dependabot-bundler 0.325.0 → 0.326.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57eb6fdc66cbe528038e510497e0f82f35002e2c4a47e842caecbc79d1c7f4f9
-  data.tar.gz: 3332c38e5415493e6d57c0094255fe1e236779b0c1d74192ee102df5e2c42dd0
+  metadata.gz: c9dbdde726b9ffb25da2452580a4c921aae56bbe85c4f26ef2d395e899f1876c
+  data.tar.gz: 416a5f9458abb3d30c6d2477e4d4aa89d543722c49d7b5e0003c57d80bba7460
 SHA512:
-  metadata.gz: 6b6bd23b82c3d2f473a7937b88c71ff6701ddda5c71ee3eb19fecb9771feb30beece480854a647f1fba4adb580b261d4f08df90ce986dbb481122368083b853b
-  data.tar.gz: a313088f61d1d1fea117c6bcfb958765d23ed8df8f27974153125e0770e4ec686c9f3a9a7a5ec2ccd80c836a620b25959dfe86c736e0ee9350b1c13c1173b9b4
+  metadata.gz: daa28d5323b6dd08bd21f2fc94aec1e6f055dd0bbcd8c38d6d30eb45c96ae10da83229762a385af467157a062bdb3529cdb2391449bbc691a33dad394f534b73
+  data.tar.gz: 338f1fb84443362403fd16cb1f3c7441ad523a22197eff7ff7258957e44dbbb06aab015122e9386c3580f14d03ad667436d67223d3402aeb1f92f7eb2303ee79

data/lib/dependabot/bundler/file_parser.rb

@@ -122,7 +122,7 @@ module Dependabot
           parsed_gemfile.each do |dep|
             next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
 
-            dependencies <<
+            dep =
               Dependency.new(
                 name: dep.fetch("name"),
                 version: dependency_version(dep.fetch("name"))&.to_s,
@@ -134,6 +134,9 @@ module Dependabot
                 }],
                 package_manager: "bundler"
               )
+
+            file.dependencies << dep
+            dependencies << dep
           end
         end
 
@@ -141,7 +144,7 @@ module Dependabot
       end
 
       sig { returns(DependencySet) }
-      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity
+      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity,Metrics/AbcSize
         @gemspec_dependencies = T.let(@gemspec_dependencies, T.nilable(DependencySet))
         return @gemspec_dependencies if @gemspec_dependencies
 
@@ -156,7 +159,7 @@ module Dependabot
             parsed_gemspec(gemspec).each do |dependency|
               next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
 
-              queue << Dependency.new(
+              dep = Dependency.new(
                 name: dependency.fetch("name"),
                 version: dependency_version(dependency.fetch("name"))&.to_s,
                 requirements: [{
@@ -171,6 +174,9 @@ module Dependabot
                 }],
                 package_manager: "bundler"
               )
+
+              gemspec.dependencies << dep
+              queue << dep
             end
           end
         end
@@ -192,16 +198,23 @@ module Dependabot
         parsed_lockfile.specs.each do |dependency|
           next if dependency.source.is_a?(::Bundler::Source::Path)
 
-          dependencies <<
-            Dependency.new(
-              name: dependency.name,
-              version: dependency_version(dependency.name)&.to_s,
-              requirements: [],
-              package_manager: "bundler",
-              subdependency_metadata: [{
-                production: production_dep_names.include?(dependency.name)
-              }]
-            )
+          # if a dependency is listed in the lockfiles' DEPENDENCIES section,
+          # then it is a direct dependency & we want to keep track of that fact
+          is_direct = parsed_lockfile.dependencies.key?(dependency.name)
+
+          dep = Dependency.new(
+            name: dependency.name,
+            version: dependency_version(dependency.name)&.to_s,
+            requirements: [],
+            package_manager: "bundler",
+            subdependency_metadata: [{
+              production: production_dep_names.include?(dependency.name)
+            }],
+            direct_relationship: is_direct
+          )
+
+          T.must(lockfile).dependencies << dep
+          dependencies << dep
         end
 
         dependencies

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.325.0
+  version: 0.326.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.0
+        version: 0.326.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.325.0
+        version: 0.326.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.325.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.326.0
 rdoc_options: []
 require_paths:
 - lib