Class: Dependabot::UpdateCheckers::Base

Inherits:
Object
  • Object
show all
Defined in:
lib/dependabot/update_checkers/base.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(dependency:, dependency_files:, repo_contents_path: nil, credentials:, ignored_versions: [], raise_on_ignored: false, security_advisories: [], requirements_update_strategy: nil) ⇒ Base

Returns a new instance of Base.


14
15
16
17
18
19
20
21
22
23
24
25
26
# File 'lib/dependabot/update_checkers/base.rb', line 14

def initialize(dependency:, dependency_files:, repo_contents_path: nil,
               credentials:, ignored_versions: [],
               raise_on_ignored: false, security_advisories: [],
               requirements_update_strategy: nil)
  @dependency = dependency
  @dependency_files = dependency_files
  @repo_contents_path = repo_contents_path
  @credentials = credentials
  @requirements_update_strategy = requirements_update_strategy
  @ignored_versions = ignored_versions
  @raise_on_ignored = raise_on_ignored
  @security_advisories = security_advisories
end

Instance Attribute Details

#credentialsObject (readonly)

Returns the value of attribute credentials


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def credentials
  @credentials
end

#dependencyObject (readonly)

Returns the value of attribute dependency


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def dependency
  @dependency
end

#dependency_filesObject (readonly)

Returns the value of attribute dependency_files


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def dependency_files
  @dependency_files
end

#ignored_versionsObject (readonly)

Returns the value of attribute ignored_versions


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def ignored_versions
  @ignored_versions
end

#raise_on_ignoredObject (readonly)

Returns the value of attribute raise_on_ignored


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def raise_on_ignored
  @raise_on_ignored
end

#repo_contents_pathObject (readonly)

Returns the value of attribute repo_contents_path


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def repo_contents_path
  @repo_contents_path
end

#requirements_update_strategyObject (readonly)

Returns the value of attribute requirements_update_strategy


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def requirements_update_strategy
  @requirements_update_strategy
end

#security_advisoriesObject (readonly)

Returns the value of attribute security_advisories


10
11
12
# File 'lib/dependabot/update_checkers/base.rb', line 10

def security_advisories
  @security_advisories
end

Instance Method Details

#can_update?(requirements_to_unlock:) ⇒ Boolean

Returns:

  • (Boolean)

36
37
38
39
40
41
42
43
44
45
46
47
48
# File 'lib/dependabot/update_checkers/base.rb', line 36

def can_update?(requirements_to_unlock:)
  # Can't update if all versions are being ignored
  return false if ignore_reqs.include?(requirement_class.new(">= 0"))

  if dependency.version
    version_can_update?(requirements_to_unlock: requirements_to_unlock)
  else
    # TODO: Handle full unlock updates for dependencies without a lockfile
    return false if requirements_to_unlock == :none

    requirements_can_update?
  end
end

#conflicting_dependenciesArray<Hash{String => String}] name [String] the blocking dependencies name version [String] the version of the blocking dependency requirement [String] the requirement on the target_dependency

Finds any dependencies in the lockfile that have a subdependency on the given dependency that do not satisfy the target_version.

Returns:

  • (Array<Hash{String => String}] name [String] the blocking dependencies name version [String] the version of the blocking dependency requirement [String] the requirement on the target_dependency)

    Array<Hash=> String] name [String] the blocking dependencies name version [String] the version of the blocking dependency requirement [String] the requirement on the target_dependency


100
101
102
# File 'lib/dependabot/update_checkers/base.rb', line 100

def conflicting_dependencies
  [] # return an empty array for ecosystems that don't support this yet
end

#latest_resolvable_previous_version(_updated_version) ⇒ Object


104
105
106
# File 'lib/dependabot/update_checkers/base.rb', line 104

def latest_resolvable_previous_version(_updated_version)
  dependency.version
end

#latest_resolvable_versionObject

Raises:

  • (NotImplementedError)

76
77
78
# File 'lib/dependabot/update_checkers/base.rb', line 76

def latest_resolvable_version
  raise NotImplementedError
end

#latest_resolvable_version_with_no_unlockObject

Raises:

  • (NotImplementedError)

90
91
92
# File 'lib/dependabot/update_checkers/base.rb', line 90

def latest_resolvable_version_with_no_unlock
  raise NotImplementedError
end

#latest_versionObject

Raises:

  • (NotImplementedError)

61
62
63
# File 'lib/dependabot/update_checkers/base.rb', line 61

def latest_version
  raise NotImplementedError
end

#lowest_resolvable_security_fix_versionObject

Raises:

  • (NotImplementedError)

86
87
88
# File 'lib/dependabot/update_checkers/base.rb', line 86

def lowest_resolvable_security_fix_version
  raise NotImplementedError
end

#lowest_security_fix_versionDependabot::<package manager>::Version, #to_s

Lowest available security fix version not checking resolvability

Returns:

  • (Dependabot::<package manager>::Version, #to_s)

    version class

Raises:

  • (NotImplementedError)

82
83
84
# File 'lib/dependabot/update_checkers/base.rb', line 82

def lowest_security_fix_version
  raise NotImplementedError
end

#preferred_resolvable_versionObject


65
66
67
68
69
70
71
72
73
74
# File 'lib/dependabot/update_checkers/base.rb', line 65

def preferred_resolvable_version
  # If this dependency is vulnerable, prefer trying to update to the
  # lowest_resolvable_security_fix_version. Otherwise update all the way
  # to the latest_resolvable_version.
  return lowest_resolvable_security_fix_version if vulnerable?

  latest_resolvable_version
rescue NotImplementedError
  latest_resolvable_version
end

#requirement_classObject


116
117
118
# File 'lib/dependabot/update_checkers/base.rb', line 116

def requirement_class
  Utils.requirement_class_for_package_manager(dependency.package_manager)
end

#requirements_unlocked_or_can_be?Boolean

For some langauges, the manifest file may be constructed such that Dependabot has no way to update it (e.g., if it fetches its versions from a web API). This method is overridden in those cases.

Returns:

  • (Boolean)

123
124
125
# File 'lib/dependabot/update_checkers/base.rb', line 123

def requirements_unlocked_or_can_be?
  true
end

#up_to_date?Boolean

Returns:

  • (Boolean)

28
29
30
31
32
33
34
# File 'lib/dependabot/update_checkers/base.rb', line 28

def up_to_date?
  if dependency.version
    version_up_to_date?
  else
    requirements_up_to_date?
  end
end

#updated_dependencies(requirements_to_unlock:) ⇒ Object


50
51
52
53
54
55
56
57
58
59
# File 'lib/dependabot/update_checkers/base.rb', line 50

def updated_dependencies(requirements_to_unlock:)
  return [] unless can_update?(requirements_to_unlock: requirements_to_unlock)

  case requirements_to_unlock&.to_sym
  when :none then [updated_dependency_without_unlock]
  when :own then [updated_dependency_with_own_req_unlock]
  when :all then updated_dependencies_after_full_unlock
  else raise "Unknown unlock level '#{requirements_to_unlock}'"
  end
end

#updated_requirementsObject

Raises:

  • (NotImplementedError)

108
109
110
# File 'lib/dependabot/update_checkers/base.rb', line 108

def updated_requirements
  raise NotImplementedError
end

#version_classObject


112
113
114
# File 'lib/dependabot/update_checkers/base.rb', line 112

def version_class
  Utils.version_class_for_package_manager(dependency.package_manager)
end

#vulnerable?Boolean

Returns:

  • (Boolean)

127
128
129
130
131
132
133
134
135
136
137
138
139
# File 'lib/dependabot/update_checkers/base.rb', line 127

def vulnerable?
  return false if security_advisories.none?

  # Can't (currently) detect whether dependencies without a version
  # (i.e., for repos without a lockfile) are vulnerable
  return false unless dependency.version

  # Can't (currently) detect whether git dependencies are vulnerable
  return false if existing_version_is_sha?

  version = version_class.new(dependency.version)
  security_advisories.any? { |a| a.vulnerable?(version) }
end