dependabot-nuget 0.238.0 → 0.239.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d913e6e79cd35b4a00551789e2d9fbea3a71476b76a12f64adfc3427cf419b1
-  data.tar.gz: 103b3ed625f8a89133b2c53b6a49941826cf3663de6897e9baad943a78fa37c7
+  metadata.gz: 2bf5bdfc4f365f5d04c30193e1b44e7a82ddb5816461148e4172cabc1a86bea3
+  data.tar.gz: 0ca7483d0fdc3d3a7dc2af7c8f475e7b02a121d4a8a5c58f495ff857d32c3dad
 SHA512:
-  metadata.gz: c820263ed7825b8f7270693513d8ebab3ee73169318ca5113c75cad689887b5b42c1731fd6496e12033ba7a3ff0d3a59752b7bc512e64ae93baf4a520d485a83
-  data.tar.gz: 7ce94d621ef880f809124364816e19aa8cb1fe1975967d8eb907cf40b1573ff2c3fe4c8fad91631f5f545433813252736c3c1db17228366dea8950f0ab50ac9a
+  metadata.gz: a0bd5448386d99ac0fa6a27ea6f5ec137885cd8a208762602d69284c1cdea6bb9e521a885b9a50cb42eb45b2de9ec760def87940c15023a910f7f9455a612fc9
+  data.tar.gz: 4096cfc58f861ec2f4f5d7a4022fd06f001d0f4421130bf0708e877a93ce2e12e722259d60b29f8303375d2e3cdc5f595e396cb4273d5c1e03a34e23a3a154ec

data/lib/dependabot/nuget/file_fetcher.rb

@@ -30,12 +30,10 @@ module Dependabot
         "Repo must contain a .proj file, .(cs|vb|fs)proj file, or a packages.config."
       end
 
-      # rubocop:disable Metrics/AbcSize
       sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files += project_files
-        fetched_files += project_files.filter_map { |f| directory_packages_props_file_from_project_file(f) }
         fetched_files += directory_build_files
         fetched_files += imported_property_files
 
@@ -47,7 +45,7 @@ module Dependabot
 
         # dedup files based on their absolute path
         fetched_files = fetched_files.uniq do |fetched_file|
-          Pathname.new(File.join(fetched_file.directory, fetched_file.name)).cleanpath.to_path
+          Pathname.new(fetched_file.directory).join(fetched_file.name).cleanpath.to_path
         end
 
         if project_files.none? && packages_config_files.none?
@@ -61,7 +59,6 @@ module Dependabot
 
         fetched_files
       end
-      # rubocop:enable Metrics/AbcSize
 
       private
 
@@ -72,8 +69,9 @@ module Dependabot
             project_files += csproj_file
             project_files += vbproj_file
             project_files += fsproj_file
-
             project_files += sln_project_files
+            project_files += proj_files
+            project_files += project_files.filter_map { |f| directory_packages_props_file_from_project_file(f) }
             project_files
           end
       rescue Octokit::NotFound, Gitlab::Error::NotFound
@@ -120,22 +118,15 @@ module Dependabot
         @directory_build_files ||= fetch_directory_build_files
       end
 
-      # rubocop:disable Metrics/AbcSize
       def fetch_directory_build_files
         attempted_dirs = []
         directory_build_files = []
         directory_path = Pathname.new(directory)
 
         # find all build files (Directory.Build.props/.targets) relative to the given project file
-        project_files.map { |f| File.dirname(File.join(f.directory, f.name)) }.uniq.each do |dir|
+        project_files.map { |f| Pathname.new(f.directory).join(f.name).dirname }.uniq.each do |dir|
           # Simulate MSBuild walking up the directory structure looking for a file
-          possible_dirs = dir.split("/").map.with_index do |_, i|
-            candidate_dir = dir.split("/").first(i + 1).join("/")
-            candidate_dir = "/#{candidate_dir}" unless candidate_dir.start_with?("/")
-            candidate_dir
-          end.reverse
-
-          possible_dirs.each do |possible_dir|
+          dir.descend.each do |possible_dir|
             break if attempted_dirs.include?(possible_dir)
 
             attempted_dirs << possible_dir
@@ -150,7 +141,6 @@ module Dependabot
 
         directory_build_files
       end
-      # rubocop:enable Metrics/AbcSize
 
       def sln_project_files
         return [] unless sln_files
@@ -196,18 +186,21 @@ module Dependabot
         @fsproj_file ||= find_and_fetch_with_suffix(".fsproj")
       end
 
+      def proj_files
+        @proj_files ||= find_and_fetch_with_suffix(".proj")
+      end
+
       def directory_packages_props_file_from_project_file(project_file)
         # walk up the tree from each project file stopping at the first `Directory.Packages.props` file found
         # https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management#central-package-management-rules
 
         found_directory_packages_props_file = nil
         directory_path = Pathname.new(directory)
-        full_project_dir = File.dirname(File.join(project_file.directory, project_file.name))
-        full_project_dir.split("/").each.with_index do |_, i|
+        full_project_dir = Pathname.new(project_file.directory).join(project_file.name).dirname
+        full_project_dir.ascend.each do |base|
           break if found_directory_packages_props_file
 
-          base = full_project_dir.split("/").first(i + 1).join("/")
-          candidate_file_path = Pathname.new(base + "/Directory.Packages.props").cleanpath.to_path
+          candidate_file_path = Pathname.new(base).join("Directory.Packages.props").cleanpath.to_path
           candidate_directory = Pathname.new(File.dirname(candidate_file_path))
           relative_candidate_directory = candidate_directory.relative_path_from(directory_path)
           candidate_file = repo_contents(dir: relative_candidate_directory).find do |f|

data/lib/dependabot/nuget/requirement.rb

@@ -1,6 +1,9 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/utils"
 require "dependabot/nuget/version"
 
@@ -8,7 +11,7 @@ require "dependabot/nuget/version"
 # https://docs.microsoft.com/en-us/nuget/reference/package-versioning
 module Dependabot
   module Nuget
-    class Requirement < Gem::Requirement
+    class Requirement < Dependabot::Requirement
       def self.parse(obj)
         return ["=", Nuget::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
 
@@ -25,6 +28,7 @@ module Dependabot
       # For consistency with other languages, we define a requirements array.
       # Dotnet doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
       def self.requirements_array(requirement_string)
         [new(requirement_string)]
       end

data/lib/dependabot/nuget/update_checker/nupkg_fetcher.rb

@@ -1,111 +1,116 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "nokogiri"
 require "zip"
 require "stringio"
-require "dependabot/nuget/update_checker"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
-      class NupkgFetcher
-        require_relative "repository_finder"
-
-        def self.fetch_nupkg_buffer(dependency_urls, package_id, package_version)
-          # check all repositories for the first one that has the nupkg
-          dependency_urls.reduce(nil) do |nupkg_buffer, repository_details|
-            nupkg_buffer || fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
-          end
+    class NupkgFetcher
+      require_relative "repository_finder"
+
+      def self.fetch_nupkg_buffer(dependency_urls, package_id, package_version)
+        # check all repositories for the first one that has the nupkg
+        dependency_urls.reduce(nil) do |nupkg_buffer, repository_details|
+          nupkg_buffer || fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
         end
+      end
 
-        def self.fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
-          return unless package_id && package_version && !package_version.empty?
+      def self.fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
+        return unless package_id && package_version && !package_version.empty?
 
-          feed_url = repository_details[:repository_url]
-          auth_header = repository_details[:auth_header]
+        feed_url = repository_details[:repository_url]
+        repository_type = repository_details[:repository_type]
 
-          azure_devops_match = try_match_azure_url(feed_url)
-          package_url = if azure_devops_match
-                          get_azure_package_url(azure_devops_match, package_id, package_version)
-                        elsif feed_url.include?("/v2")
-                          get_nuget_v2_package_url(feed_url, package_id, package_version)
-                        elsif feed_url.include?("/v3")
-                          get_nuget_v3_package_url(feed_url, package_id, package_version)
-                        else
-                          raise Dependabot::DependencyFileNotResolvable, "Unexpected NuGet feed format: #{feed_url}"
-                        end
+        azure_devops_match = try_match_azure_url(feed_url)
+        package_url = if azure_devops_match
+                        get_azure_package_url(azure_devops_match, package_id, package_version)
+                      elsif repository_type == "v2"
+                        get_nuget_v2_package_url(feed_url, package_id, package_version)
+                      elsif repository_type == "v3"
+                        get_nuget_v3_package_url(repository_details, package_id, package_version)
+                      else
+                        raise Dependabot::DependencyFileNotResolvable, "Unexpected NuGet feed format: #{feed_url}"
+                      end
 
-          fetch_stream(package_url, auth_header)
-        end
+        package_url
+      end
+
+      def self.fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
+        package_url = fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
+        return unless package_url
+
+        auth_header = repository_details[:auth_header]
+        fetch_stream(package_url, auth_header)
+      end
+
+      def self.try_match_azure_url(feed_url)
+        # if url is azure devops
+        azure_devops_regexs = [
+          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
+          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
+          %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
+        ]
+        regex = azure_devops_regexs.find { |reg| reg.match(feed_url) }
+        return unless regex
+
+        regex.match(feed_url)
+      end
+
+      def self.get_azure_package_url(azure_devops_match, package_id, package_version)
+        organization = azure_devops_match[:organization]
+        project = azure_devops_match[:project]
+        feed_id = azure_devops_match[:feedId]
 
-        def self.try_match_azure_url(feed_url)
-          # if url is azure devops
-          azure_devops_regexs = [
-            %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
-            %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
-            %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
-          ]
-          regex = azure_devops_regexs.find { |reg| reg.match(feed_url) }
-          return unless regex
-
-          regex.match(feed_url)
+        if project.empty?
+          "https://pkgs.dev.azure.com/#{organization}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
+        else
+          "https://pkgs.dev.azure.com/#{organization}/#{project}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
         end
+      end
 
-        def self.get_azure_package_url(azure_devops_match, package_id, package_version)
-          organization = azure_devops_match[:organization]
-          project = azure_devops_match[:project]
-          feed_id = azure_devops_match[:feedId]
+      def self.get_nuget_v3_package_url(repository_details, package_id, package_version)
+        base_url = repository_details[:base_url].delete_suffix("/")
+        package_id_downcased = package_id.downcase
+        "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.#{package_version}.nupkg"
+      end
 
-          if project.empty?
-            "https://pkgs.dev.azure.com/#{organization}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
-          else
-            "https://pkgs.dev.azure.com/#{organization}/#{project}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
+      def self.get_nuget_v2_package_url(feed_url, package_id, package_version)
+        base_url = feed_url
+        base_url += "/" unless base_url.end_with?("/")
+        package_id_downcased = package_id.downcase
+        "#{base_url}/package/#{package_id_downcased}/#{package_version}"
+      end
+
+      def self.fetch_stream(stream_url, auth_header, max_redirects = 5)
+        current_url = stream_url
+        current_redirects = 0
+
+        loop do
+          connection = Excon.new(current_url, persistent: true)
+
+          package_data = StringIO.new
+          response_block = lambda do |chunk, _remaining_bytes, _total_bytes|
+            package_data.write(chunk)
           end
-        end
 
-        def self.get_nuget_v3_package_url(feed_url, package_id, package_version)
-          base_url = feed_url.gsub("/index.json", "-flatcontainer")
-          package_id_downcased = package_id.downcase
-          "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.#{package_version}.nupkg"
-        end
+          response = connection.request(
+            method: :get,
+            headers: auth_header,
+            response_block: response_block
+          )
 
-        def self.get_nuget_v2_package_url(feed_url, package_id, package_version)
-          base_url = feed_url
-          base_url += "/" unless base_url.end_with?("/")
-          package_id_downcased = package_id.downcase
-          "#{base_url}/package/#{package_id_downcased}/#{package_version}"
-        end
+          if response.status == 303
+            current_redirects += 1
+            return nil if current_redirects > max_redirects
 
-        def self.fetch_stream(stream_url, auth_header, max_redirects = 5)
-          current_url = stream_url
-          current_redirects = 0
-
-          loop do
-            connection = Excon.new(current_url, persistent: true)
-
-            package_data = StringIO.new
-            response_block = lambda do |chunk, _remaining_bytes, _total_bytes|
-              package_data.write(chunk)
-            end
-
-            response = connection.request(
-              method: :get,
-              headers: auth_header,
-              response_block: response_block
-            )
-
-            if response.status == 303
-              current_redirects += 1
-              return nil if current_redirects > max_redirects
-
-              current_url = response.headers["Location"]
-            elsif response.status == 200
-              package_data.rewind
-              return package_data
-            else
-              return nil
-            end
+            current_url = response.headers["Location"]
+          elsif response.status == 200
+            package_data.rewind
+            return package_data
+          else
+            return nil
           end
         end
       end

data/lib/dependabot/nuget/update_checker/nuspec_fetcher.rb

@@ -1,85 +1,82 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "nokogiri"
 require "zip"
 require "stringio"
-require "dependabot/nuget/update_checker"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
-      class NuspecFetcher
-        require_relative "nupkg_fetcher"
-        require_relative "repository_finder"
+    class NuspecFetcher
+      require_relative "nupkg_fetcher"
+      require_relative "repository_finder"
 
-        def self.fetch_nuspec(dependency_urls, package_id, package_version)
-          # check all repositories for the first one that has the nuspec
-          dependency_urls.reduce(nil) do |nuspec_xml, repository_details|
-            nuspec_xml || fetch_nuspec_from_repository(repository_details, package_id, package_version)
-          end
+      def self.fetch_nuspec(dependency_urls, package_id, package_version)
+        # check all repositories for the first one that has the nuspec
+        dependency_urls.reduce(nil) do |nuspec_xml, repository_details|
+          nuspec_xml || fetch_nuspec_from_repository(repository_details, package_id, package_version)
         end
+      end
 
-        def self.fetch_nuspec_from_repository(repository_details, package_id, package_version)
-          return unless package_id && package_version && !package_version.empty?
-
-          feed_url = repository_details[:repository_url]
-          auth_header = repository_details[:auth_header]
+      def self.fetch_nuspec_from_repository(repository_details, package_id, package_version)
+        return unless package_id && package_version && !package_version.empty?
 
-          nuspec_xml = nil
+        feed_url = repository_details[:repository_url]
+        auth_header = repository_details[:auth_header]
 
-          if azure_package_feed?(feed_url)
-            # this is an azure devops url we can extract the nuspec from the nupkg
-            package_data = NupkgFetcher.fetch_nupkg_buffer_from_repository(repository_details, package_id,
-                                                                           package_version)
-            return if package_data.nil?
+        nuspec_xml = nil
 
-            nuspec_string = extract_nuspec(package_data, package_id)
-            nuspec_xml = Nokogiri::XML(nuspec_string)
-          else
-            # we can use the normal nuget apis to get the nuspec and list out the dependencies
-            base_url = feed_url.gsub("/index.json", "-flatcontainer")
-            package_id_downcased = package_id.downcase
-            nuspec_url = "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.nuspec"
+        if azure_package_feed?(feed_url)
+          # this is an azure devops url we can extract the nuspec from the nupkg
+          package_data = NupkgFetcher.fetch_nupkg_buffer_from_repository(repository_details, package_id,
+                                                                         package_version)
+          return if package_data.nil?
 
-            nuspec_response = Dependabot::RegistryClient.get(
-              url: nuspec_url,
-              headers: auth_header
-            )
+          nuspec_string = extract_nuspec(package_data, package_id)
+          nuspec_xml = Nokogiri::XML(nuspec_string)
+        else
+          # we can use the normal nuget apis to get the nuspec and list out the dependencies
+          base_url = feed_url.gsub("/index.json", "-flatcontainer")
+          package_id_downcased = package_id.downcase
+          nuspec_url = "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.nuspec"
 
-            return unless nuspec_response.status == 200
+          nuspec_response = Dependabot::RegistryClient.get(
+            url: nuspec_url,
+            headers: auth_header
+          )
 
-            nuspec_response_body = remove_wrapping_zero_width_chars(nuspec_response.body)
-            nuspec_xml = Nokogiri::XML(nuspec_response_body)
-          end
+          return unless nuspec_response.status == 200
 
-          nuspec_xml.remove_namespaces!
-          nuspec_xml
+          nuspec_response_body = remove_wrapping_zero_width_chars(nuspec_response.body)
+          nuspec_xml = Nokogiri::XML(nuspec_response_body)
         end
 
-        def self.azure_package_feed?(feed_url)
-          # if url is azure devops
-          azure_devops_regexs = [
-            %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
-            %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
-            %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
-          ]
-          azure_devops_regexs.any? { |reg| reg.match(feed_url) }
-        end
+        nuspec_xml.remove_namespaces!
+        nuspec_xml
+      end
 
-        def self.extract_nuspec(zip_stream, package_id)
-          Zip::File.open_buffer(zip_stream) do |zip|
-            nuspec_entry = zip.find { |entry| entry.name == "#{package_id}.nuspec" }
-            return nuspec_entry.get_input_stream.read if nuspec_entry
-          end
-          nil
-        end
+      def self.azure_package_feed?(feed_url)
+        # if url is azure devops
+        azure_devops_regexs = [
+          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
+          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
+          %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
+        ]
+        azure_devops_regexs.any? { |reg| reg.match(feed_url) }
+      end
 
-        def self.remove_wrapping_zero_width_chars(string)
-          string.force_encoding("UTF-8").encode
-                .gsub(/\A[\u200B-\u200D\uFEFF]/, "")
-                .gsub(/[\u200B-\u200D\uFEFF]\Z/, "")
+      def self.extract_nuspec(zip_stream, package_id)
+        Zip::File.open_buffer(zip_stream) do |zip|
+          nuspec_entry = zip.find { |entry| entry.name == "#{package_id}.nuspec" }
+          return nuspec_entry.get_input_stream.read if nuspec_entry
         end
+        nil
+      end
+
+      def self.remove_wrapping_zero_width_chars(string)
+        string.force_encoding("UTF-8").encode
+              .gsub(/\A[\u200B-\u200D\uFEFF]/, "")
+              .gsub(/[\u200B-\u200D\uFEFF]\Z/, "")
       end
     end
   end

data/lib/dependabot/nuget/update_checker/repository_finder.rb

@@ -26,6 +26,7 @@ module Dependabot
 
         def self.get_default_repository_details(dependency_name)
           {
+            base_url: "https://api.nuget.org/v3-flatcontainer/",
             repository_url: DEFAULT_REPOSITORY_URL,
             versions_url: "https://api.nuget.org/v3-flatcontainer/" \
                           "#{dependency_name.downcase}/index.json",
@@ -60,9 +61,11 @@ module Dependabot
 
           body = remove_wrapping_zero_width_chars(response.body)
           base_url = base_url_from_v3_metadata(JSON.parse(body))
+          resolved_base_url = base_url || repo_details.fetch(:url).gsub("/index.json", "-flatcontainer")
           search_url = search_url_from_v3_metadata(JSON.parse(body))
 
           details = {
+            base_url: resolved_base_url,
             repository_url: repo_details.fetch(:url),
             auth_header: auth_header_for_token(repo_details.fetch(:token)),
             repository_type: "v3"
@@ -120,6 +123,7 @@ module Dependabot
           base_url ||= repo_details.fetch(:url)
 
           {
+            base_url: base_url,
             repository_url: base_url,
             versions_url: File.join(
               base_url,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.238.0
+  version: 0.239.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-07 00:00:00.000000000 Z
+date: 2023-12-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.239.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.238.0
+        version: 0.239.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -134,14 +134,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -267,7 +267,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
 post_install_message: 
 rdoc_options: []
 require_paths: