dependabot-bundler 0.154.2 → 0.155.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b31ba93254309940073353b581acd7631e6db21a6ffad47d3d88afe4b08a53d
-  data.tar.gz: bc63d0f4b4455ad8c2c08da23a3d47d5e8dd567061b415c386b0453b313776fb
+  metadata.gz: e62bca6686f1f56048d245ffb38c12d94925ce5676303ffe292bc90e8f43bf63
+  data.tar.gz: b3cf9709215c482e771b738122df30049601f36dcb3f6a24afa6b9450623a7c0
 SHA512:
-  metadata.gz: dd79eec594396d1cb334ae5ef2020669b0e3edc96ac5284c2c5ee1ce65cb804ca9f266f3539e14daf7636fb752642f84d9d085f2f8e465a445a1e607b346f6e0
-  data.tar.gz: 49156e6d573d6290582776eaf7e76b1339d0341222e521d52c3f858e9de997474e0559a27382ef9f0ae49ae8140ee8c08d9fc3401a0bbb722a8360bb716c179c
+  metadata.gz: 8a5eb7ce599ac9bf48d96f81ee7b716ebf9d9bea48240ec49d580eb5878557cf5a7b7071df08e8c58de051575b03006b881da8a8c26940b5b45dc2505b34a577
+  data.tar.gz: c8911265095adf808bc59a66124a766ece394c9d2181a0de0b0083b8a0bc7646c544e1e4c7c44fe1377652225ee9fcbde163655946dd57ac6d01a131a957dc99

data/helpers/v2/spec/functions_spec.rb

@@ -21,4 +21,37 @@ RSpec.describe Functions do
       end
     end
   end
+
+  describe "#git_specs" do
+    let(:project_name) { "git_source" }
+    subject(:git_specs) do
+      in_tmp_folder do
+        Functions.git_specs(
+          dir: tmp_path,
+          gemfile_name: "Gemfile",
+          credentials: {}
+        )
+      end
+    end
+
+    def expect_specs(count)
+      expect(git_specs.size).to eq(count)
+      git_specs.each do |gs|
+        uri = URI.parse(gs[:auth_uri])
+        expect(uri.scheme).to(satisfy { |s| %w(http https).include?(s) })
+      end
+    end
+
+    it "returns git specs" do
+      expect_specs(4)
+    end
+
+    context "with github shorthand" do
+      let(:project_name) { "github_source" }
+
+      it "returns git specs" do
+        expect_specs(1)
+      end
+    end
+  end
 end

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -307,22 +307,11 @@ module Dependabot
           def replace_constant(node)
             case node.children.last&.type
             when :str, :int then nil # no-op
-            when :float, :const, :send, :lvar, :if
+            when :float, :const, :send, :lvar, :if, :dstr
               replace(
                 node.children.last.loc.expression,
                 %("#{replacement_version}")
               )
-            when :dstr
-              node.children.last.children.
-                select { |n| n.type == :begin }.
-                flat_map(&:children).
-                select { |n| node_is_version_constant?(n) }.
-                each do |n|
-                  replace(
-                    n.loc.expression,
-                    %("#{replacement_version}")
-                  )
-                end
             else
               raise "Unexpected node type #{node.children.last&.type}"
             end

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -50,10 +50,10 @@ module Dependabot
         end
 
         def ruby_version
-          requirement = if !ruby_requirement.is_a?(Gem::Requirement)
-                          Dependabot::Bundler::Requirement.new(ruby_requirement)
-                        else
+          requirement = if ruby_requirement.is_a?(Gem::Requirement)
                           ruby_requirement
+                        else
+                          Dependabot::Bundler::Requirement.new(ruby_requirement)
                         end
 
           ruby_version =

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -3,6 +3,7 @@
 require "excon"
 
 require "dependabot/bundler/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -55,7 +56,8 @@ module Dependabot
 
           relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = filter_vulnerable_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
@@ -78,11 +80,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(versions_array)
-          versions_array.
-            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && Gem::Version.correct?(dependency.version)
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -174,8 +174,11 @@ module Dependabot
               }
             )
             git_specs.reject do |spec|
+              uri = URI.parse(spec.fetch("auth_uri"))
+              next false unless %w(http https).include?(uri.scheme)
+
               Excon.get(
-                spec.fetch("auth_uri"),
+                uri.to_s,
                 idempotent: true,
                 **SharedHelpers.excon_defaults
               ).status == 200

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.154.2
+  version: 0.155.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-17 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.2
+        version: 0.155.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.2
+        version: 0.155.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement