dependabot-bazel 0.382.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17c70990ec6056251eb58da809bbc2dbb385dc52977febf54234a4d9ea1018f9
-  data.tar.gz: f8f677381b8b6ebec9974219de1afca38ba913c62d55ee2b4693af9af7ec3441
+  metadata.gz: 5de24f1c771f85a2f7751cc31cd33ab540aa5e2490238bce50e8911e3d5cf6af
+  data.tar.gz: aa3e5a4d9693afb18c3128d80c0d452352d9857ed75a23511beb7b5fdc3ff201
 SHA512:
-  metadata.gz: 540da1c84b3d29f7a78dd050d0a50630e00d7dbc79daea157b26d4257f70ecd3a0881e98d1062b7392f1d0a9e43edd7dbf8fdca511b0ad1b0c3e67e648643256
-  data.tar.gz: 9c385d81ed2d64872865104ad771e20feff129f1ec42b95aa0c9fb955e1d192947b138fb0c8763e75e3fa4578b5122d060917bcaacf50f5d9ea6b81a9d4fe766
+  metadata.gz: 1c573a560bdba70da9752dd96278b5257863f9263d43bfaf0e540211ba6ecb30236a5525b070efc88bc10cd4f66bf763a63ddb3447c13710ca39837a4b8b315f
+  data.tar.gz: f91bd0b1fed7a75d6a4ad75795a93d9d2b88d573edc1d6097cf61b779187a2ab21d5b6900af3ff2964e444446e1525b3c19c1579bcf0a2272cf4dfef192bb934

data/lib/dependabot/bazel/update_checker/requirements_updater.rb

@@ -1,6 +1,7 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "dependabot/dependency_requirement"
 require "dependabot/bazel/update_checker"
 
 module Dependabot
@@ -9,13 +10,16 @@ module Dependabot
       class RequirementsUpdater
         extend T::Sig
 
-        sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]], latest_version: String).void }
+        sig { params(requirements: T::Array[Dependabot::DependencyRequirement], latest_version: String).void }
         def initialize(requirements:, latest_version:)
-          @requirements = requirements
+          @requirements = T.let(
+            requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @latest_version = latest_version
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           @requirements.map do |requirement|
             updated_requirement = requirement.dup
@@ -26,7 +30,7 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(String) }

data/lib/dependabot/bazel/update_checker.rb

@@ -38,12 +38,10 @@ module Dependabot
       def updated_requirements
         return dependency.requirements unless latest_version
 
-        wrap_requirements(
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            latest_version: latest_version.to_s
-          ).updated_requirements
-        )
+        RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          latest_version: latest_version.to_s
+        ).updated_requirements
       end
 
       sig { returns(T.class_of(Dependabot::Bazel::Version)) }
@@ -81,7 +79,9 @@ module Dependabot
         versions = registry_client.all_module_versions(dependency.name)
         return nil if versions.empty?
 
-        filtered_versions = filter_ignored_versions(versions)
+        # Prerelease filter must run first so stable releases remain visible when upgrading from a prerelease.
+        filtered_versions = filter_prerelease_versions(versions)
+        filtered_versions = filter_ignored_versions(filtered_versions)
         filtered_versions = filter_lower_versions(filtered_versions)
         filtered_versions = apply_cooldown_filter(filtered_versions)
         return nil if filtered_versions.empty?
@@ -105,17 +105,21 @@ module Dependabot
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }
       def filter_ignored_versions(versions)
-        filtered = versions.reject do |version_string|
+        valid = versions.select { |v| version_class.correct?(v) }
+        filtered = valid.reject do |version_string|
           version = version_class.new(version_string)
           ignore_requirements.any? { |req| req.satisfied_by?(version) }
         end
 
-        if versions.count > filtered.count
-          Dependabot.logger.info("Filtered out #{versions.count - filtered.count} ignored versions")
+        if valid.count > filtered.count
+          Dependabot.logger.info("Filtered out #{valid.count - filtered.count} ignored versions")
         end
 
-        if raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions).any?
-          Dependabot.logger.info("All updates for #{dependency.name} were ignored")
+        if raise_on_ignored
+          lower_filtered = filter_lower_versions(filtered)
+          if lower_filtered.empty? && filter_lower_versions(valid).any?
+            Dependabot.logger.info("All updates for #{dependency.name} were ignored")
+          end
         end
 
         filtered
@@ -123,10 +127,45 @@ module Dependabot
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }
       def filter_lower_versions(versions)
-        return versions unless dependency.version
+        return versions unless dependency.version && version_class.correct?(dependency.version)
 
         current_version = version_class.new(dependency.version)
-        versions.select { |v| version_class.new(v) > current_version }
+        versions.select { |v| version_class.correct?(v) && version_class.new(v) > current_version }
+      end
+
+      # Filters prereleases keyed off dependency.version only (Bazel uses exact pins, not ranges).
+      sig { params(versions: T::Array[String]).returns(T::Array[String]) }
+      def filter_prerelease_versions(versions)
+        current_release = current_prerelease_release_line
+        filtered = versions.reject { |v| prerelease_to_exclude?(v, current_release) }
+
+        if versions.count > filtered.count
+          Dependabot.logger.info("Filtered out #{versions.count - filtered.count} pre-release versions")
+        end
+
+        filtered
+      end
+
+      # Returns the release line of the current version if it's a prerelease, nil otherwise.
+      sig { returns(T.nilable(Gem::Version)) }
+      def current_prerelease_release_line
+        current = dependency.version
+        return nil unless current && version_class.correct?(current)
+
+        parsed = version_class.new(current)
+        parsed.prerelease? ? parsed.release : nil
+      end
+
+      sig { params(version_string: String, current_release: T.nilable(Gem::Version)).returns(T::Boolean) }
+      def prerelease_to_exclude?(version_string, current_release)
+        # Filters malformed versions — they cannot be parsed for prerelease detection.
+        return false unless version_class.correct?(version_string)
+
+        candidate = version_class.new(version_string)
+        return false unless candidate.prerelease?
+
+        # On stable: exclude all prereleases. On prerelease: exclude only unrelated ones.
+        current_release.nil? || candidate.release != current_release
       end
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }

data/lib/dependabot/bazel/version.rb

@@ -13,15 +13,25 @@ module Dependabot
     class Version < Dependabot::Version
       extend T::Sig
 
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.nil?
+
+        super(normalize_bazel_version(version.to_s))
+      end
+
       sig { override.params(version: VersionParameter).void }
       def initialize(version)
         @version_string = T.let(version.to_s, String)
         @bcr_suffix = T.let(parse_bcr_suffix(@version_string), T.nilable(Integer))
 
-        # Remove the .bcr.X suffix for comparison, and strip leading 'v' if present
-        base_version = remove_bcr_suffix(@version_string)
-        base_version = base_version.sub(/^v/i, "")
-        super(base_version)
+        super(Dependabot::Bazel::Version.normalize_bazel_version(@version_string))
+      end
+
+      # Strips .bcr.N suffix and v prefix to yield a Gem::Version-compatible string.
+      sig { params(version_string: String).returns(String) }
+      def self.normalize_bazel_version(version_string)
+        version_string.sub(/\.bcr\.\d+$/, "").sub(/^v/i, "")
       end
 
       sig { override.returns(String) }
@@ -32,7 +42,7 @@ module Dependabot
       sig { returns(T.nilable(Integer)) }
       attr_reader :bcr_suffix
 
-      sig { override.params(other: T.untyped).returns(T.nilable(Integer)) }
+      sig { override.params(other: BasicObject).returns(T.nilable(Integer)) }
       def <=>(other)
         other_bazel = convert_to_bazel_version(other)
         return nil unless other_bazel
@@ -51,12 +61,7 @@ module Dependabot
         match ? T.must(match[1]).to_i : nil
       end
 
-      sig { params(version_string: String).returns(String) }
-      def remove_bcr_suffix(version_string)
-        version_string.sub(/\.bcr\.\d+$/, "")
-      end
-
-      sig { params(other: T.untyped).returns(T.nilable(Dependabot::Bazel::Version)) }
+      sig { params(other: BasicObject).returns(T.nilable(Dependabot::Bazel::Version)) }
       def convert_to_bazel_version(other)
         case other
         when Dependabot::Bazel::Version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bazel
 version: !ruby/object:Gem::Version
-  version: 0.382.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.382.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -269,7 +269,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -284,7 +284,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Bazel
 test_files: []