dependabot-common 0.218.0 → 0.220.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae17b3827b4bf6723d7b236187ae554dca95b8c3954d85407e7396db327872c4
-  data.tar.gz: fdac2c829db67fcb54cf0f19282ba725ffba58fd38005e1132596862a0148a41
+  metadata.gz: ffac7b072d3084a0eaa087c7bf4cdf6bf8f180a7312a55bd99fd5648320bb38f
+  data.tar.gz: af8cb21616a02e1a3368ae839f591fd2dfed3154bd4b138fe13843447f9306d6
 SHA512:
-  metadata.gz: e49bc5f0106a4a7865f8426002345682789f282258112acf4a0fbdad1e540bd2cbc2801f452822131a7467556e75a3031d620ed26fa9a86a335528272edc774b
-  data.tar.gz: a73940ba5bb5ef5d08397a1999f6a6708c828d355c2f98f0ff47b365ff2e18d7d0ab60862289b1dcb2ff42b06f13fe5fe45ba9f53bb5f31aeab48be5b6db81d9
+  metadata.gz: 3073fb55361f0b46820a01071dc35e14fa91bdbbe653cd581256dde2889df9abeef87bd6787d5c32fd619aaa728736db98116dce9ca357d132e7814941f949dd
+  data.tar.gz: 3a1c6297dcd5425c3838550486066ece3ca2f89f7d1386adc0fa29e1afa681d17a0c30ed8fe987c672e25727af75319e072e1db4668fed0d35b4f4220457fdb9

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -21,7 +21,7 @@ module Dependabot
         # fixed-length name, so we can punt on handling truncation until
         # we determine the strict validation rules for names
         def new_branch_name
-          File.join(prefixes, timestamped_group_name).gsub("/", separator)
+          File.join(prefixes, group_name_with_dependency_digest).gsub("/", separator)
         end
 
         private
@@ -37,11 +37,20 @@ module Dependabot
           ].compact
         end
 
-        # When superseding a grouped update pull request, we will have a period
-        # of time when there are two branches for the group so we use a timestamp
-        # to avoid collisions.
-        def timestamped_group_name
-          "#{dependency_group.name}-#{Time.now.utc.to_i}"
+        # Group pull requests will generally include too many dependencies to include
+        # in the branch name, but we rely on branch names being deterministic for a
+        # given set of dependency changes.
+        #
+        # Let's append a short hash digest of the dependency changes so that we can
+        # meet this guarantee.
+        def group_name_with_dependency_digest
+          "#{dependency_group.name}-#{dependency_digest}"
+        end
+
+        def dependency_digest
+          @dependency_digest ||= Digest::MD5.hexdigest(dependencies.map do |dependency|
+            "#{dependency.name}-#{dependency.removed? ? 'removed' : dependency.version}"
+          end.sort.join(",")).slice(0, 10)
         end
 
         def package_manager

data/lib/dependabot.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.218.0"
+  VERSION = "0.220.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.218.0
+  version: 0.220.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-05-22 00:00:00.000000000 Z
+date: 2023-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -508,7 +508,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.218.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.220.0
 post_install_message: 
 rdoc_options: []
 require_paths: