dependabot-go_modules 0.160.1 → 0.162.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5deaca59df2d639ff53f08c49cb7552000e1f92619dcf3e6f84834c2956d1bf5
-  data.tar.gz: 23e5966de5d891a356062b60a5d8e1f835df7b5674a0110f67d5601ede8e4645
+  metadata.gz: 8e3c6239526bd28a624f7afb5b64255811a199b3f4a9a6b8c84ad23ca08ef34f
+  data.tar.gz: 261b57bd8060fa89837d3b5d2585d5e8c3a1da58c70e591e0952b6211d3206a7
 SHA512:
-  metadata.gz: fd1eebdf65c8b1241cb4bd84bb6d493026000d5af743fb521f2ee3108ddb5238f4bcb5524e5182bee77b2f55ca0557ee1d4b51360babf2e9b0d20eec259c011e
-  data.tar.gz: 108bf74aa458b4f508a62b5ef47261d072ba2f50a4f9aad00bb756fc5b149e9fa859a3459eba1a0de1e3f17e1e898ec1e04f044e1bd8e590b7649ab3638eff5a
+  metadata.gz: 450ceb0c75ae7da96125ff6c8b4148b17716e37c174d5e30f7fa5f996ed90a05c5aa23d8f7ae9ff3fcc85f9dbfa373fca83da1a9c99ae8a3b4acfab3fd5a9f29
+  data.tar.gz: e1654d8aae5907d64a2d76b027de4d169e355714c570a5ffaa2363096b2972d4c2b25f069080f47538541f68c9c9b644660999a37112dd4542753b8ba8e7721b

data/helpers/go.mod

@@ -4,6 +4,6 @@ go 1.16
 
 require (
 	github.com/Masterminds/vcs v1.13.1
-	github.com/dependabot/gomodules-extracted v1.4.1
+	github.com/dependabot/gomodules-extracted v1.4.2
 	golang.org/x/mod v0.5.0
 )

data/helpers/go.sum

@@ -1,7 +1,7 @@
 github.com/Masterminds/vcs v1.13.1 h1:NL3G1X7/7xduQtA2sJLpVpfHTNBALVNSjob6KEjPXNQ=
 github.com/Masterminds/vcs v1.13.1/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
-github.com/dependabot/gomodules-extracted v1.4.1 h1:GbodKHQWk7P7whnNlM1DgphYibwEDHW320SMpLjjTl0=
-github.com/dependabot/gomodules-extracted v1.4.1/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
+github.com/dependabot/gomodules-extracted v1.4.2 h1:3IxvHARuuSojSNUHguc6kzWgs+uQN3fdRCowJMU1kDE=
+github.com/dependabot/gomodules-extracted v1.4.2/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=

data/lib/dependabot/go_modules/file_parser.rb

@@ -52,7 +52,7 @@ module Dependabot
         Dependency.new(
           name: details["Path"],
           version: version,
-          requirements: details["Indirect"] ? [] : reqs,
+          requirements: details["Indirect"] || dependency_is_replaced(details) ? [] : reqs,
           package_manager: "go_modules"
         )
       end
@@ -92,6 +92,15 @@ module Dependabot
 
       def local_replacements
         @local_replacements ||=
+          # Find all the local replacements, and return them with a stub path
+          # we can use in their place. Using generated paths is safer as it
+          # means we don't need to worry about references to parent
+          # directories, etc.
+          ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+      end
+
+      def manifest
+        @manifest ||=
           SharedHelpers.in_a_temporary_directory do |path|
             File.write("go.mod", go_mod.content)
 
@@ -106,12 +115,7 @@ module Dependabot
             stdout, stderr, status = Open3.capture3(env, command)
             handle_parser_error(path, stderr) unless status.success?
 
-            # Find all the local replacements, and return them with a stub path
-            # we can use in their place. Using generated paths is safer as it
-            # means we don't need to worry about references to parent
-            # directories, etc.
-            manifest = JSON.parse(stdout)
-            ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+            JSON.parse(stdout)
           end
       end
 
@@ -172,6 +176,24 @@ module Dependabot
           false
         end
       end
+
+      def dependency_is_replaced(details)
+        # Mark dependency as replaced if the requested dependency has a
+        # "replace" directive and that either has the same version, or no
+        # version mentioned. This mimics the behaviour of go get -u, and
+        # prevents that we change dependency versions without any impact since
+        # the actual version that is being imported is defined by the replace
+        # directive.
+        if manifest["Replace"]
+          dep_replace = manifest["Replace"].find do |replace|
+            replace["Old"]["Path"] == details["Path"] &&
+              (!replace["Old"]["Version"] || replace["Old"]["Version"] == details["Version"])
+          end
+
+          return true if dep_replace
+        end
+        false
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.160.1
+  version: 0.162.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-08-26 00:00:00.000000000 Z
+date: 2021-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.160.1
+        version: 0.162.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.160.1
+        version: 0.162.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement