dependabot-bundler 0.95.31 → 0.95.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d7ef04377d17bea4692a615cde13f6e23db5d1c584930314059bf3fb5fe9c49
-  data.tar.gz: 9877c2122dc313aea7ad83fe21f33befd9ab9a90e1deceeaf4dc8503415df056
+  metadata.gz: f459c79156c7d24d98b87e7c1663a080f987c6564e184f8ad6f7e313549f6faa
+  data.tar.gz: 4832ec5266b4b7aa2c3f85e90dcee0adea65d2d0ef160b32fbdbef576f244c61
 SHA512:
-  metadata.gz: f3db8d5af9a1eda31b3021ee7d2fc9f5f3bf1490624a443b2982723ba4e70283b8da04cc867edbd867b638e7ff9484881c4ac51602b6ec83c97c7e862d71f4fe
-  data.tar.gz: 556ca43eba664e9cd8f6713b71a74cc1ba980f2d3d6d67193468d4a9f4c7654824cb31e7f7ffce220bcc88adfc272ac7961978bd7d325dc96fc796719a440363
+  metadata.gz: e751f19d519f106cdcde538ea8d1c9b75da9ad87f19eb260964ceef40bd4d374c6b0ca103d54eb8d2452cbacc746a5c61d0998b8f9247f0af2cfcb019394fce0
+  data.tar.gz: 0c1b4e9782feb2a1b9296562cacf9cd78aa6fac2d3f911335ae854d62cd4b38bf9a761276ed17c97713893006175b8ceff301c7420546e44f2de8c98ef35d43a

data/lib/dependabot/bundler/update_checker.rb

@@ -32,10 +32,8 @@ module Dependabot
         return current_ver if git_dependency? && git_commit_checker.pinned?
 
         @latest_resolvable_version_detail_with_no_unlock ||=
-          version_resolver(
-            remove_git_source: false,
-            unlock_requirement: false
-          ).latest_resolvable_version_details
+          version_resolver(remove_git_source: false, unlock_requirement: false).
+          latest_resolvable_version_details
 
         if git_dependency?
           @latest_resolvable_version_detail_with_no_unlock&.fetch(:commit_sha)
@@ -45,14 +43,29 @@ module Dependabot
       end
 
       def updated_requirements
-        RequirementsUpdater.new(
-          requirements: dependency.requirements,
-          update_strategy: requirements_update_strategy,
-          updated_source: updated_source,
-          latest_version: latest_version_details&.fetch(:version)&.to_s,
-          latest_resolvable_version:
-            latest_resolvable_version_details&.fetch(:version)&.to_s
-        ).updated_requirements
+        if updated_source&.fetch(:ref, nil) &&
+           updated_source.fetch(:ref) != dependency_source_details.fetch(:ref)
+          updated_version =
+            latest_resolvable_version_details_with_updated_git_source&.
+            fetch(:version)&.
+            to_s
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            update_strategy: requirements_update_strategy,
+            updated_source: updated_source,
+            latest_version: updated_version,
+            latest_resolvable_version: updated_version
+          ).updated_requirements
+        else
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            update_strategy: requirements_update_strategy,
+            updated_source: updated_source,
+            latest_version: latest_version_details&.fetch(:version)&.to_s,
+            latest_resolvable_version:
+              latest_resolvable_version_details&.fetch(:version)&.to_s
+          ).updated_requirements
+        end
       end
 
       def requirements_unlocked_or_can_be?
@@ -207,15 +220,7 @@ module Dependabot
 
         return false if git_commit_checker.local_tag_for_latest_version.nil?
 
-        replacement_tag = git_commit_checker.local_tag_for_latest_version
-
-        VersionResolver.new(
-          dependency: dependency,
-          unprepared_dependency_files: dependency_files,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          replacement_git_pin: replacement_tag.fetch(:tag)
-        ).latest_resolvable_version_details
+        latest_resolvable_version_details_with_updated_git_source
 
         @git_tag_resolvable = true
       rescue Dependabot::DependencyFileNotResolvable
@@ -281,6 +286,21 @@ module Dependabot
           )
       end
 
+      def latest_resolvable_version_details_with_updated_git_source
+        @latest_resolvable_version_details_with_updated_git_source ||=
+          begin
+            replacement_tag = git_commit_checker.local_tag_for_latest_version
+
+            VersionResolver.new(
+              dependency: dependency,
+              unprepared_dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              replacement_git_pin: replacement_tag.fetch(:tag)
+            ).latest_resolvable_version_details
+          end
+      end
+
       def version_resolver(remove_git_source:, unlock_requirement: true)
         @version_resolver ||= {}
         @version_resolver[remove_git_source] ||= {}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.95.31
+  version: 0.95.32
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.31
+        version: 0.95.32
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.31
+        version: 0.95.32
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement