dependabot-go_modules 0.128.0 → 0.128.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74032d4440871c9e994752053c51fd29f56efd8790a74237dd3b11af6a64527f
-  data.tar.gz: bc35d312dbb2ddb1ea18e87590e0fa3c47a5cf392aaee094cc99dcc1611a7bec
+  metadata.gz: 29da29921bc4394c205fb629cb0789c925786644cb959b46f9b2f298db09cfaf
+  data.tar.gz: 7a4d3430eedaabe4042c9ffe8e6217b012c79ede1baeeca957da44baaa507ee0
 SHA512:
-  metadata.gz: a1dbad5aedfdf7d19c86e857ecb4d552946970cfff0ecd0673e4b625586be3925c8672aa59469173dc48ae81a2867074d6e900335f44bc7623d518f2adb414ef
-  data.tar.gz: 3a2a32a1e1e2dc2d1bdd34f1a4083b241686696a7a85f585524f919c417882acff6872517c91c5e3e46e49193365e449bf173cde71c7c6f10849ff7f42857165
+  metadata.gz: ff7112a43b6836338ff04931727b1b7868963e5adb342df5168690afb4817ff2cdc15e86d9f745e389a5c36ced024f47dc3b02666865a0f29454c9b86a1732cc
+  data.tar.gz: ade4e284555898deb7a757149be26461ebf75b4e94e1b226165cfa2bcea2a1464580e83e503528674f29436bfe47ae9e7c048af071cf3c80f789cebc1f635ccc

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -240,12 +240,37 @@ module Dependabot
               (manifest["Replace"] || []).
                 map { |r| r["New"]["Path"] }.
                 compact.
-                select { |p| p.start_with?(".") || p.start_with?("/") }.
+                select { |p| stub_replace_path?(p) }.
                 map { |p| [p, "./" + Digest::SHA2.hexdigest(p)] }.
                 to_h
             end
         end
 
+        # returns true if the provided path should be replaced with a stub
+        def stub_replace_path?(path)
+          return true if absolute_path?(path)
+          return false unless relative_replacement_path?(path)
+
+          resolved_path = module_pathname.join(path).realpath
+          inside_repo_contents_path = resolved_path.to_s.start_with?(repo_contents_path.to_s)
+          !inside_repo_contents_path
+        rescue Errno::ENOENT
+          true
+        end
+
+        def absolute_path?(path)
+          path.start_with?("/")
+        end
+
+        def relative_replacement_path?(path)
+          # https://golang.org/ref/mod#go-mod-file-replace
+          path.start_with?("./") || path.start_with?("../")
+        end
+
+        def module_pathname
+          @module_pathname ||= repo_contents_path.join(directory)
+        end
+
         def substitute_all(substitutions)
           body = substitutions.reduce(File.read("go.mod")) do |text, (a, b)|
             text.sub(a, b)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.128.0
+  version: 0.128.1
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.128.0
+        version: 0.128.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.128.0
+        version: 0.128.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement