dependabot-bundler 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39fcadba0e242442b3e47d0eb3217a64830dde572424d06266a89b31bbfde55a
-  data.tar.gz: 99a0d72550c281c293e7a6ccd8e992402e3df5e44bf7bdb9c2473938c5eb98d0
+  metadata.gz: 9e2cfe36953b52d740602cbe899a76cdf8e0875e9a0ea518d3974de718c65f43
+  data.tar.gz: 881f8e5751de035a59aa7a0fbfb2f45b9f26eb1d4e973ae8e65f962217ce3569
 SHA512:
-  metadata.gz: 825f095afb8b27e725f15a083b0301a686e020d6a9023817b2a7a9f35c0b8d98df667fe583d1bccb270ae9232778e04b326fead86ec2bc778769ed0d36f5d8e2
-  data.tar.gz: 240587e72dec8f0184e0cdd91c8506e6cb84d7d01c449a006560c52237345e5cbd3536b92462a45c61f83a2c95471dcf5e58a2363337af815bf85deabb8d64a7
+  metadata.gz: 71de057814bc1fe297d4ef37cca8280bb13186346eb4b780e242b38249a95517dba7389434be5817425163f0bfe5ae662a45784914fdf0738d7465f4acf8eaa3
+  data.tar.gz: ee1e4cf2a0d0e3b21b489e5d88202d2f30738d531e91cf83172889ec6637f021b0b56a5fa3360dedc207286eddeb067b719483357a25632f52d0940d97b1a57c

data/lib/dependabot/bundler/file_fetcher.rb

@@ -206,13 +206,23 @@ module Dependabot
           .map { |fp| fetch_file_from_host(fp, fetch_submodules: true) }
       end
 
+      # `Bundler::Source::Path#path` is not the value the lockfile declared: it is re-relativised
+      # against `Bundler.root`, and `..` segments that escape the filesystem root are dropped
+      # rather than preserved. A `remote:` reaching further up than `Bundler.root` is deep
+      # therefore resolves to a shallower, wrong directory. The lockfile's own value survives
+      # verbatim in the source's options, so read it from there.
+      sig { params(source: ::Bundler::Source::Path).returns(String) }
+      def lockfile_path_source_path(source)
+        (source.options["path"] || source.path).to_s
+      end
+
       sig { returns(T::Array[String]) }
       def fetch_path_gemspec_paths
         if lockfile
           parsed_lockfile = CachedLockfileParser.parse(T.must(sanitized_lockfile_content))
           parsed_lockfile.specs
                          .select { |s| s.source.instance_of?(::Bundler::Source::Path) }
-                         .map { |s| s.source.path }.uniq
+                         .map { |s| lockfile_path_source_path(s.source) }.uniq
         else
           gemfiles = ([gemfile] + child_gemfiles).compact
           gemfiles.flat_map do |file|
@@ -259,8 +269,7 @@ module Dependabot
           next if file.name == path
 
           # Skip excluded child Gemfiles
-          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+          if !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
             raise Dependabot::DependencyFileNotEvaluatable,
                   "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
                   "Please either remove the reference from '#{file.name}' " \

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,34 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.24'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.24'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -183,14 +189,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +360,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib