dependabot-common 0.208.0 → 0.211.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 912d048222662ce1e434cebc8cfe40f108937215a3d4b2d2ce60613aaaeda092
-  data.tar.gz: a1b87d317cd78ce56d0140c8ea7adb3740ee212e7417b1dc12a1ad78512034f0
+  metadata.gz: 6e1b0e492dee111c834810de7850faa8a0bb5150e281d5eb32e8b44802f2be1f
+  data.tar.gz: 2c9c14aeb59e0d6c33b1630c5425529dff45624f9b1657390ae644dd8d0abbbf
 SHA512:
-  metadata.gz: b1900e1ceba510ad0f73ed1c0a53265261f730c07af87f6731347a13e3d0ada91066fe138ce370a3ec997687188d56c880ad921d2839e1106dc146a02fd1dd03
-  data.tar.gz: 42ef74f670779d88927c3426b6598b06fd77f057e41fe29a78b2976ed3007b6d085113ca3f7d23da0efd9989374cc50b0ef101a64e403b5338463e868f1dc594
+  metadata.gz: 821283e91686501710d6146944b8b10f559cd7ed9e0084edfc5176027083c24b26918a273c823f5fd829f575d5e1a29ead356db403307ba0e36147de30e9e3de
+  data.tar.gz: 768791aeb20b739bd36d4b788164f5d9e11f096879b7ac517cc4fbaa81462f58e1e1cb1d03a8fce5183b0af4da2ac5458a482dc31ee36cc6d5bf09697300c5ef

data/lib/dependabot/dependency.rb

@@ -41,7 +41,7 @@ module Dependabot
 
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil,
-                   subdependency_metadata: [])
+                   subdependency_metadata: [], removed: false)
       @name = name
       @version = version
       @requirements = requirements.map { |req| symbolize_keys(req) }
@@ -53,6 +53,7 @@ module Dependabot
         @subdependency_metadata = subdependency_metadata&.
                                   map { |h| symbolize_keys(h) }
       end
+      @removed = removed
 
       check_values
     end
@@ -61,6 +62,10 @@ module Dependabot
       requirements.any?
     end
 
+    def removed?
+      @removed
+    end
+
     def to_h
       {
         "name" => name,
@@ -69,7 +74,8 @@ module Dependabot
         "previous_version" => previous_version,
         "previous_requirements" => previous_requirements,
         "package_manager" => package_manager,
-        "subdependency_metadata" => subdependency_metadata
+        "subdependency_metadata" => subdependency_metadata,
+        "removed" => removed? ? true : nil
       }.compact
     end
 

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -18,9 +18,7 @@ module Dependabot
         return [] unless repo_contents_path && vendor_dir
 
         Dir.chdir(repo_contents_path) do
-          relative_dir = Pathname.new(vendor_dir).relative_path_from(
-            repo_contents_path
-          )
+          relative_dir = Pathname.new(base_directory).sub(%r{\A/}, "").join(vendor_dir)
 
           status = SharedHelpers.run_shell_command(
             "git status --untracked-files all --porcelain v1 #{relative_dir}"

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -293,10 +293,14 @@ module Dependabot
         return metadata_links_for_dep(dependencies.first) if dependencies.count == 1
 
         dependencies.map do |dep|
-          "\n\nUpdates `#{dep.display_name}` "\
-          "#{from_version_msg(previous_version(dep))}to "\
-          "#{new_version(dep)}"\
-          "#{metadata_links_for_dep(dep)}"
+          if dep.removed?
+            "\n\nRemoves `#{dep.display_name}`"
+          else
+            "\n\nUpdates `#{dep.display_name}` "\
+            "#{from_version_msg(previous_version(dep))}to "\
+            "#{new_version(dep)}"\
+            "#{metadata_links_for_dep(dep)}"
+          end
         end.join
       end
 
@@ -313,9 +317,13 @@ module Dependabot
         return metadata_cascades_for_dep(dependencies.first) if dependencies.one?
 
         dependencies.map do |dep|
-          msg = "\nUpdates `#{dep.display_name}` "\
-                "#{from_version_msg(previous_version(dep))}"\
-                "to #{new_version(dep)}"
+          msg = if dep.removed?
+                  "\nRemoves `#{dep.display_name}`"
+                else
+                  "\nUpdates `#{dep.display_name}` "\
+                        "#{from_version_msg(previous_version(dep))}"\
+                        "to #{new_version(dep)}"
+                end
 
           if vulnerabilities_fixed[dep.name]&.one?
             msg += " **This update includes a security fix.**"
@@ -328,6 +336,8 @@ module Dependabot
       end
 
       def metadata_cascades_for_dep(dependency)
+        return "" if dependency.removed?
+
         MetadataPresenter.new(
           dependency: dependency,
           source: source,

data/lib/dependabot/pull_request_updater/azure.rb

@@ -11,16 +11,17 @@ module Dependabot
       OBJECT_ID_FOR_BRANCH_DELETE = "0000000000000000000000000000000000000000"
 
       attr_reader :source, :files, :base_commit, :old_commit, :credentials,
-                  :pull_request_number
+                  :pull_request_number, :author_details
 
       def initialize(source:, files:, base_commit:, old_commit:,
-                     credentials:, pull_request_number:)
+                     credentials:, pull_request_number:, author_details: nil)
         @source = source
         @files = files
         @base_commit = base_commit
         @old_commit = old_commit
         @credentials = credentials
         @pull_request_number = pull_request_number
+        @author_details = author_details
       end
 
       def update
@@ -74,12 +75,15 @@ module Dependabot
       end
 
       def create_temp_branch
+        author = author_details&.slice(:name, :email, :date)
+        author = nil unless author&.any?
+
         response = azure_client_for_source.create_commit(
           temp_branch_name,
           base_commit,
           commit_message,
           files,
-          nil
+          author
         )
 
         JSON.parse(response.body).fetch("refUpdates").first.fetch("newObjectId")

data/lib/dependabot/security_advisory.rb

@@ -62,6 +62,9 @@ module Dependabot
       # Ignore deps that weren't previously vulnerable
       return false unless affects_version?(dependency.previous_version)
 
+      # Removing a dependency is a way to fix the vulnerability
+      return true if dependency.removed?
+
       # Select deps that are now fixed
       !affects_version?(dependency.version)
     end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.208.0"
+  VERSION = "0.211.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.208.0
+  version: 0.211.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-16 00:00:00.000000000 Z
+date: 2022-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -98,20 +98,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.11'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.11'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.7.1
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: excon
   requirement: !ruby/object:Gem::Requirement
@@ -284,6 +284,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: parallel_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.11.1
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -332,14 +346,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.33.0
+        version: 1.35.1
 - !ruby/object:Gem::Dependency
   name: ruby-debug-ide
   requirement: !ruby/object:Gem::Requirement