Fix dependency tag filtering to use exact prefix matching

common/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -75,7 +75,7 @@ def all_dep_releases
           releases_with_dependency_name =
             releases
             .reject { |r| r.tag_name.nil? }
-            .select { |r| r.tag_name.downcase.include?(dep_prefix) }
+            .select { |r| r.tag_name.start_with?(dep_prefix) }
 
           return releases unless releases_with_dependency_name.any?
 

common/spec/dependabot/metadata_finders/base/release_finder_spec.rb

@@ -493,6 +493,21 @@
           end
         end
 
+        context "doesn't filter out the correct tag due to an unrelated tag containing the package name" do
+          let(:dependency_name) { "React" }
+          let(:dependency_version) { "18.3.1" }
+          let(:dependency_previous_version) { "18.3.0" }
+          let(:github_response) { fixture("github", "releases_with_mixed_tag_formats.json") }
+
+          it "gets the right text" do
+            expect(releases_text)
+              .to eq(
+                    "## 18.3.1 (April 26, 2024)\n" \
+                    "- Export `act` from `react` [f1338f](https://github.com/facebook/react/commit/f1338f8080abd1386454a10bbf93d67bfe37ce85)"
+                  )
+          end
+        end
+
         context "without GitHub credentials" do
           let(:credentials) do
             [{

common/spec/fixtures/github/releases_with_mixed_tag_formats.json

@@ -0,0 +1,159 @@
+[
+  {
+    "url": "https://api.github.com/repos/facebook/react/releases/179537491",
+    "assets_url": "https://api.github.com/repos/facebook/react/releases/179537491/assets",
+    "upload_url": "https://uploads.github.com/repos/facebook/react/releases/179537491/assets{?name,label}",
+    "html_url": "https://github.com/facebook/react/releases/tag/eslint-plugin-react-hooks%405.0.0",
+    "id": 179537491,
+    "author": {
+      "login": "eps1lon",
+      "id": 12292047,
+      "node_id": "MDQ6VXNlcjEyMjkyMDQ3",
+      "avatar_url": "https://avatars.githubusercontent.com/u/12292047?v=4",
+      "gravatar_id": "",
+      "url": "https://api.github.com/users/eps1lon",
+      "html_url": "https://github.com/eps1lon",
+      "followers_url": "https://api.github.com/users/eps1lon/followers",
+      "following_url": "https://api.github.com/users/eps1lon/following{/other_user}",
+      "gists_url": "https://api.github.com/users/eps1lon/gists{/gist_id}",
+      "starred_url": "https://api.github.com/users/eps1lon/starred{/owner}{/repo}",
+      "subscriptions_url": "https://api.github.com/users/eps1lon/subscriptions",
+      "organizations_url": "https://api.github.com/users/eps1lon/orgs",
+      "repos_url": "https://api.github.com/users/eps1lon/repos",
+      "events_url": "https://api.github.com/users/eps1lon/events{/privacy}",
+      "received_events_url": "https://api.github.com/users/eps1lon/received_events",
+      "type": "User",
+      "site_admin": false
+    },
+    "node_id": "RE_kwDOAJy2Ks4Ks4ZT",
+    "tag_name": "eslint-plugin-react-hooks@5.0.0",
+    "target_commitish": "main",
+    "name": "eslint-plugin-react-hooks@5.0.0 (Oct 11, 2024)",
+    "draft": false,
+    "prerelease": false,
+    "created_at": "2024-10-11T13:20:25Z",
+    "published_at": "2024-10-11T13:32:09Z",
+    "assets": [
+    ],
+    "tarball_url": "https://api.github.com/repos/facebook/react/tarball/eslint-plugin-react-hooks@5.0.0",
+    "zipball_url": "https://api.github.com/repos/facebook/react/zipball/eslint-plugin-react-hooks@5.0.0",
+    "body": "This release only contains `eslint-plugin-react-hooks`. Notably, new violations and support for ESLint v9 were added.\r\n\r\n## `eslint-plugin-react-hooks`\r\n\r\n* **New Violations:** Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means `_Button` or `_component` are no longer valid. ([@kassens](https://github.com/kassens)) in [#25162](https://github.com/facebook/react/pull/25162)\r\n    For example, in\r\n    ```tsx\r\n    function _Component() {\r\n      useState()\r\n      ^^^^^^^^ A React Hook \"useState\" is called in function \"_Component\" which is neither a Component nor a custom React Hook function.\r\n    }\r\n    ```\r\n    `_Component` should be renamed to `Component`.\r\n    \r\n\r\n- Add support for ESLint v9. ([@eps1lon](https://github.com/eps1lon) in [#28773](https://github.com/facebook/react/pull/28773))\r\n- Consider dispatch from `useActionState` stable. ([@eps1lon](https://github.com/eps1lon) in [#29665](https://github.com/facebook/react/pull/29665))\r\n- Accept `as` expression in callback. ([@StyleShit](https://github.com/StyleShit) in [#28202](https://github.com/facebook/react/pull/28202))\r\n- Accept `as` expressions in deps array. ([@StyleShit](https://github.com/StyleShit) in [#28189](https://github.com/facebook/react/pull/28189))\r\n- Treat `React.use()` the same as `use()`. ([@kassens](https://github.com/kassens) in [#27769](https://github.com/facebook/react/pull/27769))\r\n- Move `use()` lint to non-experimental. ([@kassens](https://github.com/kassens) in [#27768](https://github.com/facebook/react/pull/27768))\r\n- Support Flow `as` expressions. ([@cpojer](https://github.com/cpojer) in [#27590](https://github.com/facebook/react/pull/27590))\r\n- Allow `useEffect(fn, undefined)`. ([@kassens](https://github.com/kassens) in [#27525](https://github.com/facebook/react/pull/27525))\r\n- Disallow hooks in async functions. ([@acdlite](https://github.com/acdlite) in [#27045](https://github.com/facebook/react/pull/27045))\r\n- Rename experimental `useEvent` to `useEffectEvent`. ([@sebmarkbage](https://github.com/sebmarkbage) in [#25881](https://github.com/facebook/react/pull/25881))\r\n- Lint for presence of `useEvent` functions in dependency lists. ([@poteto](https://github.com/poteto) in [#25512](https://github.com/facebook/react/pull/25512))\r\n- Check `useEvent` references instead. ([@poteto](https://github.com/poteto) in [#25319](https://github.com/facebook/react/pull/25319))\r\n- Update `RulesOfHooks` with `useEvent` rules. ([@poteto](https://github.com/poteto) in [#25285](https://github.com/facebook/react/pull/25285))",
+    "reactions": {
+      "url": "https://api.github.com/repos/facebook/react/releases/179537491/reactions",
+      "total_count": 289,
+      "+1": 122,
+      "-1": 0,
+      "laugh": 0,
+      "hooray": 61,
+      "confused": 0,
+      "heart": 46,
+      "rocket": 43,
+      "eyes": 17
+    }
+  },
+  {
+    "url": "https://api.github.com/repos/facebook/react/releases/153049289",
+    "assets_url": "https://api.github.com/repos/facebook/react/releases/153049289/assets",
+    "upload_url": "https://uploads.github.com/repos/facebook/react/releases/153049289/assets{?name,label}",
+    "html_url": "https://github.com/facebook/react/releases/tag/v18.3.1",
+    "id": 153049289,
+    "author": {
+      "login": "rickhanlonii",
+      "id": 2440089,
+      "node_id": "MDQ6VXNlcjI0NDAwODk=",
+      "avatar_url": "https://avatars.githubusercontent.com/u/2440089?v=4",
+      "gravatar_id": "",
+      "url": "https://api.github.com/users/rickhanlonii",
+      "html_url": "https://github.com/rickhanlonii",
+      "followers_url": "https://api.github.com/users/rickhanlonii/followers",
+      "following_url": "https://api.github.com/users/rickhanlonii/following{/other_user}",
+      "gists_url": "https://api.github.com/users/rickhanlonii/gists{/gist_id}",
+      "starred_url": "https://api.github.com/users/rickhanlonii/starred{/owner}{/repo}",
+      "subscriptions_url": "https://api.github.com/users/rickhanlonii/subscriptions",
+      "organizations_url": "https://api.github.com/users/rickhanlonii/orgs",
+      "repos_url": "https://api.github.com/users/rickhanlonii/repos",
+      "events_url": "https://api.github.com/users/rickhanlonii/events{/privacy}",
+      "received_events_url": "https://api.github.com/users/rickhanlonii/received_events",
+      "type": "User",
+      "site_admin": false
+    },
+    "node_id": "RE_kwDOAJy2Ks4JH1jJ",
+    "tag_name": "v18.3.1",
+    "target_commitish": "18-3-1",
+    "name": "18.3.1 (April 26, 2024)",
+    "draft": false,
+    "prerelease": false,
+    "created_at": "2024-04-26T16:17:57Z",
+    "published_at": "2024-04-26T19:53:42Z",
+    "assets": [
+    ],
+    "tarball_url": "https://api.github.com/repos/facebook/react/tarball/v18.3.1",
+    "zipball_url": "https://api.github.com/repos/facebook/react/zipball/v18.3.1",
+    "body": "- Export `act` from `react` [f1338f](https://github.com/facebook/react/commit/f1338f8080abd1386454a10bbf93d67bfe37ce85)",
+    "reactions": {
+      "url": "https://api.github.com/repos/facebook/react/releases/153049289/reactions",
+      "total_count": 637,
+      "+1": 284,
+      "-1": 0,
+      "laugh": 77,
+      "hooray": 79,
+      "confused": 0,
+      "heart": 95,
+      "rocket": 88,
+      "eyes": 14
+    }
+  },
+  {
+    "url": "https://api.github.com/repos/facebook/react/releases/153048806",
+    "assets_url": "https://api.github.com/repos/facebook/react/releases/153048806/assets",
+    "upload_url": "https://uploads.github.com/repos/facebook/react/releases/153048806/assets{?name,label}",
+    "html_url": "https://github.com/facebook/react/releases/tag/v18.3.0",
+    "id": 153048806,
+    "author": {
+      "login": "rickhanlonii",
+      "id": 2440089,
+      "node_id": "MDQ6VXNlcjI0NDAwODk=",
+      "avatar_url": "https://avatars.githubusercontent.com/u/2440089?v=4",
+      "gravatar_id": "",
+      "url": "https://api.github.com/users/rickhanlonii",
+      "html_url": "https://github.com/rickhanlonii",
+      "followers_url": "https://api.github.com/users/rickhanlonii/followers",
+      "following_url": "https://api.github.com/users/rickhanlonii/following{/other_user}",
+      "gists_url": "https://api.github.com/users/rickhanlonii/gists{/gist_id}",
+      "starred_url": "https://api.github.com/users/rickhanlonii/starred{/owner}{/repo}",
+      "subscriptions_url": "https://api.github.com/users/rickhanlonii/subscriptions",
+      "organizations_url": "https://api.github.com/users/rickhanlonii/orgs",
+      "repos_url": "https://api.github.com/users/rickhanlonii/repos",
+      "events_url": "https://api.github.com/users/rickhanlonii/events{/privacy}",
+      "received_events_url": "https://api.github.com/users/rickhanlonii/received_events",
+      "type": "User",
+      "site_admin": false
+    },
+    "node_id": "RE_kwDOAJy2Ks4JH1bm",
+    "tag_name": "v18.3.0",
+    "target_commitish": "18-3",
+    "name": "18.3.0 (April 25, 2024)",
+    "draft": false,
+    "prerelease": false,
+    "created_at": "2024-04-25T16:22:01Z",
+    "published_at": "2024-04-26T19:48:51Z",
+    "assets": [
+
+    ],
+    "tarball_url": "https://api.github.com/repos/facebook/react/tarball/v18.3.0",
+    "zipball_url": "https://api.github.com/repos/facebook/react/zipball/v18.3.0",
+    "body": "This release is identical to 18.2 but adds warnings for deprecated APIs and other changes that are needed for React 19.\r\n\r\nRead the [React 19 Upgrade Guide](https://react.dev/blog/2024/04/25/react-19-upgrade-guide) for more info.\r\n\r\n### React\r\n\r\n- Allow writing to `this.refs` to support string ref codemod [909071](https://github.com/facebook/react/commit/9090712fd3ca4e1099e1f92e67933c2cb4f32552)\r\n- Warn for deprecated `findDOMNode` outside StrictMode [c3b283](https://github.com/facebook/react/commit/c3b283964108b0e8dbcf1f9eb2e7e67815e39dfb)\r\n- Warn for deprecated `test-utils` methods [d4ea75](https://github.com/facebook/react/commit/d4ea75dc4258095593b6ac764289f42bddeb835c)\r\n- Warn for deprecated Legacy Context outside StrictMode [415ee0](https://github.com/facebook/react/commit/415ee0e6ea0fe3e288e65868df2e3241143d5f7f)\r\n- Warn for deprecated string refs outside StrictMode [#25383](https://github.com/facebook/react/pull/25383)\r\n- Warn for deprecated `defaultProps` for function components [#25699](https://github.com/facebook/react/pull/25699)\r\n- Warn when spreading `key` [#25697](https://github.com/facebook/react/pull/25697)\r\n- Warn when using `act` from `test-utils` [d4ea75](https://github.com/facebook/react/commit/d4ea75dc4258095593b6ac764289f42bddeb835c)\r\n\r\n### React DOM\r\n- Warn for deprecated `unmountComponentAtNode` [8a015b](https://github.com/facebook/react/commit/8a015b68cc060079878e426610e64e86fb328f8d)\r\n- Warn for deprecated `renderToStaticNodeStream` [#28874](https://github.com/facebook/react/pull/28874)\r\n",
+    "reactions": {
+      "url": "https://api.github.com/repos/facebook/react/releases/153048806/reactions",
+      "total_count": 289,
+      "+1": 113,
+      "-1": 0,
+      "laugh": 24,
+      "hooray": 39,
+      "confused": 0,
+      "heart": 48,
+      "rocket": 61,
+      "eyes": 4
+    }
+  }
+]