dependabot-common 0.112.9 → 0.112.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0010f0be767b7e831bd3b5d800f654e2e6d4e9704e5d6c3bd7992cac538ad602
-  data.tar.gz: 1ba423e2ed36e2d759e6a1ece7c0da8bf1b7645e790052eb1bc3a60651818b8f
+  metadata.gz: bd7eb33e16f8ff1807f09f20ed43ab05a0698ab0f7c120e47048aa3e44525dcc
+  data.tar.gz: 8a3c5defc616266504e0b01c4f751d69416155837902bf4dad4458c4c189e751
 SHA512:
-  metadata.gz: 398dd8c59f2e8138cb60ae18d2dfbc8f9bac759d941a64bad9f91c214f14e3e4861fadc997474fdde32b81406d171459a35939c893567f1ad95e291e32746ade
-  data.tar.gz: 8b0a711173b4b46ac602dcecacc3c6f1505d58af92022c78bc9a08667d62df0c5a25d264bb90d98237d12ce02e0604a99e794cf3825a48ee501f000aed3188af
+  metadata.gz: efd76369fdf023e2b458855a1ad2ad87fb08069e2c63763c0d1a717d1c8d6d3ec0f75205d3d8dd86d83dd759fd019c6efd35a870186c246427dc9ae5d59d9c6d
+  data.tar.gz: 9fa11f2ee914d3f7dc6a87a7086e7339506d34175b03bac01fb683f2c37df5f3938a7bb3066e27a4c41c91cebbc85619d2bdd9fb2a40a3b22583f0c2505c5177

data/lib/dependabot/git_commit_checker.rb

@@ -12,6 +12,7 @@ require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/git_metadata_fetcher"
 
+# rubocop:disable Metrics/ClassLength
 module Dependabot
   class GitCommitChecker
     VERSION_REGEX = /
@@ -58,6 +59,15 @@ module Dependabot
       dependency_source_details.fetch(:ref).match?(VERSION_REGEX)
     end
 
+    def pinned_ref_looks_like_commit_sha?
+      return false unless pinned?
+
+      ref = dependency_source_details.fetch(:ref)
+      return false unless ref.match?(/^[0-9a-f]{6,40}$/)
+
+      local_repo_git_metadata_fetcher.head_commit_for_ref(ref).nil?
+    end
+
     def branch_or_ref_in_release?(version)
       pinned_ref_in_release?(version) || branch_behind_release?(version)
     end
@@ -352,3 +362,4 @@ module Dependabot
     end
   end
 end
+# rubocop:enable Metrics/ClassLength

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -64,12 +64,12 @@ module Dependabot
           # case, the best we can do is return nil.
           return [] unless releases.any?
 
-          if updated_release && version_class.correct?(dependency.version)
+          if updated_release && version_class.correct?(new_version)
             releases = filter_releases_using_updated_release(releases)
             filter_releases_using_updated_version(releases, conservative: true)
           elsif updated_release
             filter_releases_using_updated_release(releases)
-          elsif version_class.correct?(dependency.version)
+          elsif version_class.correct?(new_version)
             filter_releases_using_updated_version(releases, conservative: false)
           else
             [updated_release].compact
@@ -77,7 +77,6 @@ module Dependabot
         end
 
         def releases_since_previous_version
-          previous_version = dependency.previous_version
           return [updated_release].compact unless previous_version
 
           if previous_release && version_class.correct?(previous_version)
@@ -108,8 +107,6 @@ module Dependabot
         end
 
         def filter_releases_using_previous_version(releases, conservative:)
-          previous_version = version_class.new(dependency.previous_version)
-
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
             cleaned_name = release.name&.gsub(/^[^0-9]*/, "")
@@ -125,12 +122,12 @@ module Dependabot
 
             # Reject any releases that are less than the previous version
             # (e.g., if two major versions are being maintained)
-            tag_version <= previous_version
+            tag_version <= version_class.new(previous_version)
           end
         end
 
         def filter_releases_using_updated_version(releases, conservative:)
-          updated_version = version_class.new(dependency.version)
+          updated_version = version_class.new(new_version)
 
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
@@ -152,11 +149,11 @@ module Dependabot
         end
 
         def updated_release
-          release_for_version(dependency.version)
+          release_for_version(new_version)
         end
 
         def previous_release
-          release_for_version(dependency.previous_version)
+          release_for_version(previous_version)
         end
 
         def release_for_version(version)
@@ -246,6 +243,48 @@ module Dependabot
           []
         end
 
+        def previous_version
+          # If we don't have a previous version, we *may* still be able to
+          # figure one out if a ref was provided and has been changed (in which
+          # case the previous ref was essentially the version).
+          if dependency.previous_version.nil?
+            return ref_changed? ? previous_ref : nil
+          end
+
+          if dependency.previous_version.match?(/^[0-9a-f]{40}$/) &&
+             ref_changed?
+            previous_ref
+          else
+            dependency.previous_version
+          end
+        end
+
+        def new_version
+          if dependency.version.match?(/^[0-9a-f]{40}$/) && ref_changed?
+            return new_ref
+          end
+
+          dependency.version
+        end
+
+        def previous_ref
+          dependency.previous_requirements.map do |r|
+            r.dig(:source, "ref") || r.dig(:source, :ref)
+          end.compact.first
+        end
+
+        def new_ref
+          dependency.requirements.map do |r|
+            r.dig(:source, "ref") || r.dig(:source, :ref)
+          end.compact.first
+        end
+
+        def ref_changed?
+          return false unless previous_ref
+
+          previous_ref != new_ref
+        end
+
         def gitlab_client
           @gitlab_client ||= Dependabot::Clients::GitlabWithRetries.
                              for_gitlab_dot_com(credentials: credentials)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.112.9"
+  VERSION = "0.112.10"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.112.9
+  version: 0.112.10
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-21 00:00:00.000000000 Z
+date: 2019-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr