.gz: 382b5dd9ff837756128801e483e1d0b52b56835fc14c6ad0a77a1f83de428b14
+  metadata.gz: 509b4e32324a90de3f53a92b18a10ba69ee289832b2c5e055a64509e7ba44692
+  data.tar.gz: caaeb4becac7f1704441184b30103d4715b5cc33e3f3be44c9d2b21c5a4c0592
 SHA512:
-  metadata.gz: 48d2dee3f5259e8e30cb1260c1aa36062317be5a0e6618782263bb7ef651c59a203b05cc2b6c6656eac7ff021270fc6b928496e03ae87c4d19f31e2824b7df40
-  data.tar.gz: '078102f4f979baecbff1005e423711c8e0bdd8a69ea19470f70115e6b71ea1bf0c3d97ec68630836228f866b0dc9ba4afcb258175499062ae35b7e3c7d7cd173'
+  metadata.gz: f8f6b6914a5ecd15bdddbcb1f1912e63b96a9bcb87a094e25243e5ab53090d87a37200f3675c3d91d83a86c56f7270352eeb64f998d041b0618bbedbdecdad2e
+  data.tar.gz: 7ff33ae737369fdb3d282e0e902ff468ef2e63980d7d696aac231cbc4245db4a8cd77647593b2c5d7e92139f959a3c51d3c54d4ce69252abbec881f9df204744

data/lib/dependabot/nuget/update_checker/version_finder.rb

@@ -210,14 +210,8 @@ module Dependabot
           @v2_nuget_listings ||=
             dependency_urls.
             select { |details| details.fetch(:repository_type) == "v2" }.
-            map do |url_details|
-              response = Excon.get(
-                url_details[:versions_url],
-                idempotent: true,
-                **SharedHelpers.excon_defaults(
-                  excon_options.merge(headers: url_details[:auth_header])
-                )
-              )
+            flat_map { |url_details| fetch_paginated_v2_nuget_listings(url_details) }.
+            map do |url_details, response|
               next unless response.status == 200
 
               {
@@ -227,6 +221,39 @@ module Dependabot
             end.compact
         end
 
+        def fetch_paginated_v2_nuget_listings(url_details, results = {})
+          response = Excon.get(
+            url_details[:versions_url],
+            idempotent: true,
+            **SharedHelpers.excon_defaults(excon_options.merge(headers: url_details[:auth_header]))
+          )
+
+          # NOTE: Short circuit if we get a circular next link
+          return results.to_a if results.key?(url_details)
+
+          results[url_details] = response
+
+          if (link_href = fetch_v2_next_link_href(response.body))
+            url_details = url_details.dup
+            url_details[:versions_url] = link_href
+            fetch_paginated_v2_nuget_listings(url_details, results)
+          end
+
+          results.to_a
+        end
+
+        def fetch_v2_next_link_href(xml_body)
+          doc = Nokogiri::XML(xml_body)
+          doc.remove_namespaces!
+          link_node = doc.xpath("/feed/link").find do |node|
+            rel = node.attribute("rel").value.strip
+            rel == "next"
+          end
+          link_node.attribute("href").value.strip if link_node
+        rescue Nokogiri::XML::XPath::SyntaxError
+          nil
+        end
+
         def versions_for_v3_repository(repository_details)
           # If we have a search URL that returns results we use it
           # (since it will exclude unlisted versions)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.144.0
+  version: 0.145.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-05 00:00:00.000000000 Z
+date: 2021-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.144.0
+        version: 0.145.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.144.0
+        version: 0.145.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: 1.14.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.13.0
+        version: 1.14.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement