dependabot-pub 0.227.0 → 0.228.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d6b98f865064a2c3ed99dd01f82474e78b0e6bd11f9af0205bbe8d664ebac92
-  data.tar.gz: dff1e05b143ad48e91dfd895931d02739ed84b2758c8163cd9417738de25c881
+  metadata.gz: 89c3dd639ade3b8c89f0b9ef43904d6d3974b3828c44cef691f9fbb706d3e958
+  data.tar.gz: a2b03d36175babea90b1d610a5344144efefc864f4ca6096498af13751a79e0e
 SHA512:
-  metadata.gz: e68671a3ed56b6ac5b8a2129fe663f0a8d6f7c7535bbf3d625dd7e5565c3fb51dad52e582b1b24ce3bcc3a57662825803e080ed1531dae2ad84cf5261d15ea7b
-  data.tar.gz: 6e7c8cba2a24407a1b4acf842bbc81427b085de0f5e64854c7ad849dd585f07ba68e81ee116121f959086a2ca073c2292dfcee5c6eef1599e4e7065ae385fbbd
+  metadata.gz: fe5f28e407052da38c627cc4852ff111375027b6532e739599bec42373cc1230b1e712c2f7759080fa74ad601047f271990cda03d74e90a1aa1ffb61da681615
+  data.tar.gz: 0d2726e86605abd222592a526d12e3ccda488405ed583c9ec15b544143a752e9e61390ae513cdaee281aeb0627e0681972b1b9f7a1dcabeb520dc309e5da3b95

data/lib/dependabot/pub/helpers.rb

@@ -17,13 +17,12 @@ module Dependabot
       end
 
       def self.run_infer_sdk_versions(dir, url: nil)
-        stdout, _, status = Dir.chdir dir do
-          Open3.capture3(
-            {},
-            File.join(pub_helpers_path, "infer_sdk_versions"),
-            *("--flutter-releases-url=#{url}" if url)
-          )
-        end
+        stdout, _, status = Open3.capture3(
+          {},
+          File.join(pub_helpers_path, "infer_sdk_versions"),
+          *("--flutter-releases-url=#{url}" if url),
+          chdir: dir
+        )
         return nil unless status.success?
 
         JSON.parse(stdout)
@@ -35,6 +34,60 @@ module Dependabot
         JSON.parse(run_dependency_services("list"))["dependencies"]
       end
 
+      def repository_url(dependency)
+        source = dependency.requirements&.first&.dig(:source)
+        source&.dig("description", "url") || options[:pub_hosted_url] || "https://pub.dev"
+      end
+
+      def fetch_package_listing(dependency)
+        # Because we get the security_advisories as a set of constraints, we
+        # fetch the list of all versions and filter them to a list of vulnerable
+        # versions.
+        #
+        # Ideally we would like the helper to be the only one doing requests to
+        # the repository. But this should work for now:
+        response = Dependabot::RegistryClient.get(url: "#{repository_url(dependency)}/api/packages/#{dependency.name}")
+        JSON.parse(response.body)
+      end
+
+      def available_versions(dependency)
+        fetch_package_listing(dependency)["versions"].map do |v|
+          Dependabot::Pub::Version.new(v["version"])
+        end
+      end
+
+      def dependency_services_smallest_update
+        return @smallest_update if @smallest_update
+
+        security_advisories.each do |a|
+          # Sanity check, that we only get the advisories for a single package
+          # at a time. If we got all advisories for all current dependencies,
+          # the helper would be able to handle it, but we would need a better
+          # way to find the repository url.
+          if a.dependency_name != dependency.name
+            raise "Only expected advisories for #{dependency.name} got for #{a.dependency_name}"
+          end
+        end
+        vulnerable_versions = available_versions(dependency).select do |v|
+          security_advisories.any? { |a| a.vulnerable?(v) }
+        end
+        input = {
+          # For "smallest update" we don't cache the report to be shared between
+          # dependencies, but run a specific report for the current dependency.
+          target: dependency.name,
+          disallowed:
+            [
+              {
+                name: dependency.name,
+                url: repository_url(dependency),
+                versions: vulnerable_versions.map { |v| { range: v.to_s } }
+              }
+            ]
+        }
+        report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
+        @smallest_update = report.find { |d| d["name"] == dependency.name }["smallestUpdate"]
+      end
+
       def dependency_services_report
         sha256 = Digest::SHA256.new
         dependency_files.each do |f|
@@ -45,16 +98,16 @@ module Dependabot
         cache_file = "/tmp/report-#{hash}-pid-#{Process.pid}.json"
         return JSON.parse(File.read(cache_file)) if File.file?(cache_file)
 
-        report = JSON.parse(run_dependency_services("report"))["dependencies"]
+        report = JSON.parse(run_dependency_services("report", stdin_data: ""))["dependencies"]
         File.write(cache_file, JSON.generate(report))
         report
       end
 
       def dependency_services_apply(dependency_changes)
-        run_dependency_services("apply", stdin_data: dependencies_to_json(dependency_changes)) do
+        run_dependency_services("apply", stdin_data: dependencies_to_json(dependency_changes)) do |temp_dir|
           dependency_files.map do |f|
             updated_file = f.dup
-            updated_file.content = File.read(f.name)
+            updated_file.content = File.read(File.join(temp_dir, f.name))
             updated_file
           end
         end
@@ -108,31 +161,29 @@ module Dependabot
       ## Detects the right flutter release to use for the pubspec.yaml.
       ## Then checks it out if it is not already.
       ## Returns the sdk versions
-      def ensure_right_flutter_release
-        @ensure_right_flutter_release ||= begin
-          versions = Helpers.run_infer_sdk_versions(
-            File.join(Dir.pwd, dependency_files.first.directory),
-            url: options[:flutter_releases_url]
-          )
-          flutter_ref =
-            if versions
-              Dependabot.logger.info(
-                "Installing the Flutter SDK version: #{versions['flutter']} " \
-                "from channel #{versions['channel']} with Dart #{versions['dart']}"
-              )
-              "refs/tags/#{versions['flutter']}"
-            else
-              Dependabot.logger.info(
-                "Failed to infer the flutter version. Attempting to use latest stable release."
-              )
-              # Choose the 'stable' version if the tool failed to infer a version.
-              "stable"
-            end
-
-          check_out_flutter_ref flutter_ref
-          run_flutter_doctor
-          run_flutter_version
-        end
+      def ensure_right_flutter_release(dir)
+        versions = Helpers.run_infer_sdk_versions(
+          File.join(dir, dependency_files.first.directory),
+          url: options[:flutter_releases_url]
+        )
+        flutter_ref =
+          if versions
+            Dependabot.logger.info(
+              "Installing the Flutter SDK version: #{versions['flutter']} " \
+              "from channel #{versions['channel']} with Dart #{versions['dart']}"
+            )
+            "refs/tags/#{versions['flutter']}"
+          else
+            Dependabot.logger.info(
+              "Failed to infer the flutter version. Attempting to use latest stable release."
+            )
+            # Choose the 'stable' version if the tool failed to infer a version.
+            "stable"
+          end
+
+        check_out_flutter_ref flutter_ref
+        run_flutter_doctor
+        run_flutter_version
       end
 
       def run_flutter_doctor
@@ -181,13 +232,13 @@ module Dependabot
       end
 
       def run_dependency_services(command, stdin_data: nil)
-        SharedHelpers.in_a_temporary_directory do
+        SharedHelpers.in_a_temporary_directory do |temp_dir|
           dependency_files.each do |f|
-            in_path_name = File.join(Dir.pwd, f.directory, f.name)
+            in_path_name = File.join(temp_dir, f.directory, f.name)
             FileUtils.mkdir_p File.dirname(in_path_name)
             File.write(in_path_name, f.content)
           end
-          sdk_versions = ensure_right_flutter_release
+          sdk_versions = ensure_right_flutter_release(temp_dir)
           SharedHelpers.with_git_configured(credentials: credentials) do
             env = {
               "CI" => "true",
@@ -198,18 +249,19 @@ module Dependabot
               # TODO(sigurdm): Would be nice to have a better handle for fixing the dart sdk version.
               "_PUB_TEST_SDK_VERSION" => sdk_versions["dart"]
             }
-            Dir.chdir File.join(Dir.pwd, dependency_files.first.directory) do
-              stdout, stderr, status = Open3.capture3(
-                env.compact,
-                File.join(Helpers.pub_helpers_path, "dependency_services"),
-                command,
-                stdin_data: stdin_data
-              )
-              raise Dependabot::DependabotError, "dependency_services failed: #{stderr}" unless status.success?
-              return stdout unless block_given?
-
-              yield
-            end
+            command_dir = File.join(temp_dir, dependency_files.first.directory)
+
+            stdout, stderr, status = Open3.capture3(
+              env.compact,
+              File.join(Helpers.pub_helpers_path, "dependency_services"),
+              command,
+              stdin_data: stdin_data,
+              chdir: command_dir
+            )
+            raise Dependabot::DependabotError, "dependency_services failed: #{stderr}" unless status.success?
+            return stdout unless block_given?
+
+            yield command_dir
           end
         end
       end

data/lib/dependabot/pub/requirement.rb

@@ -52,7 +52,7 @@ module Dependabot
 
       def to_s
         if @raw_constraint.nil?
-          as_list.join ", "
+          as_list.join " "
         else
           @raw_constraint
         end

data/lib/dependabot/pub/update_checker.rb

@@ -42,26 +42,39 @@ module Dependabot
       end
 
       def lowest_security_fix_version
-        # TODO: Pub lacks a lowest-non-vulnerable version strategy, for now we simply bump to latest resolvable:
-        # https://github.com/dependabot/dependabot-core/issues/5391
-        relevant_version = latest_resolvable_version
-        return unless relevant_version
-
-        # NOTE: in other ecosystems, the native helpers return a list of possible versions, to which we apply
-        # post-filtering. Ideally we move toward a world where we hand the native helper a list of ignored versions
-        # and possibly a flag indicating "use min version rather than max". The pub team is interested in supporting
-        # that. But in the meantime for internal consistency with other dependabot ecosystem implementations I kept
-        # `relevant_versions` as an array.
-        relevant_versions = [relevant_version]
-        relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
-                                                                                                  security_advisories)
-        relevant_versions.min
+        # Don't attempt to do security updates for git dependencies.
+        return nil if git_revision? dependency.version
+        # If the current version is not vulnerable, we stay on it.
+        return version_unless_ignored dependency.version unless vulnerable?
+
+        e = dependency_services_smallest_update
+        return nil if e.nil?
+
+        upgrade = e.find { |u| u["name"] == dependency.name }
+
+        version = upgrade["version"]
+        version_unless_ignored(version)
       end
 
       def updated_requirements
         # Requirements that need to be changed, if obtain:
-        # latest_resolvable_version
-        entry = current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
+        # latest_resolvable_version or lowest_security_fix_version
+        entry = if vulnerable?
+                  updates = dependency_services_smallest_update
+
+                  # Ideally we would like to do any upgrade that migrates away from the vulnerability
+                  # but this method can only return a single requirement udate.
+                  breaking_changes = updates.filter { |d| d["previousConstraint"] != d["constraintBumpedIfNeeded"] }
+
+                  # This security update would require unlocking other packages, which is not currently supported.
+                  # Because of that, return original requirements, so that no requirements are actually updated and
+                  # the error bubbles up as security_update_not_possible to the user.
+                  return dependency.requirements if breaking_changes.size > 1
+
+                  updates.find { |u| u["name"] == dependency.name }
+                else
+                  current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
+                end
         return unless entry
 
         parse_updated_dependency(entry, requirements_update_strategy: resolved_requirements_update_strategy).
@@ -108,8 +121,13 @@ module Dependabot
       end
 
       def updated_dependencies_after_full_unlock
+        report_section = if vulnerable?
+                           dependency_services_smallest_update
+                         else
+                           current_report["multiBreaking"]
+                         end
         # We only expose non-transitive dependencies here...
-        direct_deps = current_report["multiBreaking"].reject do |d|
+        direct_deps = report_section.reject do |d|
           d["kind"] == "transitive"
         end
         direct_deps.map do |d|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.227.0
+  version: 0.228.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-18 00:00:00.000000000 Z
+date: 2023-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.227.0
+        version: 0.228.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.227.0
+        version: 0.228.0
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.50.0
+        version: 1.56.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.50.0
+        version: 1.56.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -214,7 +214,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.227.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.228.0
 post_install_message: 
 rdoc_options: []
 require_paths: