Consider all dependency versions in Job.vulnerable?

[mctofu]

In testing #5801 via the updater we found there's an additional spot we need to consider all versions of a dependency when doing a vulnerability check. This is to prevent Dependabot from returning a confusing error message that all versions have been ignored.

This code path is invoked from the updater at

dependabot-core/updater/lib/dependabot/updater.rb

Line 231 in 97ae98c

return record_security_update_ignored(checker) unless job.allowed_update?(dependency)

Part of the allowed update check is to see if the dependency is actually still vulnerable:

dependabot-core/updater/lib/dependabot/job.rb

Lines 77 to 78 in 97ae98c

	security_update = update_type == "security" || security_updates_only?
	next false if security_update && !vulnerable?(dependency)

I considered removing this check as it's a duplicate of this check in the create pr flow:

dependabot-core/updater/lib/dependabot/updater.rb

Lines 221 to 222 in 97ae98c

	if job.security_updates_only?
	unless checker.vulnerable?

However, it's also checked in the update pr flow so it would have taken more changes to try and sort that out so I'm leaving that for a future cleanup:

dependabot-core/updater/lib/dependabot/updater.rb

Lines 140 to 141 in 97ae98c

	if job.security_updates_only? &&
	dependencies.none? { |d| job.allowed_update?(d) }

[bdragon]

This looks great!

[bdragon]

👌

[bdragon]

I've noticed this code

version_class = Utils.version_class_for_package_manager(package_manager)
version_class.new(version) if version_class.correct?(version)

in a lot of places. Looking at it once again here, I'm wondering if it wouldn't make sense to put this in Dependency. It would be a reasonable argument to say it's too much for that class to know about, but it would remove some boilerplate. Maybe something like this (but probably with better naming)

def correct_version
  version_class = Utils.version_class_for_package_manager(package_manager)
  version_class.new(version) if version_class.correct?(version)
end

def all_correct_versions
  version_class = Utils.version_class_for_package_manager(package_manager)
  all_versions.filter_map { |v| version_class.new(v) if version_class.correct?(v) }
end

[mctofu]

Yeah, that's a good thought! There's still some future changes needed to get a successful PR through. If that ends up duplicating this again I think that'd be good opportunity to dry it up?

[bdragon]

Good thinking