dependabot-pre_commit 0.382.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de6bac526822d2c914ca36efc338590cb3bec576e8b537e49836782e964fc79c
-  data.tar.gz: 6ef5a17a539307bc5a2f2a754ee20f847c7c1c78d34b91d7e9c7a5aadf813af3
+  metadata.gz: db90dd134e2c56d73c6d1704648f7e53078225fb55c72e658e2c4e0153737bfc
+  data.tar.gz: 59fb6fe620e22cdf60ae7a725a89c08bb81be1872c747855b2b2f975b982dd0f
 SHA512:
-  metadata.gz: 76c3b588cf94c06df7e81a66e9d99d740e54e5397d6faf363b23e74c739aaf2d0fcea79ca7e909c15f1702b9d55264f9b1412794a3d29545d0c294138f390008
-  data.tar.gz: ef3f97603378a968016fe7b52dffe3d0786af304ce32b3d310adc265a6dd97601273f18f1a88a4062b96240a431e4081027716b4c0d770502bbe6f80cfef9638
+  metadata.gz: f68683ecba1916a93cd1646ae9d2dce7376eb216ec4df03218bf674c898503bcc76eb94fd5b4f75efb97f252fdf35282dac91584d9e39328238951dc5255225f
+  data.tar.gz: 8c4b2f0cc14473646bb6d210f9410a4da060be712308e250542bf19f344a57795114ef276a1dca9f4a522b7bac2f36048c9fff24c31702ffea23b3bef79b0767

data/lib/dependabot/pre_commit/additional_dependency_checkers/python.rb

@@ -3,6 +3,7 @@
 
 require "sorbet-runtime"
 require "dependabot/dependency"
+require "dependabot/dependency_requirement"
 require "dependabot/update_checkers"
 require "dependabot/requirements_update_strategy"
 require "dependabot/python/update_checker/requirements_updater"
@@ -165,12 +166,14 @@ module Dependabot
           return ">=#{new_version}" unless original_requirement
 
           updater = Dependabot::Python::UpdateChecker::RequirementsUpdater.new(
-            requirements: [{
-              requirement: original_requirement,
-              file: "requirements.txt",
-              groups: [],
-              source: nil
-            }],
+            requirements: [Dependabot::DependencyRequirement.create(
+              {
+                requirement: original_requirement,
+                file: "requirements.txt",
+                groups: [],
+                source: nil
+              }
+            )],
             update_strategy: Dependabot::RequirementsUpdateStrategy::BumpVersions,
             has_lockfile: false,
             latest_resolvable_version: new_version

data/lib/dependabot/pre_commit/update_checker/latest_version_finder.rb

@@ -2,7 +2,9 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/clients/github_with_retries"
 require "dependabot/errors"
+require "dependabot/git_cooldown_date_resolver"
 require "dependabot/pre_commit/comment_version_helper"
 require "dependabot/pre_commit/file_parser"
 require "dependabot/pre_commit/package/package_details_fetcher"
@@ -19,6 +21,7 @@ module Dependabot
     class UpdateChecker
       class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
+        include Dependabot::GitCooldownDateResolver
 
         sig do
           params(
@@ -48,6 +51,7 @@ module Dependabot
           @options             = options
           @cooldown_options = cooldown_options
           @cooldown_selected_tag = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @cooldown_rejected_all = T.let(false, T::Boolean)
 
           @git_helper = T.let(git_helper, Dependabot::PreCommit::Helpers::Githelper)
           super(
@@ -92,9 +96,21 @@ module Dependabot
 
         sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_tag
+          return nil if @cooldown_rejected_all
+
           @cooldown_selected_tag || available_latest_version_tag
         end
 
+        sig { override.returns(T.nilable(String)) }
+        def cooldown_source_url
+          @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
+        end
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        def cooldown_credentials
+          @credentials
+        end
+
         private
 
         sig do
@@ -113,6 +129,7 @@ module Dependabot
           return result if result
 
           Dependabot.logger.info("All candidate versions are in cooldown, keeping current version #{current_version}")
+          @cooldown_rejected_all = true
           current_version
         end
 
@@ -151,15 +168,81 @@ module Dependabot
           true
         end
 
-        # Checks versions from latest downward (among versions > current_version)
-        # in a single bare clone. Returns the newest version outside cooldown,
-        # or nil if all candidates are within cooldown.
+        # Checks versions from latest downward (among versions > current_version).
+        # First attempts to use GitHub Release published_at dates (no clone needed).
+        # Falls back to a bare clone for git-based date detection.
         sig { returns(T.nilable(Dependabot::Version)) }
         def find_latest_version_outside_cooldown
           candidates = version_candidates_descending
           return nil if candidates.empty?
 
-          url = @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
+          # Try GitHub Release dates first (avoids clone)
+          result = check_candidates_via_github_releases(candidates)
+          return result if result
+
+          # Fallback: clone and check tag/commit dates
+          check_candidates_via_git_clone(candidates)
+        rescue StandardError => e
+          Dependabot.logger.error("Error checking cooldown for #{dependency.name}: #{e.message}")
+          nil
+        end
+
+        # Attempts to resolve cooldown using GitHub Release published_at dates.
+        # Returns:
+        # - A version outside cooldown (first eligible candidate)
+        # - current_version when ALL candidates have releases and all are in cooldown
+        # - nil when no releases exist or some candidates lack releases (triggers git fallback)
+        sig do
+          params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def check_candidates_via_github_releases(candidates)
+          releases = cached_github_releases
+          return nil if releases.empty?
+
+          filtered_count = 0
+          all_have_releases = T.let(true, T::Boolean)
+
+          candidates.each do |tag|
+            tag_name = normalize_tag_name(tag[:tag] || "v#{tag[:version]}")
+            release = releases.find { |r| r.tag_name == tag_name }
+
+            unless release&.published_at
+              all_have_releases = false
+              next
+            end
+
+            unless release_in_cooldown_period?(release.published_at)
+              log_cooldown_result(filtered_count, tag[:version], release.published_at)
+              @cooldown_selected_tag = tag
+              return T.cast(tag[:version], Dependabot::Version)
+            end
+
+            filtered_count += 1
+          end
+
+          return nil if filtered_count.zero?
+
+          # Some candidates lacked releases — fall back to git clone for those
+          return nil unless all_have_releases
+
+          # Every candidate had a release and all were in cooldown
+          Dependabot.logger.info(
+            "Filtered #{filtered_count} version(s) due to cooldown for #{dependency.name}, " \
+            "no eligible version found (via GitHub Releases)"
+          )
+          @cooldown_rejected_all = true
+          T.cast(current_version, T.nilable(Dependabot::Version))
+        end
+
+        # Checks candidate tags inside a bare clone directory, returning the first
+        # version whose tag creation date falls outside the cooldown window.
+        sig do
+          params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def check_candidates_via_git_clone(candidates)
+          url = cooldown_source_url
           source = T.must(Source.from_url(url))
 
           SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
@@ -170,13 +253,12 @@ module Dependabot
               return check_candidates_cooldown(candidates)
             end
           end
-        rescue StandardError => e
-          Dependabot.logger.error("Error checking cooldown for #{dependency.name}: #{e.message}")
-          nil
         end
 
         # Iterates candidate tags inside a bare clone directory, returning the first
         # version whose release date falls outside the cooldown window.
+        # Prefers GitHub Release published_at when available for a candidate,
+        # falling back to tag creation date from the cloned repo.
         sig do
           params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
             .returns(T.nilable(Dependabot::Version))
@@ -188,11 +270,8 @@ module Dependabot
             commit_sha = tag[:commit_sha]
             next unless commit_sha
 
-            date_str = SharedHelpers.run_shell_command(
-              "git show --no-patch --format=\"%cd\" --date=iso #{commit_sha}",
-              fingerprint: "git show --no-patch --format=\"%cd\" --date=iso <commit_sha>"
-            )
-            release_date = Time.parse(date_str)
+            tag_name = normalize_tag_name(tag[:tag] || "v#{tag[:version]}")
+            release_date = resolve_candidate_date(tag_name, commit_sha)
 
             if release_in_cooldown_period?(release_date)
               filtered_count += 1

data/lib/dependabot/pre_commit/update_checker.rb

@@ -114,10 +114,18 @@ module Dependabot
         frozen_ver = version_from_comment
         return super unless frozen_ver
 
+        # Use latest_version (which respects cooldown) for semantic comparison.
+        # This ensures that when cooldown rejects all candidates, the dependency
+        # is correctly treated as up-to-date.
+        lv = latest_version
+        return true if lv.is_a?(Dependabot::Version) && lv <= frozen_ver
+
         resolved_sha = latest_commit_sha
-        return true if resolved_sha && resolved_sha == dependency.version
+        # If no SHA can be resolved (e.g., all candidate versions rejected by cooldown),
+        # there is nothing to update to — treat as up-to-date.
+        return true unless resolved_sha
 
-        false
+        resolved_sha == dependency.version
       end
 
       sig { override.returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pre_commit
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,84 +15,84 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: dependabot-cargo
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: dependabot-common
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: dependabot-go_modules
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: dependabot-npm_and_yarn
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.383.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -338,7 +338,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib