dependabot-bundler 0.235.0 → 0.236.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38176c3434d5010be520cb43bc4c56a9932269422551b38ccd6e37dabd23e3d6
-  data.tar.gz: bfd86e1e458314109a1694c60c663d0f487696400d8b7f69b8cd14e873b8ab78
+  metadata.gz: 4fd34dd5e86ac6b391a703c276d062a73f797c3f936658aebc25680ee886edc6
+  data.tar.gz: f06e52b4ddfaba21629b65ccc739eede69faccc75eb542cb2da726f3a1611cba
 SHA512:
-  metadata.gz: 1d347d3d714957801878e9953f21dfe1607bf870cb4dca6954e18f5a10bbcd115784ba2a3544b5007917ac02c212b50a1aea94426066826116e2c7673e015a4e
-  data.tar.gz: 1d6fbeb3dbd3adf3fa5731aa49bd3efdf24dee0c6c985bb07646ff0b55a15b5d4de8bf8aa5be5d6be9979ce7a7f3b077e9f330308686bac2b312980fbbb85c75
+  metadata.gz: 6e6ec483cbd9483321846361ade36c24bf9fca1c355e43bbffcfc7a3d25c7c8ec08f3e88137913d3538928fdde6b00bb3f82edb912fccff856ade082a5b00ba6
+  data.tar.gz: 1581d435a66c7753929a5adece2b9b9387477fad411de498afb85f9972ba99a1f6df9482597acbab5bacaf0b8cbda2a6f42e6de080b41572da9ac2255e3a9694

data/helpers/v2/lib/functions/force_updater.rb

@@ -4,6 +4,7 @@
 module Functions
   class ForceUpdater
     class TransitiveDependencyError < StandardError; end
+    class TopLevelDependencyDowngradedError < StandardError; end
 
     def initialize(dependency_name:, target_version:, gemfile_name:,
                    lockfile_name:, update_multiple_dependencies:)
@@ -21,13 +22,21 @@ module Functions
         definition = build_definition(dependencies_to_unlock: dependencies_to_unlock)
         definition.resolve_remotely!
         specs = definition.resolve
-        updates = ([dependency_name, *dependencies_to_unlock] - subdependencies).uniq.map { |name| { name: name } }
+        updates = ([dependency_name, *dependencies_to_unlock] - subdependencies + extra_top_level_deps(specs)).uniq
+
+        updates = updates.map do |name|
+          {
+            name: name
+          }
+        end
+
         specs = specs.map do |dep|
           {
             name: dep.name,
             version: dep.version
           }
         end
+
         [updates, specs]
       rescue Bundler::SolveFailure => e
         raise unless update_multiple_dependencies?
@@ -53,6 +62,24 @@ module Functions
                 :update_multiple_dependencies
     alias update_multiple_dependencies? update_multiple_dependencies
 
+    def extra_top_level_deps(specs)
+      top_level_dep_names.reject do |name|
+        original_version = original_specs.find { |s| s.name == name }&.version
+        new_version = specs[name].first&.version
+
+        if original_version == new_version
+          true
+        else
+          original_version = Gem::Version.new(original_version)
+          new_version = Gem::Version.new(new_version)
+
+          raise TopLevelDependencyDowngradedError if new_version < original_version
+
+          false
+        end
+      end
+    end
+
     def new_dependencies_to_unlock_from(error:, already_unlocked:)
       names = [*already_unlocked, dependency_name]
       extra_names_to_unlock = []
@@ -118,13 +145,15 @@ module Functions
       # subdependencies
       return [] unless lockfile
 
-      all_deps =  Bundler::LockfileParser.new(lockfile)
-                                         .specs.map(&:name)
-      top_level = Bundler::Definition
-                  .build(gemfile_name, lockfile_name, {})
-                  .dependencies.map(&:name)
+      original_specs.map(&:name) - top_level_dep_names
+    end
+
+    def top_level_dep_names
+      @top_level_dep_names ||= Bundler::Definition.build(gemfile_name, lockfile_name, {}).dependencies.map(&:name)
+    end
 
-      all_deps - top_level
+    def original_specs
+      @original_specs ||= Bundler::LockfileParser.new(lockfile).specs
     end
 
     def unlock_gem(definition:, gem_name:)

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -78,15 +78,6 @@ module Dependabot
             ).parse
         end
 
-        def top_level_dependencies
-          @top_level_dependencies ||=
-            FileParser.new(
-              dependency_files: dependency_files.reject { |file| file.name == lockfile.name },
-              credentials: credentials,
-              source: nil
-            ).parse
-        end
-
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -95,17 +86,14 @@ module Dependabot
           #
           # This is kind of a bug in Bundler, and we should try to fix it,
           # but resolving it won't necessarily be easy.
+          updated_deps.filter_map do |dep|
+            original_dep =
+              original_dependencies.find { |d| d.name == dep.fetch("name") }
+            spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-          # put the lead dependency first
-          index = specs.index { |dep| dep["name"] == updated_deps.first["name"] }
-          specs.unshift(specs.delete_at(index))
-          specs.filter_map do |dep|
-            next unless top_level_dependencies.find { |d| d.name == dep.fetch("name") }
-
-            original_dep = original_dependencies.find { |d| d.name == dep.fetch("name") }
-            next if dep.fetch("version") == original_dep.version
+            next if spec.fetch("version") == original_dep.version
 
-            build_dependency(original_dep, dep)
+            build_dependency(original_dep, spec)
           end
         end
 

data/lib/dependabot/bundler/version.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/version"

data/lib/dependabot/bundler.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 # These all need to be required so the various classes can be registered in a

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.235.0
+  version: 0.236.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-19 00:00:00.000000000 Z
+date: 2023-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.236.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.236.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -282,7 +282,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.235.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.236.0
 post_install_message: 
 rdoc_options: []
 require_paths: