dependabot-common 0.111.44 → 0.111.45

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc7dc0b974c99fd91b16afe848b948d92b627c8551bfb0c1d19bbdf464ba055b
-  data.tar.gz: bbf9945d4f9847f28045f81b1e2542045af2d2ac98aca316826d6d4f824e4f69
+  metadata.gz: a45971fdc7d2a17e0c712a72f70338a43103f75080c607f1c48c881a4f8d3769
+  data.tar.gz: 1757ca960513d5183a16f15b2136915eb4dba362fe6503386073c3bfd25ad2e8
 SHA512:
-  metadata.gz: dad540e2a79a299a21b88a28938fc8cfb5b7cddf5eff075a4f1e3dfd234cd89d8c007391f404938516fb0021af4ce2b66a73ae41f567649387830a5258a94a95
-  data.tar.gz: bfa1382e52e25f07a9f7749ccad0832a8f72ad8b93bf47cca98770a173750d5699c4e8f345faf3ea854388ed6db2c91e99d5436d1be9287045fd7dc265f3cf91
+  metadata.gz: 521ba407169aa3ec3f4af5772e63a8c1f02cec240e26ace8befb2a17e6bbd1127e548a85d9752fdd0db089a6870167e635b00b4988b5af47339d00693b59afcc
+  data.tar.gz: f9f31fe3e9312614d73f4aaa8f7b78bbd33d1e9c4b44c85cd7029a9367d9a4df3ff7f111901a82f877cba0b92b121d021a70c714627db1552b919ec084ba6f80

data/lib/dependabot/dependency.rb

@@ -41,7 +41,7 @@ module Dependabot
 
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil,
-                   subdependency_metadata: nil)
+                   subdependency_metadata: [])
       @name = name
       @version = version
       @requirements = requirements.map { |req| symbolize_keys(req) }
@@ -49,7 +49,10 @@ module Dependabot
       @previous_requirements =
         previous_requirements&.map { |req| symbolize_keys(req) }
       @package_manager = package_manager
-      @subdependency_metadata = subdependency_metadata unless top_level?
+      unless top_level? || subdependency_metadata == []
+        @subdependency_metadata = subdependency_metadata&.
+                                  map { |h| symbolize_keys(h) }
+      end
 
       check_values
     end
@@ -75,7 +78,7 @@ module Dependabot
     end
 
     def production?
-      return true unless top_level?
+      return subdependency_production_check unless top_level?
 
       groups = requirements.flat_map { |r| r.fetch(:groups).map(&:to_s) }
 
@@ -84,6 +87,10 @@ module Dependabot
         call(groups)
     end
 
+    def subdependency_production_check
+      !subdependency_metadata&.all? { |h| h[:production] == false }
+    end
+
     def display_name
       display_name_builder =
         self.class.display_name_builder_for_package_manager(package_manager)
@@ -111,6 +118,11 @@ module Dependabot
         raise ArgumentError, "blank strings must not be provided as versions"
       end
 
+      check_requirement_fields
+      check_subdependency_metadata
+    end
+
+    def check_requirement_fields
       requirement_fields = [requirements, previous_requirements].compact
       unless requirement_fields.all? { |r| r.is_a?(Array) } &&
              requirement_fields.flatten.all? { |r| r.is_a?(Hash) }
@@ -132,6 +144,15 @@ module Dependabot
       raise ArgumentError, "blank strings must not be provided as requirements"
     end
 
+    def check_subdependency_metadata
+      return unless subdependency_metadata
+
+      unless subdependency_metadata.is_a?(Array) &&
+             subdependency_metadata.all? { |r| r.is_a?(Hash) }
+        raise ArgumentError, "subdependency_metadata must be an array of hashes"
+      end
+    end
+
     def symbolize_keys(hash)
       Hash[hash.keys.map { |k| [k.to_sym, hash[k]] }]
     end

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -78,12 +78,10 @@ module Dependabot
             else new_dep.version
             end
 
-          if old_dep.subdependency_metadata
-            subdependency_metadata = old_dep.subdependency_metadata.
-                                     merge(new_dep.subdependency_metadata || {})
-          elsif new_dep.subdependency_metadata
-            subdependency_metadata = new_dep.subdependency_metadata
-          end
+          subdependency_metadata = (
+            (old_dep.subdependency_metadata || []) +
+            (new_dep.subdependency_metadata || [])
+          ).uniq
 
           Dependency.new(
             name: old_dep.name,
@@ -93,9 +91,9 @@ module Dependabot
             subdependency_metadata: subdependency_metadata
           )
         end
-        # rubocop:enable Metrics/PerceivedComplexity
-        # rubocop:enable Metrics/CyclomaticComplexity
         # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/CyclomaticComplexity
+        # rubocop:enable Metrics/PerceivedComplexity
       end
     end
   end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.111.44"
+  VERSION = "0.111.45"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.111.44
+  version: 0.111.45
 platform: ruby
 authors:
 - Dependabot