dependabot-composer 0.112.12 → 0.112.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41cfe027e0eb8b442af2db581d5be61b984aff3fc0161464c99edacba3674724
-  data.tar.gz: 7a0ea2b2b4d2ec07bd15b1bc5002d45244ac70feff9d494da4e5d711715403a0
+  metadata.gz: a0b719288dd5f6a3665d1ea7af743acbcf26045966c46c8fe33d2d8261460ba9
+  data.tar.gz: 18d1ec9ee8f1e1af15d3404f4f7b3077f82b373a9cf00b7626ea872266fda0df
 SHA512:
-  metadata.gz: 9e767f6f2eca4e96776a3238cc7ca586152ed4af509350737a9529da4d3c5300e66c6716aa3fda3d805b3c0e986e3b5a0dc0fe03afcad3c5fd3e38e55d1979c8
-  data.tar.gz: cbbc724822d2208afa6641667ed3529833407db06c0b885b97d2dcd5fbd8a56fdfa614c73758b162c13a68fe80476c6897fd069e6df190da838e280eb138981b
+  metadata.gz: 56ef078a97030517d06442165836949dd1e93bea43811bcc56d75db9d86118d1a5297c53f77a27a3af447f173d87e256d2d9668adb18282b0e05ae054e02d266
+  data.tar.gz: d94a4440f5140d9cf68e38a298de181f13e8fe7174e73f331bea045d717452db52d5a3f8ee7a6c366f77a6c66fa418a0afe4917ac62990177c4493f238cba9e3

data/lib/dependabot/composer/file_parser.rb

@@ -38,7 +38,7 @@ module Dependabot
         dependencies = DependencySet.new
 
         DEPENDENCY_GROUP_KEYS.each do |keys|
-          next unless parsed_composer_json[keys[:manifest]]
+          next unless parsed_composer_json[keys[:manifest]].is_a?(Hash)
 
           parsed_composer_json[keys[:manifest]].each do |name, req|
             next unless package?(name)
@@ -78,39 +78,46 @@ module Dependabot
         )
       end
 
+      # rubocop:disable Metrics/CyclomaticComplexity
+      # rubocop:disable Metrics/PerceivedComplexity
       def lockfile_dependencies
         dependencies = DependencySet.new
 
         return dependencies unless lockfile
 
-        DEPENDENCY_GROUP_KEYS.each do |h|
-          key = h.fetch(:lockfile)
-          next unless parsed_lockfile[key]
+        DEPENDENCY_GROUP_KEYS.each do |keys|
+          key = keys.fetch(:lockfile)
+          next unless parsed_lockfile[key].is_a?(Array)
 
           parsed_lockfile[key].each do |details|
             name = details["name"]
-            next unless package?(name)
+            next unless name.is_a?(String) && package?(name)
 
             version = details["version"]&.to_s&.sub(/^v?/, "")
-            next if version.nil?
+            next unless version.is_a?(String)
             next unless version.match?(/^\d/) ||
                         version.match?(/^[0-9a-f]{40}$/)
 
-            dependencies <<
-              Dependency.new(
-                name: name,
-                version: version,
-                requirements: [],
-                package_manager: "composer",
-                subdependency_metadata: [{
-                  production: h.fetch(:group) != "development"
-                }]
-              )
+            dependencies << build_lockfile_dependency(name, version, keys)
           end
         end
 
         dependencies
       end
+      # rubocop:enable Metrics/CyclomaticComplexity
+      # rubocop:enable Metrics/PerceivedComplexity
+
+      def build_lockfile_dependency(name, version, keys)
+        Dependency.new(
+          name: name,
+          version: version,
+          requirements: [],
+          package_manager: "composer",
+          subdependency_metadata: [{
+            production: keys.fetch(:group) != "development"
+          }]
+        )
+      end
 
       def dependency_version(name:, type:)
         return unless lockfile

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.112.12
+  version: 0.112.13
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.12
+        version: 0.112.13
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.12
+        version: 0.112.13
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement