dependabot-bundler 0.223.0 → 0.225.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23ce0d39fdead4b32fc1c52df64211e60bf4230da2ad1893c14f7b2d5ef58683
-  data.tar.gz: 10da25c6e318ddf4a0028789ff6f3180469ca703f72c93fca750b18ae35bfe44
+  metadata.gz: 4ba17ad283a50a7c06199c0dd9eb7546616bbc18161b2d475587f67535c4f527
+  data.tar.gz: e0ec3920c84e0a1df752bebd6f3f9545c50782e34a22f0933f94e3c27932c506
 SHA512:
-  metadata.gz: 6b5ef015097c78c7ebbf1db0ca446bf1b6f4c46a798fb4f2b7f4ba3eb2dbf48a5e85ca3c2d4bd54c41a106df1a667445c4cc3eb27f6b34e9fc1af19a6dc6809c
-  data.tar.gz: ba36300ab2907b311051e2f3f63400410bc0c1d830657bc5b9d0fd39212304a555d43f3dee6bcc1454625be862330eb9bf721475653f243945d7bb94fcc0241d
+  metadata.gz: f7c2375065f8ce381f6b2c1293f24ba0b279416c14adba367ef6623a915a56b5e2c93ba5e382eef5cfb06487630b3291d5f5af368469db2ade9a139751d35dde
+  data.tar.gz: 1028997b2e4d5bf9deb4b07eac0532af63aa7e4cc9fa9e59007fb61da7a44adefd6ef2ef4de7720ac6ce5cf3f8d7217c521f99baf4239641fd0197dd63497dc8

data/lib/dependabot/bundler/helpers.rb

@@ -9,7 +9,7 @@ module Dependabot
       # newest version we support
       DEFAULT = V2
       # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, with failover to V1 on the assumption
+      # the version it was bundled with, we failover to V1 on the assumption
       # it was created with an old version that didn't add this information
       FAILOVER = V1
 

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -77,6 +77,15 @@ module Dependabot
             ).parse
         end
 
+        def top_level_dependencies
+          @top_level_dependencies ||=
+            FileParser.new(
+              dependency_files: dependency_files.reject { |file| file.name == lockfile.name },
+              credentials: credentials,
+              source: nil
+            ).parse
+        end
+
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -85,14 +94,17 @@ module Dependabot
           #
           # This is kind of a bug in Bundler, and we should try to fix it,
           # but resolving it won't necessarily be easy.
-          updated_deps.filter_map do |dep|
-            original_dep =
-              original_dependencies.find { |d| d.name == dep.fetch("name") }
-            spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-            next if spec.fetch("version") == original_dep.version
+          # put the lead dependency first
+          index = specs.index { |dep| dep["name"] == updated_deps.first["name"] }
+          specs.unshift(specs.delete_at(index))
+          specs.filter_map do |dep|
+            next unless top_level_dependencies.find { |d| d.name == dep.fetch("name") }
+
+            original_dep = original_dependencies.find { |d| d.name == dep.fetch("name") }
+            next if dep.fetch("version") == original_dep.version
 
-            build_dependency(original_dep, spec)
+            build_dependency(original_dep, dep)
           end
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.225.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -268,7 +268,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
 post_install_message: 
 rdoc_options: []
 require_paths: