dependabot-bundler 0.266.0 → 0.268.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba47a31a93ed895b0a42732b8956e5a766b89b65f25d7c64980b2f647ba4f1f2
-  data.tar.gz: aa00f8412609b36613dca3335e8eaebf93cddf28937b9760b4231fb01ff9a168
+  metadata.gz: 9ec972207d34861dbccfda640936ec5d4cf4ae37819b68c65af371a487f06d93
+  data.tar.gz: 2092aeba3d9de6fa7128d814580c92aa33832c4fe5f455100d89ac2f4acfac19
 SHA512:
-  metadata.gz: 800dad7720d941227c3d22e6e214033989dd16ad9a2f006d573e1cc34ba946394db64419bf50644836951698df70cd8f78035fd040304b14e0ff2690beb4e2c0
-  data.tar.gz: bd9c28a9b6d5e82d7505aa3b7dde9ce50e192ed05283070aac60f04ae957698ff454e52923d0c70f9fa5a2790e21d66e7ac68f5dd7150d9618a622cdf4d83f19
+  metadata.gz: 71e53ea5de97bf359124bbc06b0f0b3059fd97ef2e45639feafe38c30e719a47059f67128be2472198ecbb9777a6730492401e99d9d2ea1a729fe0718ee921f0
+  data.tar.gz: 85c98c0f9c9eba669473150d53335dcccd6e2998fb5079630470000907075589f88ea31fe23d93ec2d62208538afee8c7555b1ab76d84d09790ab42a51bfa6ec

data/helpers/v2/lib/functions/force_updater.rb

@@ -3,7 +3,6 @@
 
 module Functions
   class ForceUpdater
-    class TransitiveDependencyError < StandardError; end
     class TopLevelDependencyDowngradedError < StandardError; end
 
     def initialize(dependency_name:, target_version:, gemfile_name:,
@@ -120,16 +119,28 @@ module Functions
       dep = definition.dependencies
                       .find { |d| d.name == dependency_name }
 
-      # If the dependency is not found in the Gemfile it means this is a
-      # transitive dependency that we can't force update.
-      raise TransitiveDependencyError unless dep
-
-      # Set the requirement for the gem we're forcing an update of
-      new_req = Gem::Requirement.create("= #{target_version}")
-      dep.instance_variable_set(:@requirement, new_req)
-      dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
-
-      definition
+      if dep
+        # Set the requirement for the gem we're forcing an update of
+        new_req = Gem::Requirement.create("= #{target_version}")
+        dep.instance_variable_set(:@requirement, new_req)
+        dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
+
+        definition
+      else
+        # If the dependency is not found in the Gemfile it means this is a
+        # transitive dependency. To force update it, we recreate a definition
+        # from the Gemfile, but add an extra dependency to it that pins the
+        # dependency we want to update.
+        gemfile = Pathname.new(gemfile_name).expand_path
+        builder = Bundler::Dsl.new
+        builder.eval_gemfile(gemfile)
+        builder.gem dependency_name, "= #{target_version}"
+        builder.to_definition(
+          lockfile_name,
+          gems: gems_to_unlock + subdependencies,
+          conservative: true
+        )
+      end
     end
 
     def lockfile

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.266.0
+  version: 0.268.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-18 00:00:00.000000000 Z
+date: 2024-08-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.268.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.268.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.266.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.268.0
 post_install_message: 
 rdoc_options: []
 require_paths: