From 8a8f9275b35f3747c3fe2e019c1f463acc147d6b Mon Sep 17 00:00:00 2001 From: Ofer Affias Date: Sun, 11 May 2025 12:49:19 +0300 Subject: [PATCH 1/2] Fix Dependabot version extraction by parsing JSON description --- .../filters/extractDependabotVersionBump/index.js | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/plugins/filters/extractDependabotVersionBump/index.js b/plugins/filters/extractDependabotVersionBump/index.js index 46652fe53..7e2e1a954 100644 --- a/plugins/filters/extractDependabotVersionBump/index.js +++ b/plugins/filters/extractDependabotVersionBump/index.js @@ -9,8 +9,9 @@ module.exports = (desc) => { - if (desc && desc !== '""' && desc !== "''" ) { - const matches = /Bumps.*from ([\d\.]+[A-Za-zαß]*) to ([\d\.]+[A-Za-zαß]*)/.exec(desc); + if (desc && desc !== '""' && desc !== "''" ) { + const parsedDesc = JSON.parse(desc); + const matches = /Bumps.*from ([\d\.]+[A-Za-zαß]*) to ([\d\.]+[A-Za-zαß]*)/.exec(parsedDesc); if (matches && matches.length == 3) { var [_, from, to] = matches; // remove trailing dot on to @@ -23,3 +24,11 @@ module.exports = (desc) => { return null; } + + +const extarct = require('./index.js'); +var description = "\"Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 6.0.1 to 6.0.2.
\\n

\\nRelease notes
\\n

Sourced from serialize-javascript's releases.


\\n

\\n

v6.0.2


\\n

    \\n
  • fix: serialize URL string contents to prevent XSS (#173) f27d65d

    • \\n
  • Bump @​babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0

    • \\n
  • docs: update readme with URL support (#146) 0d88527

    • \\n
  • chore: update node version and lock file e2a3a91

    • \\n
  • fix typo (#164) 5a1fa64

    • \\n

\\n

https://github.com/yahoo/serialize-javascript/compare/v6.0.1...v6.0.2


\\n

\\n

\\n

\\nCommits
\\n
\\n

\\n

\\n
\\n
\\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=serialize-javascript&package-manager=npm_and_yarn&previous-version=6.0.1&new-version=6.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
\\n
\\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
\\n
\\n[//]: # (dependabot-automerge-start)
\\n[//]: # (dependabot-automerge-end)
\\n
\\n---
\\n
\\n

\\nDependabot commands and options
\\n

\\n
\\nYou can trigger Dependabot actions by commenting on this PR:
\\n- `@dependabot rebase` will rebase this PR
\\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
\\n- `@dependabot merge` will merge this PR after your CI passes on it
\\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
\\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
\\n- `@dependabot reopen` will reopen this PR if it is closed
\\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
\\n- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
\\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
\\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
\\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
\\n
\\n
\\n
\"" +; + +console.assert(extarct(description)[0] === '6.0.2', `extarct(description) === [ '6.0.2', '6.0.1' ]`); +console.assert(extarct(description)[1] === '6.0.1', `extarct(description) === [ '6.0.2', '6.0.1' ]`); From 95d04e382c81732d5292126e22cc81986ab3ea67 Mon Sep 17 00:00:00 2001 From: Ofer Affias Date: Mon, 12 May 2025 15:28:28 +0300 Subject: [PATCH 2/2] Fix parsing of Dependabot version bump descriptions --- plugins/filters/extractDependabotVersionBump/index.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/plugins/filters/extractDependabotVersionBump/index.js b/plugins/filters/extractDependabotVersionBump/index.js index 7600844d7..1556bfeaf 100644 --- a/plugins/filters/extractDependabotVersionBump/index.js +++ b/plugins/filters/extractDependabotVersionBump/index.js @@ -13,8 +13,13 @@ module.exports = (desc) => { if (desc && desc !== '""' && desc !== "''" ) { // Match both "Bumps" and "Updates" patterns with version numbers // The regex captures version numbers that follow "from" and "to" keywords + let parsedDesc = desc; + try { + parsedDesc = JSON.parse(desc); + } catch (e) { + // If parsing fails, use the description as is + } const regex = /(Bumps|Updates).*?from ([\d\.]+[A-Za-zαß]*) to ([\d\.]+[A-Za-zαß]*)/; - const parsedDesc = JSON.parse(desc); const matches = regex.exec(parsedDesc); if (matches && matches.length == 4) { var [_, action, from, to] = matches;