dependabot-bundler 0.266.0 → 0.267.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba47a31a93ed895b0a42732b8956e5a766b89b65f25d7c64980b2f647ba4f1f2
-  data.tar.gz: aa00f8412609b36613dca3335e8eaebf93cddf28937b9760b4231fb01ff9a168
+  metadata.gz: 1e357e6fc4d35510809265927eee0e2bb31f6a04e83193b5031966c53b6801f6
+  data.tar.gz: a6868142bd65fa6c78a9971d5e9cb6872408f4055e1e7fed655ef693a7d762d0
 SHA512:
-  metadata.gz: 800dad7720d941227c3d22e6e214033989dd16ad9a2f006d573e1cc34ba946394db64419bf50644836951698df70cd8f78035fd040304b14e0ff2690beb4e2c0
-  data.tar.gz: bd9c28a9b6d5e82d7505aa3b7dde9ce50e192ed05283070aac60f04ae957698ff454e52923d0c70f9fa5a2790e21d66e7ac68f5dd7150d9618a622cdf4d83f19
+  metadata.gz: d508e07d23e23125d89b16d43d65ee637315e07a0e78029a6f40b96e167fbd36511803ef83275b303d3df4cdc251dce4ccc0696c0efe68967f461e0a2fb1c70f
+  data.tar.gz: 92c1f567ebe086f7749110704d3b21d38aacccdcc16f9b6b536505a95c44e19e5630aa4f32872c0dc15ab076ffa1ad758e09ddcd205569007e3a5647ec061d35

data/helpers/v2/lib/functions/force_updater.rb

@@ -3,7 +3,6 @@
 
 module Functions
   class ForceUpdater
-    class TransitiveDependencyError < StandardError; end
     class TopLevelDependencyDowngradedError < StandardError; end
 
     def initialize(dependency_name:, target_version:, gemfile_name:,
@@ -120,16 +119,28 @@ module Functions
       dep = definition.dependencies
                       .find { |d| d.name == dependency_name }
 
-      # If the dependency is not found in the Gemfile it means this is a
-      # transitive dependency that we can't force update.
-      raise TransitiveDependencyError unless dep
-
-      # Set the requirement for the gem we're forcing an update of
-      new_req = Gem::Requirement.create("= #{target_version}")
-      dep.instance_variable_set(:@requirement, new_req)
-      dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
-
-      definition
+      if dep
+        # Set the requirement for the gem we're forcing an update of
+        new_req = Gem::Requirement.create("= #{target_version}")
+        dep.instance_variable_set(:@requirement, new_req)
+        dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
+
+        definition
+      else
+        # If the dependency is not found in the Gemfile it means this is a
+        # transitive dependency. To force update it, we recreate a definition
+        # from the Gemfile, but add an extra dependency to it that pins the
+        # dependency we want to update.
+        gemfile = Pathname.new(gemfile_name).expand_path
+        builder = Bundler::Dsl.new
+        builder.eval_gemfile(gemfile)
+        builder.gem dependency_name, "= #{target_version}"
+        builder.to_definition(
+          lockfile_name,
+          gems: gems_to_unlock + subdependencies,
+          conservative: true
+        )
+      end
     end
 
     def lockfile

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.266.0
+  version: 0.267.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-18 00:00:00.000000000 Z
+date: 2024-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.267.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.267.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.266.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.267.0
 post_install_message: 
 rdoc_options: []
 require_paths: