dependabot-pub 0.176.0 → 0.177.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55f5860d255487229cc4277f0efc5cdc7811ca4e541ec722a9d657d4212b7f3e
-  data.tar.gz: a263996e7b0081a8557a20ee97f20fc09635a88733c80c4250ba89611e81bf26
+  metadata.gz: 742728ff646203c67750c9afe88a12a5a0b65ca94757a4a7290fc720cbe97b61
+  data.tar.gz: b958908581ca1c23a7148343a212a2c4da8e6a4b1243088f5d6ca023f55a6cfe
 SHA512:
-  metadata.gz: 3befba7ade7037906a01793ada0cb3736e101c689bb877486d151b8fcac1b6d5c041227b0a1360c9f823026ebcd0e86625d76fd309f15acc616b78cb4dc35b20
-  data.tar.gz: 65555682c69b9360e6aa9a3ea82bda54047ebd245545289299aa59348f25796df749e235c6f18f114584139e1f7b2004771a8a3f564a49caaa3b5d9f1842eae3
+  metadata.gz: ce5d35e1b8ec8c54775c6c12560e15ac056018c26d8ab90bd4023a7c39acddfad24863435bda3a60498caf9797de044063fa893148a0288156092c71197b4d8d
+  data.tar.gz: a06f0276dfd6bdbfd1cdecd4b382091f434b2d33d5a0d148307f874150e8aa020a4bd3cf8e2ed264781be87e74dd952e2267f56fbd4cce788346ba3cd53d35aa

data/lib/dependabot/pub/file_parser.rb

@@ -15,7 +15,7 @@ module Dependabot
       def parse
         dependency_set = DependencySet.new
         list.map do |d|
-          dependency_set << to_dependency(d)
+          dependency_set << parse_listed_dependency(d)
         end
         dependency_set.dependencies.sort_by(&:name)
       end

data/lib/dependabot/pub/helpers.rb

@@ -60,6 +60,7 @@ module Dependabot
               stdout, stderr, status = Open3.capture3(
                 env.compact,
                 "dart",
+                "--root-certs-file=/etc/ssl/certs/ca-certificates.crt",
                 "--no-analytics",
                 "pub",
                 "global",
@@ -77,13 +78,15 @@ module Dependabot
         end
       end
 
-      def to_dependency(json)
+      # Parses a dependency as listed by `dependency_services list`.
+      def parse_listed_dependency(json)
         params = {
           name: json["name"],
           version: json["version"],
           package_manager: "pub",
           requirements: []
         }
+
         if json["kind"] != "transitive" && !json["constraint"].nil?
           constraint = json["constraint"]
           params[:requirements] << {
@@ -93,6 +96,33 @@ module Dependabot
             file: "pubspec.yaml"
           }
         end
+        Dependency.new(**params)
+      end
+
+      # Parses the updated dependencies returned by
+      # `dependency_services report`.
+      #
+      # The `requirements_update_strategy`` is
+      # used to chose the right updated constraint.
+      def parse_updated_dependency(json, requirements_update_strategy: nil)
+        params = {
+          name: json["name"],
+          version: json["version"],
+          package_manager: "pub",
+          requirements: []
+        }
+        constraint_field = constraint_field_from_update_strategy(requirements_update_strategy)
+
+        if json["kind"] != "transitive" && !json[constraint_field].nil?
+          constraint = json[constraint_field]
+          params[:requirements] << {
+            requirement: constraint,
+            groups: [json["kind"]],
+            source: nil, # TODO: Expose some information about the source
+            file: "pubspec.yaml"
+          }
+        end
+
         if json["previousVersion"]
           params = {
             **params,
@@ -112,6 +142,19 @@ module Dependabot
         Dependency.new(**params)
       end
 
+      # expects "auto" to already have been resolved to one of the other
+      # strategies.
+      def constraint_field_from_update_strategy(requirements_update_strategy)
+        case requirements_update_strategy
+        when "widen_ranges"
+          "constraintWidened"
+        when "bump_versions"
+          "constraintBumped"
+        when "bump_versions_if_necessary"
+          "constraintBumpedIfNeeded"
+        end
+      end
+
       def dependencies_to_json(dependencies)
         if dependencies.nil?
           nil

data/lib/dependabot/pub/update_checker.rb

@@ -3,7 +3,7 @@
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/pub/helpers"
-
+require "yaml"
 module Dependabot
   module Pub
     class UpdateChecker < Dependabot::UpdateCheckers::Base
@@ -49,7 +49,8 @@ module Dependabot
         entry = current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
         return unless entry
 
-        to_dependency(entry).requirements
+        parse_updated_dependency(entry, requirements_update_strategy: resolved_requirements_update_strategy).
+          requirements
       end
 
       private
@@ -67,7 +68,7 @@ module Dependabot
           d["kind"] == "transitive"
         end
         direct_deps.map do |d|
-          to_dependency(d)
+          parse_updated_dependency(d, requirements_update_strategy: resolved_requirements_update_strategy)
         end
       end
 
@@ -78,6 +79,35 @@ module Dependabot
       def current_report
         report.find { |d| d["name"] == dependency.name }
       end
+
+      def resolved_requirements_update_strategy
+        @resolved_requirements_update_strategy ||= resolve_requirements_update_strategy
+      end
+
+      def resolve_requirements_update_strategy
+        raise "Unexpected requirements_update_strategy #{requirements_update_strategy}" unless
+          [nil, "widen_ranges", "bump_versions", "bump_versions_if_necessary"].include? requirements_update_strategy
+
+        if requirements_update_strategy.nil?
+          # Check for a version field in the pubspec.yaml. If it is present
+          # we assume the package is a library, and the requirement update
+          # strategy is widening. Otherwise we assume it is an application, and
+          # go for "bump_versions".
+          pubspec = dependency_files.find { |d| d.name == "pubspec.yaml" }
+          begin
+            parsed_pubspec = YAML.safe_load(pubspec.content, aliases: false)
+          rescue ScriptError
+            return "bump_versions"
+          end
+          if parsed_pubspec["version"].nil?
+            "bump_versions"
+          else
+            "widen_ranges"
+          end
+        else
+          requirements_update_strategy
+        end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.176.0
+  version: 0.177.0
 platform: ruby
 authors:
 - Dependabot
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-28 00:00:00.000000000 Z
+date: 2022-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.176.0
+        version: 0.177.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.176.0
+        version: 0.177.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -198,7 +198,7 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -213,8 +213,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.2.32
+signing_key: 
 specification_version: 4
 summary: Dart (pub) support for dependabot
 test_files: []