Skip to content

Commit 2b2aa60

Browse files
yeikelyeikel
authored
Merge branch 'main' into refactor-api-client
2 parents be61630 + 13929b9 commit 2b2aa60

File tree

6 files changed

+283
-180
lines changed

6 files changed

+283
-180
lines changed

‎Gemfile.lock‎

Lines changed: 87 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
PATH
22
remote: bun
33
specs:
4-
dependabot-bun (0.331.0)
5-
dependabot-common (= 0.331.0)
4+
dependabot-bun (0.332.0)
5+
dependabot-common (= 0.332.0)
66

77
PATH
88
remote: bundler
99
specs:
10-
dependabot-bundler (0.331.0)
11-
dependabot-common (= 0.331.0)
10+
dependabot-bundler (0.332.0)
11+
dependabot-common (= 0.332.0)
1212
parallel (~> 1.24)
1313

1414
PATH
1515
remote: cargo
1616
specs:
17-
dependabot-cargo (0.331.0)
18-
dependabot-common (= 0.331.0)
17+
dependabot-cargo (0.332.0)
18+
dependabot-common (= 0.332.0)
1919

2020
PATH
2121
remote: common
2222
specs:
23-
dependabot-common (0.331.0)
23+
dependabot-common (0.332.0)
2424
aws-sdk-codecommit (~> 1.28)
2525
aws-sdk-ecr (~> 1.5)
2626
bundler (>= 1.16, < 3.0.0)
@@ -46,151 +46,151 @@ PATH
4646
PATH
4747
remote: composer
4848
specs:
49-
dependabot-composer (0.331.0)
50-
dependabot-common (= 0.331.0)
49+
dependabot-composer (0.332.0)
50+
dependabot-common (= 0.332.0)
5151

5252
PATH
5353
remote: conda
5454
specs:
55-
dependabot-conda (0.331.0)
56-
dependabot-common (= 0.331.0)
57-
dependabot-python (= 0.331.0)
55+
dependabot-conda (0.332.0)
56+
dependabot-common (= 0.332.0)
57+
dependabot-python (= 0.332.0)
5858

5959
PATH
6060
remote: devcontainers
6161
specs:
62-
dependabot-devcontainers (0.331.0)
63-
dependabot-common (= 0.331.0)
62+
dependabot-devcontainers (0.332.0)
63+
dependabot-common (= 0.332.0)
6464

6565
PATH
6666
remote: docker_compose
6767
specs:
68-
dependabot-docker_compose (0.331.0)
69-
dependabot-common (= 0.331.0)
70-
dependabot-docker (= 0.331.0)
68+
dependabot-docker_compose (0.332.0)
69+
dependabot-common (= 0.332.0)
70+
dependabot-docker (= 0.332.0)
7171

7272
PATH
7373
remote: docker
7474
specs:
75-
dependabot-docker (0.331.0)
76-
dependabot-common (= 0.331.0)
75+
dependabot-docker (0.332.0)
76+
dependabot-common (= 0.332.0)
7777

7878
PATH
7979
remote: dotnet_sdk
8080
specs:
81-
dependabot-dotnet_sdk (0.331.0)
82-
dependabot-common (= 0.331.0)
81+
dependabot-dotnet_sdk (0.332.0)
82+
dependabot-common (= 0.332.0)
8383

8484
PATH
8585
remote: elm
8686
specs:
87-
dependabot-elm (0.331.0)
88-
dependabot-common (= 0.331.0)
87+
dependabot-elm (0.332.0)
88+
dependabot-common (= 0.332.0)
8989

9090
PATH
9191
remote: git_submodules
9292
specs:
93-
dependabot-git_submodules (0.331.0)
94-
dependabot-common (= 0.331.0)
93+
dependabot-git_submodules (0.332.0)
94+
dependabot-common (= 0.332.0)
9595
parseconfig (~> 1.0, < 1.1.0)
9696

9797
PATH
9898
remote: github_actions
9999
specs:
100-
dependabot-github_actions (0.331.0)
101-
dependabot-common (= 0.331.0)
100+
dependabot-github_actions (0.332.0)
101+
dependabot-common (= 0.332.0)
102102

103103
PATH
104104
remote: go_modules
105105
specs:
106-
dependabot-go_modules (0.331.0)
107-
dependabot-common (= 0.331.0)
106+
dependabot-go_modules (0.332.0)
107+
dependabot-common (= 0.332.0)
108108

109109
PATH
110110
remote: gradle
111111
specs:
112-
dependabot-gradle (0.331.0)
113-
dependabot-common (= 0.331.0)
114-
dependabot-maven (= 0.331.0)
112+
dependabot-gradle (0.332.0)
113+
dependabot-common (= 0.332.0)
114+
dependabot-maven (= 0.332.0)
115115

116116
PATH
117117
remote: helm
118118
specs:
119-
dependabot-helm (0.331.0)
120-
dependabot-common (= 0.331.0)
121-
dependabot-docker (= 0.331.0)
119+
dependabot-helm (0.332.0)
120+
dependabot-common (= 0.332.0)
121+
dependabot-docker (= 0.332.0)
122122

123123
PATH
124124
remote: hex
125125
specs:
126-
dependabot-hex (0.331.0)
127-
dependabot-common (= 0.331.0)
126+
dependabot-hex (0.332.0)
127+
dependabot-common (= 0.332.0)
128128

129129
PATH
130130
remote: maven
131131
specs:
132-
dependabot-maven (0.331.0)
133-
dependabot-common (= 0.331.0)
132+
dependabot-maven (0.332.0)
133+
dependabot-common (= 0.332.0)
134134

135135
PATH
136136
remote: npm_and_yarn
137137
specs:
138-
dependabot-npm_and_yarn (0.331.0)
139-
dependabot-common (= 0.331.0)
138+
dependabot-npm_and_yarn (0.332.0)
139+
dependabot-common (= 0.332.0)
140140

141141
PATH
142142
remote: nuget
143143
specs:
144-
dependabot-nuget (0.331.0)
145-
dependabot-common (= 0.331.0)
144+
dependabot-nuget (0.332.0)
145+
dependabot-common (= 0.332.0)
146146

147147
PATH
148148
remote: pub
149149
specs:
150-
dependabot-pub (0.331.0)
151-
dependabot-common (= 0.331.0)
150+
dependabot-pub (0.332.0)
151+
dependabot-common (= 0.332.0)
152152

153153
PATH
154154
remote: python
155155
specs:
156-
dependabot-python (0.331.0)
157-
dependabot-common (= 0.331.0)
156+
dependabot-python (0.332.0)
157+
dependabot-common (= 0.332.0)
158158

159159
PATH
160160
remote: rust_toolchain
161161
specs:
162-
dependabot-rust_toolchain (0.331.0)
163-
dependabot-common (= 0.331.0)
162+
dependabot-rust_toolchain (0.332.0)
163+
dependabot-common (= 0.332.0)
164164

165165
PATH
166166
remote: silent
167167
specs:
168-
dependabot-silent (0.331.0)
169-
dependabot-common (= 0.331.0)
168+
dependabot-silent (0.332.0)
169+
dependabot-common (= 0.332.0)
170170

171171
PATH
172172
remote: swift
173173
specs:
174-
dependabot-swift (0.331.0)
175-
dependabot-common (= 0.331.0)
174+
dependabot-swift (0.332.0)
175+
dependabot-common (= 0.332.0)
176176

177177
PATH
178178
remote: terraform
179179
specs:
180-
dependabot-terraform (0.331.0)
181-
dependabot-common (= 0.331.0)
180+
dependabot-terraform (0.332.0)
181+
dependabot-common (= 0.332.0)
182182

183183
PATH
184184
remote: uv
185185
specs:
186-
dependabot-uv (0.331.0)
187-
dependabot-common (= 0.331.0)
186+
dependabot-uv (0.332.0)
187+
dependabot-common (= 0.332.0)
188188

189189
PATH
190190
remote: vcpkg
191191
specs:
192-
dependabot-vcpkg (0.331.0)
193-
dependabot-common (= 0.331.0)
192+
dependabot-vcpkg (0.332.0)
193+
dependabot-common (= 0.332.0)
194194

195195
GEM
196196
remote: https://rubygems.org/
@@ -497,34 +497,34 @@ CHECKSUMS
497497
csv (3.3.0) sha256=0bbd1defdc31134abefed027a639b3723c2753862150f4c3ee61cab71b20d67d
498498
date (3.4.1) sha256=bf268e14ef7158009bfeaec40b5fa3c7271906e88b196d958a89d4b408abe64f
499499
debug (1.9.2) sha256=48e026c0852c7a10c60263e2e527968308958e266231e36d64e3efcabec7e7fc
500-
dependabot-bun (0.331.0)
501-
dependabot-bundler (0.331.0)
502-
dependabot-cargo (0.331.0)
503-
dependabot-common (0.331.0)
504-
dependabot-composer (0.331.0)
505-
dependabot-conda (0.331.0)
506-
dependabot-devcontainers (0.331.0)
507-
dependabot-docker (0.331.0)
508-
dependabot-docker_compose (0.331.0)
509-
dependabot-dotnet_sdk (0.331.0)
510-
dependabot-elm (0.331.0)
511-
dependabot-git_submodules (0.331.0)
512-
dependabot-github_actions (0.331.0)
513-
dependabot-go_modules (0.331.0)
514-
dependabot-gradle (0.331.0)
515-
dependabot-helm (0.331.0)
516-
dependabot-hex (0.331.0)
517-
dependabot-maven (0.331.0)
518-
dependabot-npm_and_yarn (0.331.0)
519-
dependabot-nuget (0.331.0)
520-
dependabot-pub (0.331.0)
521-
dependabot-python (0.331.0)
522-
dependabot-rust_toolchain (0.331.0)
523-
dependabot-silent (0.331.0)
524-
dependabot-swift (0.331.0)
525-
dependabot-terraform (0.331.0)
526-
dependabot-uv (0.331.0)
527-
dependabot-vcpkg (0.331.0)
500+
dependabot-bun (0.332.0)
501+
dependabot-bundler (0.332.0)
502+
dependabot-cargo (0.332.0)
503+
dependabot-common (0.332.0)
504+
dependabot-composer (0.332.0)
505+
dependabot-conda (0.332.0)
506+
dependabot-devcontainers (0.332.0)
507+
dependabot-docker (0.332.0)
508+
dependabot-docker_compose (0.332.0)
509+
dependabot-dotnet_sdk (0.332.0)
510+
dependabot-elm (0.332.0)
511+
dependabot-git_submodules (0.332.0)
512+
dependabot-github_actions (0.332.0)
513+
dependabot-go_modules (0.332.0)
514+
dependabot-gradle (0.332.0)
515+
dependabot-helm (0.332.0)
516+
dependabot-hex (0.332.0)
517+
dependabot-maven (0.332.0)
518+
dependabot-npm_and_yarn (0.332.0)
519+
dependabot-nuget (0.332.0)
520+
dependabot-pub (0.332.0)
521+
dependabot-python (0.332.0)
522+
dependabot-rust_toolchain (0.332.0)
523+
dependabot-silent (0.332.0)
524+
dependabot-swift (0.332.0)
525+
dependabot-terraform (0.332.0)
526+
dependabot-uv (0.332.0)
527+
dependabot-vcpkg (0.332.0)
528528
diff-lcs (1.6.2) sha256=9ae0d2cba7d4df3075fe8cd8602a8604993efc0dfa934cff568969efb1909962
529529
docile (1.4.0) sha256=5f1734bde23721245c20c3d723e76c104208e1aa01277a69901ce770f0ebb8d3
530530
docker_registry2 (1.18.2) sha256=2ace909110fbca29d69dd1cdec99f555024aa6f6577798638139c8e8e556910f

‎common/lib/dependabot.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22
# frozen_string_literal: true
33

44
module Dependabot
5-
VERSION = "0.331.0"
5+
VERSION = "0.332.0"
66
end

‎conda/lib/dependabot/conda/update_checker.rb‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,19 +135,26 @@ def latest_version_finder
135135
def fetch_lowest_resolvable_security_fix_version
136136
# Delegate to latest_version_finder for security fix resolution
137137
# This leverages Python ecosystem's security advisory infrastructure
138-
latest_version_finder.lowest_security_fix_version
138+
fix_version = latest_version_finder.lowest_security_fix_version
139+
140+
# If no security fix version is found, fall back to latest_resolvable_version
141+
if fix_version.nil?
142+
fallback = latest_resolvable_version
143+
return fallback.is_a?(String) ? Dependabot::Conda::Version.new(fallback) : fallback
144+
end
145+
146+
fix_version
139147
end
140148

141149
sig { override.returns(T::Boolean) }
142150
def latest_version_resolvable_with_full_unlock?
143-
# For Phase 3, return false as placeholder since we're not doing full dependency resolution
151+
# No lock file support for Conda
144152
false
145153
end
146154

147155
sig { override.returns(T::Array[Dependabot::Dependency]) }
148156
def updated_dependencies_after_full_unlock
149-
# For Phase 3, return empty array as placeholder
150-
[]
157+
raise NotImplementedError
151158
end
152159

153160
sig { params(requirement_string: String, new_version: String).returns(String) }

‎conda/lib/dependabot/conda/update_checker/latest_version_finder.rb‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ def python_latest_version_finder
5454
credentials: credentials,
5555
ignored_versions: ignored_versions,
5656
raise_on_ignored: @raise_on_ignored,
57-
security_advisories: security_advisories,
57+
security_advisories: python_compatible_security_advisories,
5858
cooldown_options: @cooldown_options
5959
),
6060
T.nilable(Dependabot::Python::UpdateChecker::LatestVersionFinder)
@@ -81,6 +81,28 @@ def python_compatible_requirements
8181
end
8282
end
8383

84+
sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
85+
def python_compatible_security_advisories
86+
security_advisories.map do |advisory|
87+
# Convert Conda requirements to Python requirements for pip compatibility
88+
python_vulnerable_versions = advisory.vulnerable_versions.flat_map do |conda_req|
89+
Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
90+
end
91+
92+
python_safe_versions = advisory.safe_versions.flat_map do |conda_req|
93+
Dependabot::Python::Requirement.requirements_array(conda_req.to_s)
94+
end
95+
96+
# Normalize security advisories to use 'pip' package manager for Python delegation
97+
Dependabot::SecurityAdvisory.new(
98+
dependency_name: advisory.dependency_name,
99+
package_manager: "pip", # Use pip for PyPI compatibility
100+
vulnerable_versions: python_vulnerable_versions,
101+
safe_versions: python_safe_versions
102+
)
103+
end
104+
end
105+
84106
sig { params(conda_requirement: T.nilable(String)).returns(T.nilable(String)) }
85107
def convert_conda_requirement_to_pip(conda_requirement)
86108
RequirementTranslator.conda_to_pip(conda_requirement)

0 commit comments

Comments
 (0)