Handle invalid major version errors

dependabot · Nov 19, 2021 · 1d5a203 · 1d5a203
1 parent 464bf15
commit 1d5a203
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/go_modules/lib/dependabot/go_modules/update_checker/latest_version_finder.rb b/go_modules/lib/dependabot/go_modules/update_checker/latest_version_finder.rb
@@ -24,6 +24,7 @@ class LatestVersionFinder
           # (Private) module could not be fetched
           /module .*: git ls-remote .*: exit status 128/m.freeze
         ].freeze
+        INVALID_VERSION_REGEX = /version "[^"]+" invalid/m.freeze
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/.freeze
 
         def initialize(dependency:, dependency_files:, credentials:,
@@ -108,6 +109,8 @@ def available_versions
         def handle_subprocess_error(error)
           if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
             ResolvabilityErrors.handle(error.message, credentials: credentials)
+          elsif INVALID_VERSION_REGEX =~ error.message
+            raise Dependabot::DependencyFileNotResolvable, error.message
           end
 
           raise

diff --git a/go_modules/spec/dependabot/go_modules/update_checker/latest_version_finder_spec.rb b/go_modules/spec/dependabot/go_modules/update_checker/latest_version_finder_spec.rb
@@ -186,6 +186,34 @@ module foobar
       end
     end
 
+    context "when the dependency's major version is invalid because it's not specified in its go.mod" do
+      let(:dependency_name) { "github.com/dependabot-fixtures/go-modules-lib/v2" }
+      let(:dependency_version) { "2.0.0" }
+
+      it "raises a DependencyFileNotResolvable error" do
+        error_class = Dependabot::DependencyFileNotResolvable
+        expect { finder.latest_version }.
+          to raise_error(error_class) do |error|
+          expect(error.message).to include("github.com/dependabot-fixtures/go-modules-lib/v2")
+          expect(error.message).to include("version \"v2.0.0\" invalid")
+        end
+      end
+    end
+
+    context "when the dependency's major version is invalid because not properly imported" do
+      let(:dependency_name) { "github.com/dependabot-fixtures/go-modules-lib" }
+      let(:dependency_version) { "3.0.0" }
+
+      it "raises a DependencyFileNotResolvable error" do
+        error_class = Dependabot::DependencyFileNotResolvable
+        expect { finder.latest_version }.
+          to raise_error(error_class) do |error|
+          expect(error.message).to include("github.com/dependabot-fixtures/go-modules-lib")
+          expect(error.message).to include("version \"v3.0.0\" invalid")
+        end
+      end
+    end
+
     context "when the module is unreachable" do
       let(:dependency_files) { [go_mod] }
       let(:dependency_name) { "github.com/dependabot-fixtures/go-modules-private" }