dependabot-bazel 0.348.1 → 0.349.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 221f9f4fd50522e20df8be2a4a35ec04a343b885a2efd3f9e466443bac135a75
-  data.tar.gz: e371b25ed3cd91b9eb700ae26385173d98ed4abe5516c0b097202c3cead41279
+  metadata.gz: ed0dbfa97a75fd1406bca951209c70fd4a6662af02ea56ee4358a4a35775a49a
+  data.tar.gz: 06572e1e787cd4a06b8a87ca8e9ba64a217ba05a521a7b43734f37f77619a724
 SHA512:
-  metadata.gz: 35b6973873aae8617c2e9c72ec588aa130ab22a9f4cfb1d024b55d910c66281ddd502142931067d1766b5a514191b4c353e688cd9bbf82ebd3c3f5591a134d19
-  data.tar.gz: b49518e5b26b63f82b666a855b90d0432ea26840d281b61b61cba03bb8060b1c3efc27e6754ead197c24db49d12d5598accd55ec58229367d1bdb627bae48fee
+  metadata.gz: 2389b544675a0ea95032e4b7011bb61344c1becd2f238b009d8cc206f8d12c11f32a9707edc05cf4d525738821a0f118b7129f9c72e6777266c832eda6d12aec
+  data.tar.gz: a1c6fea7689e7d7518bba8f42f6b5a6c57a17446b8f6f8e349338f4822d4442430ccf77d680da7bfd09c60e2d27caa2e9783461bcb048f32ebb7bf5a6ef6b8f0

data/lib/dependabot/bazel/requirement.rb

@@ -10,39 +10,44 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      # Bazel dependencies typically use exact versions, not version ranges
-      # This class exists for consistency with Dependabot patterns but
-      # may not be heavily used since Bazel tends to pin exact versions
-
       sig { params(requirement_string: String).returns(String) }
       def self.normalize_requirement(requirement_string)
-        # Handle exact version specifications (most common in Bazel)
         return requirement_string if requirement_string.match?(/^[<>=~]/)
 
-        # For bare version strings, treat as exact match
         return "= #{requirement_string}" if requirement_string.match?(/^\d+(\.\d+)*(-[\w\d.]+)?(\+[\w\d.]+)?$/)
 
         requirement_string
       end
 
-      # This abstract method must be implemented
       sig do
         override
           .params(requirement_string: T.nilable(String))
           .returns(T::Array[Dependabot::Requirement])
       end
       def self.requirements_array(requirement_string)
-        # For Bazel, most requirements are simple exact versions
         return [] if requirement_string.nil? || requirement_string.strip.empty?
 
-        normalized = normalize_requirement(requirement_string)
-        [new(normalized)]
+        # Handle comma-separated constraints (e.g., ">= 1.0, < 2.0")
+        constraints = requirement_string.split(",").map do |req_string|
+          normalize_requirement(req_string.strip)
+        end.reject(&:empty?)
+
+        return [] if constraints.empty?
+
+        [new(constraints)]
+      end
+
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
+      def initialize(*requirements)
+        requirements = requirements.flatten.flat_map do |req_string|
+          T.must(req_string).split(",").map(&:strip)
+        end
+
+        super(requirements)
       end
 
       sig { override.params(version: Gem::Version).returns(T::Boolean) }
       def satisfied_by?(version)
-        # For Bazel versions, delegate to the base class
-        # but ensure we're working with proper version objects
         bazel_version = case version
                         when Dependabot::Bazel::Version
                           version

data/lib/dependabot/bazel/update_checker.rb

@@ -78,7 +78,9 @@ module Dependabot
         versions = registry_client.all_module_versions(dependency.name)
         return nil if versions.empty?
 
-        filtered_versions = apply_cooldown_filter(versions)
+        filtered_versions = filter_ignored_versions(versions)
+        filtered_versions = filter_lower_versions(filtered_versions)
+        filtered_versions = apply_cooldown_filter(filtered_versions)
         return nil if filtered_versions.empty?
 
         latest_version_string = filtered_versions.max_by { |v| version_sort_key(v) }
@@ -98,6 +100,32 @@ module Dependabot
         )
       end
 
+      sig { params(versions: T::Array[String]).returns(T::Array[String]) }
+      def filter_ignored_versions(versions)
+        filtered = versions.reject do |version_string|
+          version = version_class.new(version_string)
+          ignore_requirements.any? { |req| req.satisfied_by?(version) }
+        end
+
+        if versions.count > filtered.count
+          Dependabot.logger.info("Filtered out #{versions.count - filtered.count} ignored versions")
+        end
+
+        if raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions).any?
+          Dependabot.logger.info("All updates for #{dependency.name} were ignored")
+        end
+
+        filtered
+      end
+
+      sig { params(versions: T::Array[String]).returns(T::Array[String]) }
+      def filter_lower_versions(versions)
+        return versions unless dependency.version
+
+        current_version = version_class.new(dependency.version)
+        versions.select { |v| version_class.new(v) > current_version }
+      end
+
       sig { params(versions: T::Array[String]).returns(T::Array[String]) }
       def apply_cooldown_filter(versions)
         return versions if should_skip_cooldown?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bazel
 version: !ruby/object:Gem::Version
-  version: 0.348.1
+  version: 0.349.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.348.1
+        version: 0.349.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.348.1
+        version: 0.349.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -263,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.348.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.349.0
 rdoc_options: []
 require_paths:
 - lib