stefangr: - Github Plus

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jeff Widman jeff@jeffwidman.com

commit sha：7bd3c32a09bc7ff9e91b0bc6ff64d72af8ceed57

Add compatibility with composer v2.4+ (#6503)

When running the dependabot-script with DEBUG_HELPERS=true I saw this error:

PHP Deprecated:  Installer::setIgnorePlatformRequirements is deprecated since Composer 2.2, use setPlatformRequirementFilter instead. in /opt/composer/v2/vendor/composer/composer/src/Composer/Installer.php on line 1289

So this commit resolves the deprecations and also added a forward compatible change to disable the audit.

Applied changes:

Use eventDispatcher::setRunScripts instead of deprecated Installer::setRunScripts
Use Installer::setPlatformRequirementFilter instead of deprecated Installer::setIgnorePlatformRequirements
Use setAudit(false) if Installer has that method

Co-authored-by: Stefan Grootscholten stefan.grootscholten@tripolis.com

commit sha：b6bc36341f504c11399d902286b992f8506bb887

Fix typo to avoid test confusion (#6505)

commit sha：3b6c080800911d1c5a86569b2138555a498cf097

build(deps): bump composer/composer in /composer/helpers/v2

Bumps composer/composer from 2.3.9 to 2.4.1.

updated-dependencies:

dependency-name: composer/composer dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：e9525603685c23883a943b61a3c9d95e54211e4a

setAudit should always be present on composer >= 2.4

commit sha：e3875084e8787f7ec1c854128ef0b6b9078c877f

Merge pull request #5577 from dependabot/dependabot/composer/composer/helpers/v2/composer/composer-2.4.1

build(deps): bump composer/composer from 2.3.9 to 2.4.1 in /composer/helpers/v2

commit sha：572b08ef7f3e9f398de565d46cedcd8affd0934b

add missing if causing the updater-core to build for no reason (#6508)

commit sha：82096ce81a132947fab1e57eccf2faf985eb36e1

Fix two pending tests (#6194)

Per the discussion in https://github.com/dependabot/dependabot-core/pull/3319#discussion_r599482825, these only temporarily needed to be marked pending until https://github.com/dependabot/dependabot-core/pull/3327 was merged.

From the first thread it looks like the intent was to remove the pending marker, but that accidentally got overlooked.

So this removes the pending marker, and then fixes the failures:

The first was a straightforward change from method to hash value.
The second wasn't raising the expected error... However, this has been true since this code was originally committed (once #3327 was merged to make the test work). So I deleted the test as it added no value.

commit sha：7b41200ba5f12d60ef69dd8dc73c7759b35394ab

add missing CI tests for common and updater (#6504)

commit sha：2a91fed8467d5440b69be4abd9ca98a3160d8a59

build(deps): bump commonmarker from 0.23.6 to 0.23.7 in /updater (#6511)

Bumps commonmarker from 0.23.6 to 0.23.7.

updated-dependencies:

dependency-name: commonmarker dependency-type: indirect ...

Signed-off-by: dependabot[bot] support@github.com

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit sha：41e88cd4d70ac75eb4933f7b520d5d8ef72a0f60

build(deps-dev): bump rimraf in /npm_and_yarn/helpers (#6513)

Bumps rimraf from 4.1.1 to 4.1.2.

updated-dependencies:

dependency-name: rimraf dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit sha：8a65521fb5acdd753279003d577b9d31347e7406

build(deps-dev): bump jest in /npm_and_yarn/helpers (#6514)

Bumps jest from 29.3.1 to 29.4.0.

updated-dependencies:

dependency-name: jest dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit sha：6e72b1e591f2ba67c0ec153e3c8bc86ea34f5d18

Don't try to update path dependencies (#6084)

Since by definition they're at the latest version.

There were actually specs positively checking for this, but I believe they may have been an oversight. They were introduced when adding support for updating subdpendencies at b8010392313fa97dbbdb74792e3fafc7deb35d67, and I don't think this change regresses there.

commit sha：4334f028e048360ae2b4d19384f97c26ff3ca1f9

Fallback to github.com for actions source

There have been a few reported issues where Dependabot is attempting to source actions incorrectly from non-github.com sources. This implements a check and fallback so non-github sources will work, but will default to github.com if the non-github source is incorrect/inaccessible

commit sha：0eb40d5a97f4b060cd9f6365b9247b1247d77660

factor out the init so lint is happy

commit sha：c41270d862c962338f5b6228b80226e9a37b5a6a

I don't like this refactor. how can I do it better?

commit sha：7639d36a6fba716f4723384c12a92cabb44a47c1

Created at 1 month ago

delete branch

stefangr/dependabot-core

stefangr delete branch add-compatibility-with-composer-v2.4-v2.5

Created at 2 months ago

issue comment

dependabot/dependabot-core

Add compatibility with composer v2.4+

For simplicity of working across timezones / PR rebases, does the following sound reasonable?

1. Merge this

2. Rebase the Dependabot PR to bump `composer` to `2.5.x`

3. Add a commit remove the optional checks, such that `setAudit` is always called.

4. Merge... so hopefully we'll be back up to `composer` `latest` by EOD +1

That sounds completely reasonable. :+1:

Created at 2 months ago

pull request opened

dependabot/dependabot-core

Add compatibility with composer v2.4+

When running the dependabot-script with DEBUG_HELPERS=true I saw this error:

PHP Deprecated:  Installer::setIgnorePlatformRequirements is deprecated since Composer 2.2, use setPlatformRequirementFilter instead. in /opt/composer/v2/vendor/composer/composer/src/Composer/Installer.php on line 1289

In this PR I work around the deprecations (there was one more, which was not verbose) and also added a forward compatible change to disable the audit.

Applied changes:

Use eventDispatcher::setRunScripts instead of deprecated Installer::setRunScripts
Use Installer::setPlatformRequirementFilter instead of deprecated Installer::setIgnorePlatformRequirements
Use setAudit(false) if Installer has that method

Created at 2 months ago

create branch

stefangr/dependabot-core

stefangr create branch add-compatibility-with-composer-v2.4-v2.5

Created at 2 months ago

issue comment

getsentry/self-hosted

All Events tab doesn't work for issue with lots of events

Thanks for that. I tried it and the problem is persistent even with larger buffer sizes.

This call just worked in version 22.12.0 without having to change the nginx configuration.

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Fix RuboCop excludes not respected in the updater CI

In the Dockerfile.updater, the layout of rubocop configurations is the following:

~/.rubocop.yml
~/updater/.rubocop.yml

Note that this slightly differs from the setup of other "components" in the Dockerfile.ci. For example:

~/dependabot-core/.rubocop.yml
~/dependabot-core/bundler/.rubocop.yml

This subtle difference makes running the script/lint script in the updater's CI fail, so we had to workaround that by passing explicit folders to RuboCop (docker_bundle_exec rubocop lib/ spec/)

The reason is that in the updater CI, exclusions in the main RuboCop config are not correctly interpreted, because they are resolved using the current directory as a base, not the directory of the configuration file itself.

So the following exclusion

---
AllCops:
  DisplayCopNames: true
  Exclude:
  - "*/vendor/**/*"

is interpreted as ~/updater/*/vendor/**/*, so the stuff installed at ~/updater/vendor/**/* is not properly ignored.

The reason for this is that a ~/.rubocop.yml configuration (located at the HOME folder) has special behavior with respect to exclusions. Normally, this file is shared as a base configuration to be shared among all your applications, so the special behavior of making exclude patterns be based on the PWD instead of on the path to the configuration itself makes sense to me. BUT, it breaks our particular case.

For the curious, this is where RuboCop special cases this:

https://github.com/rubocop/rubocop/blob/a643eaaa00dd65ba5aacff98b027e5b5a40c1561/lib/rubocop/config.rb#L211-L224

The solution is to move the common configuration to live in the omnibus folder instead. This way, this special behavior does not affect us.

There were other alternatives like:

Keep the current workaround, but RuboCop also behaves specially when given explicit folders, so I think better to normalize things to avoid surprises.
Relax the current Exclude patterns to catch everything. That could work, but we leave the ~/.rubocop.yml file in place, but I believe the special behavior of this file will be likely to bite us again.

commit sha：0a134d15c2d0773999f2a3fe47c6c73b351cb2e8

Merge pull request #5609 from dependabot/deivid-rodriguez/fix-rubocop-excludes-not-respected

Fix RuboCop excludes not respected in the updater CI

commit sha：88960b99040757e5a32b5101389f59175866dcda

remove Dockerfile.ci since it is redundant (#6424)

Co-authored-by: David Rodríguez deivid.rodriguez@riseup.net

commit sha：40b4020daf95299f339dd07087daa44b4d0de2d5

fix git config not present for certain tests (#6431)

commit sha：9a941db3517eb407f00c5832c902a57a8762f1cb

Fix Nullpointer for Gradle Parsing

commit sha：85701862d465809eaab6c55d82ca77b2ecfeb280

Bump phpstan/phpstan from 1.9.8 to 1.9.11 in /composer/helpers/v2

Bumps phpstan/phpstan from 1.9.8 to 1.9.11.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：9e68286dd25629e1e8035fbd8a0d1a9cd52bfcf4

Bump @npmcli/arborist from 6.1.5 to 6.1.6 in /npm_and_yarn/helpers

Bumps @npmcli/arborist from 6.1.5 to 6.1.6.

updated-dependencies:

dependency-name: "@npmcli/arborist" dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：4224ac7983a1423aea1bbdc5d08efc64e05fcbb9

Update parallel_tests requirement from ~> 4.0.0 to ~> 4.1.0 in /omnibus

Updates the requirements on parallel_tests to permit the latest version.

updated-dependencies:

dependency-name: parallel_tests dependency-type: direct:development ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：197bfc6008be784cba6d62612d1a5381e5e54f09

Bump licensed from 4.0.1 to 4.0.2 in /updater

Bumps licensed from 4.0.1 to 4.0.2.

updated-dependencies:

dependency-name: licensed dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：6e8ef4346ab88d4b5c9bea87cc9b61f503fafd04

Bump phpstan/phpstan from 1.9.8 to 1.9.11 in /composer/helpers/v1

Bumps phpstan/phpstan from 1.9.8 to 1.9.11.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：0f31571d3c1c503f6efdd7a9594e312741d6da93

Bump rimraf from 3.0.2 to 4.0.7 in /npm_and_yarn/helpers

Bumps rimraf from 3.0.2 to 4.0.7.

updated-dependencies:

dependency-name: rimraf dependency-type: direct:development update-type: version-update:semver-major ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：35ee34083cb2f56da385338ea696217ffa18d94a

Bump prettier from 2.8.2 to 2.8.3 in /npm_and_yarn/helpers

Bumps prettier from 2.8.2 to 2.8.3.

updated-dependencies:

dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：c8e8f73541ec97d8c44f2bb569211420b0f68d20

Bump nock from 13.2.9 to 13.3.0 in /npm_and_yarn/helpers

Bumps nock from 13.2.9 to 13.3.0.

updated-dependencies:

dependency-name: nock dependency-type: direct:production update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：0aa174e4758a31bf9f08eea174945e628b5b71f9

Bump eslint from 8.31.0 to 8.32.0 in /npm_and_yarn/helpers

Bumps eslint from 8.31.0 to 8.32.0.

updated-dependencies:

dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：07ff8273f02211c834cc6fab7443b05559e97466

Update faraday requirement from = 2.7.2 to = 2.7.3 in /omnibus (#6449)

Updates the requirements on faraday to permit the latest version.

updated-dependencies:

dependency-name: faraday dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jeff Widman jeff@jeffwidman.com

commit sha：7b49aee37121d5066376a899bfafe98304de28ea

Remove duplicate sanitization

While working on https://github.com/dependabot/dependabot-core/pull/6434, I discovered that my prior change https://github.com/dependabot/dependabot-core/pull/6291/files#diff-82bee76077e5dbd4f3073948aa2ad29eec23333f9b4e06550fbf54c259875a24R343 was blowing up because error.message cannot be directly modified.

When I started to look how to change that, I realized that we already sanitize all URL credentials from any message at the global level:

https://github.com/dependabot/dependabot-core/pull/2828

So there's no need to sanitize here.

I compared the two regexes: https://github.com/dependabot/dependabot-core/blob/9a941db3517eb407f00c5832c902a57a8762f1cb/common/lib/dependabot/errors.rb#L7 https://github.com/dependabot/dependabot-core/blob/9a941db3517eb407f00c5832c902a57a8762f1cb/composer/lib/dependabot/composer/update_checker/version_resolver.rb#L526

and while they differ, they both strip username/password from the sensitive_error test case: https://github.com/dependabot/dependabot-core/blob/9a941db3517eb407f00c5832c902a57a8762f1cb/common/spec/helpers/test/run.rb#L11

I also grep'ed around, and we don't do creds sanitization for URLs in any other ecosystem... so it's best to remove this. If we do hear reports of unredacted creds getting into logs, then we certainly would rather fix at the global level regex, and not solely here in composer.

Also, from a GitHub security perspective, these creds never even make it to dependabot-core since we use a separate proxy for handling credentials... so this only affects users running dependabot-core on their own.

commit sha：0487f465d5f6c3cfd89ce455a7248ec0c9d9d098

Support Poetry group dependencies

Fixes #5766

commit sha：a5e540517b8a5c7e2356ae538e9a4597098479a3

Bump rspec and rspec-its to latest versions

commit sha：9df8aec3878641a139b9b63d94e43dbbb125c715

Instruct commonmarker not to format to HTML for bitbucket

commit sha：a563c04fb373bee50acfd000d6f6b38be6df0601

Added Ruby 3.2.0 to RubyRequirementSetter version requirements

commit sha：0c78810ae37e37b4c83c0cc711c629d7579ee124

Created at 2 months ago

opened issue

getsentry/self-hosted

All Events tab doesn't work for issue with lots of events

Self-Hosted Version

23.1.0

CPU Architecture

x86_64

Docker Version

20.10.23

Docker Compose Version

2.15.1

Steps to Reproduce

Have an issue with more than ~50 individual events
Open the "All events" tab

Expected Result

The all events page shows the list of all events paginated

Actual Result

The browser gets a HTTP 502 Bad Gateway returned.

The spinner animation on the "All events" tab is permanent.

Relevant nginx log output:

sentry-self-hosted-nginx-1                                     | 2023/01/20 07:28:12 [error] 27#27: *2985 upstream sent too big header while reading response header from upstream, client: yy.yy.yy.yy, server: , request: "GET /api/0/issues/13177/attachments/?per_page=50&types=event.minidump&event_id=d58d7624c3214558810510c8ec0e4e8c&event_id=241c7e629ba74abcae9bd4374095eae1&event_id=f77a3d03635e467688f10fc744395270&event_id=75d53c47b96c4194a1a6f6ba67f0f192&event_id=11784f253ffc41c6a656b1e47a06262d&event_id=9c2c886a05374dfabf7c0c58c97e661c&event_id=8719783fe3d74a2aa48587f705170cbc&event_id=bdf25f593208444d89934f6963a9b62a&event_id=8369b6c2408b42ae95f5b082de6dca0b&event_id=f4674866da5e43bbad4dc3003ece4124&event_id=4c50f2863cfc42aaa1d8ff4e4a7bc364&event_id=8d5bf7e16a72496b9fc7c2fa118b13b9&event_id=3c7b52123f284ea8806ab65b4c8e10e4&event_id=53df552adf254d47bd3f727e7d657342&event_id=d6bc29cb49004ce19ecd3e24a409dee1&event_id=a00b60bbb9d64634bd86944060058991&event_id=3e699fe3bf03439c9ed409aeb7a299ac&event_id=d0799b9456be46c59a8cd8ab443fff8b&event_id=59f5efa1af74495d8ac3ec767bd4d4b7&event_id=86d1528f022a4a9eae0ef7b825d09be7&event_id=76e5878ff51249be9230b888f1b70756&event_id=02279bb8966d4fb4857b2f59e9ebc08f&event_id=e1cd1684eeae48fcb7d15f15b4b2e3db&event_id=3542672ce48a401abb05740a54c8cfad&event_id=d18b40a3c3f740f798823ef8228a7eb5&event_id=8c43f7e36730440394f777dd834c09d8&event_id=cb7ed9d24b1645bdbf067f9814520dba&event_id=4d1350f02fdf4dd79dbe05f67a412ffe&event_id=c085713affa347f2ac5a740f6a80e46d&event_id=2f4ffc32960e4e6aa74961faea5eaf0b&event_id=90b1ba37848546948872c20bb475abd1&event_id=fe094d5a8197413c8bbc777140017fd4&event_id=eac8d43f1ab244838a00e2c85cda59a8&event_id=799c86012448496b9624db39e5d37a3f&event_id=a256fc31028245f5b6f1176b698fcc09&event_id=15e97942653a4ffe8d69cee68a4aedfc&event_id=7557606f2af94905a4b97e60b33b0e44&event_id=3bbc4b4346214bd3a9470166c923b429&event_id=1870a844883148b58d5ce2a922e379b9&event_id=1001faab384140ad90a8897186532295&event_id=6154f30380fd460292d205b6d44068a4&event_id=d9c514620d36413abdaacebbe7915444&event_id=18ac58cab74945a0b0beb1a70c71d55c&event_id=ffcd
sentry-self-hosted-nginx-1                                     | yy.yy.yy.yy - - [20/Jan/2023:07:28:12 +0000] "GET /api/0/issues/13177/attachments/?per_page=50&types=event.minidump&event_id=d58d7624c3214558810510c8ec0e4e8c&event_id=241c7e629ba74abcae9bd4374095eae1&event_id=f77a3d03635e467688f10fc744395270&event_id=75d53c47b96c4194a1a6f6ba67f0f192&event_id=11784f253ffc41c6a656b1e47a06262d&event_id=9c2c886a05374dfabf7c0c58c97e661c&event_id=8719783fe3d74a2aa48587f705170cbc&event_id=bdf25f593208444d89934f6963a9b62a&event_id=8369b6c2408b42ae95f5b082de6dca0b&event_id=f4674866da5e43bbad4dc3003ece4124&event_id=4c50f2863cfc42aaa1d8ff4e4a7bc364&event_id=8d5bf7e16a72496b9fc7c2fa118b13b9&event_id=3c7b52123f284ea8806ab65b4c8e10e4&event_id=53df552adf254d47bd3f727e7d657342&event_id=d6bc29cb49004ce19ecd3e24a409dee1&event_id=a00b60bbb9d64634bd86944060058991&event_id=3e699fe3bf03439c9ed409aeb7a299ac&event_id=d0799b9456be46c59a8cd8ab443fff8b&event_id=59f5efa1af74495d8ac3ec767bd4d4b7&event_id=86d1528f022a4a9eae0ef7b825d09be7&event_id=76e5878ff51249be9230b888f1b70756&event_id=02279bb8966d4fb4857b2f59e9ebc08f&event_id=e1cd1684eeae48fcb7d15f15b4b2e3db&event_id=3542672ce48a401abb05740a54c8cfad&event_id=d18b40a3c3f740f798823ef8228a7eb5&event_id=8c43f7e36730440394f777dd834c09d8&event_id=cb7ed9d24b1645bdbf067f9814520dba&event_id=4d1350f02fdf4dd79dbe05f67a412ffe&event_id=c085713affa347f2ac5a740f6a80e46d&event_id=2f4ffc32960e4e6aa74961faea5eaf0b&event_id=90b1ba37848546948872c20bb475abd1&event_id=fe094d5a8197413c8bbc777140017fd4&event_id=eac8d43f1ab244838a00e2c85cda59a8&event_id=799c86012448496b9624db39e5d37a3f&event_id=a256fc31028245f5b6f1176b698fcc09&event_id=15e97942653a4ffe8d69cee68a4aedfc&event_id=7557606f2af94905a4b97e60b33b0e44&event_id=3bbc4b4346214bd3a9470166c923b429&event_id=1870a844883148b58d5ce2a922e379b9&event_id=1001faab384140ad90a8897186532295&event_id=6154f30380fd460292d205b6d44068a4&event_id=d9c514620d36413abdaacebbe7915444&event_id=18ac58cab74945a0b0beb1a70c71d55c&event_id=ffcdbd5a18704d6aa492912e93abb147&event_id=263e3b9e9b7b41cabadda69f485e36d2&event_id=4765139fbd7f4129891ce64d3eba4567&event_id=b4a595b71a4249c09bfdad7a4d0d053b&event_id=177a622c76b44971b2048807bdabffa8&event_id=13f9622d6f654194875eeb7be3082168&event_id=7be914ef1be9455ea27c3043e3ed7448 HTTP/1.0" 502 150 "https://sentry.ourdomain.ext/organizations/organization-name/issues/13177/events/?project=3&referrer=issue-stream&sort=freq&statsPeriod=14d" "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0" "xx.xx.xx.xx"

Event ID

No response

Created at 2 months ago

create branch

stefangr/easy-coding-standard

stefangr create branch checkstyle-output-formatter

Created at 2 months ago

fork

stefangr/easy-coding-standard

stefangr forked symplify/easy-coding-standard

Created at 2 months ago

delete branch

stefangr/dependabot-core

stefangr delete branch bitbucket-convert-html-to-markdown

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Update excon requirement from ~> 0.75, < 0.94 to ~> 0.75, < 0.97

Updates the requirements on excon to permit the latest version.

updated-dependencies:

dependency-name: excon dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：8dbef27637fe191da60f08d11c13d7081fef0b06

run bundle install to regenerate Gemfile.lock

commit sha：c5557f9a15e54033350cb68e70adea92c86bec63

Update pip-tools requirement in /python/helpers

Updates the requirements on pip-tools to permit the latest version.

updated-dependencies:

dependency-name: pip-tools dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：7bc35820d8d23b45dd72e204529826ffc81d3c1f

update test to match reworded error message from upstream

commit sha：44a3f9b02465953dd4cd011e2a705a826467f818

Update faraday requirement from = 2.6.0 to = 2.7.2 in /omnibus

Updates the requirements on faraday to permit the latest version.

updated-dependencies:

dependency-name: faraday dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：309275ce6d55482f0983904d02a978e59c481d98

run bundle install to regenerate updater/Gemfile.lock

commit sha：5dc907e3148961c74ddc0b4494730f8e86118f79

Bump phpstan/phpstan from 1.9.4 to 1.9.8 in /composer/helpers/v1

Bumps phpstan/phpstan from 1.9.4 to 1.9.8.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：03d9d8e2cf7ae06955a9fd1388bfbab11b5c3476

Bump friendsofphp/php-cs-fixer in /composer/helpers/v2

Bumps friendsofphp/php-cs-fixer from 3.13.1 to 3.13.2.

updated-dependencies:

dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：2fe8ef854dae23c31d337dfff70b1b1ed4f978b0

Bump phpstan/phpstan from 1.9.4 to 1.9.8 in /composer/helpers/v2

Bumps phpstan/phpstan from 1.9.4 to 1.9.8.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：27e745c4b759f3f98d56e24e7eac93971501353c

Bump eslint-config-prettier from 8.5.0 to 8.6.0 in /npm_and_yarn/helpers

Bumps eslint-config-prettier from 8.5.0 to 8.6.0.

updated-dependencies:

dependency-name: eslint-config-prettier dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：6051c02185a5b0aaf735753db9eb80dca03397f3

Bump prettier from 2.8.1 to 2.8.2 in /npm_and_yarn/helpers

Bumps prettier from 2.8.1 to 2.8.2.

updated-dependencies:

dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：ec794ebfaef9f1c8ac4fc73c57d864c9a88c334f

Bump cython from 0.29.32 to 0.29.33 in /python/helpers

Bumps cython from 0.29.32 to 0.29.33.

updated-dependencies:

dependency-name: cython dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：20532876ea456c488ddb8a63f616f359d6205e5f

Bump licensed from 3.9.1 to 4.0.1 in /updater

Bumps licensed from 3.9.1 to 4.0.1.

updated-dependencies:

dependency-name: licensed dependency-type: direct:development update-type: version-update:semver-major ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：d18388d99eeca9fdda1dd454d695a4ba2fa53293

Update rubocop requirement from ~> 1.39.0 to ~> 1.42.0 in /omnibus

Updates the requirements on rubocop to permit the latest version.

updated-dependencies:

dependency-name: rubocop dependency-type: direct:development ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：d7fb942233a61312c5c2083cac02700403147ed0

Bump rubocop from 1.39.0 to 1.42.0 in /updater

Bumps rubocop from 1.39.0 to 1.42.0.

updated-dependencies:

dependency-name: rubocop dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：bfa0e51a0d38ecbdab8f7fca1f32085628f78d6c

Disable Style/RedundantConstantBase

This rule is causing some issues for us, see https://github.com/rubocop/rubocop/issues/11401.

We chatted about it internally and nobody really minds the :: prefix so decided to disable the rule for now.

commit sha：ab4989820510e8904f1ca34c88cf788ccf208e21

Update poetry requirement in /python/helpers

Updates the requirements on poetry to permit the latest version.

updated-dependencies:

dependency-name: poetry dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：a0e1b6654c4774b7cfe62afb8c631798d5d82cf4

Update excon requirement from ~> 0.75, < 0.97 to ~> 0.75, < 0.98 in /omnibus (#6403)

Updates the requirements on excon to permit the latest version.

updated-dependencies:

dependency-name: excon dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jeff Widman jeff@jeffwidman.com

commit sha：cef915d9dbf097c12a6dee1caabd0195b7e692b8

Bump activesupport from 6.1.4.4 to 6.1.7 in /updater

Bumps activesupport from 6.1.4.4 to 6.1.7.

updated-dependencies:

dependency-name: activesupport dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：dd2ad70fee04a55f9a67123062e52f0efa25ff35

Use latest Python patch releases for builds

Follow-up to #6375 this activates those latest patch releases during runtime

commit sha：db6310a12f9b653265db14f7814fedb1c2d5659e

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Update excon requirement from ~> 0.75, < 0.94 to ~> 0.75, < 0.97

Updates the requirements on excon to permit the latest version.

updated-dependencies:

dependency-name: excon dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：8dbef27637fe191da60f08d11c13d7081fef0b06

run bundle install to regenerate Gemfile.lock

commit sha：c5557f9a15e54033350cb68e70adea92c86bec63

Update pip-tools requirement in /python/helpers

Updates the requirements on pip-tools to permit the latest version.

updated-dependencies:

dependency-name: pip-tools dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：7bc35820d8d23b45dd72e204529826ffc81d3c1f

update test to match reworded error message from upstream

commit sha：44a3f9b02465953dd4cd011e2a705a826467f818

Update faraday requirement from = 2.6.0 to = 2.7.2 in /omnibus

Updates the requirements on faraday to permit the latest version.

updated-dependencies:

dependency-name: faraday dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：309275ce6d55482f0983904d02a978e59c481d98

run bundle install to regenerate updater/Gemfile.lock

commit sha：5dc907e3148961c74ddc0b4494730f8e86118f79

Bump phpstan/phpstan from 1.9.4 to 1.9.8 in /composer/helpers/v1

Bumps phpstan/phpstan from 1.9.4 to 1.9.8.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：03d9d8e2cf7ae06955a9fd1388bfbab11b5c3476

Bump friendsofphp/php-cs-fixer in /composer/helpers/v2

Bumps friendsofphp/php-cs-fixer from 3.13.1 to 3.13.2.

updated-dependencies:

dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：2fe8ef854dae23c31d337dfff70b1b1ed4f978b0

Bump phpstan/phpstan from 1.9.4 to 1.9.8 in /composer/helpers/v2

Bumps phpstan/phpstan from 1.9.4 to 1.9.8.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：27e745c4b759f3f98d56e24e7eac93971501353c

Bump eslint-config-prettier from 8.5.0 to 8.6.0 in /npm_and_yarn/helpers

Bumps eslint-config-prettier from 8.5.0 to 8.6.0.

updated-dependencies:

dependency-name: eslint-config-prettier dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：6051c02185a5b0aaf735753db9eb80dca03397f3

Bump prettier from 2.8.1 to 2.8.2 in /npm_and_yarn/helpers

Bumps prettier from 2.8.1 to 2.8.2.

updated-dependencies:

dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：ec794ebfaef9f1c8ac4fc73c57d864c9a88c334f

Bump cython from 0.29.32 to 0.29.33 in /python/helpers

Bumps cython from 0.29.32 to 0.29.33.

updated-dependencies:

dependency-name: cython dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：20532876ea456c488ddb8a63f616f359d6205e5f

Bump licensed from 3.9.1 to 4.0.1 in /updater

Bumps licensed from 3.9.1 to 4.0.1.

updated-dependencies:

dependency-name: licensed dependency-type: direct:development update-type: version-update:semver-major ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：d18388d99eeca9fdda1dd454d695a4ba2fa53293

Update rubocop requirement from ~> 1.39.0 to ~> 1.42.0 in /omnibus

Updates the requirements on rubocop to permit the latest version.

updated-dependencies:

dependency-name: rubocop dependency-type: direct:development ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：d7fb942233a61312c5c2083cac02700403147ed0

Bump rubocop from 1.39.0 to 1.42.0 in /updater

Bumps rubocop from 1.39.0 to 1.42.0.

updated-dependencies:

dependency-name: rubocop dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：bfa0e51a0d38ecbdab8f7fca1f32085628f78d6c

Disable Style/RedundantConstantBase

This rule is causing some issues for us, see https://github.com/rubocop/rubocop/issues/11401.

We chatted about it internally and nobody really minds the :: prefix so decided to disable the rule for now.

commit sha：ab4989820510e8904f1ca34c88cf788ccf208e21

Update poetry requirement in /python/helpers

Updates the requirements on poetry to permit the latest version.

updated-dependencies:

dependency-name: poetry dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：a0e1b6654c4774b7cfe62afb8c631798d5d82cf4

Update excon requirement from ~> 0.75, < 0.97 to ~> 0.75, < 0.98 in /omnibus (#6403)

Updates the requirements on excon to permit the latest version.

updated-dependencies:

dependency-name: excon dependency-type: direct:production ...

Signed-off-by: dependabot[bot] support@github.com Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jeff Widman jeff@jeffwidman.com

commit sha：cef915d9dbf097c12a6dee1caabd0195b7e692b8

Bump activesupport from 6.1.4.4 to 6.1.7 in /updater

Bumps activesupport from 6.1.4.4 to 6.1.7.

updated-dependencies:

dependency-name: activesupport dependency-type: direct:production update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：dd2ad70fee04a55f9a67123062e52f0efa25ff35

Use latest Python patch releases for builds

Follow-up to #6375 this activates those latest patch releases during runtime

commit sha：db6310a12f9b653265db14f7814fedb1c2d5659e

Created at 2 months ago

issue comment

dependabot/dependabot-core

Do not convert the markdown PR description to HTML for bitbucket

I traced the change back to the upgrade of the dependabot-omnibus package from 0.212.0 to 0.214.0.

There I found this little change. Which is fine of course and should stay.

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Bump to Ruby 3.1.3

Saw this warning in the logs, which reminded me it's time to bump ruby to 3.1.3:

warning: parser/current is loading parser/ruby31, which recognizes3.1.3-compliant syntax, but you are running 3.1.2.
Please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.

Also bumped bundler to 2.3.26 match what comes with Ruby by default.

Co-authored-by: David Rodríguez deivid.rodriguez@riseup.net

commit sha：c7b47378b7aa0ec5e325b10c7559eceaaab39c59

Fix lints

Various lints flagged by Rubocop.

commit sha：42892139bd49e47a6cdabd9c91d2213ee38b7a62

Instruct commonmarker not to format to HTML for bitbucket

commit sha：dc511fbc1726dd28708081c4aeb04b3b4d73d10b

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Bump to Ruby 3.1.3

Saw this warning in the logs, which reminded me it's time to bump ruby to 3.1.3:

warning: parser/current is loading parser/ruby31, which recognizes3.1.3-compliant syntax, but you are running 3.1.2.
Please see https://github.com/whitequark/parser#compatibility-with-ruby-mri.

Also bumped bundler to 2.3.26 match what comes with Ruby by default.

Co-authored-by: David Rodríguez deivid.rodriguez@riseup.net

commit sha：c7b47378b7aa0ec5e325b10c7559eceaaab39c59

Fix lints

Various lints flagged by Rubocop.

commit sha：42892139bd49e47a6cdabd9c91d2213ee38b7a62

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Verify Dart SHA256 hashes

In addition to downloading the Dart SDK, also download and verify SHA256 hashes.

Dart includes both the hash value and the downloaded file name in the hash file. To avoid having to parse the hash file, the script moves to the /tmp/ directory to verify the hash.

commit sha：82f80ff2e94ef694a43065eb5fd57d8f91ea1ca8

Bump the Dart SDK version

commit sha：fcfc78c5b059e6e8d892c51fa03f73ee7890741f

Bump phpstan/phpstan from 1.9.2 to 1.9.4 in /composer/helpers/v1

Bumps phpstan/phpstan from 1.9.2 to 1.9.4.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：1bae8129b0d3943cdf896f058700720f2840f1a3

Bump phpstan/phpstan from 1.9.2 to 1.9.4 in /composer/helpers/v2

Bumps phpstan/phpstan from 1.9.2 to 1.9.4.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：dc6584174b027b7313e1ccc92adae209417c8910

Bump eslint from 8.29.0 to 8.30.0 in /npm_and_yarn/helpers

Bumps eslint from 8.29.0 to 8.30.0.

updated-dependencies:

dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：6f77c792f0b5ee9435b211297f8dfeadedd28364

Remove superfluous v customization in test fixture

Historical context: In https://github.com/dependabot/dependabot-core/commit/77406d5d220ce7c61c7d68d1bacb8b8fadf59277, support was added for version numbers that included a "v" prefix. At the time, the only packagist test fixture was this single file: https://github.com/dependabot/dependabot-core/tree/77406d5d220ce7c61c7d68d1bacb8b8fadf59277/spec/fixtures/php So to test this, Grey added a customization to force a "v" prefix on a version.

However, we now have a whole folder of packagist responses: https://github.com/dependabot/dependabot-core/tree/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses

And several of those include "v" prefixes:

https://github.com/dependabot/dependabot-core/blob/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses/symfony--polyfill-mbstring.json#L875
https://raw.githubusercontent.com/dependabot/dependabot-core/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses/illuminate--console.json

And I confirmed that we do run tests against some of those: https://github.com/dependabot/dependabot-core/blob/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/dependabot/composer/file_updater_spec.rb#L94

So we no longer need this customization.

And tracking down these customizations has been a royal pain while working on https://github.com/dependabot/dependabot-core/issues/3010.

While retaining it is semi-harmless, explicitly removing this provides a git blame trail because in a future PR I'll be removing this generic packagist_response.json file completely in favor of using the explicit packagist response files.

commit sha：2d20ff2e0424c2810be4ad583182c07d942d2280

Update monolog/monolog fixture to latest packagist response

For a few upcoming PR's, it'll be helpful if the monolog/monolog packagist fixture is current to match what's actually returned by https://repo.packagist.org/p/monolog/monolog.json.

Initially I updated all the other fixtures as well, but the illuminate/* fixtures ballooned to 43+ MB... and then when I switched them to the v2 metadata endpoint (https://github.com/dependabot/dependabot-core/issues/3010) they shrank back down... no point in adding that much cruft to our git history when I'm going to almost immediately drop it.

But the monolog/monolog change is necessary because I'll be updating all the tests that point at the generic packagist_response.json to point at this fixture... and since it already has a newer version than is in packagist_response.json, might as well first ensure the fixture is fully-up-to-date.

commit sha：71f5036f44e50d9a6a34c9a5c8baba5dbff35f81

Stop using handcrafted fixture for packagist responses

As part of working on https://github.com/dependabot/dependabot-core/issues/3010, I need to update the test fixtures to match what the Packagist v2 metadata API returns.

However, we have a custom packagist_response.json fixture which cloned the response for monolog/monolog and then applied a couple of handcrafted customizations... So when updating the fixture, I needed to re-copy the upstream monolog/monolog, then apply the customizations. However, the upstream API now minifies the resulting output, which makes correctly applying customizations a little more risky.

In https://github.com/dependabot/dependabot-core/pull/6332 / https://github.com/dependabot/dependabot-core/commit/2d20ff2e0424c2810be4ad583182c07d942d2280 I removed one of the customizations, so the only one left was having a pre-release version. However, we already have an existing fixture in the doctrine--dbal.json file that has several pre-release versions. So by flipping those tests using pre-releases to use that fixture, we could actually drop the packagist_response.json file entirely.

Going forward, we can use off-the-shelf fixture responses directly from Packagist, which will be much easier to maintain.

So this PR does the following:

Makes the way that the packagist_url / packagist_response param handling consistent in all three files that called out to packagist_response.json.
Flips them all from using packagist_response.json to instead using the off-the-shelf fixtures in the packagist_responses directory. We already have a monolog--monolog.json fixture (which I just updated in https://github.com/dependabot/dependabot-core/pull/6334), so I didn't need to replacement fixture.
Deletes the old custom packagist.json fixture that is no longer used.
Flips the tests for pre-release versions to use the doctrine--dbal.json fixture.
Minor refactorings on a couple of tests to make them more readable/internally consistent.

This should greatly increase our confidence for https://github.com/dependabot/dependabot-core/issues/3010 that our tests are matching what we're actually receiving from Packagist.

commit sha：3304cb60fb0e0774248c1cd45e085f6c3e09a7d1

Bump friendsofphp/php-cs-fixer in /composer/helpers/v2

Bumps friendsofphp/php-cs-fixer from 3.13.0 to 3.13.1.

updated-dependencies:

dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：9ff48e199affb6eee14664fc73550c0da69a6485

Clarify composer v1 PEAR unit test

It took me a while to understand this unit test, because this package is actually present on packagist: https://repo.packagist.org/p/pear-pear.horde.org/horde_date.json

However, from the associated composer.json fixture plus the existing fixture, it's clear that this test is checking what happens when a PEAR dependency is not present on packagist.

So remove the fixture from the packagist_responses directory which is supposed to match what Packagist actually returns and hardcode the response for this single unit test to avoid confusion of future devs thinking they need to update it to match the actual packagist response.

This will make the https://github.com/dependabot/dependabot-core/pull/6315 a bit more straightforward because composer v1 doesn't know about the v2 metadata API so I will need to hardcode both v1 and v2 metadata responses (which return different HTTP status codes).

PEAR is mostly dead it seems, but it doesn't hurt to leave it around in case any old composer v1 projects still have PEAR deps listed... and this will all be gone soon enough once we remove support for composer v1:

https://github.com/dependabot/dependabot-core/issues/6298

commit sha：8d2dffd0b0c72d149a000b4c313721d798c8ec5f

Allow optional single and double quotes in yaml versions/tags

commit sha：1f2acc3877ae9749016b778865da8da51e58ac07

Generate compare path and fetch commits for Azure in metadata

commit sha：fba6788abe1382af82f7275c3e53513514c705b9

Support pulling changelog and related files from Azure based repos

commit sha：20805b7dbb2c2b7b56809d4ae7eb866a535e20ec

Added tests

commit sha：9794aa56b727fc3cc390c695b276d78998864647

Add CommitFinder tests for Azure added in #6321

commit sha：b20f2c2c2c25aacdd725c285ed0e48d8a2a62989

Migrate to packagist's v2 metadata API

As explained in https://github.com/dependabot/dependabot-core/issues/3010:

Packagist supports a new metadata format (introduced for composer 2 as composer 1 does not know how to use it) for better performance and reduced bandwidth. The composer team plans to deprecate the v1 metadata format and disable it on packagist.org in the future ... The new endpoint is at https://repo.packagist.org/p2/ instead of https://repo.packagist.org/p/

The differences between the v1 and v2 metadata formats are documented in https://github.com/composer/composer/blob/master/UPGRADE-2.0.md#for-composer-repository-implementors. Here are the main highlights:

metadata are minified (this can be detected based on the "minified": "composer/2.0" top-level key in the file) to reduce the file size thanks to the fact that most releases don't change most of the metadata fields compared to the previous release. This will probably impact dependabot as it will need to un-minify the metadata

only metadata for the package itself are in the file, not other packages providing the same name (should not be an issue for dependabot if it cares about the versions for the package name it loads)

dev versions (corresponding to git branches rather than tags) are in a separate file (most projects don't allow dev versions of their dependencies and so don't need the metadata for git branches. Splitting them allowed a better caching as releases happen less often than pushes to branches)

absence of a package is now always represented by a 404 response rather than sometimes returning a 200 response with an empty list in the packages key.

So I did the following steps:

Update the two places we call this endpoing to hit /p2/ rather than /p/
Update the code that parses those URL responses to handle the change from returning a hash of version listings to an array of version listings.
Research the minification impact--it turned out to not affect us because we were already searching for the newest source URL link, which is the one that doesn't get minified away.
Update the content of the packagist response test fixtures to match what's returned by the new endpoint. This was by far the most time consuming part as we had some test fixtures that tried to do double-duty in various ways, so I cleaned those up on a few separate PR's, which made the updates in this PR much more straightforward.
Decide how to handle the move of dev versions (aka branches rather than tags) to an outside channel. Since these are tied to a branch rather than a tag, it doesn't really make sense to support these, as currently I'm not aware of a way to know "this branch updates to this other branch". (At least not for composer, GitHub actions obviously is different.) Additionally, pre-release version suffixes such as BETA1 or -RC1 are still returned on the main channel, so anyone who really wants pre-release versions that are upgradeable can still use those.
Investigate if any tests needed updating that were looking for 200 response and a missing package now that Packagist guarantees they'll return a 404 for missing packages. The only tests affected were a couple that check if Packagist returns an empty array, and I'd rather keep those for defensive coding purposes, as they may occur in the future if Packagist ever has bugs.

Fix https://github.com/dependabot/dependabot-core/issues/3010

commit sha：6716a52836f390e25cd23aa271045fcad18b7d6a

Bump debug from 1.7.0 to 1.7.1 in /updater

Bumps debug from 1.7.0 to 1.7.1.

updated-dependencies:

dependency-name: debug dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：25c11f8fb8810b157eb8a94b2332bf77708ed883

Bump minimatch from 3.0.4 to 3.1.2 in /npm_and_yarn/helpers

Bumps minimatch from 3.0.4 to 3.1.2.

updated-dependencies:

dependency-name: minimatch dependency-type: indirect ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：b7088738ae23ce433da9a7178e722fe10aa4ca94

Mention "metadata" in --pull-request description

I was helping a friend repro a bug, and he was using the dry-run script... when we initially grep'd for "metadata", we didn't find this --pull-request option, so adding it here for easier grep'ability.

commit sha：06702c83e5d964173504ddba6838c37fe37207ba

Bump rubocop-performance from 1.15.1 to 1.15.2 in /updater

Bumps rubocop-performance from 1.15.1 to 1.15.2.

updated-dependencies:

dependency-name: rubocop-performance dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：7b919fc1897c4e92d35223ab6a0b00b18316b178

Created at 2 months ago

push

stefangr/dependabot-core

stefangr push stefangr/dependabot-core

Verify Dart SHA256 hashes

In addition to downloading the Dart SDK, also download and verify SHA256 hashes.

Dart includes both the hash value and the downloaded file name in the hash file. To avoid having to parse the hash file, the script moves to the /tmp/ directory to verify the hash.

commit sha：82f80ff2e94ef694a43065eb5fd57d8f91ea1ca8

Bump the Dart SDK version

commit sha：fcfc78c5b059e6e8d892c51fa03f73ee7890741f

Bump phpstan/phpstan from 1.9.2 to 1.9.4 in /composer/helpers/v1

Bumps phpstan/phpstan from 1.9.2 to 1.9.4.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：1bae8129b0d3943cdf896f058700720f2840f1a3

Bump phpstan/phpstan from 1.9.2 to 1.9.4 in /composer/helpers/v2

Bumps phpstan/phpstan from 1.9.2 to 1.9.4.

updated-dependencies:

dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：dc6584174b027b7313e1ccc92adae209417c8910

Bump eslint from 8.29.0 to 8.30.0 in /npm_and_yarn/helpers

Bumps eslint from 8.29.0 to 8.30.0.

updated-dependencies:

dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：6f77c792f0b5ee9435b211297f8dfeadedd28364

Remove superfluous v customization in test fixture

However, we now have a whole folder of packagist responses: https://github.com/dependabot/dependabot-core/tree/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses

And several of those include "v" prefixes:

https://github.com/dependabot/dependabot-core/blob/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses/symfony--polyfill-mbstring.json#L875
https://raw.githubusercontent.com/dependabot/dependabot-core/dc6584174b027b7313e1ccc92adae209417c8910/composer/spec/fixtures/packagist_responses/illuminate--console.json

So we no longer need this customization.

And tracking down these customizations has been a royal pain while working on https://github.com/dependabot/dependabot-core/issues/3010.

commit sha：2d20ff2e0424c2810be4ad583182c07d942d2280

Update monolog/monolog fixture to latest packagist response

For a few upcoming PR's, it'll be helpful if the monolog/monolog packagist fixture is current to match what's actually returned by https://repo.packagist.org/p/monolog/monolog.json.

commit sha：71f5036f44e50d9a6a34c9a5c8baba5dbff35f81

Stop using handcrafted fixture for packagist responses

As part of working on https://github.com/dependabot/dependabot-core/issues/3010, I need to update the test fixtures to match what the Packagist v2 metadata API returns.

Going forward, we can use off-the-shelf fixture responses directly from Packagist, which will be much easier to maintain.

So this PR does the following:

Makes the way that the packagist_url / packagist_response param handling consistent in all three files that called out to packagist_response.json.
Flips them all from using packagist_response.json to instead using the off-the-shelf fixtures in the packagist_responses directory. We already have a monolog--monolog.json fixture (which I just updated in https://github.com/dependabot/dependabot-core/pull/6334), so I didn't need to replacement fixture.
Deletes the old custom packagist.json fixture that is no longer used.
Flips the tests for pre-release versions to use the doctrine--dbal.json fixture.
Minor refactorings on a couple of tests to make them more readable/internally consistent.

This should greatly increase our confidence for https://github.com/dependabot/dependabot-core/issues/3010 that our tests are matching what we're actually receiving from Packagist.

commit sha：3304cb60fb0e0774248c1cd45e085f6c3e09a7d1

Bump friendsofphp/php-cs-fixer in /composer/helpers/v2

Bumps friendsofphp/php-cs-fixer from 3.13.0 to 3.13.1.

updated-dependencies:

dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ...

Signed-off-by: dependabot[bot] support@github.com

commit sha：9ff48e199affb6eee14664fc73550c0da69a6485

Clarify composer v1 PEAR unit test

It took me a while to understand this unit test, because this package is actually present on packagist: https://repo.packagist.org/p/pear-pear.horde.org/horde_date.json

However, from the associated composer.json fixture plus the existing fixture, it's clear that this test is checking what happens when a PEAR dependency is not present on packagist.

https://github.com/dependabot/dependabot-core/issues/6298

commit sha：8d2dffd0b0c72d149a000b4c313721d798c8ec5f

Allow optional single and double quotes in yaml versions/tags

commit sha：1f2acc3877ae9749016b778865da8da51e58ac07

Generate compare path and fetch commits for Azure in metadata

commit sha：fba6788abe1382af82f7275c3e53513514c705b9

Support pulling changelog and related files from Azure based repos

commit sha：20805b7dbb2c2b7b56809d4ae7eb866a535e20ec

Added tests

commit sha：9794aa56b727fc3cc390c695b276d78998864647

Add CommitFinder tests for Azure added in #6321

commit sha：b20f2c2c2c25aacdd725c285ed0e48d8a2a62989

Migrate to packagist's v2 metadata API

As explained in https://github.com/dependabot/dependabot-core/issues/3010:

Packagist supports a new metadata format (introduced for composer 2 as composer 1 does not know how to use it) for better performance and reduced bandwidth. The composer team plans to deprecate the v1 metadata format and disable it on packagist.org in the future ... The new endpoint is at https://repo.packagist.org/p2/ instead of https://repo.packagist.org/p/

The differences between the v1 and v2 metadata formats are documented in https://github.com/composer/composer/blob/master/UPGRADE-2.0.md#for-composer-repository-implementors. Here are the main highlights:

metadata are minified (this can be detected based on the "minified": "composer/2.0" top-level key in the file) to reduce the file size thanks to the fact that most releases don't change most of the metadata fields compared to the previous release. This will probably impact dependabot as it will need to un-minify the metadata

only metadata for the package itself are in the file, not other packages providing the same name (should not be an issue for dependabot if it cares about the versions for the package name it loads)

dev versions (corresponding to git branches rather than tags) are in a separate file (most projects don't allow dev versions of their dependencies and so don't need the metadata for git branches. Splitting them allowed a better caching as releases happen less often than pushes to branches)

absence of a package is now always represented by a 404 response rather than sometimes returning a 200 response with an empty list in the packages key.

So I did the following steps:

Update the two places we call this endpoing to hit /p2/ rather than /p/
Update the code that parses those URL responses to handle the change from returning a hash of version listings to an array of version listings.
Research the minification impact--it turned out to not affect us because we were already searching for the newest source URL link, which is the one that doesn't get minified away.
Update the content of the packagist response test fixtures to match what's returned by the new endpoint. This was by far the most time consuming part as we had some test fixtures that tried to do double-duty in various ways, so I cleaned those up on a few separate PR's, which made the updates in this PR much more straightforward.
Decide how to handle the move of dev versions (aka branches rather than tags) to an outside channel. Since these are tied to a branch rather than a tag, it doesn't really make sense to support these, as currently I'm not aware of a way to know "this branch updates to this other branch". (At least not for composer, GitHub actions obviously is different.) Additionally, pre-release version suffixes such as BETA1 or -RC1 are still returned on the main channel, so anyone who really wants pre-release versions that are upgradeable can still use those.
Investigate if any tests needed updating that were looking for 200 response and a missing package now that Packagist guarantees they'll return a 404 for missing packages. The only tests affected were a couple that check if Packagist returns an empty array, and I'd rather keep those for defensive coding purposes, as they may occur in the future if Packagist ever has bugs.