dependabot-bundler 0.392.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a138c6365394197429180097e4313439247425bee62007670d386b138e3e135
-  data.tar.gz: 6a19d0836c030bc9aaa9b27a4b1761fe11bb27e0afc8ecc6b1d1ae001872a892
+  metadata.gz: 9e2cfe36953b52d740602cbe899a76cdf8e0875e9a0ea518d3974de718c65f43
+  data.tar.gz: 881f8e5751de035a59aa7a0fbfb2f45b9f26eb1d4e973ae8e65f962217ce3569
 SHA512:
-  metadata.gz: e03c7d9d79a773cc78d4d43e2cca675bddb45053c5aee73d68b86476ce560e092e94b5441e5aeca5dd5a8c8e99337b24a542dcdd5de4c5b7a5de20749a357579
-  data.tar.gz: '08fc1b1c9f73c5649a53758f60a41a8139211f48fa81b371cce24666fd79ae6000e998c802808664ee8d54675047693c11bc15d544cbcd6598b43c75cd962d23'
+  metadata.gz: 71de057814bc1fe297d4ef37cca8280bb13186346eb4b780e242b38249a95517dba7389434be5817425163f0bfe5ae662a45784914fdf0738d7465f4acf8eaa3
+  data.tar.gz: ee1e4cf2a0d0e3b21b489e5d88202d2f30738d531e91cf83172889ec6637f021b0b56a5fa3360dedc207286eddeb067b719483357a25632f52d0940d97b1a57c

data/lib/dependabot/bundler/file_fetcher.rb

@@ -206,13 +206,23 @@ module Dependabot
           .map { |fp| fetch_file_from_host(fp, fetch_submodules: true) }
       end
 
+      # `Bundler::Source::Path#path` is not the value the lockfile declared: it is re-relativised
+      # against `Bundler.root`, and `..` segments that escape the filesystem root are dropped
+      # rather than preserved. A `remote:` reaching further up than `Bundler.root` is deep
+      # therefore resolves to a shallower, wrong directory. The lockfile's own value survives
+      # verbatim in the source's options, so read it from there.
+      sig { params(source: ::Bundler::Source::Path).returns(String) }
+      def lockfile_path_source_path(source)
+        (source.options["path"] || source.path).to_s
+      end
+
       sig { returns(T::Array[String]) }
       def fetch_path_gemspec_paths
         if lockfile
           parsed_lockfile = CachedLockfileParser.parse(T.must(sanitized_lockfile_content))
           parsed_lockfile.specs
                          .select { |s| s.source.instance_of?(::Bundler::Source::Path) }
-                         .map { |s| s.source.path }.uniq
+                         .map { |s| lockfile_path_source_path(s.source) }.uniq
         else
           gemfiles = ([gemfile] + child_gemfiles).compact
           gemfiles.flat_map do |file|
@@ -259,8 +269,7 @@ module Dependabot
           next if file.name == path
 
           # Skip excluded child Gemfiles
-          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+          if !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
             raise Dependabot::DependencyFileNotEvaluatable,
                   "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
                   "Please either remove the reference from '#{file.name}' " \

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -49,7 +49,7 @@ module Dependabot
         #
         # @param dependency [Dependabot::Dependency] the dependency to check
         # @param target_version [String] the version to check
-        # @return [Array<Hash{String => String}]
+        # @return [Array<Hash{String => Object}]
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
@@ -58,7 +58,7 @@ module Dependabot
             dependency: Dependabot::Dependency,
             target_version: String
           )
-            .returns(T::Array[T::Hash[String, String]])
+            .returns(T::Array[Dependabot::UpdateCheckers::Conflict])
         end
         def conflicting_dependencies(dependency:, target_version:)
           return [] if lockfile.nil?

data/lib/dependabot/bundler/update_checker.rb

@@ -131,7 +131,7 @@ module Dependabot
         cooldown_options_builder.release_cooldown_options(@update_cooldown)
       end
 
-      sig { override.returns(T::Array[T::Hash[String, String]]) }
+      sig { override.returns(T::Array[Dependabot::UpdateCheckers::Conflict]) }
       def conflicting_dependencies
         ConflictingDependencyResolver.new(
           dependency_files: dependency_files,
@@ -297,7 +297,7 @@ module Dependabot
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
         latest_tag = git_commit_checker.local_tag_for_pinned_version_ref(git_dependency_cooldown)
-        return latest_tag.fetch(:tag_sha) || dependency.version if latest_tag
+        return latest_tag.tag_sha || dependency.version if latest_tag
 
         # If the dependency is pinned to a tag that doesn't look like a
         # version then there's nothing we can do.
@@ -321,7 +321,7 @@ module Dependabot
         # of the latest tag that looks like a version.
         if latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_pinned_version_ref(git_dependency_cooldown)
-          return new_tag&.fetch(:tag_sha)
+          return new_tag&.tag_sha
         end
 
         # If the dependency is pinned to a tag that doesn't look like a
@@ -358,7 +358,7 @@ module Dependabot
         latest_tag_details = git_commit_checker.local_tag_for_pinned_version_ref(git_dependency_cooldown)
         return false unless latest_tag_details
 
-        git_tag_resolvable?(latest_tag_details.fetch(:tag))
+        git_tag_resolvable?(latest_tag_details.tag)
       end
 
       sig { params(release: T.untyped).returns(T::Boolean) }
@@ -376,7 +376,7 @@ module Dependabot
         # Update the git tag if updating a pinned version
         if latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_pinned_version_ref(git_dependency_cooldown)
-          return T.must(dependency_source_details).merge(ref: T.must(new_tag).fetch(:tag))
+          return T.must(dependency_source_details).merge(ref: T.must(new_tag).tag)
         end
 
         # Otherwise return the original source

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,34 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.24'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.24'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -183,14 +189,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +360,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib