dependabot-opentofu 0.383.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc4253cdce3171a37489fb046de7882875e655c15b56732bebf43a754546ab4a
-  data.tar.gz: ea6af31292e7683f9a0d5948efe78df36a4cdb1f77589bc86fb2f18e6a6bcb05
+  metadata.gz: 3bb80d0b504e093127b1fc9a74f482b8a8b73f99698c968bfd0e8b1c198dd026
+  data.tar.gz: fa2816fbf5b4108eb4bbe9e3acbe13efb6a7dee9aafc385af73ecb404233ed76
 SHA512:
-  metadata.gz: 7d9d8a564be61e229656b4d3e86a0bd366e07aa2cffdda3e244f067db8f5d2b640c8301cee04362eb60189674a5affe9c148a0408370884771667cd9bd3a7bc7
-  data.tar.gz: 3250c78283dbe1f3f045bec1e1be132464038696c9ddf16feab9b5181310a1f8fee05070e33cc9fd8dea179b99baf2ec39ba8e5eae5d26bc46cb13a4a50a6163
+  metadata.gz: bb7b69e38138d4ea57b94df897078e63dbc9bab27ac79d8e6dd5c63528ddc4c1a890afeb18c97688e77d9bd4976304ba13b7cfffd4522c1c2c6b4b489f9a0b28
+  data.tar.gz: 8fa4575d341d81acbd5a242e800590f6b8326d84cb55c58bcf4b8d84a81c74d53c59425f7676ba2dd4a7c29dfbc7640ad99cbf9520a892b1ffbdf23940a76475

data/lib/dependabot/opentofu/file_parser.rb

@@ -346,11 +346,11 @@ module Dependabot
         # sub-module path; only the bare repo is queryable for tags.
         artifact_identifier, subdirectory = uri_part.split(%r{(?<!:)//}, 2)
 
-        qs = CGI.parse(query_part)
+        qs = URI.decode_www_form(query_part).to_h
         # Treat `?tag=` or `?digest=` (empty value) the same as the param
         # being absent, so we don't propagate "" as a usable version.
-        tag = qs["tag"].first&.then { |v| v.empty? ? nil : v }
-        digest = qs["digest"].first&.then { |v| v.empty? ? nil : v }
+        tag = qs["tag"]&.then { |v| v.empty? ? nil : v }
+        digest = qs["digest"]&.then { |v| v.empty? ? nil : v }
 
         if tag && digest
           raise DependencyFileNotEvaluatable,

data/lib/dependabot/opentofu/package/package_details_fetcher.rb

@@ -3,7 +3,6 @@
 
 require "json"
 require "time"
-require "cgi"
 require "excon"
 require "sorbet-runtime"
 require "dependabot/swift"

data/lib/dependabot/opentofu/registry_client.rb

@@ -185,7 +185,7 @@ module Dependabot
           return nil unless response.status == 204
 
           source_url = response.headers.fetch("X-OpenTofu-Get")
-          source_url = URI.join(download_url, source_url) if
+          source_url = URI.join(download_url, source_url).to_s if
             source_url.start_with?("/", "./", "../")
           source_url = RegistryClient.get_proxied_source(source_url) if source_url
         when "provider", "providers"
@@ -233,8 +233,8 @@ module Dependabot
         ).returns(Excon::Response)
       end
       def self.oci_get(url, host:, credentials:)
-        cred = credentials.find do |c|
-          c["type"] == "opentofu_registry" && (c["host"] == host || c["registry"] == host)
+        cred = credentials.reverse_each.find do |c|
+          ACCEPTED_CREDENTIAL_TYPES.include?(c["type"]) && (c["host"] == host || c["registry"] == host)
         end
 
         headers = {}
@@ -299,11 +299,7 @@ module Dependabot
 
       sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
       def self.oci_token_cache
-        @oci_token_cache = T.let(
-          @oci_token_cache,
-          T.nilable(T::Hash[String, T::Hash[Symbol, T.untyped]])
-        )
-        @oci_token_cache ||= {}
+        @oci_token_cache ||= T.let({}, T.nilable(T::Hash[String, T::Hash[Symbol, T.untyped]]))
       end
       private_class_method :oci_token_cache
 

data/lib/dependabot/opentofu/requirements_updater.rb

@@ -99,7 +99,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       attr_reader :requirements
 
-      sig { returns(Dependabot::Opentofu::Version) }
+      sig { returns(T.nilable(Dependabot::Opentofu::Version)) }
       attr_reader :latest_version
 
       sig { returns(T.nilable(String)) }
@@ -133,12 +133,15 @@ module Dependabot
       def update_registry_requirement(req)
         return req if req.fetch(:requirement).nil?
 
+        latest = latest_version
+        return req if latest.nil?
+
         string_req = req.fetch(:requirement).strip
         ruby_req = requirement_class.new(string_req)
-        return req if ruby_req.satisfied_by?(latest_version)
+        return req if ruby_req.satisfied_by?(latest)
 
         new_req =
-          if ruby_req.exact? then latest_version.to_s
+          if ruby_req.exact? then latest.to_s
           elsif string_req.start_with?("~>")
             update_twiddle_version(string_req).to_s
           else
@@ -153,18 +156,19 @@ module Dependabot
       def update_twiddle_version(req_string)
         old_version = requirement_class.new(req_string)
                                        .requirements.first.last
-        updated_version = at_same_precision(latest_version, old_version)
+        updated_version = at_same_precision(T.must(latest_version), old_version)
         req_string.sub(old_version.to_s, updated_version)
       end
 
       sig { params(req_string: String).returns(T::Array[Dependabot::Opentofu::Requirement]) }
       def update_range(req_string)
+        latest = T.must(latest_version)
         requirement_class.new(req_string).requirements.flat_map do |r|
           ruby_req = requirement_class.new(r.join(" "))
-          next ruby_req if ruby_req.satisfied_by?(latest_version)
+          next ruby_req if ruby_req.satisfied_by?(latest)
 
           case op = ruby_req.requirements.first.first
-          when "<", "<=" then [update_greatest_version(ruby_req, latest_version)]
+          when "<", "<=" then [update_greatest_version(ruby_req, latest)]
           when "!=" then []
           else raise "Unexpected operation for unsatisfied req: #{op}"
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-opentofu
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib
@@ -277,7 +277,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for OpenTofu
 test_files: []