dependabot-pre_commit 0.361.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 756b5487cc3c7be59843fde399c176c66d3716acca89a364b9a9b2309001a0eb
+  data.tar.gz: 11184797fefef083921b31eef2b74ca04a27e70ddf0e3f48cc7819554a8c2c56
+SHA512:
+  metadata.gz: ee6ac4a1364fa3f9c7d897c80dd5d68edf73552b522b112175bcda3e1e76b0e35cabb4904c1fd22027709de68544b38e0b92473217cbad72cf5f12fdc7fb1c91
+  data.tar.gz: adcecfc80611486b0446a56cc6a95d011b1213e4266aff09b9bd0623fff26c1e87f513726449c8f4e7a34a3f1919cf1ba98a2e9f604696dc0f4cb5335b176e8b

data/lib/dependabot/pre_commit/additional_dependency_checkers/base.rb

@@ -0,0 +1,89 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module PreCommit
+    module AdditionalDependencyCheckers
+      # Abstract base class for language-specific additional_dependency update checkers.
+      # Each language implementation should inherit from this class and implement
+      # the abstract methods.
+      #
+      # The checker is responsible for:
+      # 1. Finding the latest available version from the language's registry (PyPI, npm, etc.)
+      # 2. Generating updated requirements that preserve the original version constraint operators
+      #
+      # Example implementation for a new language:
+      #
+      #   class MyLanguage < Base
+      #     def latest_version
+      #       # Delegate to ecosystem's UpdateChecker
+      #       ecosystem_checker = Dependabot::UpdateCheckers
+      #         .for_package_manager("my_pm")
+      #         .new(dependency: build_ecosystem_dependency, ...)
+      #       ecosystem_checker.latest_version&.to_s
+      #     end
+      #
+      #     def updated_requirements(latest_version)
+      #       # Build updated requirements preserving operators
+      #     end
+      #   end
+      #
+      #   AdditionalDependencyCheckers.register("my_language", MyLanguage)
+      #
+      class Base
+        extend T::Sig
+        extend T::Helpers
+
+        abstract!
+
+        sig do
+          params(
+            source: T::Hash[Symbol, T.untyped],
+            credentials: T::Array[Dependabot::Credential],
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            current_version: T.nilable(String)
+          ).void
+        end
+        def initialize(source:, credentials:, requirements:, current_version:)
+          @source = source
+          @credentials = credentials
+          @requirements = requirements
+          @current_version = current_version
+        end
+
+        # Find the latest available version for this dependency
+        # Should delegate to the appropriate ecosystem UpdateChecker
+        # Returns nil if no update is available or if there's an error
+        sig { abstract.returns(T.nilable(String)) }
+        def latest_version; end
+
+        # Generate updated requirements for the new version
+        # Should preserve the original version constraint operator (>=, ~=, etc.)
+        # and update the source hash with the new original_string
+        sig { abstract.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements(latest_version); end
+
+        private
+
+        sig { returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :source
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        attr_reader :requirements
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :current_version
+
+        sig { returns(T.nilable(String)) }
+        def package_name
+          source[:package_name]&.to_s
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pre_commit/additional_dependency_checkers/go.rb

@@ -0,0 +1,160 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/update_checkers"
+require "dependabot/go_modules/version"
+require "dependabot/pre_commit/additional_dependency_checkers"
+require "dependabot/pre_commit/additional_dependency_checkers/base"
+
+module Dependabot
+  module PreCommit
+    module AdditionalDependencyCheckers
+      class Go < Base
+        extend T::Sig
+
+        sig { override.returns(T.nilable(String)) }
+        def latest_version
+          return nil unless package_name
+
+          @latest_version ||= T.let(
+            fetch_latest_version_via_go_checker,
+            T.nilable(String)
+          )
+        end
+
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements(latest_version)
+          requirements.map do |original_req|
+            original_source = original_req[:source]
+            next original_req unless original_source.is_a?(Hash)
+            next original_req unless original_source[:type] == "additional_dependency"
+
+            new_requirement = "v#{latest_version}"
+
+            new_original_string = build_original_string(
+              original_name: original_source[:original_name] || original_source[:package_name],
+              requirement: new_requirement
+            )
+
+            new_source = original_source.merge(original_string: new_original_string)
+
+            original_req.merge(
+              requirement: new_requirement,
+              source: new_source
+            )
+          end
+        end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def fetch_latest_version_via_go_checker
+          go_checker = go_update_checker
+          return nil unless go_checker
+
+          latest = go_checker.latest_version
+          Dependabot.logger.info("Go UpdateChecker found latest version: #{latest || 'none'}")
+
+          latest&.to_s
+        rescue Dependabot::PrivateSourceTimedOut,
+               Dependabot::PrivateSourceAuthenticationFailure,
+               Dependabot::DependencyFileNotResolvable,
+               Dependabot::DependencyNotFound,
+               Excon::Error::Timeout,
+               Excon::Error::Socket => e
+          Dependabot.logger.warn("Error checking Go module: #{e.message}")
+          nil
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def go_update_checker
+          @go_update_checker ||= T.let(
+            build_go_update_checker,
+            T.nilable(Dependabot::UpdateCheckers::Base)
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def build_go_update_checker
+          go_dependency = build_go_dependency
+          return nil unless go_dependency
+
+          Dependabot.logger.info("Delegating to Go UpdateChecker for module: #{go_dependency.name}")
+
+          Dependabot::UpdateCheckers.for_package_manager("go_modules").new(
+            dependency: go_dependency,
+            dependency_files: build_go_dependency_files,
+            credentials: credentials,
+            ignored_versions: [],
+            security_advisories: [],
+            raise_on_ignored: false
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::Dependency)) }
+        def build_go_dependency
+          return nil unless package_name
+
+          version = current_version || extract_version_from_requirement
+
+          Dependabot::Dependency.new(
+            name: T.must(package_name),
+            version: version,
+            requirements: [{
+              requirement: version ? "v#{version}" : nil,
+              groups: [],
+              file: "go.mod",
+              source: { type: "default", source: T.must(package_name) }
+            }],
+            package_manager: "go_modules"
+          )
+        end
+
+        sig { returns(T.nilable(String)) }
+        def extract_version_from_requirement
+          req_string = requirements.first&.dig(:requirement)
+          return nil unless req_string
+
+          # Go versions are like "v1.2.3" — strip the leading "v"
+          version = req_string.to_s.delete_prefix("v")
+          return nil unless Dependabot::GoModules::Version.correct?(version)
+
+          version
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def build_go_dependency_files
+          version = current_version || extract_version_from_requirement
+          version_string = version ? "v#{version}" : ""
+          content = "module dependabot/pre-commit-dummy\n\ngo 1.21\n\nrequire #{package_name} #{version_string}\n"
+
+          [
+            Dependabot::DependencyFile.new(
+              name: "go.mod",
+              content: content
+            )
+          ]
+        end
+
+        sig do
+          params(
+            original_name: T.nilable(String),
+            requirement: T.nilable(String)
+          ).returns(String)
+        end
+        def build_original_string(original_name:, requirement:)
+          base = original_name.to_s
+          base = "#{base}@#{requirement}" if requirement
+          base
+        end
+      end
+    end
+  end
+end
+
+Dependabot::PreCommit::AdditionalDependencyCheckers.register(
+  "golang",
+  Dependabot::PreCommit::AdditionalDependencyCheckers::Go
+)

data/lib/dependabot/pre_commit/additional_dependency_checkers/node.rb

@@ -0,0 +1,175 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "excon"
+require "json"
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/update_checkers"
+require "dependabot/pre_commit/additional_dependency_checkers"
+require "dependabot/pre_commit/additional_dependency_checkers/base"
+
+module Dependabot
+  module PreCommit
+    module AdditionalDependencyCheckers
+      class Node < Base
+        extend T::Sig
+
+        sig { override.returns(T.nilable(String)) }
+        def latest_version
+          return nil unless package_name
+
+          @latest_version ||= T.let(
+            fetch_latest_version_via_npm_checker,
+            T.nilable(String)
+          )
+        end
+
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements(latest_version)
+          requirements.map do |original_req|
+            original_source = original_req[:source]
+            next original_req unless original_source.is_a?(Hash)
+            next original_req unless original_source[:type] == "additional_dependency"
+
+            original_requirement = original_req[:requirement]
+            new_requirement = build_updated_requirement(original_requirement, latest_version)
+
+            new_original_string = build_original_string(
+              package_name: original_source[:original_name] || original_source[:package_name],
+              requirement: new_requirement
+            )
+
+            new_source = original_source.merge(original_string: new_original_string)
+
+            original_req.merge(
+              requirement: new_requirement,
+              source: new_source
+            )
+          end
+        end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def fetch_latest_version_via_npm_checker
+          npm_checker = npm_update_checker
+          return nil unless npm_checker
+
+          latest = npm_checker.latest_version
+          Dependabot.logger.info("Node UpdateChecker found latest version: #{latest || 'none'}")
+
+          latest&.to_s
+        rescue Dependabot::DependabotError, Excon::Error, JSON::ParserError => e
+          Dependabot.logger.debug("Error checking Node package #{package_name}: #{e.message}")
+          nil
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def npm_update_checker
+          @npm_update_checker ||= T.let(
+            build_npm_update_checker,
+            T.nilable(Dependabot::UpdateCheckers::Base)
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def build_npm_update_checker
+          npm_dependency = build_npm_dependency
+          return nil unless npm_dependency
+
+          Dependabot.logger.info("Delegating to npm_and_yarn UpdateChecker for package: #{npm_dependency.name}")
+
+          Dependabot::UpdateCheckers.for_package_manager("npm_and_yarn").new(
+            dependency: npm_dependency,
+            dependency_files: build_npm_dependency_files,
+            credentials: credentials,
+            ignored_versions: [],
+            security_advisories: [],
+            raise_on_ignored: false
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::Dependency)) }
+        def build_npm_dependency
+          return nil unless package_name
+
+          version = current_version || extract_version_from_requirement
+
+          Dependabot::Dependency.new(
+            name: T.must(package_name),
+            version: version,
+            requirements: [{
+              requirement: version || nil,
+              groups: ["dependencies"],
+              file: "package.json",
+              source: nil
+            }],
+            package_manager: "npm_and_yarn"
+          )
+        end
+
+        sig { returns(T.nilable(String)) }
+        def extract_version_from_requirement
+          req_string = requirements.first&.dig(:requirement)
+          return nil unless req_string
+
+          version_part = req_string.sub(/\A[~^]|[><=]+\s*/, "")
+          return version_part if version_part.match?(/\A\d+(?:\.\d+)*(?:-[\w.]+)?(?:\+[\w.]+)?\z/)
+
+          nil
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def build_npm_dependency_files
+          version = current_version || extract_version_from_requirement
+          content = JSON.generate(
+            {
+              "name" => "dependabot-pre-commit-check",
+              "version" => "0.0.1",
+              "dependencies" => {
+                T.must(package_name) => version || "*"
+              }
+            }
+          )
+
+          [
+            Dependabot::DependencyFile.new(
+              name: "package.json",
+              content: content
+            )
+          ]
+        end
+
+        sig do
+          params(
+            package_name: T.nilable(String),
+            requirement: T.nilable(String)
+          ).returns(String)
+        end
+        def build_original_string(package_name:, requirement:)
+          base = package_name.to_s
+          base = "#{base}@#{requirement}" if requirement
+          base
+        end
+
+        sig { params(original_requirement: T.nilable(String), new_version: String).returns(String) }
+        def build_updated_requirement(original_requirement, new_version)
+          return new_version unless original_requirement
+
+          operator_match = original_requirement.match(/\A(?<op>[~^]|[><=]+)\s*/)
+          if operator_match
+            "#{operator_match[:op]}#{new_version}"
+          else
+            new_version
+          end
+        end
+      end
+    end
+  end
+end
+
+Dependabot::PreCommit::AdditionalDependencyCheckers.register(
+  "node",
+  Dependabot::PreCommit::AdditionalDependencyCheckers::Node
+)

data/lib/dependabot/pre_commit/additional_dependency_checkers/python.rb

@@ -0,0 +1,213 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/update_checkers"
+require "dependabot/requirements_update_strategy"
+require "dependabot/python/update_checker/requirements_updater"
+require "dependabot/pre_commit/additional_dependency_checkers"
+require "dependabot/pre_commit/additional_dependency_checkers/base"
+
+module Dependabot
+  module PreCommit
+    module AdditionalDependencyCheckers
+      class Python < Base
+        extend T::Sig
+
+        sig { override.returns(T.nilable(String)) }
+        def latest_version
+          return nil unless package_name
+
+          @latest_version ||= T.let(
+            fetch_latest_version_via_pip_checker,
+            T.nilable(String)
+          )
+        end
+
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements(latest_version)
+          requirements.map do |original_req|
+            original_source = original_req[:source]
+            next original_req unless original_source.is_a?(Hash)
+            next original_req unless original_source[:type] == "additional_dependency"
+
+            original_requirement = original_req[:requirement]
+            new_requirement = build_updated_requirement(original_requirement, latest_version)
+
+            new_original_string = build_original_string(
+              original_name: original_source[:original_name] || original_source[:package_name],
+              extras: original_source[:extras],
+              requirement: new_requirement
+            )
+
+            new_source = original_source.merge(original_string: new_original_string)
+
+            original_req.merge(
+              requirement: new_requirement,
+              source: new_source
+            )
+          end
+        end
+
+        private
+
+        sig { returns(T.nilable(String)) }
+        def fetch_latest_version_via_pip_checker
+          pip_checker = pip_update_checker
+          return nil unless pip_checker
+
+          latest = pip_checker.latest_version
+          Dependabot.logger.info("Python UpdateChecker found latest version: #{latest || 'none'}")
+
+          latest&.to_s
+        rescue Dependabot::PrivateSourceTimedOut,
+               Dependabot::PrivateSourceAuthenticationFailure,
+               Dependabot::DependencyFileNotResolvable,
+               Dependabot::DependencyNotFound,
+               Excon::Error::Timeout,
+               Excon::Error::Socket => e
+          Dependabot.logger.warn("Error checking Python package: #{e.message}")
+          nil
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def pip_update_checker
+          @pip_update_checker ||= T.let(
+            build_pip_update_checker,
+            T.nilable(Dependabot::UpdateCheckers::Base)
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::UpdateCheckers::Base)) }
+        def build_pip_update_checker
+          pip_dependency = build_pip_dependency
+          return nil unless pip_dependency
+
+          Dependabot.logger.info("Delegating to Python UpdateChecker for package: #{pip_dependency.name}")
+
+          Dependabot::UpdateCheckers.for_package_manager("pip").new(
+            dependency: pip_dependency,
+            dependency_files: build_pip_dependency_files,
+            credentials: credentials,
+            ignored_versions: [],
+            security_advisories: [],
+            raise_on_ignored: false
+          )
+        end
+
+        sig { returns(T.nilable(Dependabot::Dependency)) }
+        def build_pip_dependency
+          return nil unless package_name
+
+          # Extract version from requirement string if current_version is nil
+          # This prevents Python's UpdateChecker from treating it as a sub-dependency
+          version = current_version || extract_version_from_requirement
+
+          # Use an exact requirement (==version) to force Python's UpdateChecker
+          # to use the :requirements resolver instead of subdependency_resolver.
+          exact_requirement = version ? "==#{version}" : nil
+
+          # Build a dependency that Python's UpdateChecker understands
+          Dependabot::Dependency.new(
+            name: T.must(package_name),
+            version: version,
+            requirements: [{
+              requirement: exact_requirement,
+              groups: [],
+              file: "requirements.txt",
+              source: nil
+            }],
+            package_manager: "pip"
+          )
+        end
+
+        sig { returns(T.nilable(String)) }
+        def extract_version_from_requirement
+          req_string = requirements.first&.dig(:requirement)
+          return nil unless req_string
+
+          match = req_string.match(/[\d]+(?:\.[\d]+)*(?:\.?\w+)*/)
+          match&.[](0)
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def build_pip_dependency_files
+          version = current_version || extract_version_from_requirement
+          exact_requirement = version ? "==#{version}" : ""
+          content = "#{package_name}#{exact_requirement}\n"
+
+          [
+            Dependabot::DependencyFile.new(
+              name: "requirements.txt",
+              content: content
+            )
+          ]
+        end
+
+        sig do
+          params(
+            original_name: T.nilable(String),
+            extras: T.nilable(String),
+            requirement: T.nilable(String)
+          ).returns(String)
+        end
+        def build_original_string(original_name:, extras:, requirement:)
+          base = original_name.to_s
+          base = "#{base}[#{extras}]" if extras
+          base = "#{base}#{requirement}" if requirement
+          base
+        end
+
+        sig { params(original_requirement: T.nilable(String), new_version: String).returns(T.nilable(String)) }
+        def build_updated_requirement(original_requirement, new_version)
+          return ">=#{new_version}" unless original_requirement
+
+          updater = Dependabot::Python::UpdateChecker::RequirementsUpdater.new(
+            requirements: [{
+              requirement: original_requirement,
+              file: "requirements.txt",
+              groups: [],
+              source: nil
+            }],
+            update_strategy: Dependabot::RequirementsUpdateStrategy::BumpVersions,
+            has_lockfile: false,
+            latest_resolvable_version: new_version
+          )
+
+          updated_reqs = updater.updated_requirements
+          updated_req = updated_reqs.first&.fetch(:requirement, nil)
+
+          return ">=#{new_version}" if updated_req == :unfixable
+
+          if updated_req == original_requirement
+            force_bump_lower_bounds(original_requirement, new_version)
+          else
+            updated_req || ">=#{new_version}"
+          end
+        end
+
+        sig { params(requirement: String, new_version: String).returns(String) }
+        def force_bump_lower_bounds(requirement, new_version)
+          constraints = requirement.split(",").map(&:strip)
+
+          updated = constraints.map do |constraint|
+            if constraint.match?(/\A(>=|>|~=)/)
+              operator = T.must(constraint.match(/\A(>=|>|~=)/))[1]
+              "#{operator}#{new_version}"
+            else
+              constraint
+            end
+          end
+
+          updated.join(",")
+        end
+      end
+    end
+  end
+end
+
+Dependabot::PreCommit::AdditionalDependencyCheckers.register(
+  "python",
+  Dependabot::PreCommit::AdditionalDependencyCheckers::Python
+)