dependabot-bundler 0.245.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b064f061277407a92133970d8c0287c6aacf60cf52e8813d793d374dce4dd2b
-  data.tar.gz: 403e7e5d8b01c1deb8df4f00b04360e21c456f76bb434624fbc0a5f931e22bbf
+  metadata.gz: dcd4f16b3bd7636cd65c77255a1d3b37888a0b3b0294ac4974035e9642debd02
+  data.tar.gz: 011fb6db795058131d051d1533973d0df2c61a5bb976bfc7b6a15d4ca337206b
 SHA512:
-  metadata.gz: ebfb704cba98fedb9a2d979f1d22ef598ae97cca14866247006e7deda488a17326bfef96c04ea30d0d72e26f9a4b3105728d89da1f1218cbb1fc5768f97a8952
-  data.tar.gz: 9091bffdc4c7bcf874118684eaf14af6cd232e168abc6c082fa25887815ea03df36b5adedd0b054000f7d38582aa44a89c89f769bdc9a43f534783e31d1ab8d8
+  metadata.gz: 9a59aa6f31d04899347ea046f1b94211d1816bae26a23f7ef228adc8ed2204e8835dc456de2047b467a7d0a5a8f7532b2aa148a554d7d988094b8055aa824bd4
+  data.tar.gz: b2896086152ffa5138f47e1eea0b628869eab812348c7e988f834b5aa69c54f1971d7937251670ee08453f93e6d3e03df54ccec309d229768435f36d951a83cd

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -4,12 +4,15 @@
 require "dependabot/registry_client"
 require "dependabot/bundler/native_helpers"
 require "dependabot/bundler/helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Bundler
     class UpdateChecker
       class LatestVersionFinder
         class DependencySource
+          extend T::Sig
+
           require_relative "../shared_bundler_helpers"
           include SharedBundlerHelpers
 
@@ -33,7 +36,7 @@ module Dependabot
 
           # The latest version details for the dependency from a registry
           #
-          # @return [Array<Gem::Version>]
+          sig { returns(T::Array[Gem::Version]) }
           def versions
             return rubygems_versions if dependency.name == "bundler"
             return rubygems_versions unless gemfile

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -10,11 +10,14 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/bundler/update_checker/latest_version_finder/" \
         "dependency_source"
+require "sorbet-runtime"
 
 module Dependabot
   module Bundler
     class UpdateChecker
       class LatestVersionFinder
+        extend T::Sig
+
         def initialize(dependency:, dependency_files:, repo_contents_path: nil,
                        credentials:, ignored_versions:, raise_on_ignored: false,
                        security_advisories:, options:)
@@ -65,12 +68,18 @@ module Dependabot
           relevant_versions.min
         end
 
+        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
-          versions_array.reject(&:prerelease?)
+          filtered = versions_array.reject(&:prerelease?)
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
+          end
+          filtered
         end
 
+        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
         def filter_ignored_versions(versions_array)
           filtered = versions_array
                      .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
@@ -78,6 +87,10 @@ module Dependabot
             raise AllVersionsIgnored
           end
 
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
+          end
+
           filtered
         end
 

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -1,16 +1,27 @@
 # typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/bundler/update_checker"
+require "dependabot/requirements_update_strategy"
 
 module Dependabot
   module Bundler
     class UpdateChecker
       class RequirementsUpdater
+        extend T::Sig
+
         class UnfixableRequirement < StandardError; end
 
-        ALLOWED_UPDATE_STRATEGIES =
-          %i(lockfile_only bump_versions bump_versions_if_necessary).freeze
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
 
         def initialize(requirements:, update_strategy:, updated_source:,
                        latest_version:, latest_resolvable_version:)
@@ -28,7 +39,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == :lockfile_only
+          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
 
           requirements.map do |req|
             if req[:file].include?(".gemspec")
@@ -58,9 +69,9 @@ module Dependabot
           return req unless latest_resolvable_version
 
           case update_strategy
-          when :bump_versions
+          when RequirementsUpdateStrategy::BumpVersions
             update_version_requirement(req)
-          when :bump_versions_if_necessary
+          when RequirementsUpdateStrategy::BumpVersionsIfNecessary
             update_version_requirement_if_needed(req)
           else raise "Unexpected update strategy: #{update_strategy}"
           end

data/lib/dependabot/bundler/update_checker.rb

@@ -1,11 +1,13 @@
 # typed: true
 # frozen_string_literal: true
 
-require "dependabot/update_checkers"
-require "dependabot/update_checkers/base"
 require "dependabot/bundler/file_updater/requirement_replacer"
 require "dependabot/bundler/version"
 require "dependabot/git_commit_checker"
+require "dependabot/requirements_update_strategy"
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+
 module Dependabot
   module Bundler
     class UpdateChecker < Dependabot::UpdateCheckers::Base
@@ -75,11 +77,11 @@ module Dependabot
 
       def requirements_unlocked_or_can_be?
         return true if requirements_unlocked?
-        return false if requirements_update_strategy == :lockfile_only
+        return false if requirements_update_strategy == RequirementsUpdateStrategy::LockfileOnly
 
         dependency.specific_requirements
                   .all? do |req|
-          file = dependency_files.find { |f| f.name == req.fetch(:file) }
+          file = T.must(dependency_files.find { |f| f.name == req.fetch(:file) })
           updated = FileUpdater::RequirementReplacer.new(
             dependency: dependency,
             file_type: file.name.end_with?("gemspec") ? :gemspec : :gemfile,
@@ -92,10 +94,14 @@ module Dependabot
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+        return @requirements_update_strategy if @requirements_update_strategy
 
         # Otherwise, widen ranges for libraries and bump versions for apps
-        dependency.version.nil? ? :bump_versions_if_necessary : :bump_versions
+        if dependency.version.nil?
+          RequirementsUpdateStrategy::BumpVersionsIfNecessary
+        else
+          RequirementsUpdateStrategy::BumpVersions
+        end
       end
 
       def conflicting_dependencies

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.245.0
+  version: 0.247.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-22 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -136,6 +136,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -313,7 +327,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.245.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
 post_install_message: 
 rdoc_options: []
 require_paths: