dependabot-common 0.116.5 → 0.116.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 999a78c5cab8fb23387cadf8a8ccb5d2dee82979a3858f8762db6dc99b168693
-  data.tar.gz: 8cfbffcaf398f3a5c311347b68412a009b2020e2ebac5e01c04b43f834dd7e99
+  metadata.gz: cd6d1cb619675f1da2656b37b2eb4d27a6ae0c8789b516c51bce122497cb923a
+  data.tar.gz: c9eaca28c8869517e55aeb9605b9e2bfdc698505ebf5cc757eaa565678b4294e
 SHA512:
-  metadata.gz: '098cc18aff2efd626f1d6505ac8242063807105431768dd94279f2902e64bbe7fe84e5fdf6109ce6ce3a347487c2eea0250ad76b187152f21b1251b40a58b1c5'
-  data.tar.gz: e90e52811aad8725153e05ceb562a66d641d5b6701a3c77c0376a0feaae458ddbd0f533428830037e7d3bc40d4a0a7de20c9b5c769f6925f011997624823bcbb
+  metadata.gz: 618053c87e601c5c5de915b2da255a4e18748fc30ed414894383b2a83fa19526bbab8671e4eeefeefa7f5753977f2569eb43c5086853f049c7ea689354695803
+  data.tar.gz: 3fcbdf49ee0f6077fcf33b8bc3ce9895215f4dd9a9d70798f5c84bc73b4913c49d879ab4614a02f751c522366b6d634d5f8df9b1ca336603c8110118782b7a78

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -27,7 +27,11 @@ module Dependabot
               elsif dependencies.count > 1 && updating_a_dependency_set?
                 dependency_set.fetch(:group)
               else
-                dependencies.map(&:name).join("-and-").tr(":", "-").tr("@", "")
+                dependencies.
+                  map(&:name).
+                  join("-and-").
+                  tr(":[]", "-").
+                  tr("@", "")
               end
 
             dep = dependencies.first
@@ -41,12 +45,8 @@ module Dependabot
             end
           end
 
-        branch_name = File.join(prefixes, @name).
-                      gsub(%r{/\.}, "/dot-").
-                      gsub(%r{/\.}, "/dot-")
-
         # Some users need branch names without slashes
-        branch_name.gsub("/", separator)
+        sanitize_ref(File.join(prefixes, @name).gsub("/", separator))
       end
 
       # rubocop:enable Metrics/PerceivedComplexity
@@ -113,8 +113,7 @@ module Dependabot
           gsub(">", "gt-").
           gsub("<", "lt-").
           gsub("*", "star").
-          gsub(",", "-and-").
-          sub(/\.$/, "")
+          gsub(",", "-and-")
       end
 
       def new_version(dependency)
@@ -169,6 +168,23 @@ module Dependabot
       def requirements_changed?(dependency)
         (dependency.requirements - dependency.previous_requirements).any?
       end
+
+      def sanitize_ref(ref)
+        # This isn't a complete implementation of git's ref validation, but it
+        # covers most cases that crop up. Its list of allowed charactersr is a
+        # bit stricter than git's, but that's for cosmetic reasons.
+        ref.
+          # Remove forbidden characters (those not already replaced elsewhere)
+          gsub(%r{[^A-Za-z0-9/\-_.(){}]}, "").
+          # Slashes can't be followed by periods
+          gsub(%r{/\.}, "/dot-").
+          # Two or more sequential periods are forbidden
+          gsub(/\.+/, ".").
+          # Two or more sequential slashes are forbidden
+          gsub(%r{/+}, "/").
+          # Trailing periods are forbidden
+          sub(/\.$/, "")
+      end
     end
   end
 end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.116.5"
+  VERSION = "0.116.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.116.5
+  version: 0.116.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-31 00:00:00.000000000 Z
+date: 2020-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit