dependabot-composer 0.112.11 → 0.112.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b4253e42c894aad96ef877a35e0267ee21f7aee2e15793f48759f31a53474cba
-  data.tar.gz: 4993208ba3fd9e44d55194ce14780003f1eb21d0a20e79e5db32237fb6bae1d3
+  metadata.gz: 41cfe027e0eb8b442af2db581d5be61b984aff3fc0161464c99edacba3674724
+  data.tar.gz: 7a0ea2b2b4d2ec07bd15b1bc5002d45244ac70feff9d494da4e5d711715403a0
 SHA512:
-  metadata.gz: 66d14d6b9d336c80579eecb4c2b0c6414e248a63490b74a3bd85488cbb8aa84b7ecb1b0e88b793bc12511d02339089123a66ae4df795ef7d81ab8c929d737216
-  data.tar.gz: 1abeb64a7e2c7dcd129d19240d9d35f3ceca40d04d232109c128b9078952f6fb3a784e546c4d55be80ee81cf6060d150bdbf958750420ac44a321b73f4124f38
+  metadata.gz: 9e767f6f2eca4e96776a3238cc7ca586152ed4af509350737a9529da4d3c5300e66c6716aa3fda3d805b3c0e986e3b5a0dc0fe03afcad3c5fd3e38e55d1979c8
+  data.tar.gz: cbbc724822d2208afa6641667ed3529833407db06c0b885b97d2dcd5fbd8a56fdfa614c73758b162c13a68fe80476c6897fd069e6df190da838e280eb138981b

data/lib/dependabot/composer/file_parser.rb

@@ -46,33 +46,38 @@ module Dependabot
             if lockfile
               version = dependency_version(name: name, type: keys[:group])
 
-              # Ignore dependencies which appear in the composer.json but not
-              # the composer.lock.
-              next if version.nil?
-
-              # Ignore dependency versions which are non-numeric, since they
+              # Ignore dependency versions which don't appear in the
+              # composer.lock or are non-numeric and not a git SHA, since they
               # can't be compared later in the process.
-              next unless version.match?(/^\d/)
+              next unless version&.match?(/^\d/) ||
+                          version&.match?(/^[0-9a-f]{40}$/)
             end
 
-            dependencies <<
-              Dependency.new(
-                name: name,
-                version: dependency_version(name: name, type: keys[:group]),
-                requirements: [{
-                  requirement: req,
-                  file: "composer.json",
-                  source: dependency_source(name: name, type: keys[:group]),
-                  groups: [keys[:group]]
-                }],
-                package_manager: "composer"
-              )
+            dependencies << build_manifest_dependency(name, req, keys)
           end
         end
 
         dependencies
       end
 
+      def build_manifest_dependency(name, req, keys)
+        Dependency.new(
+          name: name,
+          version: dependency_version(name: name, type: keys[:group]),
+          requirements: [{
+            requirement: req,
+            file: "composer.json",
+            source: dependency_source(
+              name: name,
+              type: keys[:group],
+              requirement: req
+            ),
+            groups: [keys[:group]]
+          }],
+          package_manager: "composer"
+        )
+      end
+
       def lockfile_dependencies
         dependencies = DependencySet.new
 
@@ -88,7 +93,8 @@ module Dependabot
 
             version = details["version"]&.to_s&.sub(/^v?/, "")
             next if version.nil?
-            next unless version.match?(/^\d/)
+            next unless version.match?(/^\d/) ||
+                        version.match?(/^[0-9a-f]{40}$/)
 
             dependencies <<
               Dependency.new(
@@ -111,13 +117,21 @@ module Dependabot
 
         key = lockfile_key(type)
 
-        parsed_lockfile.
+        version =
+          parsed_lockfile.
           fetch(key, []).
           find { |d| d["name"] == name }&.
           fetch("version")&.to_s&.sub(/^v?/, "")
+
+        return version unless version&.start_with?("dev-")
+
+        parsed_lockfile.
+          fetch(key, []).
+          find { |d| d["name"] == name }&.
+          dig("source", "reference")
       end
 
-      def dependency_source(name:, type:)
+      def dependency_source(name:, type:, requirement:)
         return unless lockfile
 
         key = lockfile_key(type)
@@ -131,10 +145,17 @@ module Dependabot
 
         return unless package.dig("source", "type") == "git"
 
-        {
+        details = {
           type: "git",
           url: package.dig("source", "url")
         }
+
+        return details unless requirement.start_with?("dev-")
+
+        details.merge(
+          branch: requirement.sub(/^dev-/, "").split("#").first,
+          ref: nil
+        )
       end
 
       def lockfile_key(type)

data/lib/dependabot/composer/update_checker.rb

@@ -15,13 +15,14 @@ module Dependabot
 
       def latest_version
         return nil if path_dependency?
+        return latest_version_for_git_dependency if git_dependency?
 
         # Fall back to latest_resolvable_version if no listings found
         latest_version_from_registry || latest_resolvable_version
       end
 
       def latest_resolvable_version
-        return nil if path_dependency?
+        return nil if path_dependency? || git_dependency?
 
         @latest_resolvable_version ||=
           VersionResolver.new(
@@ -45,7 +46,7 @@ module Dependabot
       end
 
       def latest_resolvable_version_with_no_unlock
-        return nil if path_dependency?
+        return nil if path_dependency? || git_dependency?
 
         @latest_resolvable_version_with_no_unlock ||=
           VersionResolver.new(
@@ -101,7 +102,7 @@ module Dependabot
       end
 
       def fetch_lowest_resolvable_security_fix_version
-        return nil if path_dependency?
+        return nil if path_dependency? || git_dependency?
 
         fix_version = latest_version_finder.lowest_security_fix_version
         return latest_resolvable_version if fix_version.nil?
@@ -123,6 +124,11 @@ module Dependabot
         dependency.requirements.any? { |r| r.dig(:source, :type) == "path" }
       end
 
+      def git_dependency?
+        dependency.requirements.
+          any? { |r| r.fetch(:requirement)&.start_with?("dev-") }
+      end
+
       def composer_file
         composer_file =
           dependency_files.find { |f| f.name == "composer.json" }
@@ -134,6 +140,35 @@ module Dependabot
       def library?
         JSON.parse(composer_file.content)["type"] == "library"
       end
+
+      def latest_version_for_git_dependency
+        # If the dependency isn't pinned then we just want to check that it
+        # points to the latest commit on the relevant branch.
+        unless git_commit_checker.pinned?
+          return git_commit_checker.head_commit_for_current_branch
+        end
+
+        # If the dependency is pinned to a tag that looks like a version then
+        # we want to update that tag. The latest version will then be the SHA
+        # of the latest tag that looks like a version.
+        if git_commit_checker.pinned_ref_looks_like_version? &&
+           git_commit_checker.local_tag_for_latest_version
+          latest_tag = git_commit_checker.local_tag_for_latest_version
+          return latest_tag.fetch(:commit_sha)
+        end
+
+        # If the dependency is pinned to a tag that doesn't look like a
+        # version then there's nothing we can do.
+        dependency.version
+      end
+
+      def git_commit_checker
+        @git_commit_checker ||= Dependabot::GitCommitChecker.new(
+          dependency: dependency,
+          credentials: credentials,
+          ignored_versions: ignored_versions
+        )
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.112.11
+  version: 0.112.12
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-22 00:00:00.000000000 Z
+date: 2019-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.11
+        version: 0.112.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.11
+        version: 0.112.12
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement