dependabot-bazel 0.383.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d41722565f366dc9662e0c7743dcecb9291a2bd50c703c3dc38355d91d218e6
-  data.tar.gz: 96e947e020343d0a28fd799f844e14484d55d3d5a1235403e86c8bec1799abea
+  metadata.gz: 5de24f1c771f85a2f7751cc31cd33ab540aa5e2490238bce50e8911e3d5cf6af
+  data.tar.gz: aa3e5a4d9693afb18c3128d80c0d452352d9857ed75a23511beb7b5fdc3ff201
 SHA512:
-  metadata.gz: e8f2d8ea5b90c582b6ae65f578123d969fb2a48f35b9606d4a1396abee0f736a5b4b827386808bf5685520a84dc1363f8bea70c39e0d8a8888fc37312f727634
-  data.tar.gz: b61bc8a80902f0c9e0589a3204d8b150976f05e12777bf02893d9445da4f930507d61b75ed3566f2b35d16aaab20e4d301cf8abfce8f78eb5856cf1f5d0107d4
+  metadata.gz: 1c573a560bdba70da9752dd96278b5257863f9263d43bfaf0e540211ba6ecb30236a5525b070efc88bc10cd4f66bf763a63ddb3447c13710ca39837a4b8b315f
+  data.tar.gz: f91bd0b1fed7a75d6a4ad75795a93d9d2b88d573edc1d6097cf61b779187a2ab21d5b6900af3ff2964e444446e1525b3c19c1579bcf0a2272cf4dfef192bb934

data/lib/dependabot/bazel/update_checker.rb

@@ -79,7 +79,9 @@ module Dependabot
         versions = registry_client.all_module_versions(dependency.name)
         return nil if versions.empty?
 
-        filtered_versions = filter_ignored_versions(versions)
+        # Prerelease filter must run first so stable releases remain visible when upgrading from a prerelease.
+        filtered_versions = filter_prerelease_versions(versions)
+        filtered_versions = filter_ignored_versions(filtered_versions)
         filtered_versions = filter_lower_versions(filtered_versions)
         filtered_versions = apply_cooldown_filter(filtered_versions)
         return nil if filtered_versions.empty?
@@ -103,17 +105,21 @@ module Dependabot
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }
       def filter_ignored_versions(versions)
-        filtered = versions.reject do |version_string|
+        valid = versions.select { |v| version_class.correct?(v) }
+        filtered = valid.reject do |version_string|
           version = version_class.new(version_string)
           ignore_requirements.any? { |req| req.satisfied_by?(version) }
         end
 
-        if versions.count > filtered.count
-          Dependabot.logger.info("Filtered out #{versions.count - filtered.count} ignored versions")
+        if valid.count > filtered.count
+          Dependabot.logger.info("Filtered out #{valid.count - filtered.count} ignored versions")
         end
 
-        if raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions).any?
-          Dependabot.logger.info("All updates for #{dependency.name} were ignored")
+        if raise_on_ignored
+          lower_filtered = filter_lower_versions(filtered)
+          if lower_filtered.empty? && filter_lower_versions(valid).any?
+            Dependabot.logger.info("All updates for #{dependency.name} were ignored")
+          end
         end
 
         filtered
@@ -121,10 +127,45 @@ module Dependabot
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }
       def filter_lower_versions(versions)
-        return versions unless dependency.version
+        return versions unless dependency.version && version_class.correct?(dependency.version)
 
         current_version = version_class.new(dependency.version)
-        versions.select { |v| version_class.new(v) > current_version }
+        versions.select { |v| version_class.correct?(v) && version_class.new(v) > current_version }
+      end
+
+      # Filters prereleases keyed off dependency.version only (Bazel uses exact pins, not ranges).
+      sig { params(versions: T::Array[String]).returns(T::Array[String]) }
+      def filter_prerelease_versions(versions)
+        current_release = current_prerelease_release_line
+        filtered = versions.reject { |v| prerelease_to_exclude?(v, current_release) }
+
+        if versions.count > filtered.count
+          Dependabot.logger.info("Filtered out #{versions.count - filtered.count} pre-release versions")
+        end
+
+        filtered
+      end
+
+      # Returns the release line of the current version if it's a prerelease, nil otherwise.
+      sig { returns(T.nilable(Gem::Version)) }
+      def current_prerelease_release_line
+        current = dependency.version
+        return nil unless current && version_class.correct?(current)
+
+        parsed = version_class.new(current)
+        parsed.prerelease? ? parsed.release : nil
+      end
+
+      sig { params(version_string: String, current_release: T.nilable(Gem::Version)).returns(T::Boolean) }
+      def prerelease_to_exclude?(version_string, current_release)
+        # Filters malformed versions — they cannot be parsed for prerelease detection.
+        return false unless version_class.correct?(version_string)
+
+        candidate = version_class.new(version_string)
+        return false unless candidate.prerelease?
+
+        # On stable: exclude all prereleases. On prerelease: exclude only unrelated ones.
+        current_release.nil? || candidate.release != current_release
       end
 
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }

data/lib/dependabot/bazel/version.rb

@@ -13,15 +13,25 @@ module Dependabot
     class Version < Dependabot::Version
       extend T::Sig
 
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.nil?
+
+        super(normalize_bazel_version(version.to_s))
+      end
+
       sig { override.params(version: VersionParameter).void }
       def initialize(version)
         @version_string = T.let(version.to_s, String)
         @bcr_suffix = T.let(parse_bcr_suffix(@version_string), T.nilable(Integer))
 
-        # Remove the .bcr.X suffix for comparison, and strip leading 'v' if present
-        base_version = remove_bcr_suffix(@version_string)
-        base_version = base_version.sub(/^v/i, "")
-        super(base_version)
+        super(Dependabot::Bazel::Version.normalize_bazel_version(@version_string))
+      end
+
+      # Strips .bcr.N suffix and v prefix to yield a Gem::Version-compatible string.
+      sig { params(version_string: String).returns(String) }
+      def self.normalize_bazel_version(version_string)
+        version_string.sub(/\.bcr\.\d+$/, "").sub(/^v/i, "")
       end
 
       sig { override.returns(String) }
@@ -51,11 +61,6 @@ module Dependabot
         match ? T.must(match[1]).to_i : nil
       end
 
-      sig { params(version_string: String).returns(String) }
-      def remove_bcr_suffix(version_string)
-        version_string.sub(/\.bcr\.\d+$/, "")
-      end
-
       sig { params(other: BasicObject).returns(T.nilable(Dependabot::Bazel::Version)) }
       def convert_to_bazel_version(other)
         case other

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bazel
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -269,7 +269,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -284,7 +284,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Bazel
 test_files: []