From cd4d1c90ea21115c5c2571b5ce46e7e72b3445fb Mon Sep 17 00:00:00 2001 From: Jon Ruskin Date: Fri, 7 Mar 2025 17:50:14 -0700 Subject: [PATCH 1/3] support ruby style requirements in gradle a requirement like `> 1.2.3+0.1.1` can be provided as part of an ignore condition --- gradle/lib/dependabot/gradle/requirement.rb | 17 +++++++++++------ .../spec/dependabot/gradle/requirement_spec.rb | 6 ++++++ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/gradle/lib/dependabot/gradle/requirement.rb b/gradle/lib/dependabot/gradle/requirement.rb index 274264ac8dc..f0ed2dd6ad2 100644 --- a/gradle/lib/dependabot/gradle/requirement.rb +++ b/gradle/lib/dependabot/gradle/requirement.rb @@ -16,6 +16,8 @@ class Requirement < Dependabot::Requirement quoted = OPS.keys.map { |k| Regexp.quote k }.join("|") PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{Gradle::Version::VERSION_PATTERN})\\s*".freeze, String) PATTERN = /\A#{PATTERN_RAW}\z/ + # Like PATTERN, but the leading operator is required + RUBY_STYLE_PATTERN = /\A\s*(#{quoted})\s*(#{Gradle::Version::VERSION_PATTERN})\s*\z/ sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) } def self.parse(obj) @@ -76,13 +78,16 @@ def convert_java_constraint_to_ruby_constraint(req_string) raise "Can't convert multiple Java reqs to a single Ruby one" end - # NOTE: Support ruby-style version requirements that are created from - # PR ignore conditions version_reqs = req_string.split(",").map(&:strip) - if req_string.include?(",") && !version_reqs.all? { |s| PATTERN.match?(s) } - convert_java_range_to_ruby_range(req_string) if req_string.include?(",") - else - version_reqs.map { |r| convert_java_equals_req_to_ruby(r) } + if version_reqs.length > 1 && !version_reqs.all? { |s| PATTERN.match?(s) } + return convert_java_range_to_ruby_range(req_string) + end + + version_reqs.map do |r| + # if an operator is already provided, use it + next r if r.match?(RUBY_STYLE_PATTERN) + + convert_java_equals_req_to_ruby(r) end end diff --git a/gradle/spec/dependabot/gradle/requirement_spec.rb b/gradle/spec/dependabot/gradle/requirement_spec.rb index 85f182fe97e..883257c7c5f 100644 --- a/gradle/spec/dependabot/gradle/requirement_spec.rb +++ b/gradle/spec/dependabot/gradle/requirement_spec.rb @@ -93,6 +93,12 @@ let(:requirement_string) { "~> 4.2.5, >= 4.2.5.1" } it { is_expected.to eq(described_class.new("~> 4.2.5", ">= 4.2.5.1")) } + + context "with dynamic version requirements" do + let(:requirement_string) { "~> 4.2.5+1.0.1, >= 4.2.5.1+1." } + + it { is_expected.to eq(described_class.new("~> 4.2.5+1.0.1, >= 4.2.5.1+1.")) } + end end end From 44ced48b491114f7ae16fb8537ffc1754c62c860 Mon Sep 17 00:00:00 2001 From: Jon Ruskin Date: Fri, 7 Mar 2025 18:03:36 -0700 Subject: [PATCH 2/3] support ruby style requirements in maven a requirement like `> 1.2.3+0.1.1` can be provided as part of an ignore condition --- maven/lib/dependabot/maven/requirement.rb | 17 +++++++++++------ maven/spec/dependabot/maven/requirement_spec.rb | 6 ++++++ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/maven/lib/dependabot/maven/requirement.rb b/maven/lib/dependabot/maven/requirement.rb index d473643c8f4..4aace48514e 100644 --- a/maven/lib/dependabot/maven/requirement.rb +++ b/maven/lib/dependabot/maven/requirement.rb @@ -16,6 +16,8 @@ class Requirement < Dependabot::Requirement OR_SYNTAX = /(?<=\]|\)),/ PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{Maven::Version::VERSION_PATTERN})\\s*".freeze PATTERN = /\A#{PATTERN_RAW}\z/ + # Like PATTERN, but the leading operator is required + RUBY_STYLE_PATTERN = /\A\s*(#{quoted})\s*(#{Maven::Version::VERSION_PATTERN})\s*\z/ def self.parse(obj) return ["=", Maven::Version.new(obj.to_s)] if obj.is_a?(Gem::Version) @@ -71,13 +73,16 @@ def convert_java_constraint_to_ruby_constraint(req_string) raise "Can't convert multiple Java reqs to a single Ruby one" end - # NOTE: Support ruby-style version requirements that are created from - # PR ignore conditions version_reqs = req_string.split(",").map(&:strip) - if req_string.include?(",") && !version_reqs.all? { |s| PATTERN.match?(s) } - convert_java_range_to_ruby_range(req_string) if req_string.include?(",") - else - version_reqs.map { |r| convert_java_equals_req_to_ruby(r) } + if version_reqs.length > 1 && !version_reqs.all? { |s| PATTERN.match?(s) } + return convert_java_range_to_ruby_range(req_string) + end + + version_reqs.map do |r| + # if an operator is already provided, use it + next r if r.match?(RUBY_STYLE_PATTERN) + + convert_java_equals_req_to_ruby(r) end end diff --git a/maven/spec/dependabot/maven/requirement_spec.rb b/maven/spec/dependabot/maven/requirement_spec.rb index 1d53a79979e..c2c8aaf7501 100644 --- a/maven/spec/dependabot/maven/requirement_spec.rb +++ b/maven/spec/dependabot/maven/requirement_spec.rb @@ -113,6 +113,12 @@ let(:requirement_string) { "~> 4.2.5, >= 4.2.5.1" } it { is_expected.to eq(described_class.new("~> 4.2.5", ">= 4.2.5.1")) } + + context "with dynamic version requirements" do + let(:requirement_string) { "~> 4.2.5+1.0.1, >= 4.2.5.1+1." } + + it { is_expected.to eq(described_class.new("~> 4.2.5+1.0.1, >= 4.2.5.1+1.")) } + end end end From 515970a3f62c2c1b1d6a49ba74d56546ff2af30a Mon Sep 17 00:00:00 2001 From: Jon Ruskin Date: Sat, 8 Mar 2025 21:53:30 -0700 Subject: [PATCH 3/3] update the maven version pattern to match the version parser The maven version parser was broadened in https://github.com/dependabot/dependabot-core/pull/10704, however VERSION_PATTERN was not updated to match. Looking at the version parser and the details of maven's ComparableVersion https://maven.apache.org/ref/3.5.2/maven-artifact/apidocs/org/apache/maven/artifact/versioning/ComparableVersion.html, it looks like "unlimited number of version components" means that the regex pattern can be simplified. --- maven/lib/dependabot/maven/version.rb | 2 +- maven/spec/dependabot/maven/requirement_spec.rb | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/maven/lib/dependabot/maven/version.rb b/maven/lib/dependabot/maven/version.rb index 39b16822e65..f075f420fea 100644 --- a/maven/lib/dependabot/maven/version.rb +++ b/maven/lib/dependabot/maven/version.rb @@ -24,7 +24,7 @@ class Version < Dependabot::Version VERSION_PATTERN = "[0-9a-zA-Z]+" \ '(?>\.[0-9a-zA-Z]*)*' \ - '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?' + '([_\-\+.][0-9A-Za-z]*)*' sig { returns(Dependabot::Maven::TokenBucket) } attr_accessor :token_bucket diff --git a/maven/spec/dependabot/maven/requirement_spec.rb b/maven/spec/dependabot/maven/requirement_spec.rb index c2c8aaf7501..6f5981de984 100644 --- a/maven/spec/dependabot/maven/requirement_spec.rb +++ b/maven/spec/dependabot/maven/requirement_spec.rb @@ -118,6 +118,12 @@ let(:requirement_string) { "~> 4.2.5+1.0.1, >= 4.2.5.1+1." } it { is_expected.to eq(described_class.new("~> 4.2.5+1.0.1, >= 4.2.5.1+1.")) } + + context "with additional semantic versioning" do + let(:requirement_string) { ">= 25-ea+5.a0" } + + its(:to_s) { is_expected.to eq(described_class.new(">= 25-ea+5.a0").to_s) } + end end end end