dependabot-bundler 0.104.0 → 0.104.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b3955c8a3cb5756607028ee4f13ca8ffd2f8578f9b4c5b247fc56ccc7f4865d2
-  data.tar.gz: 5b18aa92559e79eab68c4f70e39213ed32aee3e6324ce0f7acf38693d7f0c4b3
+  metadata.gz: 188b7d26a9b823b918edb744eb45ce401b0763ce98a82d9b836880cfb41f05a4
+  data.tar.gz: f7ceb08ce85a9bf0cec07e1825146d0f6e8ed9eba0def89368f63ba89edf95db
 SHA512:
-  metadata.gz: dadadec7982214f33fadacc7708b0a238b62ef1fc64d07cf2de1600194c0a28fc179d45909f98ae96e37012f26f5a5d151f310560e2b20bccb36b0a60e634c07
-  data.tar.gz: d8ad86d4c6899e16442f021fe69d9aaf4bfc15703ae5bc8609c4e032603cb243e35af7518e4d48d0cd21236ef23a42fc9adb80d9ff55d721fe87d1d29e983b3f
+  metadata.gz: b32f991ab5515799312cc8af470eaeb7fc4952860033b86a65bebff1b64a27470aedc340da0121d57b3dcb8ef411482685dd79bd3524b810fc5a486c02b12102
+  data.tar.gz: 69fef0900abf881d96bcc632d7f92ad5536711d09f89c47a5e34e7d9b8f1a9cd670128ee17c9bcd6e72467c2738c06927c1f1aa70de46090bef75ce01fa599c8

data/lib/dependabot/bundler/update_checker.rb

@@ -56,29 +56,27 @@ module Dependabot
       end
 
       def updated_requirements
-        if updated_source&.fetch(:ref, nil) &&
-           updated_source.fetch(:ref) != dependency_source_details.fetch(:ref)
-          updated_version =
-            latest_resolvable_version_details_with_updated_git_source&.
-            fetch(:version)&.
-            to_s
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            update_strategy: requirements_update_strategy,
-            updated_source: updated_source,
-            latest_version: updated_version,
-            latest_resolvable_version: updated_version
-          ).updated_requirements
-        else
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            update_strategy: requirements_update_strategy,
-            updated_source: updated_source,
-            latest_version: latest_version_details&.fetch(:version)&.to_s,
-            latest_resolvable_version:
-              preferred_resolvable_version_details&.fetch(:version)&.to_s
-          ).updated_requirements
-        end
+        latest_version_for_req_updater =
+          if switching_source_from_git_to_rubygems?
+            git_commit_checker.local_tag_for_latest_version.fetch(:version).to_s
+          else
+            latest_version_details&.fetch(:version)&.to_s
+          end
+
+        latest_resolvable_version_for_req_updater =
+          if switching_source_from_git_to_rubygems?
+            latest_version_for_req_updater
+          else
+            preferred_resolvable_version_details&.fetch(:version)&.to_s
+          end
+
+        RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          update_strategy: requirements_update_strategy,
+          updated_source: updated_source,
+          latest_version: latest_version_for_req_updater,
+          latest_resolvable_version: latest_resolvable_version_for_req_updater
+        ).updated_requirements
       end
 
       def requirements_unlocked_or_can_be?
@@ -142,7 +140,9 @@ module Dependabot
 
       def resolvable?(version)
         @resolvable ||= {}
-        @resolvable[version] ||=
+        return @resolvable[version] if @resolvable.key?(version)
+
+        @resolvable[version] =
           begin
             ForceUpdater.new(
               dependency: dependency,
@@ -250,17 +250,10 @@ module Dependabot
       end
 
       def latest_git_tag_is_resolvable?
-        return @git_tag_resolvable if @latest_git_tag_is_resolvable_checked
-
-        @latest_git_tag_is_resolvable_checked = true
-
-        return false if git_commit_checker.local_tag_for_latest_version.nil?
+        latest_tag_details = git_commit_checker.local_tag_for_latest_version
+        return false unless latest_tag_details
 
-        latest_resolvable_version_details_with_updated_git_source
-
-        @git_tag_resolvable = true
-      rescue Dependabot::DependencyFileNotResolvable
-        @git_tag_resolvable = false
+        resolvable?(latest_tag_details.fetch(:version))
       end
 
       def git_branch_or_ref_in_release?(release)
@@ -303,6 +296,12 @@ module Dependabot
         Gem::Version.correct?(latest_resolvable_version_for_git_dependency)
       end
 
+      def switching_source_from_git_to_rubygems?
+        return false unless updated_source&.fetch(:ref, nil)
+
+        updated_source.fetch(:ref) != dependency_source_details.fetch(:ref)
+      end
+
       def force_updater
         @force_updater ||=
           ForceUpdater.new(
@@ -322,21 +321,6 @@ module Dependabot
           )
       end
 
-      def latest_resolvable_version_details_with_updated_git_source
-        @latest_resolvable_version_details_with_updated_git_source ||=
-          begin
-            replacement_tag = git_commit_checker.local_tag_for_latest_version
-
-            VersionResolver.new(
-              dependency: dependency,
-              unprepared_dependency_files: dependency_files,
-              credentials: credentials,
-              ignored_versions: ignored_versions,
-              replacement_git_pin: replacement_tag.fetch(:tag)
-            ).latest_resolvable_version_details
-          end
-      end
-
       def version_resolver(remove_git_source:, unlock_requirement: true)
         @version_resolver ||= {}
         @version_resolver[remove_git_source] ||= {}

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -168,7 +168,10 @@ module Dependabot
           new_req = Gem::Requirement.create("= #{target_version}")
           definition.dependencies.
             find { |d| d.name == dependency.name }.
-            instance_variable_set(:@requirement, new_req)
+            tap do |dep|
+              dep.instance_variable_set(:@requirement, new_req)
+              dep.source = nil if dep.source.is_a?(::Bundler::Source::Git)
+            end
 
           definition
         end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -41,8 +41,7 @@ module Dependabot
                     :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
-          if dependency_source.is_a?(::Bundler::Source::Git) &&
-             dependency.name != "bundler"
+          if dependency_source.is_a?(::Bundler::Source::Git)
             return latest_git_version_details
           end
 
@@ -66,8 +65,9 @@ module Dependabot
         end
 
         def filter_prerelease_versions(versions_array)
-          versions_array.
-            reject { |v| v.prerelease? && !wants_prerelease? }
+          return versions_array if wants_prerelease?
+
+          versions_array.reject(&:prerelease?)
         end
 
         def filter_ignored_versions(versions_array)
@@ -76,13 +76,8 @@ module Dependabot
         end
 
         def filter_vulnerable_versions(versions_array)
-          arr = versions_array
-
-          security_advisories.each do |advisory|
-            arr = arr.reject { |v| advisory.vulnerable?(v) }
-          end
-
-          arr
+          versions_array.
+            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
         end
 
         def filter_lower_versions(versions_array)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.104.0
+  version: 0.104.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-16 00:00:00.000000000 Z
+date: 2019-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.0
+        version: 0.104.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.104.0
+        version: 0.104.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement