dependabot-pub 0.397.0 → 0.398.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ee93bbe3a567d05c49aa43c3cd6be245a3d297b73dd1299377d55ddcd52d8b6
-  data.tar.gz: 6af10c2f14fdd2e0dc5c324c3a1b0d3af14a82647189c2e92a85b55fcc8cce45
+  metadata.gz: d3f347c5026b0a38c8b5dcd1fe34d5bf086c5232a298d8e4ee53a2a2c77675ee
+  data.tar.gz: c63bbc442dd89bd2e88381c1f8636783a96ea1e3ce4dcf8e1107182922e575c3
 SHA512:
-  metadata.gz: 9b873c93b89ca23f6eccf6ed6d73829223226b8e86de473ae0f8b106e68d29b68bd23ee8ea42ea10782c7a090c528f8adae34e31d5d99b82693d8d08739df2d3
-  data.tar.gz: 792a68fbdb3cbd1f4a63df868102bb3b86aa6c14746ce877cc32ec37287cf729684d854bef05e2936518596d5aa3f487696f87f2070ce6617d6f1546a623355b
+  metadata.gz: 5da945c408909041abb77106389039e7d6131086dc5516411d071a248779d9cdcdd1264680f6f768dac9bb54eb6730cdcfc857537b5bcee8233042a71f4ebae0
+  data.tar.gz: 795b73580e3d48ddf10362fc1e89bc10f8dd964022434eacbeea5f3feb91cb7478ccf9d1edaa8d3d79e132a07e167358d7bae21d119b7e496290f2eec0176688

data/lib/dependabot/pub/helpers.rb

@@ -63,8 +63,9 @@ module Dependabot
 
       sig { params(dependency: Dependabot::Dependency).returns(String) }
       def repository_url(dependency)
-        RequirementSource.new(dependency.requirements.first).description_string("url") || options[:pub_hosted_url] ||
-          "https://pub.dev"
+        repository_url = RequirementSource.new(dependency.requirements.first).description_string("url") ||
+                         options[:pub_hosted_url] || "https://pub.dev"
+        repository_url.delete_suffix("/")
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Hash[String, T.untyped]) }

data/lib/dependabot/pub/metadata_finder.rb

@@ -24,7 +24,7 @@ module Dependabot
           result.commit = source.description_string("resolved-ref")
           return result
         end
-        repository_url = source.description_string("url") || "https://pub.dev"
+        repository_url = (source.description_string("url") || "https://pub.dev").delete_suffix("/")
 
         listing = repository_listing(repository_url)
         repo = listing.dig("latest", "pubspec", "repository")

data/lib/dependabot/pub/package/package_details_fetcher.rb

@@ -72,32 +72,29 @@ module Dependabot
 
         sig { returns(T.any(T::Array[Dependabot::Package::PackageRelease], T.untyped)) }
         def package_details_metadata
-          package_releases = []
-          T.let({}, T::Hash[String, T.untyped])
-
-          Dependabot.logger.error("Initializing package metadata for \"#{@dependency.name}\"")
+          Dependabot.logger.info("Initializing package metadata for \"#{@dependency.name}\"")
 
           response = fetch_package_metadata(dependency)
-          return package_releases if response.status >= 500
-
-          begin
-            package_details_metadata = JSON.parse(response.body)
-
-            package_details_metadata["versions"].select do |v|
-              package_releases << package_release(
-                version: v["version"],
-                publish_date: Time.parse(v["published"])
-              )
-            end
-
-            package_releases
-          rescue JSON::ParserError
-            Dependabot.logger.error("Failed to parse package metadata")
-            package_releases
+          return [] if response.status >= 500
+
+          versions = JSON.parse(response.body).fetch("versions", [])
+
+          # Build the full list up front. If any release can't be parsed (e.g. a
+          # missing or invalid publish date) the partial result is discarded, so
+          # callers can treat a non-empty list as a complete, trustworthy snapshot
+          # and an empty list as "no usable metadata".
+          versions.map do |v|
+            package_release(
+              version: v["version"],
+              publish_date: Time.parse(v["published"])
+            )
           end
+        rescue JSON::ParserError
+          Dependabot.logger.error("Failed to parse package metadata")
+          []
         rescue StandardError => e
           Dependabot.logger.error("Failed to fetch package metadata #{e.message}")
-          package_releases
+          []
         end
 
         private

data/lib/dependabot/pub/update_checker/latest_version_finder.rb

@@ -7,6 +7,7 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/registry_client"
 require "dependabot/pub/package/package_details_fetcher"
 require "dependabot/package/package_latest_version_finder"
+require "dependabot/update_checkers/cooldown_calculation"
 require "sorbet-runtime"
 
 module Dependabot
@@ -119,6 +120,47 @@ module Dependabot
           return unparsed_version unless cooldown_options
 
           @package_details ||= T.let(
+            package_details_fetcher.package_details_metadata,
+            T.nilable(T::Array[Dependabot::Package::PackageRelease])
+          )
+
+          version_release = @package_details.find do |release|
+            release.version.to_s == unparsed_version
+          end
+
+          if version_release&.released_at
+            return unparsed_version unless in_cooldown_period?(version_release)
+
+            return dependency.version
+          end
+
+          # No dated release for this candidate. A Pub release always carries a
+          # publication date, so a candidate is only missing here for one of two
+          # reasons, handled differently:
+          #
+          #   metadata present, candidate absent -> the date source is healthy and the
+          #     candidate simply isn't published on pub.dev (the resolver and registry
+          #     listings diverge). Skip cooldown quietly.
+          #
+          #   metadata empty -> we have no dates at all, so cooldown can't be applied.
+          #     Surface the shared "cooldown not applied" notice, matching docker/common.
+          unless @package_details.empty?
+            Dependabot.logger.info(
+              "No matching release metadata for #{dependency.name} #{unparsed_version}; skipping cooldown"
+            )
+            return unparsed_version
+          end
+
+          record_cooldown_date_unavailable(unparsed_version)
+          unparsed_version
+        rescue StandardError => e
+          Dependabot.logger.error("Failed to filter cooldown versions for \"#{dependency.name}\": #{e.backtrace}")
+          unparsed_version
+        end
+
+        sig { returns(PackageDetailsFetcher) }
+        def package_details_fetcher
+          @package_details_fetcher ||= T.let(
             PackageDetailsFetcher.new(
               dependency: dependency,
               dependency_files: dependency_files,
@@ -126,27 +168,46 @@ module Dependabot
               ignored_versions: ignored_versions,
               security_advisories: security_advisories,
               options: options
-            ).package_details_metadata,
-            T.nilable(T::Array[Dependabot::Package::PackageRelease])
+            ),
+            T.nilable(PackageDetailsFetcher)
           )
+        end
 
-          return unparsed_version unless @package_details.any?
+        sig { params(unparsed_version: String).void }
+        def record_cooldown_date_unavailable(unparsed_version)
+          return unless version_class.correct?(unparsed_version)
 
-          version_release = @package_details.find do |release|
-            release.version == unparsed_version
-          end
+          new_version = version_class.new(unparsed_version)
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
 
-          return unparsed_version unless in_cooldown_period?(version_release)
+          # Nothing to cool down when the candidate isn't an upgrade, or when it is
+          # ignored and would be discarded anyway; mirrors the common cooldown
+          # tracker's relevance check and avoids job-wide warnings when no update can
+          # be produced.
+          return if current_version && new_version <= current_version
+          return if ignored?(new_version)
 
-          dependency.version
-        rescue StandardError => e
-          Dependabot.logger.error("Failed to filter cooldown versions for \"#{dependency.name}\": #{e.backtrace}")
-          unparsed_version
+          Dependabot.logger.info(
+            "No publication date available for #{dependency.name} #{unparsed_version}; cooldown not applied"
+          )
+          Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+            dependency,
+            cooldown_days: cooldown_days_for(current_version, new_version)
+          )
+        end
+
+        sig { params(version: Dependabot::Version).returns(T::Boolean) }
+        def ignored?(version)
+          requirements = ignored_versions.flat_map do |requirement|
+            dependency.requirement_class.requirements_array(requirement)
+          end
+          requirements.any? { |requirement| requirement.satisfied_by?(version) }
         end
 
         sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
         def in_cooldown_period?(release)
-          unless release.released_at
+          released_at = release.released_at
+          unless released_at
             Dependabot.logger.info("Release date not available for version #{release.version}")
             return false
           end
@@ -155,7 +216,7 @@ module Dependabot
           days = cooldown_days_for(current_version, release.version)
 
           # Calculate the number of seconds passed since the release
-          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_seconds = Time.now.to_i - released_at.to_i
           passed_days = passed_seconds / DAY_IN_SECONDS
 
           if passed_days < days

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.398.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.398.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -260,7 +260,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
 rdoc_options: []
 require_paths:
 - lib