dependabot-bundler 0.223.0 → 0.224.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23ce0d39fdead4b32fc1c52df64211e60bf4230da2ad1893c14f7b2d5ef58683
-  data.tar.gz: 10da25c6e318ddf4a0028789ff6f3180469ca703f72c93fca750b18ae35bfe44
+  metadata.gz: fe41f546784766646a331b7b9b278bd0a0be01d13c0b9f51da8457a83db4db16
+  data.tar.gz: b15f4967d4c25a5e7bf87ba352b649c186e10b843964ba5910c381537340d0f7
 SHA512:
-  metadata.gz: 6b5ef015097c78c7ebbf1db0ca446bf1b6f4c46a798fb4f2b7f4ba3eb2dbf48a5e85ca3c2d4bd54c41a106df1a667445c4cc3eb27f6b34e9fc1af19a6dc6809c
-  data.tar.gz: ba36300ab2907b311051e2f3f63400410bc0c1d830657bc5b9d0fd39212304a555d43f3dee6bcc1454625be862330eb9bf721475653f243945d7bb94fcc0241d
+  metadata.gz: cc3ea7c204c643484527dfe5f90eec51fcf968ae1d1bccaf42709c1101bcb7ec2dec3015cc20eb2a6cce40d58e505a8da0d28b59cae8ca4540a69db6e6eeac97
+  data.tar.gz: e88b57ec7b8fff13d5353ba46654ebc9b82bb975ed16f80be20e73e9b568919f8743defe09a4489f4514fd05bd927c4716eb984847b401b430f7d309088a4196

data/lib/dependabot/bundler/helpers.rb

@@ -9,7 +9,7 @@ module Dependabot
       # newest version we support
       DEFAULT = V2
       # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, with failover to V1 on the assumption
+      # the version it was bundled with, we failover to V1 on the assumption
       # it was created with an old version that didn't add this information
       FAILOVER = V1
 

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -77,6 +77,15 @@ module Dependabot
             ).parse
         end
 
+        def top_level_dependencies
+          @top_level_dependencies ||=
+            FileParser.new(
+              dependency_files: dependency_files.reject { |file| file.name == lockfile.name },
+              credentials: credentials,
+              source: nil
+            ).parse
+        end
+
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -85,14 +94,17 @@ module Dependabot
           #
           # This is kind of a bug in Bundler, and we should try to fix it,
           # but resolving it won't necessarily be easy.
-          updated_deps.filter_map do |dep|
-            original_dep =
-              original_dependencies.find { |d| d.name == dep.fetch("name") }
-            spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-            next if spec.fetch("version") == original_dep.version
+          # put the lead dependency first
+          index = specs.index { |dep| dep["name"] == updated_deps.first["name"] }
+          specs.unshift(specs.delete_at(index))
+          specs.filter_map do |dep|
+            next unless top_level_dependencies.find { |d| d.name == dep.fetch("name") }
+
+            original_dep = original_dependencies.find { |d| d.name == dep.fetch("name") }
+            next if dep.fetch("version") == original_dep.version
 
-            build_dependency(original_dep, spec)
+            build_dependency(original_dep, dep)
           end
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.224.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -268,7 +268,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
 post_install_message: 
 rdoc_options: []
 require_paths: