dependabot-common 0.124.2 → 0.124.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8c1c6ce7dbce6606fe13ea021cddbdf6cc73561227f1e944024b0cd59c066f8
-  data.tar.gz: 43be3e7cd0d8c583d2286a909d5c616b126eda8d1800db931ebf9ed66ee013bd
+  metadata.gz: 45ddffe6ea8f049656daee7b94bb0ff2c5c73cfb67746789c35a0557367c0ce3
+  data.tar.gz: 245e1180b6bcb30dd120e9d94162ded2d9cdc9cace6cb8fffdb8119ea411c851
 SHA512:
-  metadata.gz: d8a3a6a7ca1e6910132f9c102c13547310eb38e1ac899df526a7fe6bf0cb8ebc264962b3f5ff9376a77f85e5cc5f385de81d58a1ccbfd165c295a9c9c5270d96
-  data.tar.gz: 90c3aa1296c25e4616de3f29b83d5fb49c6dea2e05ccc12fa1c1f69d37342442cfc41acad10a9258d88352c21ff988a3417ae768fb559365873e317413194c23
+  metadata.gz: 7d02322fb6f5a3a140e793deab8c048790750c15244c1b285a03b3df5753e85c799bfbf8c72d3f7686c9d3dd995da554d1e4f787773d15ccd43e1fccf2d63d8d
+  data.tar.gz: 982fbcc7a24947726bd39cddf7814c69fefd6086499f8d4137db1734e750e9649ab256b2faf67acc68b671060656507ab290e0c8de1147aa94a7c32fb98948b9

data/lib/dependabot/security_advisory.rb

@@ -43,8 +43,13 @@ module Dependabot
       safe_versions.any?
     end
 
-    def fixes_advisory?(dependency)
-      return false unless dependency_name == dependency.name
+    # Check if the advisory is fixed by the updated dependency
+    #
+    # @param dependency [Dependabot::Dependency] Updated dependency
+    # @return [Boolean]
+    def fixed_by?(dependency)
+      # Handle case mismatch between the security advisory and parsed name
+      return false unless dependency_name.downcase == dependency.name.downcase
       return false unless package_manager == dependency.package_manager
       # TODO: Support no previous version to the same level as dependency graph
       # and security alerts. We currently ignore dependency updates without a
@@ -59,6 +64,10 @@ module Dependabot
       !affects_version?(dependency.version)
     end
 
+    # Check if the version is affected by the advisory
+    #
+    # @param version [Dependabot::<Package Manager>::Version] version class
+    # @return [Boolean]
     def affects_version?(version)
       return false unless version_class.correct?(version)
       return false unless [*safe_versions, *vulnerable_versions].any?

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.124.2"
+  VERSION = "0.124.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.124.2
+  version: 0.124.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-26 00:00:00.000000000 Z
+date: 2020-10-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit