dependabot-bundler 0.217.0 → 0.219.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc4045411c16c5c5d69967b8b7694692fea34cc37585ecf2ab1523c83b5de265
-  data.tar.gz: ca89213aada1cbdd4c8b012bf8cdc68ea06e7192bbc9db4fb01a9994f6f242dd
+  metadata.gz: 405561659bfd74c15f22fdd5879be9a3d238159a18c6b2a57af1a9b6868122cd
+  data.tar.gz: 3cce94b0751d9b2b26bc96c322f8956b8c764d5ce93e1e997723e154b610d022
 SHA512:
-  metadata.gz: 61280bebf02b003e7913724a4b9f628ecc93d41ac3e8147d92b002ba283b1c7334b4b8b4fc552c568732ae55d3a8bad1439b54ad48b3e897a671394fe2de3724
-  data.tar.gz: 18e729dfb58e8b2debf30d1fcfee40fd44de8fec097fadd625d81fdbce4f5c9ab7edcad6fb3f21e0209b0d7606ec4e7b201209f19092cd7899be1c9a1eb15383
+  metadata.gz: 68e3db074b5b6076aa283117a3ec027257a36c526753d387ae787eb8eaeabfc0f39e47b13f14bfb6c4df88ba35c815dae490bd93dd3f640af35b4a693f35eeb9
+  data.tar.gz: a599a89231f374a2afb742ad42e228315d4a03edb86c936e1eaee8f00625afe61bd02c691ccec49a8d87bd08c511cf78da582e8c8fe6f9ec8a46a8e8b0c63e56

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -89,15 +89,10 @@ module Dependabot
           File.write(gemfile.name, prepared_gemfile_content(gemfile))
           File.write(lockfile.name, sanitized_lockfile_body)
 
-          top_level_gemspecs.each do |gemspec|
-            path = gemspec.name
-            FileUtils.mkdir_p(Pathname.new(path).dirname)
-            updated_content = updated_gemspec_content(gemspec)
-            File.write(path, sanitized_gemspec_content(path, updated_content))
-          end
-
+          write_gemspecs(top_level_gemspecs)
           write_ruby_version_file
-          write_path_gemspecs
+          write_gemspecs(path_gemspecs)
+          write_specification_files
           write_imported_ruby_files
 
           evaled_gemfiles.each do |file|
@@ -115,13 +110,16 @@ module Dependabot
           File.write(path, ruby_version_file.content)
         end
 
-        def write_path_gemspecs
-          path_gemspecs.each do |file|
+        def write_gemspecs(files)
+          files.each do |file|
             path = file.name
             FileUtils.mkdir_p(Pathname.new(path).dirname)
-            File.write(path, sanitized_gemspec_content(path, file.content))
+            updated_content = updated_gemspec_content(file)
+            File.write(path, sanitized_gemspec_content(path, updated_content))
           end
+        end
 
+        def write_specification_files
           specification_files.each do |file|
             path = file.name
             FileUtils.mkdir_p(Pathname.new(path).dirname)

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -9,7 +9,7 @@ module Dependabot
         class UnfixableRequirement < StandardError; end
 
         ALLOWED_UPDATE_STRATEGIES =
-          %i(bump_versions bump_versions_if_necessary).freeze
+          %i(lockfile_only bump_versions bump_versions_if_necessary).freeze
 
         def initialize(requirements:, update_strategy:, updated_source:,
                        latest_version:, latest_resolvable_version:)
@@ -27,6 +27,8 @@ module Dependabot
         end
 
         def updated_requirements
+          return requirements if update_strategy == :lockfile_only
+
           requirements.map do |req|
             if req[:file].include?(".gemspec")
               update_gemspec_requirement(req)

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -37,6 +37,8 @@ module Dependabot
           @unlock_requirement          = unlock_requirement
           @latest_allowable_version    = latest_allowable_version
           @options                     = options
+
+          @latest_allowable_version_incompatible_with_ruby = false
         end
 
         def latest_resolvable_version_details
@@ -44,6 +46,10 @@ module Dependabot
             fetch_latest_resolvable_version_details
         end
 
+        def latest_allowable_version_incompatible_with_ruby?
+          @latest_allowable_version_incompatible_with_ruby
+        end
+
         private
 
         attr_reader :dependency, :unprepared_dependency_files,
@@ -208,7 +214,9 @@ module Dependabot
           ruby_requirement = Dependabot::Bundler::Requirement.new(ruby_requirement)
           current_ruby_version = Dependabot::Bundler::Version.new(details[:ruby_version])
 
-          !ruby_requirement.satisfied_by?(current_ruby_version)
+          return false if ruby_requirement.satisfied_by?(current_ruby_version)
+
+          @latest_allowable_version_incompatible_with_ruby = true
         rescue JSON::ParserError, Excon::Error::Socket, Excon::Error::Timeout
           # Give the benefit of the doubt if something goes wrong fetching
           # version details (could be that it's a private index, etc.)

data/lib/dependabot/bundler/update_checker.rb

@@ -73,8 +73,10 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        dependency.requirements.
-          select { |r| requirement_class.new(r[:requirement]).specific? }.
+        return true if requirements_unlocked?
+        return false if requirements_update_strategy == :lockfile_only
+
+        dependency.specific_requirements.
           all? do |req|
             file = dependency_files.find { |f| f.name == req.fetch(:file) }
             updated = FileUpdater::RequirementReplacer.new(
@@ -109,8 +111,13 @@ module Dependabot
 
       private
 
+      def requirements_unlocked?
+        dependency.specific_requirements.none?
+      end
+
       def latest_version_resolvable_with_full_unlock?
         return false unless latest_version
+        return false if version_resolver(remove_git_source: false).latest_allowable_version_incompatible_with_ruby?
 
         updated_dependencies = force_updater.updated_dependencies
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.217.0
+  version: 0.219.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-24 00:00:00.000000000 Z
+date: 2023-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.217.0
+        version: 0.219.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.217.0
+        version: 0.219.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -295,8 +295,8 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata:
-  issue_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.219.0
 post_install_message: 
 rdoc_options: []
 require_paths: