dependabot-bundler 0.154.3 → 0.156.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3018dfbdcf3fea39c0b5fc045057bd6ed3a8ac737ae6b6d401b9167d25fcb4d6
-  data.tar.gz: '016299a100e9fd8508f771c8681531aa7f1eaf04ed2596ad47cef8727fc3dc10'
+  metadata.gz: 25dea5795af9730a648b40f40d7879f1a0dcb50ad0cf175a9f54c3469004889c
+  data.tar.gz: eff4a40cb7cacd32ec3cd07cf620d6835186c491b8656a4ce6202aa6d569f7f1
 SHA512:
-  metadata.gz: 7e9774e9bc9d5ca0c6a24108ba31719183018f4922ba2d33d0b0156284023e3059afb58c7985ea470d3038544dbb127f5d759615d0fa4c5eebd4080fb5b64dcb
-  data.tar.gz: ebc2bab0725f9c4194ac8db332d1ab53ba3e1abb44b062d5bfc28e797cf0bab146f7f0383fe91b23c7198d01545aa34b026f545d4823917b9d570a5bb876dcf9
+  metadata.gz: 7c4333d49f18fb131f2a85485aafe4fedca04765c085e07847190fb9d518ede7e8b88eef6004dd8f7f23e10065c25f3a59a13b9bb8fde4b25e1432a64405b4ac
+  data.tar.gz: 4907949fd68bf4576c26425326a668395a194b160e3f966b2e2edb9e134ae7e61b77393d42569c8dcbdd48b16cf914d4ac305c442bdcd0ca0721bc7d1f88ce06

data/helpers/v2/spec/functions_spec.rb

@@ -21,4 +21,37 @@ RSpec.describe Functions do
       end
     end
   end
+
+  describe "#git_specs" do
+    let(:project_name) { "git_source" }
+    subject(:git_specs) do
+      in_tmp_folder do
+        Functions.git_specs(
+          dir: tmp_path,
+          gemfile_name: "Gemfile",
+          credentials: {}
+        )
+      end
+    end
+
+    def expect_specs(count)
+      expect(git_specs.size).to eq(count)
+      git_specs.each do |gs|
+        uri = URI.parse(gs[:auth_uri])
+        expect(uri.scheme).to(satisfy { |s| %w(http https).include?(s) })
+      end
+    end
+
+    it "returns git specs" do
+      expect_specs(4)
+    end
+
+    context "with github shorthand" do
+      let(:project_name) { "github_source" }
+
+      it "returns git specs" do
+        expect_specs(1)
+      end
+    end
+  end
 end

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -307,22 +307,11 @@ module Dependabot
           def replace_constant(node)
             case node.children.last&.type
             when :str, :int then nil # no-op
-            when :float, :const, :send, :lvar, :if
+            when :float, :const, :send, :lvar, :if, :dstr
               replace(
                 node.children.last.loc.expression,
                 %("#{replacement_version}")
               )
-            when :dstr
-              node.children.last.children.
-                select { |n| n.type == :begin }.
-                flat_map(&:children).
-                select { |n| node_is_version_constant?(n) }.
-                each do |n|
-                  replace(
-                    n.loc.expression,
-                    %("#{replacement_version}")
-                  )
-                end
             else
               raise "Unexpected node type #{node.children.last&.type}"
             end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -3,6 +3,7 @@
 require "excon"
 
 require "dependabot/bundler/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -55,7 +56,8 @@ module Dependabot
 
           relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = filter_vulnerable_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
@@ -78,11 +80,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(versions_array)
-          versions_array.
-            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && Gem::Version.correct?(dependency.version)
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -174,8 +174,11 @@ module Dependabot
               }
             )
             git_specs.reject do |spec|
+              uri = URI.parse(spec.fetch("auth_uri"))
+              next false unless %w(http https).include?(uri.scheme)
+
               Excon.get(
-                spec.fetch("auth_uri"),
+                uri.to_s,
                 idempotent: true,
                 **SharedHelpers.excon_defaults
               ).status == 200

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.154.3
+  version: 0.156.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-21 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.3
+        version: 0.156.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement