dependabot-opentofu 0.382.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 795820e01073939474e76fb612047bf11d37e473a445b5941ca79a2ee998f288
-  data.tar.gz: ce4906ac45dab4d5e76e043c3077bb3e78ac73f8606a2fefd091eec655c71eaa
+  metadata.gz: 2a82604c26d4a240e6651632638402c50c7ae24196dc3658a1b7d3d3e3229f1c
+  data.tar.gz: 01c7e7cbb510f2d31d4183010cef5ee5254926f3c1a1538ca76a3f277000d260
 SHA512:
-  metadata.gz: 2a16d679db4789481dfd0ce1143b6ec3e83d4142c022f6566d518190358c70b22029fac4d1f15cbe80521b254b8e251523e8e2cd4571c7756fbd60a7fac9dde3
-  data.tar.gz: 1476dae536fe9751cbdd13c21bbb2ad392485571589048d13e7b4f17df5e472d1a095c8426bb7127602f6f9e6ea1d748baea02fc15464d6f68b7fbf09250faae
+  metadata.gz: a30a2babda1cbb778c624303560a44811e06635f3625afb82e3b082146937a8bb698c6b8d53bb0903e3617faae21beb5b631932df255bde76c8049ef8e702158
+  data.tar.gz: a16f41398bf1f36d7ff4df3447de9cb2fe30ed0915b36677c6b58f47abe675e27145c7cf8e5402362cf9c801215211d54860f2daa2b2925a26bcb8e801e17918

data/lib/dependabot/opentofu/file_parser.rb

@@ -346,11 +346,11 @@ module Dependabot
         # sub-module path; only the bare repo is queryable for tags.
         artifact_identifier, subdirectory = uri_part.split(%r{(?<!:)//}, 2)
 
-        qs = CGI.parse(query_part)
+        qs = URI.decode_www_form(query_part).to_h
         # Treat `?tag=` or `?digest=` (empty value) the same as the param
         # being absent, so we don't propagate "" as a usable version.
-        tag = qs["tag"].first&.then { |v| v.empty? ? nil : v }
-        digest = qs["digest"].first&.then { |v| v.empty? ? nil : v }
+        tag = qs["tag"]&.then { |v| v.empty? ? nil : v }
+        digest = qs["digest"]&.then { |v| v.empty? ? nil : v }
 
         if tag && digest
           raise DependencyFileNotEvaluatable,

data/lib/dependabot/opentofu/package/package_details_fetcher.rb

@@ -3,7 +3,6 @@
 
 require "json"
 require "time"
-require "cgi"
 require "excon"
 require "sorbet-runtime"
 require "dependabot/swift"

data/lib/dependabot/opentofu/registry_client.rb

@@ -233,8 +233,8 @@ module Dependabot
         ).returns(Excon::Response)
       end
       def self.oci_get(url, host:, credentials:)
-        cred = credentials.find do |c|
-          c["type"] == "opentofu_registry" && (c["host"] == host || c["registry"] == host)
+        cred = credentials.reverse_each.find do |c|
+          ACCEPTED_CREDENTIAL_TYPES.include?(c["type"]) && (c["host"] == host || c["registry"] == host)
         end
 
         headers = {}
@@ -299,11 +299,7 @@ module Dependabot
 
       sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
       def self.oci_token_cache
-        @oci_token_cache = T.let(
-          @oci_token_cache,
-          T.nilable(T::Hash[String, T::Hash[Symbol, T.untyped]])
-        )
-        @oci_token_cache ||= {}
+        @oci_token_cache ||= T.let({}, T.nilable(T::Hash[String, T::Hash[Symbol, T.untyped]]))
       end
       private_class_method :oci_token_cache
 

data/lib/dependabot/opentofu/requirements_updater.rb

@@ -8,6 +8,7 @@
 
 require "sorbet-runtime"
 
+require "dependabot/dependency_requirement"
 require "dependabot/opentofu/version"
 require "dependabot/opentofu/requirement"
 
@@ -50,18 +51,21 @@ module Dependabot
     class RequirementsUpdater
       extend T::Sig
 
-      # @param requirements [Hash{Symbol => String, Array, Hash}]
+      # @param requirements [Array<Dependabot::DependencyRequirement>]
       # @param latest_version [Dependabot::Opentofu::Version]
       # @param tag_for_latest_version [String, NilClass]
       sig do
         params(
-          requirements: T::Array[T::Hash[Symbol, T.untyped]],
+          requirements: T::Array[Dependabot::DependencyRequirement],
           latest_version: T.nilable(Dependabot::Version::VersionParameter),
           tag_for_latest_version: T.nilable(String)
         ).void
       end
       def initialize(requirements:, latest_version:, tag_for_latest_version:)
-        @requirements = requirements
+        @requirements = T.let(
+          requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+          T::Array[Dependabot::DependencyRequirement]
+        )
         @tag_for_latest_version = tag_for_latest_version
 
         return unless latest_version
@@ -70,12 +74,12 @@ module Dependabot
         @latest_version = T.let(version_class.new(latest_version), Dependabot::Opentofu::Version)
       end
 
-      # @return requirements [Hash{Symbol => String, Array, Hash}]
+      # @return requirements [Array<Dependabot::DependencyRequirement>]
       #   * requirement [String, NilClass] the updated version constraint
       #   * groups [Array] no-op for OpenTofu
       #   * file [String] the file that specified this dependency
       #   * source [Hash{Symbol => String}] The updated git or registry source details
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         # NOTE: Order is important here. The FileUpdater needs the updated
         # requirement at index `i` to correspond to the previous requirement
@@ -92,7 +96,7 @@ module Dependabot
 
       private
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       attr_reader :requirements
 
       sig { returns(Dependabot::Opentofu::Version) }
@@ -101,15 +105,15 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :tag_for_latest_version
 
-      sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
       def update_git_requirement(req)
         return req unless req.dig(:source, :ref)
         return req unless tag_for_latest_version
 
-        req.merge(source: req[:source].merge(ref: tag_for_latest_version))
+        Dependabot::DependencyRequirement.create(req.merge(source: req[:source].merge(ref: tag_for_latest_version)))
       end
 
-      sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
       def update_oci_requirement(req)
         return req unless defined?(@latest_version) && @latest_version
         return req if req.dig(:source, :digest)
@@ -118,12 +122,14 @@ module Dependabot
         new_tag = latest_version.to_s
         return req if req.dig(:source, :tag) == new_tag
 
-        req.merge(
-          source: req[:source].merge(tag: new_tag, version: new_tag)
+        Dependabot::DependencyRequirement.create(
+          req.merge(
+            source: req[:source].merge(tag: new_tag, version: new_tag)
+          )
         )
       end
 
-      sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+      sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
       def update_registry_requirement(req)
         return req if req.fetch(:requirement).nil?
 
@@ -139,7 +145,7 @@ module Dependabot
             update_range(string_req).join(", ")
           end
 
-        req.merge(requirement: new_req)
+        Dependabot::DependencyRequirement.create(req.merge(requirement: new_req))
       end
 
       # Updates the version in a "~>" constraint to allow the given version

data/lib/dependabot/opentofu/update_checker.rb

@@ -48,13 +48,11 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        wrap_requirements(
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            latest_version: latest_version&.to_s,
-            tag_for_latest_version: tag_for_latest_version
-          ).updated_requirements
-        )
+        RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          latest_version: latest_version&.to_s,
+          tag_for_latest_version: tag_for_latest_version
+        ).updated_requirements
       end
 
       sig { returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-opentofu
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -277,7 +277,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for OpenTofu
 test_files: []