dependabot-pub 0.212.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd396990d0534aa0e083d063237cb2e49b29311d8909097f93e9ba9875a440ee
-  data.tar.gz: 11b3cd736296b07f6a8fac4f8976b0df157127bfdf372d325b5b7c3e8fc6a4e6
+  metadata.gz: d727a361fb81d56fa752aeb69bc5515c8ee2761f6f612069382e0c68bdfa2717
+  data.tar.gz: b25f27d1ffbda1a9d2a859ab0e082cf6c53005ed9a742b939f00c5b5e8e3cc07
 SHA512:
-  metadata.gz: 6c4ed82fd24db8fd4af09d393b177646d55c3ba296fc1202dc50665c3809f660e1395908920672f1b2ab44216457d37426cb4c2296a69a3a92927913776c0df0
-  data.tar.gz: 4a111393f6d02f1fd448a401782a7bd619b96a9200b7ac18cfaf9b6eebcb0b7d0a72f78e9d3411cff2f196f14fd17aede65789b59d9e37553cbea2e285f7b470
+  metadata.gz: 06451a70a859aceb04eb731058f942391092f531834fbc93ab6fb9416b9ec356b08260bf500585b11aef0d597f6ef1e54bc1e6b379ec65dcf378cbe1e67bd44d
+  data.tar.gz: d9663a74898cfb97e3b78a0753c5772bd9b19ff05b7d56f4faadd57ae2cf71982bf26fbd59b3a895e6e398bc7fe5614ef50f2923cac0b38fd2d0f70a4e695011

data/lib/dependabot/pub/helpers.rb

@@ -5,6 +5,7 @@ require "open3"
 require "digest"
 
 require "dependabot/errors"
+require "dependabot/logger"
 require "dependabot/shared_helpers"
 require "dependabot/pub/requirement"
 
@@ -61,6 +62,7 @@ module Dependabot
       def ensure_flutter_repo
         return if File.directory?("/tmp/flutter/.git")
 
+        Dependabot.logger.info "Cloning the flutter repo https://github.com/flutter/flutter."
         # Make a flutter checkout
         _, stderr, status = Open3.capture3(
           {},
@@ -76,6 +78,7 @@ module Dependabot
       # Will ensure that /tmp/flutter contains the flutter repo checked out at `ref`.
       def check_out_flutter_ref(ref)
         ensure_flutter_repo
+        Dependabot.logger.info "Checking out Flutter version #{ref}"
         # Ensure we have the right version (by tag)
         _, stderr, status = Open3.capture3(
           {},
@@ -106,43 +109,70 @@ module Dependabot
       def ensure_right_flutter_release
         @ensure_right_flutter_release ||= begin
           versions = Helpers.run_infer_sdk_versions url: options[:flutter_releases_url]
-          flutter_ref = if versions
-                          "refs/tags/#{versions['flutter']}"
-                        else
-                          # Choose the 'stable' version if the tool failed to infer a version.
-                          "stable"
-                        end
+          flutter_ref =
+            if versions
+              Dependabot.logger.info(
+                "Installing the Flutter SDK version: #{versions['flutter']} " \
+                "from channel #{versions['channel']} with Dart #{versions['dart']}"
+              )
+              "refs/tags/#{versions['flutter']}"
+            else
+              Dependabot.logger.info(
+                "Failed to infer the flutter version. Attempting to use latest stable release."
+              )
+              # Choose the 'stable' version if the tool failed to infer a version.
+              "stable"
+            end
 
           check_out_flutter_ref flutter_ref
+          run_flutter_doctor
+          run_flutter_version
+        end
+      end
 
-          # Run `flutter --version` to make Flutter download engine artifacts and create flutter/version.
-          _, stderr, status = Open3.capture3(
-            {},
-            "/tmp/flutter/bin/flutter",
-            "doctor",
-            chdir: "/tmp/flutter/"
-          )
-          raise Dependabot::DependabotError, "Running 'flutter doctor' failed: #{stderr}" unless status.success?
+      def run_flutter_doctor
+        Dependabot.logger.info(
+          "Running `flutter doctor` to install artifacts and create flutter/version."
+        )
+        _, stderr, status = Open3.capture3(
+          {},
+          "/tmp/flutter/bin/flutter",
+          "doctor",
+          chdir: "/tmp/flutter/"
+        )
+        raise Dependabot::DependabotError, "Running 'flutter doctor' failed: #{stderr}" unless status.success?
+      end
 
-          # Run `flutter --version --machine` to get the current flutter version.
-          stdout, stderr, status = Open3.capture3(
-            {},
-            "/tmp/flutter/bin/flutter",
-            "--version",
-            "--machine",
-            chdir: "/tmp/flutter/"
-          )
-          unless status.success?
-            raise Dependabot::DependabotError,
-                  "Running 'flutter --version --machine' failed: #{stderr}"
-          end
+      # Runs `flutter version` and returns the dart and flutter version numbers in a map.
+      def run_flutter_version
+        Dependabot.logger.info "Running `flutter --version`"
+        # Run `flutter --version --machine` to get the current flutter version.
+        stdout, stderr, status = Open3.capture3(
+          {},
+          "/tmp/flutter/bin/flutter",
+          "--version",
+          "--machine",
+          chdir: "/tmp/flutter/"
+        )
+        unless status.success?
+          raise Dependabot::DependabotError,
+                "Running 'flutter --version --machine' failed: #{stderr}"
+        end
 
-          parsed = JSON.parse(stdout)
-          {
-            "flutter" => parsed["frameworkVersion"],
-            "dart" => parsed["dartSdkVersion"].split.first
-          }
+        parsed = JSON.parse(stdout)
+        flutter_version = parsed["frameworkVersion"]
+        dart_version = parsed["dartSdkVersion"]&.split&.first
+        unless flutter_version && dart_version
+          raise Dependabot::DependabotError,
+                "Bad output from `flutter --version`: #{stdout}"
         end
+        Dependabot.logger.info(
+          "Installed the Flutter SDK version: #{flutter_version} with Dart #{dart_version}."
+        )
+        {
+          "flutter" => flutter_version,
+          "dart" => dart_version
+        }
       end
 
       def run_dependency_services(command, stdin_data: nil)

data/lib/dependabot/pub/requirement.rb

@@ -15,7 +15,7 @@ module Dependabot
       version_pattern = Pub::Version::VERSION_PATTERN
 
       PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       # Use Pub::Version rather than Gem::Version to ensure that
       # pre-release versions aren't transformed.
@@ -32,7 +32,7 @@ module Dependabot
         [matches[1] || "=", Pub::Version.new(matches[2])]
       end
 
-      # For consistency with other langauges, we define a requirements array.
+      # For consistency with other languages, we define a requirements array.
       # Dart doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
       def self.requirements_array(requirement_string)

data/lib/dependabot/pub/update_checker.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/pub/helpers"
 require "yaml"
 module Dependabot
@@ -34,6 +35,29 @@ module Dependabot
         version_unless_ignored(entry["version"])
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        lowest_security_fix_version
+      end
+
+      def lowest_security_fix_version
+        # TODO: Pub lacks a lowest-non-vulnerable version strategy, for now we simply bump to latest resolvable:
+        # https://github.com/dependabot/dependabot-core/issues/5391
+        relevant_version = latest_resolvable_version
+        return unless relevant_version
+
+        # NOTE: in other ecosystems, the native helpers return a list of possible versions, to which we apply
+        # post-filtering. Ideally we move toward a world where we hand the native helper a list of ignored versions
+        # and possibly a flag indicating "use min version rather than max". The pub team is interested in supporting
+        # that. But in the meantime for internal consistency with other dependabot ecosystem implementations I kept
+        # `relevant_versions` as an array.
+        relevant_versions = [relevant_version]
+        relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                  security_advisories)
+        relevant_versions.min
+      end
+
       def updated_requirements
         # Requirements that need to be changed, if obtain:
         # latest_resolvable_version

data/lib/dependabot/pub/version.rb

@@ -17,7 +17,7 @@ module Dependabot
   module Pub
     class Version < Gem::Version
       VERSION_PATTERN = Gem::Version::VERSION_PATTERN + "(\\+[0-9a-zA-Z\\-.]+)?"
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       attr_reader :build_info
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.212.0
+  version: 0.214.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-06 00:00:00.000000000 Z
+date: 2022-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
-  name: debase
+  name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: '1.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: '1.7'
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,42 +128,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.14.2
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -276,14 +248,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Dart (pub) support for dependabot