dependabot-common 0.143.2 → 0.144.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82f605b43ae5d4332b84cd8bca628b5621e518f26dfab590b680401b17fb2282
-  data.tar.gz: 6913eb7ddb27d985b3aa28ad9e40f239f0efbfeb4f22400a45d9755a9b566287
+  metadata.gz: 06f9de893151cd2ab1d29916da6c5d821cc70dc6878e3ccd144eb887a4588322
+  data.tar.gz: 26bcac9593d947e959aecc53e6c9f7b1474214dda334206df517c0f71cd446ec
 SHA512:
-  metadata.gz: 1114b083a13b2416c8be267f37bc0c2f3ac21cabf97613c879419d21cd506271972efb3d7519b1af54b092ca7b46542e53f2b6edaae3ebd342ed51c885d065cc
-  data.tar.gz: 26f6b95978c3d8492486687cf275285eee383a9b12328e06d8477ddb2707affeacd498abfa7436bfe1f5226e7d485ac84e391a1797408386c2d75ab28ec2184d
+  metadata.gz: f27252cbb1d0ee59aaee1a619b9546a1a7c22613b07f38c014eaac88be8d7ad75ebdcf5f5891f30d715441b80821ba62f99e17749cacbdb9fe4c16a2b7ca2de9
+  data.tar.gz: a7e5d2b6f8f3bf3689cd490e9b8b7c35898ae6ad15a832afda6693a64f850f3dbfbe21397de2cb8e943ab167e2b69d542c2fe8364f5d36841661c1112907af94

data/lib/dependabot/config/file.rb

@@ -55,22 +55,13 @@ module Dependabot
         "terraform" => "terraform"
       }.freeze
 
-      UPDATE_TYPE_LOOKUP = {
-        "version-update:semver-patch" => :ignore_patch_versions,
-        "version-update:semver-minor" => :ignore_minor_versions,
-        "version-update:semver-major" => :ignore_major_versions
-      }.freeze
-
       def ignore_conditions(cfg)
         ignores = cfg&.dig(:ignore) || []
         ignores.map do |ic|
-          update_types = ic[:"update-types"]&.
-                         map { |t| UPDATE_TYPE_LOOKUP[t.downcase.strip] }&.
-                         compact
           Dependabot::Config::IgnoreCondition.new(
             dependency_name: ic[:"dependency-name"],
             versions: ic[:versions],
-            update_types: update_types
+            update_types: ic[:"update-types"]
           )
         end
       end

data/lib/dependabot/config/ignore_condition.rb

@@ -4,37 +4,43 @@ module Dependabot
   module Config
     # Filters versions that should not be considered for dependency updates
     class IgnoreCondition
-      UPDATE_TYPES = %i(
-        ignore_major_versions
-        ignore_minor_versions
-        ignore_patch_versions
-      ).freeze
+      PATCH_VERSION_TYPE = "version-update:semver-patch"
+      MINOR_VERSION_TYPE = "version-update:semver-minor"
+      MAJOR_VERSION_TYPE = "version-update:semver-major"
 
       ALL_VERSIONS = ">= 0"
 
       attr_reader :dependency_name, :versions, :update_types
+
       def initialize(dependency_name:, versions: nil, update_types: nil)
         @dependency_name = dependency_name
         @versions = versions || []
         @update_types = update_types || []
       end
 
-      def ignored_versions(dependency)
-        return [ALL_VERSIONS] if @versions.empty? && @update_types.empty?
+      def ignored_versions(dependency, security_updates_only)
+        return versions if security_updates_only
+        return [ALL_VERSIONS] if versions.empty? && transformed_update_types.empty?
 
-        versions_by_type(dependency) + @versions
+        versions_by_type(dependency) + versions
       end
 
       private
 
+      def transformed_update_types
+        update_types.map(&:downcase).map(&:strip).compact
+      end
+
       def versions_by_type(dependency)
-        @update_types.flat_map do |t|
+        return [] unless dependency.version
+
+        transformed_update_types.flat_map do |t|
           case t
-          when :ignore_patch_versions
+          when PATCH_VERSION_TYPE
             ignore_patch(dependency.version)
-          when :ignore_minor_versions
+          when MINOR_VERSION_TYPE
             ignore_minor(dependency.version)
-          when :ignore_major_versions
+          when MAJOR_VERSION_TYPE
             ignore_major(dependency.version)
           else
             []
@@ -43,53 +49,44 @@ module Dependabot
       end
 
       def ignore_patch(version)
-        parts = version.split(".")
-        return [] unless parts.size > 2
+        return [] unless rubygems_compatible?(version)
 
-        lower_parts = parts.first(2) + ["a"]
-        upper_parts = parts.first(2)
-        upper_parts[1] = upper_parts[1].to_i + 1
-        lower_bound = ">= #{lower_parts.join('.')}"
+        parts = version.split(".")
+        version_parts = parts.fill(0, parts.length...2)
+        upper_parts = version_parts.first(1) + [version_parts[1].to_i + 1]
+        lower_bound = "> #{version}"
         upper_bound = "< #{upper_parts.join('.')}"
+
         ["#{lower_bound}, #{upper_bound}"]
       end
 
       def ignore_minor(version)
-        parts = version.split(".")
-        return [] if parts.size < 2
-
-        if Gem::Version.correct?(version)
-          lower_parts = parts.first(2) + ["a"]
-          upper_parts = parts.first(1)
-          lower_parts[1] = lower_parts[1].to_i + 1
-          upper_parts[0] = upper_parts[0].to_i + 1
-        else
-          lower_parts = parts.first(1) + ["a"]
-          upper_parts = parts.first(1)
-          begin
-            upper_parts[0] = Integer(upper_parts[0]) + 1
-          rescue ArgumentError
-            upper_parts.push(999_999)
-          end
-        end
+        return [] unless rubygems_compatible?(version)
 
+        parts = version.split(".")
+        version_parts = parts.fill(0, parts.length...2)
+        lower_parts = version_parts.first(1) + [version_parts[1].to_i + 1] + ["a"]
+        upper_parts = version_parts.first(0) + [version_parts[0].to_i + 1]
         lower_bound = ">= #{lower_parts.join('.')}"
         upper_bound = "< #{upper_parts.join('.')}"
+
         ["#{lower_bound}, #{upper_bound}"]
       end
 
       def ignore_major(version)
-        parts = version.split(".")
-        return [] unless parts.size > 1
+        return [] unless rubygems_compatible?(version)
 
-        lower_parts = parts.first(1) + ["a"]
-        upper_parts = parts.first(1)
-        lower_parts[0] = lower_parts[0].to_i + 1
-        upper_parts[0] = upper_parts[0].to_i + 2
+        version_parts = version.split(".")
+        lower_parts = [version_parts[0].to_i + 1] + ["a"]
         lower_bound = ">= #{lower_parts.join('.')}"
-        upper_bound = "< #{upper_parts.join('.')}"
 
-        ["#{lower_bound}, #{upper_bound}"]
+        [lower_bound]
+      end
+
+      def rubygems_compatible?(version)
+        return false if version.nil? || version.empty?
+
+        Gem::Version.correct?(version)
       end
     end
   end

data/lib/dependabot/config/update_config.rb

@@ -12,12 +12,13 @@ module Dependabot
         @commit_message_options = commit_message_options
       end
 
-      def ignored_versions_for(dependency)
+      def ignored_versions_for(dependency, security_updates_only: false)
         normalizer = name_normaliser_for(dependency)
-        dep_name = name_normaliser_for(dependency).call(dependency.name)
+        dep_name = normalizer.call(dependency.name)
+
         @ignore_conditions.
           select { |ic| self.class.wildcard_match?(normalizer.call(ic.dependency_name), dep_name) }.
-          map { |ic| ic.ignored_versions(dependency) }.
+          map { |ic| ic.ignored_versions(dependency, security_updates_only) }.
           flatten.
           compact.
           uniq

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.143.2"
+  VERSION = "0.144.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.143.2
+  version: 0.144.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-23 00:00:00.000000000 Z
+date: 2021-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport