dependabot-nuget 0.154.3 → 0.156.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea02518caac5d69c55e2177c4bf16db5f4b851bab6d8627cb0d1f3c9d3abf170
-  data.tar.gz: 42bf343e932846e8595ede421750ec211a92112b3210f14bfbfa581c922c7b1f
+  metadata.gz: f317e36154b80c5549df7780b1176bf4ee9aafe602916897a9d122956ffe2bbf
+  data.tar.gz: 862841144e0af01c3854cf8724f482bc7d9db86ab93339261b4e76d387f9994b
 SHA512:
-  metadata.gz: ab9c6181b787e6855c57db329f6e1c897d434c866ae7de7645f50d4adfb7462dc4ca6a9624af6ed63f4fa69417ff616c3c7dca3e6a6105b9d185fdf0081d92ef
-  data.tar.gz: e38ffe198ef54d7e573766ab131e9ed9475676b90ae0ab22c496cc55e364d03dbf82e489c2bae2e3d00232fd13353daec3c92611d50268df2eb0340c169c2243
+  metadata.gz: 93dadc9a344bb2efdbf2096d5bd608a58a4025b6cadeec416cf43df5b75cadaa080f5f94efcf282faae4b4ae41fca347ffc7afb95d58ea4b499168844eb558f4
+  data.tar.gz: 3753a0e32c9b2bfdfe870e17d0cb93ff81d519155373ac9343f63c81eeb2d671be7f040cb7ab4af19b903eb5ab1b5b308324d042747cd4472acd3da288eedeff

data/lib/dependabot/nuget/update_checker/version_finder.rb

@@ -5,6 +5,7 @@ require "nokogiri"
 
 require "dependabot/nuget/version"
 require "dependabot/nuget/requirement"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/nuget/update_checker"
 require "dependabot/shared_helpers"
 
@@ -42,9 +43,12 @@ module Dependabot
             begin
               possible_versions = versions
               possible_versions = filter_prereleases(possible_versions)
-              possible_versions = filter_vulnerable_versions(possible_versions)
+              possible_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+                possible_versions, security_advisories
+              )
               possible_versions = filter_ignored_versions(possible_versions)
               possible_versions = filter_lower_versions(possible_versions)
+
               possible_versions.min_by { |hash| hash.fetch(:version) }
             end
         end
@@ -83,18 +87,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(possible_versions)
-          versions_array = possible_versions
-
-          security_advisories.each do |advisory|
-            versions_array =
-              versions_array.
-              reject { |v| advisory.vulnerable?(v.fetch(:version)) }
-          end
-
-          versions_array
-        end
-
         def filter_lower_versions(possible_versions)
           return possible_versions unless dependency.version && version_class.correct?(dependency.version)
 
@@ -114,17 +106,16 @@ module Dependabot
             listing.
               fetch("versions", []).
               map do |v|
-                nuspec_url =
-                  listing.fetch("listing_details").
-                  fetch(:versions_url).
+                listing_details = listing.fetch("listing_details")
+                nuspec_url = listing_details.
+                             fetch(:versions_url, nil)&.
                   gsub(/index\.json$/, "#{v}/#{sanitized_name}.nuspec")
 
                 {
                   version: version_class.new(v),
                   nuspec_url: nuspec_url,
                   source_url: nil,
-                  repo_url:
-                    listing.fetch("listing_details").fetch(:repository_url)
+                  repo_url: listing_details.fetch(:repository_url)
                 }
               end
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.154.3
+  version: 0.156.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-21 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement