dependabot-core 0.92.4 → 0.92.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6987f57eba5ac428c0eb5b55c25a0320db4813c04e50a281c07d36bb7be2be4a
-  data.tar.gz: 84a6e68c03a8b1172cf3560da5428e21b2840c41087cdadbecc30693ac9ad007
+  metadata.gz: 566d4afd80b7ec1d49c1c779b1e9a950b32e906a2bbcb1eab092510676d4ce0f
+  data.tar.gz: b389d792f90f839b328a35ae6e033b8715d7f3b0f0d0080914848f5ffb190c07
 SHA512:
-  metadata.gz: 354b41bbf26a3373701079d3fe2964b898443053e6c9590d415e7266e75faf121e17d67d7fb7cc66a1b41b603bcdc34ade7d13df7ee2d851893e87bdab79f347
-  data.tar.gz: 972ff82b3b92e133fa8ddd2a00b8673c75ac94d3d4a109481b3a87e435ccc8b644932d8eddb3aed72a41b9ef376bc14a5447bfca5c6552dd0d64fcbdb656d82c
+  metadata.gz: e484a4eeced08b5a7354c5c9daf9206aafc0a13aeb203ffd35a55d191f7bd8f5dddcb50ff5826a8714e9bc604f60420525f55ebf953da96151929c4c1f9d4e76
+  data.tar.gz: ae8eeb381fd24542a1f24ba8b494a319e947f65494146bd0795227ecd79cc293372c4f298735e65974ed2d11be29643ee5015636681522522a213cc203987240

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## v0.92.5, 22 January 2019
+
+- Ruby: CGI escape credentials before passing to Bundler
+- PHP: Clean Composer programmatically install
+
 ## v0.92.4, 22 January 2019
 
 - Rust: Raise PathDependenciesNotReachable errors, rather than

data/lib/dependabot/file_updaters/ruby/bundler/lockfile_updater.rb

@@ -77,9 +77,12 @@ module Dependabot
 
                   # Set auth details
                   relevant_credentials.each do |cred|
+                    token = cred["token"] ||
+                            "#{cred['username']}:#{cred['password']}"
+
                     ::Bundler.settings.set_command_option(
                       cred.fetch("host"),
-                      cred["token"] || "#{cred['username']}:#{cred['password']}"
+                      token.gsub("@", "%40F").gsub("?", "%3F")
                     )
                   end
 

data/lib/dependabot/update_checkers/ruby/bundler/force_updater.rb

@@ -75,9 +75,12 @@ module Dependabot
 
                 # Set auth details
                 relevant_credentials.each do |cred|
+                  token = cred["token"] ||
+                          "#{cred['username']}:#{cred['password']}"
+
                   ::Bundler.settings.set_command_option(
                     cred.fetch("host"),
-                    cred["token"] || "#{cred['username']}:#{cred['password']}"
+                    token.gsub("@", "%40F").gsub("?", "%3F")
                   )
                 end
 

data/lib/dependabot/update_checkers/ruby/bundler/shared_bundler_helpers.rb

@@ -50,9 +50,12 @@ module Dependabot
 
                 # Set auth details
                 relevant_credentials.each do |cred|
+                  token = cred["token"] ||
+                          "#{cred['username']}:#{cred['password']}"
+
                   ::Bundler.settings.set_command_option(
                     cred.fetch("host"),
-                    cred["token"] || "#{cred['username']}:#{cred['password']}"
+                    token.gsub("@", "%40F").gsub("?", "%3F")
                   )
                 end
 

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.92.4"
+  VERSION = "0.92.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-core
 version: !ruby/object:Gem::Version
-  version: 0.92.4
+  version: 0.92.5
 platform: ruby
 authors:
 - Dependabot