dependabot-composer 0.124.7 → 0.125.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc00427134b081ed09540128eb6079b12d98921942687e46d829ca4922b9036d
-  data.tar.gz: 541b36c1e6cf37adf68a21b9a672dff0561923d750270826190f24d80f3f7bde
+  metadata.gz: 135a5f7d49020cb96d6ec31cdb1cac9ccee9b3bbca0d505bd669404d506555cd
+  data.tar.gz: 26eb03973de655de94afcac3581317f9e331222da7bff09fd8c462011a6296d1
 SHA512:
-  metadata.gz: 1d846d2f0d18e2d325fc6670fec4dba6d83502a7e0278c9e15ad14eccf59c066c91bc67051400bbda436d9bb7f73f1f7b1d7029a81eb19da3596a4f94b981e3e
-  data.tar.gz: 90bfdc48b13bb2fa5b200aef019cad2deef007d0308d3e83f9e807694532b5865b3d807bf1409e588895a2008b4d8ae009fd0171e46ea66e781b7bbede78a30f
+  metadata.gz: 83679402888978c2ac3cf99cb03242ed8e2367ef3ea98a8cc48aac00066ca2e383d77f1c212bb8309709977491891d61d83eb11821123987261286c4bd31a1d8
+  data.tar.gz: 0b53d43ec73f1ca3936da9b4b3f720826668a5824eaa2d427fee00f822e67bd996e8ef90d3b87305dc32be8c43ad3811e17bf035f5b4835d42293ecc916ed359

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -65,9 +65,7 @@ module Dependabot
             updated_content = run_update_helper.fetch("composer.lock")
 
             updated_content = post_process_lockfile(updated_content)
-            if lockfile.content == updated_content
-              raise "Expected content to change!"
-            end
+            raise "Expected content to change!" if lockfile.content == updated_content
 
             updated_content
           end
@@ -92,7 +90,7 @@ module Dependabot
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
               command: "php -d memory_limit=-1 #{php_helper_path}",
-              escape_command_str: false,
+              allow_unsafe_shell_command: true,
               function: "update",
               env: credentials_env,
               args: [
@@ -159,9 +157,7 @@ module Dependabot
             raise MissingExtensions, [missing_extension]
           end
 
-          if error.message.start_with?("Failed to execute git checkout")
-            raise git_dependency_reference_error(error)
-          end
+          raise git_dependency_reference_error(error) if error.message.start_with?("Failed to execute git checkout")
 
           # Special case for Laravel Nova, which will fall back to attempting
           # to close a private repo if given invalid (or no) credentials
@@ -193,9 +189,7 @@ module Dependabot
             raise DependencyFileNotResolvable, error.message
           end
 
-          if error.message.start_with?("Allowed memory size")
-            raise Dependabot::OutOfMemory
-          end
+          raise Dependabot::OutOfMemory if error.message.start_with?("Allowed memory size")
 
           if error.message.include?("403 Forbidden")
             source = error.message.match(%r{https?://(?<source>[^/]+)/}).
@@ -457,9 +451,7 @@ module Dependabot
           platform_php = parsed_composer_json.dig("config", "platform", "php")
 
           platform = {}
-          if platform_php.is_a?(String) && requirement_valid?(platform_php)
-            platform["php"] = [platform_php]
-          end
+          platform["php"] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
 
           # Note: We *don't* include the require-dev PHP version in our initial
           # platform. If we fail to resolve with the PHP version specified in

data/lib/dependabot/composer/metadata_finder.rb

@@ -26,9 +26,7 @@ module Dependabot
 
       def look_up_source_from_packagist
         return nil if packagist_listing&.fetch("packages", nil) == []
-        unless packagist_listing&.dig("packages", dependency.name.downcase)
-          return nil
-        end
+        return nil unless packagist_listing&.dig("packages", dependency.name.downcase)
 
         version_listings =
           packagist_listing["packages"][dependency.name.downcase].

data/lib/dependabot/composer/update_checker.rb

@@ -41,9 +41,7 @@ module Dependabot
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        if defined?(@lowest_resolvable_security_fix_version)
-          return @lowest_resolvable_security_fix_version
-        end
+        return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
 
         @lowest_resolvable_security_fix_version =
           fetch_lowest_resolvable_security_fix_version
@@ -72,9 +70,7 @@ module Dependabot
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        if @requirements_update_strategy
-          return @requirements_update_strategy.to_sym
-        end
+        return @requirements_update_strategy.to_sym if @requirements_update_strategy
 
         # Otherwise, widen ranges for libraries and bump versions for apps
         library? ? :widen_ranges : :bump_versions_if_necessary
@@ -149,9 +145,7 @@ module Dependabot
       def latest_version_for_git_dependency
         # If the dependency isn't pinned then we just want to check that it
         # points to the latest commit on the relevant branch.
-        unless git_commit_checker.pinned?
-          return git_commit_checker.head_commit_for_current_branch
-        end
+        return git_commit_checker.head_commit_for_current_branch unless git_commit_checker.pinned?
 
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -62,9 +62,7 @@ module Dependabot
             versions_array.
             reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
 
-          if @raise_on_ignored && filtered.empty? && versions_array.any?
-            raise AllVersionsIgnored
-          end
+          raise AllVersionsIgnored if @raise_on_ignored && filtered.empty? && versions_array.any?
 
           filtered
         end
@@ -81,9 +79,7 @@ module Dependabot
 
         def wants_prerelease?
           current_version = dependency.version
-          if current_version && version_class.new(current_version).prerelease?
-            return true
-          end
+          return true if current_version && version_class.new(current_version).prerelease?
 
           dependency.requirements.any? do |req|
             req[:requirement].match?(/\d-[A-Za-z]/)

data/lib/dependabot/composer/update_checker/requirements_updater.rb

@@ -144,9 +144,7 @@ module Dependabot
         def update_version_string(req_string)
           req_string.
             sub(VERSION_REGEX) do |old_version|
-              unless req_string.match?(/[~*\^]/)
-                next latest_resolvable_version.to_s
-              end
+              next latest_resolvable_version.to_s unless req_string.match?(/[~*\^]/)
 
               old_parts = old_version.split(".")
               new_parts = latest_resolvable_version.to_s.split(".").

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -125,7 +125,7 @@ module Dependabot
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
               command: "php -d memory_limit=-1 #{php_helper_path}",
-              escape_command_str: false,
+              allow_unsafe_shell_command: true,
               function: "get_latest_resolvable_version",
               args: [
                 Dir.pwd,
@@ -156,9 +156,7 @@ module Dependabot
           json = JSON.parse(content)
 
           composer_platform_extensions.each do |extension, requirements|
-            unless version_for_reqs(requirements)
-              raise "No matching version for #{requirements}!"
-            end
+            raise "No matching version for #{requirements}!" unless version_for_reqs(requirements)
 
             json["config"] ||= {}
             json["config"]["platform"] ||= {}
@@ -223,9 +221,7 @@ module Dependabot
 
           # If the original requirement is just a stability flag we append that
           # flag to the requirement
-          if lower_bound.strip.start_with?("@")
-            return "<=#{latest_allowable_version}#{lower_bound.strip}"
-          end
+          return "<=#{latest_allowable_version}#{lower_bound.strip}" if lower_bound.strip.start_with?("@")
 
           lower_bound + ", <= #{latest_allowable_version}"
         end
@@ -439,9 +435,7 @@ module Dependabot
           platform_php = parsed_composer_file.dig("config", "platform", "php")
 
           platform = {}
-          if platform_php.is_a?(String) && requirement_valid?(platform_php)
-            platform["php"] = [platform_php]
-          end
+          platform["php"] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
 
           # Note: We *don't* include the require-dev PHP version in our initial
           # platform. If we fail to resolve with the PHP version specified in

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.124.7
+  version: 0.125.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-03 00:00:00.000000000 Z
+date: 2020-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.7
+        version: 0.125.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.7
+        version: 0.125.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement