dependabot-bundler 0.111.44 → 0.111.45

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 044f9da15a311d958b6c4693b85ffb6f7a1d782508ef4fbb1181ff9a0945fad6
-  data.tar.gz: e5c73dbc0eb90a0b72a6f8b6a938aaad0b19556345d134f2da206afa9c8569c2
+  metadata.gz: 434077da7467bab17f22eb59bc69017a8d8c52986cbc2aa85206e577635919aa
+  data.tar.gz: e0cc87b65eb47012f85e8b0a458744641ee08d5dba5f08d95490b5e2efafb8f1
 SHA512:
-  metadata.gz: 35655299d02e55020f0250e19b96eaee74e87a0e36d6d48eb48128212d4ae4072cde2c64d6d7e9a4642e8bc2d3764d6045f6a2836cb581f51334c9f8dc6bbcc9
-  data.tar.gz: 5dc3180bbd906d8c40631726e71432a2d9c02f001ffbf28fb76536c7b30cfcc0efbaaf1ba0f6ff2bbbd170574bca910d29ca42f8c239aeb73eada82607a8c161
+  metadata.gz: 1d27744edc8bda9880770cd2a630c0e95c74e5f9937ab4d8b6ac7bc959ae1334bb74fae6277e5a2d03c104f0446607e339b95de92094042fc890b1fa3c57dc8a
+  data.tar.gz: 53165e4eaab20842e9a884a263953ac41d75291e7952db2049ae75e14762a5230aee1a262beb7c44054680fe8ca5d2b0f81a00208bc07c73dca727614005dbbe

data/lib/dependabot/bundler/file_parser.rb

@@ -106,7 +106,13 @@ module Dependabot
               name: dependency.name,
               version: dependency_version(dependency.name)&.to_s,
               requirements: [],
-              package_manager: "bundler"
+              package_manager: "bundler",
+              subdependency_metadata:
+                if production_dependency_names.include?(dependency.name)
+                  [{ production: true }]
+                else
+                  [{ production: false }]
+                end
             )
         end
 
@@ -279,6 +285,36 @@ module Dependabot
           ::Bundler::LockfileParser.new(sanitized_lockfile_content)
       end
 
+      def production_dependency_names
+        @production_dependency_names ||=
+          (gemfile_dependencies + gemspec_dependencies).dependencies.
+          select { |dep| production?(dep) }.
+          flat_map { |dep| expanded_dependency_names(dep) }.
+          uniq
+      end
+
+      def expanded_dependency_names(dep)
+        spec = parsed_lockfile.specs.find { |s| s.name == dep.name }
+        return [dep.name] unless spec
+
+        [
+          dep.name,
+          *spec.dependencies.flat_map { |d| expanded_dependency_names(d) }
+        ]
+      end
+
+      def production?(dependency)
+        groups = dependency.requirements.
+                 flat_map { |r| r.fetch(:groups) }.
+                 map(&:to_s)
+
+        return true if groups.empty?
+        return true if groups.include?("runtime")
+        return true if groups.include?("default")
+
+        groups.any? { |g| g.include?("prod") }
+      end
+
       def sanitized_lockfile_content
         regex = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
         lockfile.content.gsub(regex, "")
@@ -300,5 +336,4 @@ module Dependabot
   end
 end
 
-Dependabot::FileParsers.
-  register("bundler", Dependabot::Bundler::FileParser)
+Dependabot::FileParsers.register("bundler", Dependabot::Bundler::FileParser)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.111.44
+  version: 0.111.45
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.44
+        version: 0.111.45
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.44
+        version: 0.111.45
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement