Class: Dependabot::Vcpkg::UpdateChecker::SecurityFixResolver

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/vcpkg/update_checker/security_fix_resolver.rb

Overview

Works out how to move a vulnerable port onto a safe version.

vcpkg offers three levers, tried in this order:

1. raise the registry baseline, which lifts the version floor for every port
2. raise (or add) the port's own `version>=` constraint
3. pin the port with an `overrides` entry, for when the safe version uses a scheme vcpkg
 refuses to compare against the one currently selected

A safe floor always fixes the port on its own, because it sits above the current version, which in turn already satisfies any declared constraint. Levers 2 and 3 therefore only come up when no release carries the fix, and in that case there is no baseline worth moving to.

Defined Under Namespace

Classes: Fix

Instance Method Summary collapse

Constructor Details

#initialize(dependency:, dependency_files:, security_advisories:, ignored_versions:, lowest_comparable_version:, versions_database: Dependabot::Vcpkg::Package::VersionsDatabase.new) ⇒ SecurityFixResolver

Returns a new instance of SecurityFixResolver.



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/dependabot/vcpkg/update_checker/security_fix_resolver.rb', line 52

def initialize(
  dependency:,
  dependency_files:,
  security_advisories:,
  ignored_versions:,
  lowest_comparable_version:,
  versions_database: Dependabot::Vcpkg::Package::VersionsDatabase.new
)
  @dependency = dependency
  @dependency_files = dependency_files
  @security_advisories = security_advisories
  @ignored_versions = ignored_versions
  @lowest_comparable_version = lowest_comparable_version
  @versions_database = versions_database

  @fix = T.let(nil, T.nilable(Fix))
  @resolved = T.let(false, T::Boolean)
  @safe_baseline = T.let(nil, T.nilable([String, Dependabot::Vcpkg::Version]))
  @searched_baseline = T.let(false, T::Boolean)
end

Instance Method Details

#fix ⇒ Object 



74
75
76
77
78
79
 
# File 'lib/dependabot/vcpkg/update_checker/security_fix_resolver.rb', line 74

def fix
  return @fix if @resolved

  @resolved = true
  @fix = resolve
end