dependabot-core 0.85.2 → 0.85.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b4b3dd68b4786b8b1602aa9d0f8c563f66d9ae3798185b264a14d0f8f75959c8
-  data.tar.gz: b562a58b0033ab24a006ff16a0670277071d85f057777176f0c44c8bf060e372
+  metadata.gz: ae690b38c7293ceabf4f56d82deb2d613f6da6edea787473ff03f641f2cf49ae
+  data.tar.gz: d3a0b0143f332c15f332bdf3fb92f624bd01778016fccbf5d2d8b997d0683a94
 SHA512:
-  metadata.gz: 75a95ebfcd8a6a197123e46f92816fe9a12d671b3e2c9183d9157bf56bbd5f4f77102db8033771c049986ece70a1cb124ea894b9ff5c3dfe21ff224d9a68d904
-  data.tar.gz: 4759805a3f79fda1817ae8b7eb82e874d2a46dfb7be3d9afab11f0b18a95476dd82feca911dd21e1698de2f374374ade64b0aabb4b3bcb653795cfe0ac18b0d4
+  metadata.gz: 28ded14ae4261b7609e2c778dcb6c2f81600f2e9e8df19a6b12f40549ba668a06b24cd0fae42d1e2a57c1a8b837521c12a8e6fed08296c7e59ee16f6460e48da
+  data.tar.gz: 88a74d07d5218c5f2fbbfec86394566b0e06916ef32e65bd53f6906d08803e85a1f209f196868a09c8f051b88763ba10bf4685b16590b2db9cb960166f78b0d6

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v0.85.3, 17 December 2018
+
+- Rust: Ignore aliased dependencies
+- Bump cython from 0.29.1 to 0.29.2 in /python/helpers
+- Ruby: More careful replacement of equality matcher requirements
+
 ## v0.85.2, 15 December 2018
 
 - Switch Ruby RequirementsUpdater logic to use an update strategy, which can be

data/README.md

@@ -47,9 +47,9 @@ Before running Dependabot Core, install dependencies for the core library and
 the helpers:
 
 1. `bundle install`
-2. `cd helpers/yarn && yarn install && cd -`
-3. `cd helpers/npm && yarn install && cd -`
-4. `cd helpers/php && composer install && cd -`
+2. `cd helpers/yarn && yarn install --production && cd -`
+3. `cd helpers/npm && yarn install --production && cd -`
+4. `cd helpers/php && composer install --no-dev && cd -`
 5. `cd helpers/python && pyenv exec pip install -r requirements.txt && cd -`
 6. `cd helpers/elixir && mix deps.get && cd -`
 

data/lib/dependabot/file_updaters/ruby/bundler/requirement_replacer.rb

@@ -101,9 +101,13 @@ module Dependabot
 
               quote_characters = extract_quote_characters_from(req_nodes)
               space_after_specifier = space_after_specifier?(req_nodes)
+              use_equality_operator = use_equality_operator?(req_nodes)
 
-              new_req =
-                new_requirement_string(quote_characters, space_after_specifier)
+              new_req = new_requirement_string(
+                quote_characters: quote_characters,
+                space_after_specifier: space_after_specifier,
+                use_equality_operator: use_equality_operator
+              )
               if req_nodes.any?
                 replace(range_for(req_nodes), new_req)
               else
@@ -166,17 +170,48 @@ module Dependabot
               req_string.include?(" ")
             end
 
-            def new_requirement_string(quote_characters, space_after_specifier)
+            def use_equality_operator?(requirement_nodes)
+              return true if requirement_nodes.none?
+
+              req_string =
+                case requirement_nodes.first.type
+                when :str, :dstr
+                  requirement_nodes.first.loc.expression.source
+                else
+                  requirement_nodes.first.children.first.loc.expression.source
+                end
+
+              req_string.match?(/(?<![<>])=/)
+            end
+
+            def new_requirement_string(quote_characters:,
+                                       space_after_specifier:,
+                                       use_equality_operator:)
               open_quote, close_quote = quote_characters
               new_requirement_string =
                 updated_requirement.split(",").
-                map { |r| %(#{open_quote}#{r.strip}#{close_quote}) }.
-                join(", ")
+                map do |r|
+                  req_string = serialized_req(r, use_equality_operator)
+                  %(#{open_quote}#{req_string}#{close_quote})
+                end.join(", ")
 
               new_requirement_string.delete!(" ") unless space_after_specifier
               new_requirement_string
             end
 
+            def serialized_req(req, use_equality_operator)
+              tmp_req = req
+
+              # Gem::Requirement serializes exact matches as a string starting
+              # with `=`. We may need to remove that equality operator if it
+              # wasn't used originally.
+              unless use_equality_operator
+                tmp_req = tmp_req.gsub(/(?<![<>])=/, "")
+              end
+
+              tmp_req.strip
+            end
+
             def range_for(nodes)
               nodes.first.loc.begin.begin.join(nodes.last.loc.expression)
             end

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.85.2"
+  VERSION = "0.85.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-core
 version: !ruby/object:Gem::Version
-  version: 0.85.2
+  version: 0.85.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-12-15 00:00:00.000000000 Z
+date: 2018-12-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr