dependabot-bundler 0.222.0 → 0.224.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4b0cd1d53ff5dd4949d1a05f4997f58226952701c028a0fe55dffba229c73ed
-  data.tar.gz: 326a9af151e726b984e87e21198960bf723291630b4a7400a95322bad5b9f0d7
+  metadata.gz: fe41f546784766646a331b7b9b278bd0a0be01d13c0b9f51da8457a83db4db16
+  data.tar.gz: b15f4967d4c25a5e7bf87ba352b649c186e10b843964ba5910c381537340d0f7
 SHA512:
-  metadata.gz: 1e4792a504b20d2a44babbd01a9bf006efb583afd1c4f7968c35c41965e832f88fa530f02e12f5a908faf5e15558d7166f42eae7c4b17595bb6dd7e6acce1808
-  data.tar.gz: 4b431dab95098f6419c9e3d8c06701519f8262a6bfe558d95f3890b7326a793824f9ab9b080bbab93dd64c05b2dbba6f2f2145fd8d3b300f6d0eeede94f286ce
+  metadata.gz: cc3ea7c204c643484527dfe5f90eec51fcf968ae1d1bccaf42709c1101bcb7ec2dec3015cc20eb2a6cce40d58e505a8da0d28b59cae8ca4540a69db6e6eeac97
+  data.tar.gz: e88b57ec7b8fff13d5353ba46654ebc9b82bb975ed16f80be20e73e9b568919f8743defe09a4489f4514fd05bd927c4716eb984847b401b430f7d309088a4196

data/lib/dependabot/bundler/helpers.rb

@@ -9,7 +9,7 @@ module Dependabot
       # newest version we support
       DEFAULT = V2
       # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, with failover to V1 on the assumption
+      # the version it was bundled with, we failover to V1 on the assumption
       # it was created with an old version that didn't add this information
       FAILOVER = V1
 

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -77,6 +77,15 @@ module Dependabot
             ).parse
         end
 
+        def top_level_dependencies
+          @top_level_dependencies ||=
+            FileParser.new(
+              dependency_files: dependency_files.reject { |file| file.name == lockfile.name },
+              credentials: credentials,
+              source: nil
+            ).parse
+        end
+
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -85,14 +94,17 @@ module Dependabot
           #
           # This is kind of a bug in Bundler, and we should try to fix it,
           # but resolving it won't necessarily be easy.
-          updated_deps.filter_map do |dep|
-            original_dep =
-              original_dependencies.find { |d| d.name == dep.fetch("name") }
-            spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-            next if spec.fetch("version") == original_dep.version
+          # put the lead dependency first
+          index = specs.index { |dep| dep["name"] == updated_deps.first["name"] }
+          specs.unshift(specs.delete_at(index))
+          specs.filter_map do |dep|
+            next unless top_level_dependencies.find { |d| d.name == dep.fetch("name") }
+
+            original_dep = original_dependencies.find { |d| d.name == dep.fetch("name") }
+            next if dep.fetch("version") == original_dep.version
 
-            build_dependency(original_dep, spec)
+            build_dependency(original_dep, dep)
           end
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.222.0
+  version: 0.224.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.222.0
+        version: 0.224.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.222.0
+        version: 0.224.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -268,7 +268,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.222.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
 post_install_message: 
 rdoc_options: []
 require_paths: