dependabot-composer 0.245.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22db28cb3b624038e5022f40a913797e00d2e372b09058e212f42d92af7d7f7e
-  data.tar.gz: 5419dc4d093d3fc959f29d7b21095dea625a33838d393185c531c16e026b1b2f
+  metadata.gz: 118a4d16af508e1bcb354b4c3df9ad8592ea6496b531dd10226614b8647d0027
+  data.tar.gz: 7940777e44b23cd0c483a8300a34f0c897396487bbc52675c82f405285bf634c
 SHA512:
-  metadata.gz: 7fa30d51ed3bab29e43b4450be05d153638d063561809be5d9edc5da94e25890fabf06d6ae371d8f34d7ff9bca4f9fa8186ab0dd631e34d3e0ce51713ab4fd42
-  data.tar.gz: 1b5788492a1084c7225870e2cedfb6ceb5fe6975dcd1960c1a3ccc038687f61988a57585b641d934745a6f7be4bfe62ba313989723b808150a62cf50a7c0a2b5
+  metadata.gz: 2a538299023942027e90ae24dfdb09805384a9adec19c94ce3022237959732fec0b4ea7666982f172a4f38d8984aafc56c1fd60f910565e8c4788bc014b32304
+  data.tar.gz: b6ac252eea9883d506350c0983c3955d74b896e0fe59b09f31ade5d67598156971f30b6c40b262c288d7cf54a1948da2100e40df985aecec4f54bbeb1ef00a5d

data/lib/dependabot/composer/update_checker/requirements_updater.rb

@@ -6,21 +6,33 @@
 # https://getcomposer.org/doc/articles/versions.md#writing-version-constraints #
 ################################################################################
 
+require "sorbet-runtime"
+
+require "dependabot/composer/requirement"
 require "dependabot/composer/update_checker"
 require "dependabot/composer/version"
-require "dependabot/composer/requirement"
+require "dependabot/requirements_update_strategy"
 
 module Dependabot
   module Composer
     class UpdateChecker
       class RequirementsUpdater
+        extend T::Sig
+
         ALIAS_REGEX = /[a-z0-9\-_\.]*\sas\s+/
         VERSION_REGEX = /(?:#{ALIAS_REGEX})?[0-9]+(?:\.[a-zA-Z0-9*\-]+)*/
         AND_SEPARATOR = /(?<=[a-zA-Z0-9*])(?<!\sas)[\s,]+(?![\s,]*[|-]|as)/
         OR_SEPARATOR = /(?<=[a-zA-Z0-9*])[\s,]*\|\|?\s*/
         SEPARATOR = /(?:#{AND_SEPARATOR})|(?:#{OR_SEPARATOR})/
-        ALLOWED_UPDATE_STRATEGIES =
-          %i(lockfile_only widen_ranges bump_versions bump_versions_if_necessary).freeze
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::WidenRanges,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
 
         def initialize(requirements:, update_strategy:,
                        latest_resolvable_version:)
@@ -36,7 +48,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == :lockfile_only
+          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
           return requirements unless latest_resolvable_version
 
           requirements.map { |req| updated_requirement(req) }
@@ -67,13 +79,13 @@ module Dependabot
           return req if numeric_or_string_reqs.none?
           return updated_alias(req) if req_string.match?(ALIAS_REGEX)
           return req if req_satisfied_by_latest_resolvable?(req_string) &&
-                        update_strategy != :bump_versions
+                        update_strategy != RequirementsUpdateStrategy::BumpVersions
 
           new_req =
             case update_strategy
-            when :widen_ranges
+            when RequirementsUpdateStrategy::WidenRanges
               widen_requirement(req, or_separator)
-            when :bump_versions, :bump_versions_if_necessary
+            when RequirementsUpdateStrategy::BumpVersions, RequirementsUpdateStrategy::BumpVersionsIfNecessary
               update_requirement_version(req, or_separator)
             end
 

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "json"
@@ -383,7 +383,7 @@ module Dependabot
           if e.message.match?(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
             missing_extensions =
               e.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
-               .map do |extension_string|
+               .flatten.flat_map do |extension_string|
                 name, requirement = extension_string.strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end
@@ -392,7 +392,7 @@ module Dependabot
                 implicit_platform_reqs_satisfiable?(e.message)
             missing_extensions =
               e.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX)
-               .map do |extension_string|
+               .flatten.flat_map do |extension_string|
                 name, requirement = extension_string.strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end

data/lib/dependabot/composer/update_checker.rb

@@ -2,10 +2,12 @@
 # frozen_string_literal: true
 
 require "json"
+
+require "dependabot/errors"
+require "dependabot/requirements_update_strategy"
+require "dependabot/shared_helpers"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
 
 module Dependabot
   module Composer
@@ -70,15 +72,15 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        requirements_update_strategy != :lockfile_only
+        requirements_update_strategy != RequirementsUpdateStrategy::LockfileOnly
       end
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+        return @requirements_update_strategy if @requirements_update_strategy
 
         # Otherwise, widen ranges for libraries and bump versions for apps
-        library? ? :widen_ranges : :bump_versions_if_necessary
+        library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersionsIfNecessary
       end
 
       private

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.245.0
+  version: 0.247.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-22 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.245.0
+        version: 0.247.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -136,6 +136,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +286,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.245.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
 post_install_message: 
 rdoc_options: []
 require_paths: