dependabot-composer 0.111.21 → 0.111.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb5eda2964699209aa592be6f51636a66e2b7a18eb3c160fb96427c2867023c0
-  data.tar.gz: 812ea41e4e821bc4bbcded2ae7322ddee937a8a0b258f8f5640db4b8d2b26c6b
+  metadata.gz: b49add2188a910860cf1d9553ea2b989367516d32ade7f2720de3548c08d16f1
+  data.tar.gz: 1d659ec8d7e06833d765e3d34faca38dfa3cde2d58a9e7216dd69e1dab1d7981
 SHA512:
-  metadata.gz: f31f508311f3f3f7e05afdf4b273964336273dce1e65daa560aa6063d777f63347b7604471e0e84c6b8fc94ce6debcca9936f4fc29c0e101ce864fb5fcc81ca1
-  data.tar.gz: 580176b874cce02fc00e72021c910961175d2666d054b504ed48d065ed3a543be2838bcfd36b2637b31662b383e875c3c46181078a6769c47c7980c2e861d961
+  metadata.gz: bc7dd463e367b57b036ef5873ea0dd6085065784285616bb2a7d73749f8f9c3235b032ad9b34098fb2705306fe107753a376a2d642aa192bc7db7f9c288e29bd
+  data.tar.gz: 3adb07ffc095e7da30e3f7e7a0e41ebc5a1caf14857dd048d8750e45be5e9c20869f6949dc27bed0a4628121cdedbf758c03df49f04031957fabaa7996b2dec7

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -302,9 +302,11 @@ module Dependabot
         end
 
         def version_for_reqs(requirements)
-          req_array = requirements.map { |str| Composer::Requirement.new(str) }
+          req_arrays =
+            requirements.
+            map { |str| Composer::Requirement.requirements_array(str) }
           potential_versions =
-            req_array.map do |req|
+            req_arrays.flatten.map do |req|
               op, version = req.requirements.first
               case op
               when ">" then version.bump
@@ -313,8 +315,11 @@ module Dependabot
               end
             end
 
-          version = potential_versions.
-                    find { |v| req_array.all? { |r| r.satisfied_by?(v) } }
+          version =
+            potential_versions.
+            find do |v|
+              req_arrays.all? { |reqs| reqs.any? { |r| r.satisfied_by?(v) } }
+            end
           raise "No matching version for #{requirements}!" unless version
 
           version.to_s
@@ -355,9 +360,14 @@ module Dependabot
 
         def initial_platform
           return {} unless parsed_composer_json["type"] == "library"
-          return {} unless parsed_composer_json.dig("require", "php")
 
-          { "php" => [parsed_composer_json.dig("require", "php")] }
+          php_requirements = [
+            parsed_composer_json.dig("require", "php"),
+            parsed_composer_json.dig("require-dev", "php")
+          ].compact
+          return {} if php_requirements.empty?
+
+          { "php" => php_requirements }
         end
 
         def parsed_composer_json

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -255,7 +255,7 @@ module Dependabot
           version =
             potential_versions.
             find do |v|
-              req_arrays.any? { |reqs| reqs.all? { |r| r.satisfied_by?(v) } }
+              req_arrays.all? { |reqs| reqs.any? { |r| r.satisfied_by?(v) } }
             end
           raise "No matching version for #{requirements}!" unless version
 
@@ -278,6 +278,10 @@ module Dependabot
 
         def initial_platform
           return {} unless parsed_composer_file["type"] == "library"
+
+          # Note: We *don't* include the require-dev PHP version in our initial
+          # platform. If we fail to resolve with the PHP version specified in
+          # `require` then it will be picked up in a subsequent iteration.
           return {} unless parsed_composer_file.dig("require", "php")
 
           { "php" => [parsed_composer_file.dig("require", "php")] }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.111.21
+  version: 0.111.22
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-20 00:00:00.000000000 Z
+date: 2019-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.21
+        version: 0.111.22
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.111.21
+        version: 0.111.22
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement