dependabot-bundler 0.216.2 → 0.218.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ad59af24d3a0f24fa6590890f438eba205d59415b6a7444c277fefe101a1e8e
-  data.tar.gz: d4e95545b59b2b8137be001e69c404cfd9627be007d69e4b57cb363fd29e5ea3
+  metadata.gz: d623a62a3b6add7027f10b4257b7100720120d72b61e48d70880843c2e6db4cd
+  data.tar.gz: c1aecfa1fda2c62b69fc0ae5e3d5164c71ab5d35e2b9d2ec3311aca002e47de7
 SHA512:
-  metadata.gz: 6b4511cacbd8bc90175c27e44e7982e6af00ec63c5658cadca2ad8c597d3afdaa0aa971596f9ef400ed5914bc3580f54fd222ed240881125382a78c3f0822bf8
-  data.tar.gz: 29ac7bb8faae80a7d3c202f1a3b5534b0cdfe75085615740db90da109f35480a8e021b496c5c90c962dd1207b6eb249b9fc122cebbea4547755e8b2fa0668a45
+  metadata.gz: 70fc70d920f2bded048e59bf00c7050f12125a867f6d73d43a81b889fd3ee16077add5fb92603667203387fc031ea55e5ff6b58c10d4f348183a971b2d2bcb8a
+  data.tar.gz: 6502c1aa0a241258a7802f80e597638fe31ff47cef2e5b5647d2cdff4cc3e687e56f783d601a207c49eadf97e0e1316cb4b719559b177d92819d75f888027d27

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -89,15 +89,10 @@ module Dependabot
           File.write(gemfile.name, prepared_gemfile_content(gemfile))
           File.write(lockfile.name, sanitized_lockfile_body)
 
-          top_level_gemspecs.each do |gemspec|
-            path = gemspec.name
-            FileUtils.mkdir_p(Pathname.new(path).dirname)
-            updated_content = updated_gemspec_content(gemspec)
-            File.write(path, sanitized_gemspec_content(path, updated_content))
-          end
-
+          write_gemspecs(top_level_gemspecs)
           write_ruby_version_file
-          write_path_gemspecs
+          write_gemspecs(path_gemspecs)
+          write_specification_files
           write_imported_ruby_files
 
           evaled_gemfiles.each do |file|
@@ -115,13 +110,16 @@ module Dependabot
           File.write(path, ruby_version_file.content)
         end
 
-        def write_path_gemspecs
-          path_gemspecs.each do |file|
+        def write_gemspecs(files)
+          files.each do |file|
             path = file.name
             FileUtils.mkdir_p(Pathname.new(path).dirname)
-            File.write(path, sanitized_gemspec_content(path, file.content))
+            updated_content = updated_gemspec_content(file)
+            File.write(path, sanitized_gemspec_content(path, updated_content))
           end
+        end
 
+        def write_specification_files
           specification_files.each do |file|
             path = file.name
             FileUtils.mkdir_p(Pathname.new(path).dirname)

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -9,7 +9,7 @@ module Dependabot
         class UnfixableRequirement < StandardError; end
 
         ALLOWED_UPDATE_STRATEGIES =
-          %i(bump_versions bump_versions_if_necessary).freeze
+          %i(lockfile_only bump_versions bump_versions_if_necessary).freeze
 
         def initialize(requirements:, update_strategy:, updated_source:,
                        latest_version:, latest_resolvable_version:)
@@ -27,6 +27,8 @@ module Dependabot
         end
 
         def updated_requirements
+          return requirements if update_strategy == :lockfile_only
+
           requirements.map do |req|
             if req[:file].include?(".gemspec")
               update_gemspec_requirement(req)

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -37,6 +37,8 @@ module Dependabot
           @unlock_requirement          = unlock_requirement
           @latest_allowable_version    = latest_allowable_version
           @options                     = options
+
+          @latest_allowable_version_incompatible_with_ruby = false
         end
 
         def latest_resolvable_version_details
@@ -44,6 +46,10 @@ module Dependabot
             fetch_latest_resolvable_version_details
         end
 
+        def latest_allowable_version_incompatible_with_ruby?
+          @latest_allowable_version_incompatible_with_ruby
+        end
+
         private
 
         attr_reader :dependency, :unprepared_dependency_files,
@@ -208,7 +214,9 @@ module Dependabot
           ruby_requirement = Dependabot::Bundler::Requirement.new(ruby_requirement)
           current_ruby_version = Dependabot::Bundler::Version.new(details[:ruby_version])
 
-          !ruby_requirement.satisfied_by?(current_ruby_version)
+          return false if ruby_requirement.satisfied_by?(current_ruby_version)
+
+          @latest_allowable_version_incompatible_with_ruby = true
         rescue JSON::ParserError, Excon::Error::Socket, Excon::Error::Timeout
           # Give the benefit of the doubt if something goes wrong fetching
           # version details (could be that it's a private index, etc.)

data/lib/dependabot/bundler/update_checker.rb

@@ -73,8 +73,10 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        dependency.requirements.
-          select { |r| requirement_class.new(r[:requirement]).specific? }.
+        return true if requirements_unlocked?
+        return false if requirements_update_strategy == :lockfile_only
+
+        dependency.specific_requirements.
           all? do |req|
             file = dependency_files.find { |f| f.name == req.fetch(:file) }
             updated = FileUpdater::RequirementReplacer.new(
@@ -109,8 +111,13 @@ module Dependabot
 
       private
 
+      def requirements_unlocked?
+        dependency.specific_requirements.none?
+      end
+
       def latest_version_resolvable_with_full_unlock?
         return false unless latest_version
+        return false if version_resolver(remove_git_source: false).latest_allowable_version_incompatible_with_ruby?
 
         updated_dependencies = force_updater.updated_dependencies
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.216.2
+  version: 0.218.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-20 00:00:00.000000000 Z
+date: 2023-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.2
+        version: 0.218.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.2
+        version: 0.218.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -295,8 +295,8 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata:
-  issue_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.218.0
 post_install_message: 
 rdoc_options: []
 require_paths: