secupdater 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3e2a3d2fd687a912cd17a2dab8216d5c7187693c5239ccfdeac56ce87a825ac
-  data.tar.gz: 6db3dd9e3f87b76f96e75b3849c9d447ac24a1f0ea31972d24a37cdc20437ee6
+  metadata.gz: 4f19feed6401e9c35fd600135fcd76372d6f2b1146648996958119ac0063d5e3
+  data.tar.gz: 7fa86bc7f193bbe245dd672f9b1b362e3227917ebd92a78e28792cd810dbae4d
 SHA512:
-  metadata.gz: 66aabee38119a94edf9f609ba05d6d8c59581a7994f3f8c3a089f836c8460af124a5a34b08f44418dd9588439b590204864970fad3faf492e05a885f605ae329
-  data.tar.gz: 3f8607eca5779819b70d6346365dfa70ec158af70bc9f5c8a3d6c2c3ea9bef3a53839708c9eee388ff942369cc5303c03af958db07013dfb9d85ec04d162155a
+  metadata.gz: c0577d54657596f3fd338660330dde5da2dbee749a2c1349570ee64706583663850b4c080b8caccb275e63e1bd439ac3576ae7b43570498f1d7f4f82de3339ca
+  data.tar.gz: 4e07f424812cd76787ffd12226fc15a26c1c2ccc2c1b1075da706e28d3496f9acaccfc39a90b1a48910502723355a2e6b28be7910c7f6c4ad7fb48143406c86c

data/lib/secupdater/ecosystem/rubygems.rb

@@ -68,7 +68,7 @@ module Secupdater
           advisory_id = advisory["id"] if advisory_id.empty?
 
           SecurityAdvisory.new(result["gem"]["name"], advisory_id, advisory["patched_versions"])
-        end
+        end.uniq # bundle-audit reports an advisory once per platform the gem is locked for
       end
 
       def satisfies_requirement?(version, requirement)

data/lib/secupdater/publisher/gitlab.rb

@@ -29,9 +29,12 @@ module Secupdater
 
           if branch_exists?(http)
             others = other_authors(http)
-            return [:skipped, "#{reference} has commits from #{others.join(", ")}, so it won't be updated"] if others.any?
+            if others.any?
+              explain_skipping(http, open_merge_request, others) if open_merge_request
+              return [:skipped, "#{reference} has commits from #{others.join(", ")}, so it won't be updated"]
+            end
 
-            up_to_date = branch_has_changes?(http)
+            up_to_date = branch_has_changes?(http) && !target_manifests_moved_on?(http)
             commit(http, force: true) unless up_to_date
           else
             commit(http)
@@ -39,7 +42,12 @@ module Secupdater
 
           if open_merge_request
             remember(open_merge_request)
-            return [:up_to_date, nil] if up_to_date
+
+            # e.g. when this update has since absorbed another dependency's advisories
+            described = open_merge_request["description"] == description
+            request(http, Net::HTTP::Put, "merge_requests/#{open_merge_request["iid"]}", { description: description }) unless described
+
+            return [:up_to_date, nil] if up_to_date && described
           else
             remember(JSON.parse(create_merge_request(http).body))
           end
@@ -84,8 +92,12 @@ module Secupdater
         request(http, Net::HTTP::Post, "repository/commits", data)
       end
 
+      # Against every dependency the MR fixes advisories for, so finish closes
+      # their own MRs once another update has absorbed them
       def remember(merge_request)
-        @current_merge_requests[bump.dependency.name] = merge_request["iid"]
+        [bump.dependency.name, *advisories.map(&:name)].uniq.each do
+          @current_merge_requests[it] = merge_request["iid"]
+        end
       end
 
       def find_open_secupdater_merge_requests(http)
@@ -93,6 +105,26 @@ module Secupdater
         JSON.parse(request(http, Net::HTTP::Get, "merge_requests?#{query}").body)
       end
 
+      # Hidden in the rendered comment; marks the comment so it's only posted once
+      SKIPPING_MARKER = "<!-- secupdater:skipping -->"
+
+      # Says on the MR, once, that secupdater has stopped updating it, so whoever
+      # committed knows rebasing and refreshing it is now up to them
+      def explain_skipping(http, merge_request, others)
+        notes_path = "merge_requests/#{merge_request["iid"]}/notes"
+        notes = JSON.parse(request(http, Net::HTTP::Get, "#{notes_path}?#{URI.encode_www_form(per_page: 100)}").body)
+        return if notes.any? { it.dig("author", "id") == own_user(http)["id"] && it["body"].to_s.include?(SKIPPING_MARKER) }
+
+        body = <<~BODY.chomp
+          #{SKIPPING_MARKER}
+          This branch has commits from #{others.join(", ")}, so secupdater won't update it any more, \
+          including rebasing it when `#{target_branch}` changes.
+
+          To hand it back, delete the branch, or force-push it without those commits, and secupdater will take it over on its next run.
+        BODY
+        request(http, Net::HTTP::Post, notes_path, { body: })
+      end
+
       def close_merge_request(http, iid, reason)
         request(http, Net::HTTP::Post, "merge_requests/#{iid}/notes", { body: reason })
         request(http, Net::HTTP::Put, "merge_requests/#{iid}", { state_event: "close" })
@@ -129,10 +161,12 @@ module Secupdater
       end
 
       def own_emails(http)
-        @own_emails ||= begin
-          user = JSON.parse(api_request(http, Net::HTTP::Get, "user").body)
-          user.values_at("email", "commit_email", "public_email").reject { it.nil? || it.empty? }
-        end
+        own_user(http).values_at("email", "commit_email", "public_email").reject { it.nil? || it.empty? }
+      end
+
+      # Whoever owns the access token
+      def own_user(http)
+        @own_user ||= JSON.parse(api_request(http, Net::HTTP::Get, "user").body)
       end
 
       def branch_has_changes?(http)
@@ -143,6 +177,17 @@ module Secupdater
         end
       end
 
+      # Whether a manifest has changed on the target branch since the branch was
+      # cut from it. The update can come out the same even then (e.g. when another
+      # MR made some of the same bumps), but the branch would show changes the
+      # target already has, and may conflict.
+      def target_manifests_moved_on?(http)
+        query = URI.encode_www_form(from: reference, to: start_sha)
+        diffs = JSON.parse(request(http, Net::HTTP::Get, "repository/compare?#{query}").body)["diffs"]
+
+        diffs.any? { ecosystem.manifest_paths.intersect?(it.values_at("old_path", "new_path")) }
+      end
+
       def request(http, type, path, data = nil, allow_missing: false)
         api_request(http, type, "projects/#{URI.encode_www_form_component(project_id)}/#{path}", data, allow_missing:)
       end

data/lib/secupdater/publisher.rb

@@ -30,7 +30,10 @@ module Secupdater
 
     def description
       heading = "Upgrade #{ecosystem.ecosystem_name} dependency #{bump.dependency.name} to version #{bump.to} to address the following security advisories:"
-      items = advisories.map { "* #{it.report_id}" }.join("\n")
+      # Advisories for other dependencies this update also fixes say which one
+      items = advisories.map do |advisory|
+        advisory.name == bump.dependency.name ? "* #{advisory.report_id}" : "* #{advisory.report_id} (#{advisory.name})"
+      end.join("\n")
       "#{heading}\n\n#{items}\n"
     end
     

data/lib/secupdater/update.rb

@@ -1,5 +1,12 @@
 module Secupdater
   class Update
+    # What updating one vulnerable dependency on its own came to, before anything
+    # is published. diff is every dependency the update moved, not just this one.
+    Candidate = Struct.new(:dependency, :advisories, :status, :message, :level, :bump, :diff, :file_changes, keyword_init: true) do
+      def name = dependency.name
+      def resolved? = status == :resolved
+    end
+
     attr_reader :logger, :ecosystem, :publisher, :original
 
     def initialize(logger, ecosystem, publisher: nil)
@@ -16,75 +23,148 @@ module Secupdater
       missing = deps_needing_checking.keys - original.keys
       raise Secupdater::Error, "Advisories for dependencies not in the lockfile: #{missing.join(', ')}" if missing.any?
 
-      results = deps_needing_checking.to_h do |name, dep_advisories|
-        [name, update_dependency(original[name], dep_advisories)]
+      candidates = deps_needing_checking.to_h do |name, dep_advisories|
+        [name, try_update(original[name], dep_advisories)]
       end
 
+      results = publish(candidates)
+
       publisher&.finish(deps_needing_checking.keys)&.each { logger.info it }
 
-      results
+      deps_needing_checking.keys.to_h { [it, results.fetch(it)] }
     end
 
-    def update_dependency(dep, advisories)
-      logger.info("starting update for #{dep.name}, #{advisories.length} advisories")
+    private
 
-      status = message = nil
+    def try_update(dep, advisories)
+      logger.info("starting update for #{dep.name}, #{advisories.length} advisories")
 
       levels = ecosystem.update_levels
+      candidate = nil
 
       levels.each do |level|
-        status, message = attempt_update(dep, advisories, level)
-        return status unless message
+        candidate = attempt_update(dep, advisories, level)
+        return candidate if candidate.resolved?
 
-        logger.debug "#{level} update: #{message}" unless level == levels.last
+        logger.debug "#{level} update: #{candidate.message}" unless level == levels.last
       end
 
-      if status == :failed
-        logger.error message
-      else
-        logger.warn message
-      end
-
-      status
+      candidate
     rescue Secupdater::UnretryableUpdateFailed => e
-      logger.error "#{dep.name}: #{e.message}\n#{e.output}"
-      :failed
-    rescue Secupdater::PublishFailed => e
-      logger.error "#{dep.name}: #{e.message}"
-      :failed
+      Candidate.new(dependency: dep, advisories:, status: :failed, message: "#{dep.name}: #{e.message}\n#{e.output}")
     end
 
-    private
-
     def attempt_update(dep, advisories, level)
       file_changes = ecosystem.try_update(dep.name, level:)
-      bump = ecosystem.diff_snapshot(original, ecosystem.snapshot).detect { it.dependency.name == dep.name }
+      diff = ecosystem.diff_snapshot(original, ecosystem.snapshot)
+      bump = diff.detect { it.dependency.name == dep.name }
+      attempt = { dependency: dep, advisories:, level:, bump:, diff:, file_changes: }
 
-      return [:unchanged, "#{dep.name} didn't update (stuck at #{dep.version})"] unless bump
+      return Candidate.new(**attempt, status: :unchanged, message: "#{dep.name} didn't update (stuck at #{dep.version})") unless bump
 
-      resolved = advisories.all? do |advisory|
-        advisory.patched_versions.any? { ecosystem.satisfies_requirement?(bump.to, it) }
+      unless fixes?(bump, advisories)
+        return Candidate.new(**attempt, status: :unresolved, message: "#{dep.name} didn't update to a version that resolves the security warnings (went from #{bump.from} to #{bump.to})")
+      end
+
+      Candidate.new(**attempt, status: :resolved)
+    rescue Secupdater::UnretryableUpdateFailed
+      raise
+    rescue Secupdater::UpdateCommandFailed => e
+      Candidate.new(dependency: dep, advisories:, level:, status: :failed, message: "#{dep.name}: #{e.message}\n#{e.output}")
+    ensure
+      restore(file_changes)
+    end
+
+    # Publishes each update, with the advisories of any dependencies it absorbs.
+    # If an absorbing update is declined, the dependencies it absorbed are
+    # published without it (absorbing each other where they can).
+    def publish(candidates)
+      absorbed = absorptions(candidates)
+      results = {}
+
+      candidates.each_value do |candidate|
+        next if absorbed.key?(candidate.name)
+
+        covered = absorbed.filter_map { |name, absorber| candidates[name] if absorber == candidate.name }
+        results[candidate.name] = publish_candidate(candidate, covered)
+        next if covered.empty?
+
+        if results[candidate.name] == :declined
+          logger.info "#{candidate.name}'s update was declined, so updating #{covered.map(&:name).join(', ')} without it"
+          results.merge!(publish(covered.to_h { [it.name, it] }))
+        else
+          covered.each { results[it.name] = :absorbed }
+        end
       end
 
-      unless resolved
-        return [:unresolved, "#{dep.name} didn't update to a version that resolves the security warnings (went from #{bump.from} to #{bump.to})"]
+      results
+    end
+
+    # Which dependencies' updates go into another's MR, as { absorbed => absorber }.
+    # A absorbs B when A's update also moves B to a version that fixes all of B's
+    # advisories. The updates that cover the most go first, then by name so runs
+    # agree, and each dependency ends up in only one MR.
+    def absorptions(candidates)
+      resolved = candidates.values.select(&:resolved?)
+      covers = resolved.to_h do |candidate|
+        [candidate.name, candidates.values.select { it != candidate && covers?(candidate, it) }.map(&:name)]
+      end
+
+      absorbed = {}
+      covers.sort_by { |name, names| [-names.length, name] }.each do |name, names|
+        next if absorbed.key?(name)
+
+        names.each do |other|
+          absorbed[other] = name unless absorbed.key?(other) || absorbed.value?(other)
+        end
       end
+      absorbed
+    end
 
-      advisories.each do |advisory|
-        logger.info "upgrading #{dep.name} from #{bump.from} to #{bump.to} (#{level}) would resolve #{advisory}"
+    def covers?(candidate, other)
+      bump = candidate.diff.detect { it.dependency.name == other.name }
+      bump && (bump.to.nil? || fixes?(bump, other.advisories))
+    end
+
+    def fixes?(bump, advisories)
+      advisories.all? do |advisory|
+        advisory.patched_versions.any? { ecosystem.satisfies_requirement?(bump.to, it) }
+      end
+    end
+
+    def publish_candidate(candidate, covered)
+      unless candidate.resolved?
+        if candidate.status == :failed
+          logger.error candidate.message
+        else
+          logger.warn candidate.message
+        end
+        return candidate.status
       end
 
-      return [:resolved, nil] unless publisher
+      log_resolution(candidate, covered)
+
+      return :resolved unless publisher
 
-      status, message = publisher.call(ecosystem, bump, advisories, file_changes)
+      status, message = publisher.call(ecosystem, candidate.bump, candidate.advisories + covered.flat_map(&:advisories), candidate.file_changes)
       logger.warn message if message
-      [status, nil]
-    rescue Secupdater::UnretryableUpdateFailed
-      raise
-    rescue Secupdater::UpdateCommandFailed => e
-      [:failed, "#{dep.name}: #{e.message}\n#{e.output}"]
-    ensure
-      restore(file_changes)
+      status
+    rescue Secupdater::PublishFailed => e
+      logger.error "#{candidate.name}: #{e.message}"
+      :failed
+    end
+
+    def log_resolution(candidate, covered)
+      bump = candidate.bump
+      upgrade = "upgrading #{candidate.name} from #{bump.from} to #{bump.to} (#{candidate.level})"
+
+      candidate.advisories.each { logger.info "#{upgrade} would resolve #{it}" }
+
+      covered.each do |other|
+        other_bump = candidate.diff.detect { it.dependency.name == other.name }
+        moves = other_bump.to ? "moves #{other.name} from #{other_bump.from} to #{other_bump.to}" : "removes #{other.name}"
+        other.advisories.each { logger.info "#{upgrade} #{moves}, which would resolve #{it}" }
+      end
     end
 
     def restore(file_changes)

data/lib/secupdater/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Secupdater
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/spec/secupdater/ecosystem/rubygems_spec.rb

@@ -75,6 +75,21 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
         expect(rubygems.parse_advisories(StringIO.new(report.to_json)).map(&:report_id)).to eq(["RUBYSEC-2024-1"])
       end
     end
+
+    context "the same advisory reported once per platform the gem is locked for" do
+      let(:result) do
+        {
+          type: "unpatched_gem",
+          gem: { name: "nokogiri", version: "1.19.4" },
+          advisory: { id: "GHSA-3w22-6jfg-527w", ghsa: "3w22-6jfg-527w", patched_versions: [">= 1.19.5"] }
+        }
+      end
+      let(:report) { { results: [result, result] } }
+
+      it "returns it once" do
+        expect(rubygems.parse_advisories(StringIO.new(report.to_json)).map(&:report_id)).to eq(["ghsa/3w22-6jfg-527w"])
+      end
+    end
   end
 
   describe "#snapshot" do

data/spec/secupdater/publisher/gitlab_spec.rb

@@ -53,9 +53,17 @@ RSpec.describe Secupdater::Publisher::Gitlab do
       .to_return(status: 200, body: { commits: branch_commits }.to_json)
   end
 
+  let(:target_diffs_since_branch) { [] }
+
+  let!(:target_moved_on_stub) do
+    stub_request(:get, "#{project_api}/repository/compare")
+      .with(query: { from: "security/css_parser-1.1.0", to: "abc123" })
+      .to_return(status: 200, body: { commits: [], diffs: target_diffs_since_branch }.to_json)
+  end
+
   let!(:user_stub) do
     stub_request(:get, "#{api}/user")
-      .to_return(status: 200, body: { email: bot_email, commit_email: bot_email, public_email: "" }.to_json)
+      .to_return(status: 200, body: { id: 42, email: bot_email, commit_email: bot_email, public_email: "" }.to_json)
   end
 
   let!(:branch_file_stub) do
@@ -101,6 +109,30 @@ RSpec.describe Secupdater::Publisher::Gitlab do
       end
     end
 
+    context "with advisories for other gems the update also fixes" do
+      let(:advisories) do
+        [
+          Secupdater::SecurityAdvisory.new("css_parser", "cve/2024-0001", [">= 1.1.0"]),
+          Secupdater::SecurityAdvisory.new("addressable", "ghsa/abcd-efgh", [">= 2.9.0"])
+        ]
+      end
+
+      let!(:create_mr_stub) do
+        stub_request(:post, "#{project_api}/merge_requests")
+          .with(body: hash_including(
+            source_branch: "security/css_parser-1.1.0",
+            description: "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2024-0001\n* ghsa/abcd-efgh (addressable)\n"
+          ))
+          .to_return(status: 201, body: { iid: 9 }.to_json)
+      end
+
+      it "names the other gem against its advisories" do
+        publish
+
+        expect(create_mr_stub).to have_been_requested
+      end
+    end
+
     context "deleting a file" do
       let(:changes) { [Secupdater::FileChange.new("Gemfile.lock", "delete", nil, "xyz")] }
 
@@ -172,17 +204,56 @@ RSpec.describe Secupdater::Publisher::Gitlab do
     end
 
     context "an open MR, labelled or not" do
-      let(:existing_merge_requests) { [{ iid: 7, state: "opened", labels: [] }, { iid: 3, state: "closed", labels: ["secupdater"] }] }
+      let(:description) { "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2024-0001\n" }
+      let(:existing_merge_requests) { [{ iid: 7, state: "opened", labels: [], description: }, { iid: 3, state: "closed", labels: ["secupdater"] }] }
       let(:branch_exists) { true }
 
+      let!(:update_description_stub) do
+        stub_request(:put, "#{project_api}/merge_requests/7")
+          .with(body: { description: "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2024-0001\n" }, headers: headers)
+          .to_return(status: 200, body: "{}")
+      end
+
       context "whose branch already has these changes" do
         let(:branch_lockfile) { "abc" }
 
+        context "but whose description lists different advisories (e.g. the update has since absorbed another gem's)" do
+          let(:description) { "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2023-9999\n" }
+
+          it "updates the description, without committing" do
+            expect(publish).to eq([:published, nil])
+
+            expect(update_description_stub).to have_been_requested
+            expect(a_request(:post, "#{project_api}/repository/commits")).not_to have_been_made
+          end
+        end
+
         it "leaves it alone" do
           expect(publish).to eq([:up_to_date, nil])
 
           expect(a_request(:post, //)).not_to have_been_made
         end
+
+        context "but main has changed other files since the branch was cut" do
+          let(:target_diffs_since_branch) { [{ old_path: "app/models/user.rb", new_path: "app/models/user.rb" }] }
+
+          it "leaves it alone" do
+            expect(publish).to eq([:up_to_date, nil])
+
+            expect(a_request(:post, //)).not_to have_been_made
+          end
+        end
+
+        context "but main's Gemfile.lock has changed since the branch was cut (e.g. another MR made some of the same bumps)" do
+          let(:target_diffs_since_branch) { [{ old_path: "Gemfile.lock", new_path: "Gemfile.lock" }] }
+
+          it "replaces the branch's commit, from start_sha, so it doesn't show changes main already has" do
+            expect(publish).to eq([:published, nil])
+
+            expect(force_commit_stub).to have_been_requested
+            expect(create_mr_stub).not_to have_been_requested
+          end
+        end
       end
 
       context "whose branch is out of date" do
@@ -202,10 +273,72 @@ RSpec.describe Secupdater::Publisher::Gitlab do
           ]
         end
 
+        let(:existing_notes) { [] }
+
+        let!(:notes_stub) do
+          stub_request(:get, "#{project_api}/merge_requests/7/notes")
+            .with(query: { per_page: "100" }, headers: headers)
+            .to_return(status: 200, body: existing_notes.to_json)
+        end
+
+        let!(:comment_stub) do
+          stub_request(:post, "#{project_api}/merge_requests/7/notes")
+            .with(body: { body: <<~BODY.chomp }, headers: headers)
+              <!-- secupdater:skipping -->
+              This branch has commits from Jo Bloggs, so secupdater won't update it any more, including rebasing it when `main` changes.
+
+              To hand it back, delete the branch, or force-push it without those commits, and secupdater will take it over on its next run.
+            BODY
+            .to_return(status: 201, body: "{}")
+        end
+
         it "leaves the branch alone and says why" do
           expect(publish).to eq([:skipped, "security/css_parser-1.1.0 has commits from Jo Bloggs, so it won't be updated"])
 
-          expect(a_request(:post, //)).not_to have_been_made
+          expect(a_request(:post, "#{project_api}/repository/commits")).not_to have_been_made
+          expect(a_request(:put, //)).not_to have_been_made
+        end
+
+        it "comments on the MR to say secupdater has stopped updating it" do
+          publish
+
+          expect(comment_stub).to have_been_requested
+        end
+
+        context "when it has already said so" do
+          let(:existing_notes) do
+            [
+              { author: { id: 7 }, body: "Thanks, I've fixed the spec" },
+              { author: { id: 42 }, body: "<!-- secupdater:skipping -->\nThis branch has commits from Jo Bloggs…" }
+            ]
+          end
+
+          it "doesn't say it again" do
+            expect(publish.first).to eq(:skipped)
+
+            expect(a_request(:post, //)).not_to have_been_made
+          end
+        end
+
+        context "when only someone else has posted the marker (e.g. quoting it)" do
+          let(:existing_notes) { [{ author: { id: 7 }, body: "> <!-- secupdater:skipping -->" }] }
+
+          it "still says so" do
+            publish
+
+            expect(comment_stub).to have_been_requested
+          end
+        end
+      end
+
+      context "a branch without an MR, with a commit from someone else" do
+        let(:existing_merge_requests) { [] }
+        let(:branch_commits) { [{ author_name: "Jo Bloggs", author_email: "jo@example.com" }] }
+
+        it "skips it without commenting anywhere" do
+          expect(publish.first).to eq(:skipped)
+
+          expect(a_request(:any, %r{/notes})).not_to have_been_made
         end
       end
 
@@ -279,6 +412,32 @@ RSpec.describe Secupdater::Publisher::Gitlab do
       end
     end
 
+    context "an MR for a dependency whose advisories this run's MR for another dependency also fixes" do
+      let(:advisories) do
+        [
+          Secupdater::SecurityAdvisory.new("css_parser", "cve/2024-0001", [">= 1.1.0"]),
+          Secupdater::SecurityAdvisory.new("addressable", "ghsa/abcd-efgh", [">= 2.9.0"])
+        ]
+      end
+      let(:open_secupdater_merge_requests) do
+        [
+          { iid: 4, source_branch: "security/addressable-2.9.0" },
+          { iid: 9, source_branch: "security/css_parser-1.1.0" }
+        ]
+      end
+
+      before do
+        stub_request(:post, "#{project_api}/merge_requests").to_return(status: 201, body: { iid: 9 }.to_json)
+        publish
+      end
+
+      it "closes it, saying which MR superseded it" do
+        expect(gitlab.finish(["addressable", "css_parser"])).to eq(["closed !4 (security/addressable-2.9.0): Superseded by !9."])
+
+        expect(a_request(:put, //)).to have_been_made.once
+      end
+    end
+
     context "an MR for a dependency that no longer has advisories" do
       let(:open_secupdater_merge_requests) { [{ iid: 4, source_branch: "security/net-ssh-7.3.8" }] }
 

data/spec/secupdater/update_spec.rb

@@ -5,7 +5,8 @@ require "stringio"
 require "tmpdir"
 
 module UpdateSpec
-  # outcomes: gem name => version try_update moves it to, :unchanged, :fail, :fail_unretryable or :abort, or a hash of those by level
+  # outcomes: gem name => version try_update moves it to, a hash of gem name => version when the update
+  # moves other gems too, :unchanged, :fail, :fail_unretryable or :abort, or a hash of those by level
   class FakeEcosystem
     LOCKFILE = "Gemfile.lock"
 
@@ -35,7 +36,7 @@ module UpdateSpec
       attempts << [name, level]
 
       outcome = outcomes.fetch(name)
-      outcome = outcome.fetch(level) if outcome.is_a?(Hash)
+      outcome = outcome.fetch(level) if outcome.is_a?(Hash) && outcome.keys.all?(Symbol)
 
       case outcome
       when :fail
@@ -47,7 +48,8 @@ module UpdateSpec
       when :unchanged
         []
       else
-        after = JSON.generate(JSON.parse(before).merge(name => outcome))
+        moves = outcome.is_a?(Hash) ? outcome : { name => outcome }
+        after = JSON.generate(JSON.parse(before).merge(moves))
         File.write(LOCKFILE, after)
         [Secupdater::FileChange.new(LOCKFILE, "update", after, before)]
       end
@@ -382,6 +384,127 @@ RSpec.describe Secupdater::Update do
       end
     end
 
+    context "one gem's update also fixes other vulnerable gems (e.g. rails-html-sanitizer needing newer loofah and nokogiri)" do
+      let(:lockfile) { { "rails-html-sanitizer" => "1.0", "loofah" => "1.0", "nokogiri" => "1.0" } }
+      let(:outcomes) do
+        {
+          "rails-html-sanitizer" => { "rails-html-sanitizer" => "2.0", "loofah" => "2.0", "nokogiri" => "2.0" },
+          "loofah" => { "loofah" => "2.0", "nokogiri" => "2.0" },
+          "nokogiri" => "2.0"
+        }
+      end
+      let(:advisories) do
+        [advisory("loofah", "ghsa/l"), advisory("nokogiri", "ghsa/n1"), advisory("nokogiri", "ghsa/n2"), advisory("rails-html-sanitizer", "ghsa/r")]
+      end
+
+      it "publishes the update that covers the most, once, with every gem's advisories" do
+        update.call(advisories)
+
+        expect(published.length).to eq(1)
+
+        _, bump, advs, changes = published.first
+        expect(bump.dependency.name).to eq("rails-html-sanitizer")
+        expect(advs.map(&:report_id)).to contain_exactly("ghsa/r", "ghsa/l", "ghsa/n1", "ghsa/n2")
+        expect(JSON.parse(changes.first.content)).to eq("rails-html-sanitizer" => "2.0", "loofah" => "2.0", "nokogiri" => "2.0")
+      end
+
+      it "returns :absorbed for the gems it covers" do
+        expect(update.call(advisories)).to eq(
+          "loofah" => :absorbed,
+          "nokogiri" => :absorbed,
+          "rails-html-sanitizer" => :published
+        )
+      end
+
+      it "logs which of its moves resolves each of the other gems' advisories" do
+        update.call(advisories)
+
+        expect(log.string).to match(%r{^INFO upgrading rails-html-sanitizer from 1\.0 to 2\.0 \(patch\) moves loofah from 1\.0 to 2\.0, which would resolve loofah ghsa/l})
+      end
+
+      it "tells the publisher to tidy up every gem, so their own MRs get closed" do
+        update.call(advisories)
+
+        expect(publisher).to have_received(:finish).with(["loofah", "nokogiri", "rails-html-sanitizer"])
+      end
+
+      it "leaves the lockfile as it found it" do
+        update.call(advisories)
+
+        expect(lockfile_on_disk).to eq(lockfile)
+      end
+
+      context "and the covering update was declined" do
+        before do
+          allow(publisher).to receive(:call) do |*args|
+            published << args
+            args[1].dependency.name == "rails-html-sanitizer" ? [:declined, "security/rails-html-sanitizer-2.0 was closed in !7"] : [:published, nil]
+          end
+        end
+
+        it "publishes the other gems without it, still folding them together where it can" do
+          expect(update.call(advisories)).to eq(
+            "loofah" => :published,
+            "nokogiri" => :absorbed,
+            "rails-html-sanitizer" => :declined
+          )
+
+          loofah = published.find { it[1].dependency.name == "loofah" }
+          expect(loofah[2].map(&:report_id)).to contain_exactly("ghsa/l", "ghsa/n1", "ghsa/n2")
+        end
+      end
+
+      context "with no publisher (dry run)" do
+        let(:publisher) { nil }
+
+        it "returns :resolved for the covering gem and :absorbed for the others" do
+          expect(update.call(advisories)).to eq(
+            "loofah" => :absorbed,
+            "nokogiri" => :absorbed,
+            "rails-html-sanitizer" => :resolved
+          )
+        end
+      end
+    end
+
+    context "a gem whose own update fails, but another gem's update fixes it" do
+      let(:outcomes) { { "rack" => { "rack" => "2.1", "nokogiri" => "2.0" }, "nokogiri" => :fail } }
+
+      it "returns :absorbed for it, without logging its failure as an error" do
+        expect(update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])).to eq("rack" => :published, "nokogiri" => :absorbed)
+        expect(log.string).not_to match(/^ERROR/)
+      end
+    end
+
+    context "a gem's update moves another vulnerable gem, but not far enough to fix it" do
+      let(:outcomes) { { "rack" => { "rack" => "2.1", "nokogiri" => "1.5" }, "nokogiri" => "2.0" } }
+
+      it "publishes each separately" do
+        expect(update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])).to eq("rack" => :published, "nokogiri" => :published)
+
+        expect(published.map { [it[1].dependency.name, it[2].map(&:report_id)] }).to contain_exactly(["rack", ["cve/1"]], ["nokogiri", ["cve/2"]])
+      end
+    end
+
+    context "a gem's update fixes another gem, but doesn't fix its own advisories" do
+      let(:outcomes) { { "rack" => { "rack" => "1.5", "nokogiri" => "2.0" }, "nokogiri" => "2.0" } }
+
+      it "doesn't absorb anything into it" do
+        expect(update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])).to eq("rack" => :unresolved, "nokogiri" => :published)
+      end
+    end
+
+    context "two gems whose updates each fix the other" do
+      let(:outcomes) do
+        { "rack" => { "rack" => "2.1", "nokogiri" => "2.0" }, "nokogiri" => { "rack" => "2.1", "nokogiri" => "2.0" } }
+      end
+
+      it "publishes one of them, picked by name, so every run agrees" do
+        expect(update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])).to eq("rack" => :absorbed, "nokogiri" => :published)
+        expect(published.length).to eq(1)
+      end
+    end
+
     context "a mix of outcomes" do
       let(:lockfile) { { "rack" => "1.0", "nokogiri" => "1.0", "puma" => "1.0", "rails" => "1.0" } }
       let(:outcomes) { { "rack" => "2.1", "nokogiri" => "1.5", "puma" => :unchanged, "rails" => :fail } }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secupdater
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Ben Anderson