dependabot-composer 0.154.1 → 0.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28cb416992fb99eed45c632cb598c7387e7ee6f4e1339b29201e2a4971f628c5
-  data.tar.gz: 7e36c3d19fab24df103a5086c337fbb3a72cbc4cc51ed2b758884734de83e6fb
+  metadata.gz: 25c69bc4fe60ac1dad962f729604ce0e41fbbadbc782c830b6e77207adc88ca5
+  data.tar.gz: f11d8363f995f72b4f7f35d0f2de6e8d3081237d6fe4b031199df69fcac160db
 SHA512:
-  metadata.gz: 54323c2cfa08f31b96d5ff3f913fb041eac6435783fe8598249e2da4e81d8c3611ed0797b729f7d38b334eb03753b1129599eaef8074cf86936f9ae159c65adc
-  data.tar.gz: 9e8d2a616001fa70a27d280a1a64fe6e8eb94b1b234b054cb565e53c6da3e33ae4dee1b50df84eff6e0a2a865830b2069d8e9793d390cad99e0390d19d373ebe
+  metadata.gz: 6fea90b2bcb1a6bdca3332c9367b8c2716c13f6c83b6b9854c358dc622b1377d1a8e1b66693538df81ed9f194efd42b364ec389c034418757c87ae2ac0aff8f6
+  data.tar.gz: 19c36ca09ce59ccdb20ca86ac79cf1cd8304163569cb7f6831aea2a9d269f81fb69469658c289d60dbebe465464c4d0c6ae5ffd68e7a3370e5c79ebd26f98bcc

data/helpers/v1/composer.lock

@@ -1835,16 +1835,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "0.12.89",
+            "version": "0.12.90",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "54c0f5a6c30511b77128d58b6369f718df250542"
+                "reference": "f0e4b56630fc3d4eb5be86606d07212ac212ede4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/54c0f5a6c30511b77128d58b6369f718df250542",
-                "reference": "54c0f5a6c30511b77128d58b6369f718df250542",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f0e4b56630fc3d4eb5be86606d07212ac212ede4",
+                "reference": "f0e4b56630fc3d4eb5be86606d07212ac212ede4",
                 "shasum": ""
             },
             "require": {
@@ -1891,7 +1891,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-06-09T20:23:49+00:00"
+            "time": "2021-06-18T07:15:38+00:00"
         },
         {
             "name": "psr/event-dispatcher",

data/helpers/v2/composer.lock

@@ -1989,16 +1989,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "0.12.89",
+            "version": "0.12.90",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "54c0f5a6c30511b77128d58b6369f718df250542"
+                "reference": "f0e4b56630fc3d4eb5be86606d07212ac212ede4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/54c0f5a6c30511b77128d58b6369f718df250542",
-                "reference": "54c0f5a6c30511b77128d58b6369f718df250542",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f0e4b56630fc3d4eb5be86606d07212ac212ede4",
+                "reference": "f0e4b56630fc3d4eb5be86606d07212ac212ede4",
                 "shasum": ""
             },
             "require": {
@@ -2045,7 +2045,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-06-09T20:23:49+00:00"
+            "time": "2021-06-18T07:15:38+00:00"
         },
         {
             "name": "psr/cache",

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -321,7 +321,7 @@ module Dependabot
                            fetch(keys[:lockfile], []).
                            find { |d| d["name"] == name }&.
                            dig("source", "reference")
-              updated_req_parts = req.split(" ")
+              updated_req_parts = req.split
               updated_req_parts[0] = updated_req_parts[0] + "##{commit_sha}"
               json[keys[:manifest]][name] = updated_req_parts.join(" ")
             end

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -4,6 +4,7 @@ require "excon"
 require "json"
 
 require "dependabot/composer/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 
@@ -45,9 +46,11 @@ module Dependabot
         def fetch_lowest_security_fix_version
           versions = available_versions
           versions = filter_prerelease_versions(versions)
-          versions = filter_vulnerable_versions(versions)
+          versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(versions,
+                                                                                           security_advisories)
           versions = filter_ignored_versions(versions)
           versions = filter_lower_versions(versions)
+
           versions.min
         end
 
@@ -69,11 +72,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(versions_array)
-          versions_array.
-            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && version_class.correct?(dependency.version)
 

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -186,7 +186,7 @@ module Dependabot
                            fetch(keys[:lockfile], []).
                            find { |d| d["name"] == name }&.
                            dig("source", "reference")
-              updated_req_parts = req.split(" ")
+              updated_req_parts = req.split
               updated_req_parts[0] = updated_req_parts[0] + "##{commit_sha}"
               json[keys[:manifest]][name] = updated_req_parts.join(" ")
             end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.154.1
+  version: 0.155.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-16 00:00:00.000000000 Z
+date: 2021-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement