dependabot-vcpkg 0.389.0 → 0.390.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89e6a1875def8d22cf5ca09c168b4139c553adf1a35b4b207903b334a0c2307b
-  data.tar.gz: be872546e8c76d60e7798601b2fea7aa417b7d85f715830fe00c2805fa130ea4
+  metadata.gz: bc65886cc56d34d9e32ca3dfe8a5ebcf25219d48b6c8276a62975974d1327bf8
+  data.tar.gz: ac856f5a7eaf627129324fd03ae4379eca0667370a63db31ed6f9e3073d3ea87
 SHA512:
-  metadata.gz: 56c33fa02e255ab3fd840af1d38de768f005841b0d43b175b1ea4d00e003adbeb24c5840fb1b694f6cf47a55baa3ab57387c69331672ac5d24882dd69101abf6
-  data.tar.gz: dbfcdef51f9ac5e998b32f3e4f9b670ea794ad84492bc1c15dd079dbe8559b9b221445e9636402211ea8b55c159ccabb94f8d6b78f98943c08196144ac8c4880
+  metadata.gz: 6ef838b9a47174b9fb9b664115d5688391446a7104533ec5e06ed894917b0c680bf0be1d6c35de8b99bbfd1a90eedcd7d92b43622b1db1011bae7fff8a3448c3
+  data.tar.gz: 6015c043d8bec0d168028712c3455195d40df263dd691eddcdf63b8c35e1a32ef13f6e8ac563cfac74eb53b6a1264ddc46a11d758d8bdc3415ce9513757768c7

data/lib/dependabot/vcpkg/file_parser.rb

@@ -10,7 +10,10 @@ require "dependabot/logger"
 
 require "dependabot/vcpkg"
 require "dependabot/vcpkg/language"
+require "dependabot/vcpkg/manifest_baseline"
+require "dependabot/vcpkg/package/versions_database"
 require "dependabot/vcpkg/package_manager"
+require "dependabot/vcpkg/version"
 
 module Dependabot
   module Vcpkg
@@ -124,7 +127,7 @@ module Dependabot
 
       sig do
         params(
-          dep: T.untyped,
+          dep: Object,
           dependency_file: Dependabot::DependencyFile
         )
           .returns(T.nilable(Dependabot::Dependency))
@@ -132,40 +135,95 @@ module Dependabot
       def parse_port_dependency(dep:, dependency_file:)
         case dep
         when String
-          # Simple string dependency like "curl" - log and skip
-          Dependabot.logger.warn("Skipping vcpkg dependency '#{dep}' without version>= constraint")
-          nil
+          build_port_dependency(name: dep, constraint: nil, dependency_file:)
         when Hash
           name = dep["name"]
-          version_constraint = dep["version>="]
-
           return nil unless name.is_a?(String)
 
-          unless version_constraint
-            Dependabot.logger.warn("Skipping vcpkg dependency '#{name}' without version>= constraint")
-            return nil
-          end
-
-          # Parse version and optional port-version
-          version, _port_version = parse_version_with_port(version_constraint)
-
-          Dependabot::Dependency.new(
-            name:,
-            version:,
-            package_manager: "vcpkg",
-            requirements: [{
-              requirement: ">=#{version_constraint}",
-              groups: [],
-              source: nil,
-              file: dependency_file.name
-            }]
-          )
+          constraint = dep[VCPKG_VERSION_CONSTRAINT_KEY]
+          build_port_dependency(name:, constraint: constraint.is_a?(String) ? constraint : nil, dependency_file:)
         else
           Dependabot.logger.warn("Skipping unknown vcpkg dependency format: #{dep.inspect}")
           nil
         end
       end
 
+      # A port's version comes from its `version>=` constraint, the registry baseline, or both.
+      # vcpkg installs the lowest version satisfying every constraint, so where both are present
+      # the effective version is the higher of the two.
+      sig do
+        params(
+          name: String,
+          constraint: T.nilable(String),
+          dependency_file: Dependabot::DependencyFile
+        )
+          .returns(T.nilable(Dependabot::Dependency))
+      end
+      def build_port_dependency(name:, constraint:, dependency_file:)
+        version = effective_port_version(name:, constraint:)
+
+        unless version
+          Dependabot.logger.warn("Skipping vcpkg dependency '#{name}' without version>= constraint")
+          return nil
+        end
+
+        Dependabot::Dependency.new(
+          name:,
+          version: version.to_s,
+          package_manager: "vcpkg",
+          requirements: [{
+            requirement: constraint && ">=#{constraint}",
+            groups: [],
+            source: nil,
+            file: dependency_file.name
+          }]
+        )
+      end
+
+      sig { params(name: String, constraint: T.nilable(String)).returns(T.nilable(Dependabot::Vcpkg::Version)) }
+      def effective_port_version(name:, constraint:)
+        constraint_version = constraint && Version.correct?(constraint) ? Version.new(constraint) : nil
+        baseline_version = baseline_port_version(name)
+
+        return constraint_version unless baseline_version
+        return baseline_version unless constraint_version
+        return constraint_version unless constraint_version.comparable_with?(baseline_version)
+
+        [constraint_version, baseline_version].max
+      end
+
+      sig { params(name: String).returns(T.nilable(Dependabot::Vcpkg::Version)) }
+      def baseline_port_version(name)
+        ref = builtin_baseline_ref
+        return nil unless ref
+
+        versions_database.baseline_version_for(port: name, ref:)
+      end
+
+      # The commit the manifest pins the built-in registry to. Ports resolved from any other
+      # registry are left alone, because the versions database shipped with the image only
+      # describes the built-in one.
+      sig { returns(T.nilable(String)) }
+      def builtin_baseline_ref
+        manifest_baseline.ref
+      end
+
+      sig { returns(Dependabot::Vcpkg::ManifestBaseline) }
+      def manifest_baseline
+        @manifest_baseline ||= T.let(
+          Dependabot::Vcpkg::ManifestBaseline.new(dependency_files:),
+          T.nilable(Dependabot::Vcpkg::ManifestBaseline)
+        )
+      end
+
+      sig { returns(Dependabot::Vcpkg::Package::VersionsDatabase) }
+      def versions_database
+        @versions_database ||= T.let(
+          Dependabot::Vcpkg::Package::VersionsDatabase.new,
+          T.nilable(Dependabot::Vcpkg::Package::VersionsDatabase)
+        )
+      end
+
       sig do
         params(
           registry: T::Hash[String, T.untyped],
@@ -230,15 +288,6 @@ module Dependabot
         end
       end
 
-      sig { params(version_string: String).returns([String, T.nilable(String)]) }
-      def parse_version_with_port(version_string)
-        if version_string.include?("#")
-          version_string.split("#", 2).then { |parts| [parts[0] || "", parts[1]] }
-        else
-          [version_string, nil]
-        end
-      end
-
       # A project relying on a global vcpkg install has no baseline to update.
       # Synthesize one so the updater adds it to the manifest; later runs keep it
       # current. See https://github.com/dependabot/dependabot-core/issues/13051

data/lib/dependabot/vcpkg/file_updater.rb

@@ -7,6 +7,8 @@ require "sorbet-runtime"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/vcpkg"
+require "dependabot/vcpkg/manifest_baseline"
+require "dependabot/vcpkg/version"
 
 module Dependabot
   module Vcpkg
@@ -19,7 +21,7 @@ module Dependabot
 
         # Handle vcpkg.json
         vcpkg_json_file = get_original_file(VCPKG_JSON_FILENAME)
-        if vcpkg_json_file&.then { |file| file_changed?(file) }
+        if vcpkg_json_file && rewrite?(vcpkg_json_file)
           updated_files << updated_file(
             file: vcpkg_json_file,
             content: updated_vcpkg_json_content(vcpkg_json_file)
@@ -28,7 +30,7 @@ module Dependabot
 
         # Handle vcpkg-configuration.json
         vcpkg_config_file = get_original_file(VCPKG_CONFIGURATION_JSON_FILENAME)
-        if vcpkg_config_file&.then { |file| file_changed?(file) }
+        if vcpkg_config_file && rewrite?(vcpkg_config_file)
           updated_files << updated_file(
             file: vcpkg_config_file,
             content: updated_vcpkg_configuration_json_content(vcpkg_config_file)
@@ -40,6 +42,14 @@ module Dependabot
 
       private
 
+      # A security fix can move the baseline in a file that none of the updated dependencies
+      # declare a requirement against, so that file needs rewriting even though `file_changed?`
+      # says otherwise.
+      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+      def rewrite?(file)
+        file_changed?(file) || security_baseline&.fetch(:file) == file.name
+      end
+
       sig { override.void }
       def check_required_files
         return if get_original_file(VCPKG_JSON_FILENAME) || get_original_file(VCPKG_CONFIGURATION_JSON_FILENAME)
@@ -57,6 +67,8 @@ module Dependabot
           .select { |_, requirement| requirement }
           .each { |dependency, _| update_dependency_in_content(parsed_content, dependency, file.name) }
 
+        apply_security_baseline(parsed_content, file.name)
+
         JSON.pretty_generate(parsed_content)
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, file.path
@@ -72,6 +84,8 @@ module Dependabot
           .select { |_, requirement| requirement }
           .each { |dependency, _| update_registry_dependency_in_content(parsed_content, dependency, file.name) }
 
+        apply_security_baseline(parsed_content, file.name)
+
         JSON.pretty_generate(parsed_content)
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, file.path
@@ -83,24 +97,125 @@ module Dependabot
         when VCPKG_DEFAULT_BASELINE_DEPENDENCY_NAME
           update_baseline_in_content(content, dependency, filename)
         else
-          update_port_dependency_in_content(content, dependency)
+          update_port_dependency_in_content(content, dependency, filename)
         end
       end
 
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
       def update_baseline_in_content(content, dependency, filename)
-        update_baseline_field(content, dependency, filename, "builtin-baseline")
+        update_baseline_field(content, dependency, filename, VCPKG_BUILTIN_BASELINE_KEY)
       end
 
+      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }
+      def update_port_dependency_in_content(content, dependency, filename)
+        case remediation_for(dependency, filename)
+        when :override then apply_override(content, dependency)
+        # A baseline bump moves the port's version floor, so the port entry needs no change.
+        when :baseline then nil
+        else update_version_constraint(content, dependency)
+        end
+      end
+
+      sig do
+        params(dependency: Dependabot::Dependency, filename: String).returns(T.nilable(Symbol))
+      end
+      def remediation_for(dependency, filename)
+        requirement = dependency.requirements.find { |r| r[:file] == filename }
+        metadata = requirement&.dig(:metadata)
+        return nil unless metadata.is_a?(Hash)
+
+        metadata[:security_remediation]
+      end
+
+      sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency).void }
+      def update_version_constraint(content, dependency)
+        entries = content[VCPKG_DEPENDENCIES_KEY]
+        return unless entries.is_a?(Array)
+
+        index = entries.index { |entry| port_entry_name(entry) == dependency.name }
+        return unless index
+
+        entry = entries[index]
+        # A port declared as a bare string has to become an object to carry a constraint.
+        entry = { "name" => entry } if entry.is_a?(String)
+        return unless entry.is_a?(Hash)
+
+        entry[VCPKG_VERSION_CONSTRAINT_KEY] = dependency.version
+        entries[index] = entry
+      end
+
+      # vcpkg cannot compare versions across schemes, so when no safe version shares the current
+      # one's scheme, the only way to move the port is to pin it outright. `version` is the
+      # scheme-agnostic key, and the port version belongs in it as a `#N` suffix: the separate
+      # `port-version` key and the scheme-specific keys are both deprecated.
+      # See https://learn.microsoft.com/vcpkg/reference/vcpkg-json#overrides
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency).void }
-      def update_port_dependency_in_content(content, dependency)
-        # Update the dependencies array
-        dependencies_array = content["dependencies"]
-        return unless dependencies_array.is_a?(Array)
-
-        # Find and update the specific dependency using more functional approach
-        target_dep = dependencies_array.find { _1.is_a?(Hash) && _1["name"] == dependency.name }
-        target_dep&.[]=("version>=", dependency.version)
+      def apply_override(content, dependency)
+        entry = { "name" => dependency.name, "version" => dependency.version }
+
+        overrides = content[VCPKG_OVERRIDES_KEY]
+        unless overrides.is_a?(Array)
+          overrides = []
+          content[VCPKG_OVERRIDES_KEY] = overrides
+        end
+
+        index = overrides.index { |override| override.is_a?(Hash) && override["name"] == dependency.name }
+        index ? overrides[index] = entry : overrides << entry
+      end
+
+      sig { params(entry: T.untyped).returns(T.nilable(String)) }
+      def port_entry_name(entry)
+        return entry if entry.is_a?(String)
+        return nil unless entry.is_a?(Hash)
+
+        name = entry["name"]
+        name.is_a?(String) ? name : nil
+      end
+
+      # Where the fix wants the registry baseline moved to, if anywhere.
+      sig { returns(T.nilable(T::Hash[Symbol, String])) }
+      def security_baseline
+        return @security_baseline if @looked_up_security_baseline
+
+        @looked_up_security_baseline = T.let(true, T.nilable(T::Boolean))
+        @security_baseline = T.let(build_security_baseline, T.nilable(T::Hash[Symbol, String]))
+      end
+
+      sig { returns(T.nilable(T::Hash[Symbol, String])) }
+      def build_security_baseline
+        commit_sha = dependencies
+                     .flat_map(&:requirements)
+                     .filter_map { |requirement| requirement.dig(:metadata, :baseline_commit_sha) }
+                     .first
+        return nil unless commit_sha.is_a?(String)
+
+        location = manifest_baseline.location
+        return nil unless location
+
+        { file: location.first, commit_sha: }
+      end
+
+      sig { params(content: T::Hash[String, T.untyped], filename: String).void }
+      def apply_security_baseline(content, filename)
+        baseline = security_baseline
+        return unless baseline && baseline[:file] == filename
+
+        path = T.must(manifest_baseline.location).last
+        key = path.last
+        return unless key
+
+        target = T.must(path[0...-1]).reduce(content) { |node, segment| node.is_a?(Hash) ? node[segment] : nil }
+        return unless target.is_a?(Hash)
+
+        target[key] = baseline[:commit_sha]
+      end
+
+      sig { returns(Dependabot::Vcpkg::ManifestBaseline) }
+      def manifest_baseline
+        @manifest_baseline ||= T.let(
+          Dependabot::Vcpkg::ManifestBaseline.new(dependency_files:),
+          T.nilable(Dependabot::Vcpkg::ManifestBaseline)
+        )
       end
 
       sig { params(content: T::Hash[String, T.untyped], dependency: Dependabot::Dependency, filename: String).void }

data/lib/dependabot/vcpkg/manifest_baseline.rb

@@ -0,0 +1,112 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+
+require "dependabot/vcpkg"
+
+module Dependabot
+  module Vcpkg
+    # Finds the commit a manifest pins the built-in registry to.
+    #
+    # This ignores any other registry, because the versions database shipped with the updater image
+    # only describes the built-in one.
+    class ManifestBaseline
+      extend T::Sig
+
+      sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
+      def initialize(dependency_files:)
+        @dependency_files = dependency_files
+        @ref = T.let(nil, T.nilable(String))
+        @resolved = T.let(false, T::Boolean)
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      attr_reader :dependency_files
+
+      sig { returns(T.nilable(String)) }
+      def ref
+        return @ref if @resolved
+
+        @resolved = true
+        @ref = manifest_builtin_baseline || default_registry_builtin_baseline
+      end
+
+      # The file the baseline lives in, and the JSON path to it, so an updater knows what to
+      # rewrite.
+      sig { returns(T.nilable([String, T::Array[String]])) }
+      def location
+        return [T.must(vcpkg_manifest_file).name, [VCPKG_BUILTIN_BASELINE_KEY]] if manifest_builtin_baseline
+        return nil unless default_registry_builtin_baseline
+
+        [T.must(vcpkg_configuration_file).name, %w(default-registry baseline)]
+      end
+
+      private
+
+      sig { returns(T.nilable(String)) }
+      def manifest_builtin_baseline
+        manifest = vcpkg_manifest_file
+        return nil unless manifest
+
+        baseline = parsed_json(manifest)&.dig(VCPKG_BUILTIN_BASELINE_KEY)
+        baseline.is_a?(String) ? baseline : nil
+      end
+
+      sig { returns(T.nilable(String)) }
+      def default_registry_builtin_baseline
+        registry = default_registry
+        return nil unless registry
+        return nil unless builtin_registry?(registry)
+
+        baseline = registry["baseline"]
+        baseline.is_a?(String) ? baseline : nil
+      end
+
+      sig { returns(T.nilable(T::Hash[String, Object])) }
+      def default_registry
+        config = vcpkg_configuration_file
+        return nil unless config
+
+        registry = parsed_json(config)&.dig("default-registry")
+        registry.is_a?(Hash) ? registry : nil
+      end
+
+      sig { params(registry: T::Hash[String, Object]).returns(T::Boolean) }
+      def builtin_registry?(registry)
+        return true if registry["kind"] == "builtin"
+        return false unless registry["kind"] == "git"
+
+        repository = registry["repository"]
+        return false unless repository.is_a?(String)
+
+        official = [VCPKG_DEFAULT_REGISTRY_REPOSITORY, VCPKG_DEFAULT_BASELINE_URL]
+        official.include?(repository.delete_suffix("/"))
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def vcpkg_manifest_file
+        dependency_files.find { |file| file.name == VCPKG_JSON_FILENAME }
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def vcpkg_configuration_file
+        dependency_files.find { |file| file.name == VCPKG_CONFIGURATION_JSON_FILENAME }
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Hash[String, Object])) }
+      def parsed_json(file)
+        content = file.content
+        return nil unless content
+
+        parsed = JSON.parse(content)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/dependabot/vcpkg/package/package_details_fetcher.rb

@@ -12,6 +12,7 @@ require "dependabot/shared_helpers"
 require "dependabot/update_checkers/base"
 
 require "dependabot/vcpkg"
+require "dependabot/vcpkg/package/versions_database"
 require "dependabot/vcpkg/version"
 
 module Dependabot
@@ -22,16 +23,21 @@ module Dependabot
 
         sig do
           params(
-            dependency: Dependabot::Dependency
+            dependency: Dependabot::Dependency,
+            versions_database: Dependabot::Vcpkg::Package::VersionsDatabase
           ).void
         end
-        def initialize(dependency:)
+        def initialize(dependency:, versions_database: Dependabot::Vcpkg::Package::VersionsDatabase.new)
           @dependency = dependency
+          @versions_database = versions_database
         end
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
+        sig { returns(Dependabot::Vcpkg::Package::VersionsDatabase) }
+        attr_reader :versions_database
+
         sig { returns(T.nilable(Dependabot::Package::PackageDetails)) }
         def fetch
           if registry_dependency?
@@ -75,88 +81,14 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::Package::PackageDetails)) }
         def fetch_port_releases
-          fetch_port_versions_from_git
-            .filter_map { |version_info| create_port_package_release(version_info) }
-            .reverse
-            .uniq(&:version)
-            .then do |releases|
-            Dependabot::Package::PackageDetails.new(
-              dependency: dependency,
-              releases: releases
-            )
-          end
-        end
-
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
-        def fetch_port_versions_from_git
-          port_path = "ports/#{dependency.name}/vcpkg.json"
-          vcpkg_repo_path = "/opt/vcpkg"
-
-          # Get each commit that modified the port's vcpkg.json
-          git_log_cmd = [
-            "git", "log", "--format=%H", "--follow", "--", port_path
-          ]
+          release_dates = versions_database.release_dates_for(dependency.name)
 
-          Dir.chdir(vcpkg_repo_path) do
-            log_output = Dependabot::SharedHelpers.run_shell_command(git_log_cmd.join(" "))
+          releases = versions_database
+                     .versions_for(dependency.name)
+                     .map { |port_version| create_port_package_release(port_version, release_dates) }
+                     .uniq(&:version)
 
-            log_output.lines.map(&:strip).filter_map do |line|
-              next if line.empty?
-
-              commit_sha = line.strip
-              next unless commit_sha.match?(/\A[0-9a-f]{40}\z/) # Validate SHA format
-
-              # Get the vcpkg.json content for this commit
-              version_info = extract_version_from_commit(commit_sha, port_path)
-              version_info[:commit_sha] = commit_sha if version_info
-              version_info
-            end
-          end
-        rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
-          Dependabot.logger.warn("Failed to fetch port versions for #{dependency.name}: #{e.message}")
-          []
-        end
-
-        sig { params(commit_sha: String, file_path: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
-        def extract_version_from_commit(commit_sha, file_path)
-          show_cmd = ["git", "show", "#{commit_sha}:#{file_path}"]
-
-          file_content = Dependabot::SharedHelpers.run_shell_command(show_cmd.join(" "))
-          parsed_json = JSON.parse(file_content)
-
-          version = parsed_json["version"]
-          port_version = parsed_json["port-version"] || 0
-
-          return nil unless version
-
-          # Combine version and port-version
-          full_version = port_version.zero? ? version : "#{version}##{port_version}"
-
-          {
-            version: version,
-            port_version: port_version,
-            full_version: full_version,
-            commit_date: get_commit_date(commit_sha)
-          }
-        rescue JSON::ParserError => e
-          Dependabot.logger.warn("Failed to parse vcpkg.json for commit #{commit_sha}: #{e.message}")
-          nil
-        rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
-          Dependabot.logger.warn("Failed to show file #{file_path} for commit #{commit_sha}: #{e.message}")
-          nil
-        end
-
-        sig { params(commit_sha: String).returns(T.nilable(Time)) }
-        def get_commit_date(commit_sha)
-          date_cmd = ["git", "show", "--no-patch", "--format=%ci", commit_sha]
-          date_output = Dependabot::SharedHelpers.run_shell_command(date_cmd.join(" "))
-          Time.parse(date_output.strip)
-        rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
-          Dependabot.logger.warn("Failed to get commit date for #{commit_sha}: #{e.message}")
-          nil
-        rescue ArgumentError => e
-          Dependabot.logger.warn("Invalid date format for commit #{commit_sha}: #{e.message}")
-          nil
+          Dependabot::Package::PackageDetails.new(dependency: dependency, releases: releases)
         end
 
         sig { params(tag_info: T::Hash[Symbol, T.untyped]).returns(Dependabot::Package::PackageRelease) }
@@ -173,17 +105,27 @@ module Dependabot
           )
         end
 
-        sig { params(version_info: T::Hash[Symbol, T.untyped]).returns(Dependabot::Package::PackageRelease) }
-        def create_port_package_release(version_info)
+        sig do
+          params(
+            port_version: Dependabot::Vcpkg::Package::VersionsDatabase::PortVersion,
+            release_dates: T::Hash[String, Time]
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def create_port_package_release(port_version, release_dates)
+          version = port_version.version
+          git_tree = port_version.git_tree
+
           Dependabot::Package::PackageRelease.new(
-            version: Dependabot::Vcpkg::Version.new(version_info.fetch(:full_version)),
-            tag: version_info.fetch(:full_version),
-            url: "#{Vcpkg::VCPKG_DEFAULT_BASELINE_URL}/tree/#{version_info[:commit_sha]}/ports/#{dependency.name}",
-            released_at: version_info[:commit_date],
+            version: version,
+            tag: version.to_s,
+            url: "#{Vcpkg::VCPKG_DEFAULT_REGISTRY_REPOSITORY}/tree/" \
+                 "#{Vcpkg::VCPKG_DEFAULT_BASELINE_DEFAULT_BRANCH}/ports/#{dependency.name}",
+            released_at: git_tree && release_dates[git_tree],
             details: {
-              "commit_sha" => version_info[:commit_sha],
-              "base_version" => version_info[:version],
-              "port_version" => version_info[:port_version]
+              "scheme" => port_version.scheme,
+              "base_version" => version.text,
+              "port_version" => version.port_version,
+              "git_tree" => git_tree
             }
           )
         end