dependabot-composer 0.106.47 → 0.107.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f12eb45206fcacc3318b5ba943b21dc5c2def2e4784c591375746d1a4e65de2
-  data.tar.gz: c7e24dc31383deb0ff7422020545fabd5eee7169bd35a9768e8860d4ff7e8529
+  metadata.gz: b5433910777689666563f4a6076c46ec065304d4b265b5cae3e2825911acee6d
+  data.tar.gz: 47754d7e6ff3c6e51f3495ccfa0fea9b116092b8c6de44ba9a8631fa5a4e3749
 SHA512:
-  metadata.gz: ca2126a4fbd120066e35a0e617c3e6ada846b805bc177ad3b45c0c91268e88fa5f95927f0bdc2117e04029c1b31fca30bed83907350414ad223fe7c5a5e5dd52
-  data.tar.gz: '0919d260376b762514a492647c22356b7fcda0a7462ffe7205212faf193954028b05c9ddf3387eb68ea9c37c0b6ce8bdb52702042bbd1089a2555e7682fa6bc0'
+  metadata.gz: 7cb25a8496fc6cc25ea969ddff03cdacb77b9a3614bd141bfaa14724b450eddc14e783f0015d301dad63b54efd6b236377a8d7e9ce7ded9a43e5260a3b044d04
+  data.tar.gz: 23ed281604bb229dd0722e55d7b60da365dcd22855d2c255cb14868e5e9fc5d64d3a6f3fee25ab3ffe2f095f13d1fc1ec81d10c546b43c7e9e32b2f7db30f640

data/lib/dependabot/composer/update_checker.rb

@@ -33,6 +33,17 @@ module Dependabot
           ).latest_resolvable_version
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        if defined?(@lowest_resolvable_security_fix_version)
+          return @lowest_resolvable_security_fix_version
+        end
+
+        @lowest_resolvable_security_fix_version =
+          fetch_lowest_resolvable_security_fix_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         return nil if path_dependency?
 
@@ -49,7 +60,7 @@ module Dependabot
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
-          latest_resolvable_version: latest_resolvable_version&.to_s,
+          latest_resolvable_version: preferred_resolvable_version&.to_s,
           update_strategy: requirements_update_strategy
         ).updated_requirements
       end
@@ -89,6 +100,25 @@ module Dependabot
         )
       end
 
+      def fetch_lowest_resolvable_security_fix_version
+        return nil if path_dependency?
+
+        fix_version = latest_version_finder.lowest_security_fix_version
+        return latest_resolvable_version if fix_version.nil?
+
+        resolved_fix_version = VersionResolver.new(
+          credentials: credentials,
+          dependency: dependency,
+          dependency_files: dependency_files,
+          latest_allowable_version: fix_version,
+          requirements_to_unlock: :own
+        ).latest_resolvable_version
+
+        return fix_version if fix_version == resolved_fix_version
+
+        latest_resolvable_version
+      end
+
       def path_dependency?
         dependency.requirements.any? { |r| r.dig(:source, :type) == "path" }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.106.47
+  version: 0.107.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.47
+        version: 0.107.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.106.47
+        version: 0.107.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement