dependabot-python 0.104.1 → 0.104.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1704546d9328a26bba38bd159150a5238797253f07538aa5ee731e307d1a5a86
-  data.tar.gz: 4e1a258ebb51cedb6cd6c801d2ac4a7f2f191658b163b56046a7ab526c24c287
+  metadata.gz: 07562c281f0015c26bac56e792bd46fa643b9e418aa74504847d9f7ab28afcdd
+  data.tar.gz: ed693ef282c7b4a4e2497ef4088edee0f6894c70eb62af61b7fa6b398f0066e6
 SHA512:
-  metadata.gz: 1b994991d16cafe0ece709fdc52f5bbe5f25cb3dd635ad08fab6b87885926afe281231642d28cfe24e26724bccd4427750d99dad27e718882ecc04bf333e8ff5
-  data.tar.gz: 37ffc6c72e569f50b2c73999089237512b08742e10473fb02f5b7047751be623ffeb9d9d8298376e1748748274dfe22c64c6a15ee60647de831317f8caf71e33
+  metadata.gz: 9475d9e98b20f257d941a66a07943e76c3a3eb525561740886daee7a6a1935dfd80336335b28441887fcb6a52f1c19a053965ae8247e98a0aacd888054222af2
+  data.tar.gz: 91193f7f7b1015f34080bccd28d32423e7935893ffb70e0f37bff47b6ceedad1f21ba30ef2327ef7f1f0c34bd2764841455374fa306365fd8d2df4f96aecae78

data/lib/dependabot/python/update_checker.rb

@@ -13,7 +13,7 @@ module Dependabot
   module Python
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       require_relative "update_checker/poetry_version_resolver"
-      require_relative "update_checker/pipfile_version_resolver"
+      require_relative "update_checker/pipenv_version_resolver"
       require_relative "update_checker/pip_compile_version_resolver"
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/latest_version_finder"
@@ -31,17 +31,11 @@ module Dependabot
         @latest_resolvable_version ||=
           case resolver_type
           when :pipfile
-            PipfileVersionResolver.new(
-              resolver_args.merge(unlock_requirement: true)
-            ).latest_resolvable_version
+            pipenv_version_resolver.latest_resolvable_version
           when :poetry
-            PoetryVersionResolver.new(
-              resolver_args.merge(unlock_requirement: true)
-            ).latest_resolvable_version
+            poetry_version_resolver.latest_resolvable_version
           when :pip_compile
-            PipCompileVersionResolver.new(
-              resolver_args.merge(unlock_requirement: true)
-            ).latest_resolvable_version
+            pip_compile_version_resolver.latest_resolvable_version
           when :requirements
             # pip doesn't (yet) do any dependency resolution, so if we don't
             # have a Pipfile or a pip-compile file, we just return the latest
@@ -55,16 +49,16 @@ module Dependabot
         @latest_resolvable_version_with_no_unlock ||=
           case resolver_type
           when :pipfile
-            PipfileVersionResolver.new(
-              resolver_args.merge(unlock_requirement: false)
+            pipenv_version_resolver(
+              unlock_requirement: false
             ).latest_resolvable_version
           when :poetry
-            PoetryVersionResolver.new(
-              resolver_args.merge(unlock_requirement: false)
+            poetry_version_resolver(
+              unlock_requirement: false
             ).latest_resolvable_version
           when :pip_compile
-            PipCompileVersionResolver.new(
-              resolver_args.merge(unlock_requirement: false)
+            pip_compile_version_resolver(
+              unlock_requirement: false
             ).latest_resolvable_version
           when :requirements
             latest_pip_version_with_no_unlock
@@ -72,11 +66,26 @@ module Dependabot
           end
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        @lowest_resolvable_security_fix_version ||=
+          case resolver_type
+          when :requirements
+            latest_version_finder.lowest_security_fix_version
+          when :pipfile, :poetry, :pip_compile
+            # TODO: Handle package managers with a resolvability concept
+            latest_resolvable_version
+          else raise "Unexpected resolver type #{resolver_type}"
+          end
+
+        latest_version_finder.lowest_security_fix_version
+      end
+
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
-          latest_version: latest_version&.to_s,
-          latest_resolvable_version: latest_resolvable_version&.to_s,
+          latest_resolvable_version: preferred_resolvable_version&.to_s,
           update_strategy: requirements_update_strategy,
           has_lockfile: !(pipfile_lock || poetry_lock || pyproject_lock).nil?
         ).updated_requirements
@@ -145,6 +154,27 @@ module Dependabot
         reqs.any? { |r| Python::Requirement.new(r).exact? }
       end
 
+      def pipenv_version_resolver(unlock_requirement: true)
+        @pipenv_version_resolver ||= {}
+        @pipenv_version_resolver[unlock_requirement] ||=
+          PipenvVersionResolver.
+          new(resolver_args.merge(unlock_requirement: unlock_requirement))
+      end
+
+      def pip_compile_version_resolver(unlock_requirement: true)
+        @pip_compile_version_resolver ||= {}
+        @pip_compile_version_resolver[unlock_requirement] ||=
+          PipCompileVersionResolver.
+          new(resolver_args.merge(unlock_requirement: unlock_requirement))
+      end
+
+      def poetry_version_resolver(unlock_requirement: true)
+        @poetry_version_resolver ||= {}
+        @poetry_version_resolver[unlock_requirement] ||=
+          PoetryVersionResolver.
+          new(resolver_args.merge(unlock_requirement: unlock_requirement))
+      end
+
       def resolver_args
         {
           dependency: dependency,
@@ -167,7 +197,8 @@ module Dependabot
           dependency: dependency,
           dependency_files: dependency_files,
           credentials: credentials,
-          ignored_versions: ignored_versions
+          ignored_versions: ignored_versions,
+          security_advisories: security_advisories
         )
       end
 

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -13,11 +13,12 @@ module Dependabot
         require_relative "index_finder"
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @dependency_files = dependency_files
-          @credentials      = credentials
-          @ignored_versions = ignored_versions
+                       ignored_versions:, security_advisories:)
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
         end
 
         def latest_version
@@ -29,10 +30,14 @@ module Dependabot
             fetch_latest_version_with_no_unlock
         end
 
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
         private
 
         attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions
+                    :ignored_versions, :security_advisories
 
         def fetch_latest_version
           versions = available_versions
@@ -49,6 +54,15 @@ module Dependabot
           versions.max
         end
 
+        def fetch_lowest_security_fix_version
+          versions = available_versions
+          versions = filter_prerelease_versions(versions)
+          versions = filter_ignored_versions(versions)
+          versions = filter_vulnerable_versions(versions)
+          versions = filter_lower_versions(versions)
+          versions.min
+        end
+
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
@@ -60,6 +74,16 @@ module Dependabot
             reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
         end
 
+        def filter_vulnerable_versions(versions_array)
+          versions_array.
+            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
+        end
+
+        def filter_lower_versions(versions_array)
+          versions_array.
+            select { |version| version > version_class.new(dependency.version) }
+        end
+
         def filter_out_of_range_versions(versions_array)
           reqs = dependency.requirements.map do |r|
             requirement_class.requirements_array(r.fetch(:requirement))

data/lib/dependabot/python/update_checker/{pipfile_version_resolver.rb → pipenv_version_resolver.rb}

@@ -27,7 +27,7 @@ module Dependabot
       # Unfortunately, Pipenv doesn't resolve how we'd expect - it appears to
       # just raise if the latest version can't be resolved. Knowing that is
       # still better than nothing, though.
-      class PipfileVersionResolver
+      class PipenvVersionResolver
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
         GIT_DEPENDENCY_UNREACHABLE_REGEX =
           /Command "git clone -q (?<url>[^\s]+).*" failed/.freeze

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -16,18 +16,14 @@ module Dependabot
         class UnfixableRequirement < StandardError; end
 
         attr_reader :requirements, :update_strategy, :has_lockfile,
-                    :latest_version, :latest_resolvable_version
+                    :latest_resolvable_version
 
         def initialize(requirements:, update_strategy:, has_lockfile:,
-                       latest_version:, latest_resolvable_version:)
+                       latest_resolvable_version:)
           @requirements = requirements
           @update_strategy = update_strategy
           @has_lockfile = has_lockfile
 
-          if latest_version
-            @latest_version = Python::Version.new(latest_version)
-          end
-
           return unless latest_resolvable_version
 
           @latest_resolvable_version =

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.104.1
+  version: 0.104.2
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.1
+        version: 0.104.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.1
+        version: 0.104.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -175,7 +175,7 @@ files:
 - lib/dependabot/python/update_checker/index_finder.rb
 - lib/dependabot/python/update_checker/latest_version_finder.rb
 - lib/dependabot/python/update_checker/pip_compile_version_resolver.rb
-- lib/dependabot/python/update_checker/pipfile_version_resolver.rb
+- lib/dependabot/python/update_checker/pipenv_version_resolver.rb
 - lib/dependabot/python/update_checker/poetry_version_resolver.rb
 - lib/dependabot/python/update_checker/requirements_updater.rb
 - lib/dependabot/python/version.rb