dependabot-bundler 0.124.4 → 0.125.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb820bb6457e46ec963836b0e72dd072259920cfcc154f47782aae92d237e9e6
-  data.tar.gz: fd64efffeff89c95d03022fbdcdb8f4ac9d6b5a1d4eaf513df1829e9782d046f
+  metadata.gz: 80c1fc155e1518d591a60e985401f51bcae4f6332e469e06693ce1e5e1f29b4b
+  data.tar.gz: dec9c2bf4c74a475a78378744ec23cc97e2053c75a9fc20e3b58a3349f0df0f9
 SHA512:
-  metadata.gz: 60d5737d97621754e4c7c9c1fc82af69f94a4fcaad0ef52a0505c69d3daaa0d2a71a3585a22ab78faf4945fbd91c5f0c8f9cb3068fe468b93a5737e587c74c00
-  data.tar.gz: cc85b1eb2d914bc255cdd89ab94a41c6bf94742b0e07021f3fd7da6129b75bdf1b3f531f2ba8205cb9afd132afc67425f582d09a3c85fa8bf503982e1a8fc99c
+  metadata.gz: 2deece94900ce3d7c7d1ed93ced8845b5997d840b2453912c7c7b128bc945741e2e9b792d3106f4bc433004fb5138b1293917572ba3f0fe5d1f41e76e78f68e2
+  data.tar.gz: fbc107161f3c858edd349623d3a4d00b59ff5c85bd0557caad3dc9eead792defa09784ea412cc9d2ed1b4d349cb1fa564f9ec3ecdf3e8ab25e77a2c50a6ba7b4

data/lib/dependabot/bundler/update_checker.rb

@@ -13,6 +13,7 @@ module Dependabot
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/latest_version_finder"
+      require_relative "update_checker/conflicting_dependency_resolver"
 
       def latest_version
         return latest_version_for_git_dependency if git_dependency?
@@ -107,6 +108,17 @@ module Dependabot
         dependency.version.nil? ? :bump_versions_if_necessary : :bump_versions
       end
 
+      def conflicting_dependencies
+        ConflictingDependencyResolver.new(
+          dependency_files: dependency_files,
+          repo_contents_path: repo_contents_path,
+          credentials: credentials
+        ).conflicting_dependencies(
+          dependency: dependency,
+          target_version: lowest_security_fix_version
+        )
+      end
+
       private
 
       def latest_version_resolvable_with_full_unlock?

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "dependabot/bundler/update_checker"
+require "dependabot/bundler/native_helpers"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Bundler
+    class UpdateChecker < UpdateCheckers::Base
+      class ConflictingDependencyResolver
+        require_relative "shared_bundler_helpers"
+        include SharedBundlerHelpers
+
+        def initialize(dependency_files:, repo_contents_path:, credentials:)
+          @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
+          @credentials = credentials
+        end
+
+        # Finds any dependencies in the lockfile that have a subdependency on
+        # the given dependency that does not satisfly the target_version.
+        #
+        # @param dependency [Dependabot::Dependency] the dependency to check
+        # @param target_version [String] the version to check
+        # @return [Array<Hash{String => String}]
+        #   * name [String] the blocking dependencies name
+        #   * version [String] the version of the blocking dependency
+        #   * requirement [String] the requirement on the target_dependency
+        def conflicting_dependencies(dependency:, target_version:)
+          in_a_native_bundler_context(error_handling: false) do |tmp_dir|
+            SharedHelpers.run_helper_subprocess(
+              command: NativeHelpers.helper_path,
+              function: "conflicting_dependencies",
+              args: {
+                dir: tmp_dir,
+                dependency_name: dependency.name,
+                target_version: target_version,
+                credentials: relevant_credentials,
+                lockfile_name: lockfile.name,
+                using_bundler_2: using_bundler_2?
+              }
+            )
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.124.4
+  version: 0.125.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-30 00:00:00.000000000 Z
+date: 2020-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.4
+        version: 0.125.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.4
+        version: 0.125.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -194,6 +194,7 @@ files:
 - lib/dependabot/bundler/native_helpers.rb
 - lib/dependabot/bundler/requirement.rb
 - lib/dependabot/bundler/update_checker.rb
+- lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb
 - lib/dependabot/bundler/update_checker/file_preparer.rb
 - lib/dependabot/bundler/update_checker/force_updater.rb
 - lib/dependabot/bundler/update_checker/latest_version_finder.rb