dependabot-bundler 0.117.7 → 0.118.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd54470e0420f13ed2b00c531ed52c9e87353dec9a311a992915bf5af8cb8112
-  data.tar.gz: d594bed528b2ae1f522885d6bd3ae258f0b0df11155ccaad7c5d09a2b179d0e6
+  metadata.gz: a6dd2c977c2cfb8b8a0d6627878a012e497e832401ee9fa2af90e1cbedd49386
+  data.tar.gz: d371923a5143f85857e27ba14165fc6daf6d927afd62145078f5e0357c87d0f9
 SHA512:
-  metadata.gz: 3de580b411c62739fad3423e29d600f91d1606806debf61f39e375d16c8da034709031733d00f2fd192f7622e984b49ad18d758cb145905bad33a0eb5eebb171
-  data.tar.gz: 77b1e90c75a363b6141eeab9292478265bad97ef24032aa5e28f2b05698465d52b354f43129a79ef93b6fa1983c58f933f98ba3373de94c9625ac872333bbc46
+  metadata.gz: 947cfd229e9ad50bc411a7ecf2c3d5f27a05c99a0d0d7091a360b4012d591401d524ddc7ba82993b3919439e8e1a8c4f6f94889f5c8ee3281835fbeb65a0e583
+  data.tar.gz: b2ed6f3100c6151c040ed0ed35285c4c7cbf663492939cbb9311a2a8f29adbb1c200ff631b8f4d30f646d706a62e6c00b73021f8a9645c652c6c500653bb0fd9

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -159,7 +159,15 @@ module Dependabot
             return false unless node.children.first&.type == :lvar
             return false unless node.children[1] == :files=
 
-            node.children[2]&.type == :send
+            node_dynamically_lists_files?(node.children[2])
+          end
+
+          def node_dynamically_lists_files?(node)
+            return false unless node.is_a?(Parser::AST::Node)
+
+            return true if node.type == :send
+
+            node.type == :block && node.children.first&.type == :send
           end
 
           def node_assigns_require_paths?(node)

data/lib/dependabot/bundler/update_checker.rb

@@ -167,6 +167,7 @@ module Dependabot
               unprepared_dependency_files: dependency_files,
               credentials: credentials,
               ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
               replacement_git_pin: tag
             ).latest_resolvable_version_details
             true
@@ -348,6 +349,7 @@ module Dependabot
               unprepared_dependency_files: dependency_files,
               credentials: credentials,
               ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
               remove_git_source: remove_git_source,
               unlock_requirement: unlock_requirement,
               latest_allowable_version: latest_version
@@ -369,6 +371,7 @@ module Dependabot
               dependency_files: prepared_dependency_files,
               credentials: credentials,
               ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
               security_advisories: security_advisories
             )
           end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -19,11 +19,13 @@ module Dependabot
         include SharedBundlerHelpers
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, security_advisories:)
+                       ignored_versions:, raise_on_ignored: false,
+                       security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
           @ignored_versions    = ignored_versions
+          @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
         end
 
@@ -57,8 +59,8 @@ module Dependabot
 
           relevant_versions = registry_versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_vulnerable_versions(relevant_versions)
+          relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
           relevant_versions.min
@@ -71,8 +73,13 @@ module Dependabot
         end
 
         def filter_ignored_versions(versions_array)
-          versions_array.
-            reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+          filtered = versions_array.
+                     reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+          if @raise_on_ignored && filtered.empty? && versions_array.any?
+            raise AllVersionsIgnored
+          end
+
+          filtered
         end
 
         def filter_vulnerable_versions(versions_array)

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -25,6 +25,7 @@ module Dependabot
 
         def initialize(dependency:, unprepared_dependency_files:,
                        credentials:, ignored_versions:,
+                       raise_on_ignored: false,
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
                        latest_allowable_version: nil)
@@ -32,6 +33,7 @@ module Dependabot
           @unprepared_dependency_files = unprepared_dependency_files
           @credentials                 = credentials
           @ignored_versions            = ignored_versions
+          @raise_on_ignored            = raise_on_ignored
           @replacement_git_pin         = replacement_git_pin
           @remove_git_source           = remove_git_source
           @unlock_requirement          = unlock_requirement
@@ -270,6 +272,7 @@ module Dependabot
               dependency_files: dependency_files,
               credentials: credentials,
               ignored_versions: ignored_versions,
+              raise_on_ignored: @raise_on_ignored,
               security_advisories: []
             ).latest_version_details
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.117.7
+  version: 0.118.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-20 00:00:00.000000000 Z
+date: 2020-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.7
+        version: 0.118.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.7
+        version: 0.118.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.82.0
+        version: 0.83.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.82.0
+        version: 0.83.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement