dependabot-common 0.210.0 → 0.211.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7369765c3ef555fff544754deaaa6799522339a173a04bfded0c396761dcf01c
-  data.tar.gz: 9559d1cfbe38f273223ba271e5efc2257ae48998e52d7792ceaab0ce07d01367
+  metadata.gz: 6e1b0e492dee111c834810de7850faa8a0bb5150e281d5eb32e8b44802f2be1f
+  data.tar.gz: 2c9c14aeb59e0d6c33b1630c5425529dff45624f9b1657390ae644dd8d0abbbf
 SHA512:
-  metadata.gz: 8ff7f02f8a6303c8a231ea2a36d46b1539bd188a53bbe6c4cd3be6c3d42ff35004b02e8de392b6adaf20cf589b7796cff504144bdc0112e477b24dada73ea037
-  data.tar.gz: eea82aeb98e253cc8a101e1358a21454787d2c3b9ce510b7d39ea84b5c819bfa9a82e5d694e7765072e61fe5ed37018bf13ab72e661082916e48f0445fbd495c
+  metadata.gz: 821283e91686501710d6146944b8b10f559cd7ed9e0084edfc5176027083c24b26918a273c823f5fd829f575d5e1a29ead356db403307ba0e36147de30e9e3de
+  data.tar.gz: 768791aeb20b739bd36d4b788164f5d9e11f096879b7ac517cc4fbaa81462f58e1e1cb1d03a8fce5183b0af4da2ac5458a482dc31ee36cc6d5bf09697300c5ef

data/lib/dependabot/dependency.rb

@@ -41,7 +41,7 @@ module Dependabot
 
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil,
-                   subdependency_metadata: [])
+                   subdependency_metadata: [], removed: false)
       @name = name
       @version = version
       @requirements = requirements.map { |req| symbolize_keys(req) }
@@ -53,6 +53,7 @@ module Dependabot
         @subdependency_metadata = subdependency_metadata&.
                                   map { |h| symbolize_keys(h) }
       end
+      @removed = removed
 
       check_values
     end
@@ -61,6 +62,10 @@ module Dependabot
       requirements.any?
     end
 
+    def removed?
+      @removed
+    end
+
     def to_h
       {
         "name" => name,
@@ -69,7 +74,8 @@ module Dependabot
         "previous_version" => previous_version,
         "previous_requirements" => previous_requirements,
         "package_manager" => package_manager,
-        "subdependency_metadata" => subdependency_metadata
+        "subdependency_metadata" => subdependency_metadata,
+        "removed" => removed? ? true : nil
       }.compact
     end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -293,10 +293,14 @@ module Dependabot
         return metadata_links_for_dep(dependencies.first) if dependencies.count == 1
 
         dependencies.map do |dep|
-          "\n\nUpdates `#{dep.display_name}` "\
-          "#{from_version_msg(previous_version(dep))}to "\
-          "#{new_version(dep)}"\
-          "#{metadata_links_for_dep(dep)}"
+          if dep.removed?
+            "\n\nRemoves `#{dep.display_name}`"
+          else
+            "\n\nUpdates `#{dep.display_name}` "\
+            "#{from_version_msg(previous_version(dep))}to "\
+            "#{new_version(dep)}"\
+            "#{metadata_links_for_dep(dep)}"
+          end
         end.join
       end
 
@@ -313,9 +317,13 @@ module Dependabot
         return metadata_cascades_for_dep(dependencies.first) if dependencies.one?
 
         dependencies.map do |dep|
-          msg = "\nUpdates `#{dep.display_name}` "\
-                "#{from_version_msg(previous_version(dep))}"\
-                "to #{new_version(dep)}"
+          msg = if dep.removed?
+                  "\nRemoves `#{dep.display_name}`"
+                else
+                  "\nUpdates `#{dep.display_name}` "\
+                        "#{from_version_msg(previous_version(dep))}"\
+                        "to #{new_version(dep)}"
+                end
 
           if vulnerabilities_fixed[dep.name]&.one?
             msg += " **This update includes a security fix.**"
@@ -328,6 +336,8 @@ module Dependabot
       end
 
       def metadata_cascades_for_dep(dependency)
+        return "" if dependency.removed?
+
         MetadataPresenter.new(
           dependency: dependency,
           source: source,

data/lib/dependabot/security_advisory.rb

@@ -62,6 +62,9 @@ module Dependabot
       # Ignore deps that weren't previously vulnerable
       return false unless affects_version?(dependency.previous_version)
 
+      # Removing a dependency is a way to fix the vulnerability
+      return true if dependency.removed?
+
       # Select deps that are now fixed
       !affects_version?(dependency.version)
     end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.210.0"
+  VERSION = "0.211.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.210.0
+  version: 0.211.0
 platform: ruby
 authors:
 - Dependabot