dependabot-go_modules 0.161.0 → 0.163.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cdc977a32fe4bf62c3744a47a529d63c8831d20f8b347e28b661cad629941893
-  data.tar.gz: b64c4dd967b3344b32970bb48bfe8c75907396e6793e3d8c7781e78ab8d2bfb4
+  metadata.gz: 11af423613136b9709f2b02d91d8c2d0c1e129d405e07370760a357d4578a7a1
+  data.tar.gz: 6f0ec0aa75867c686a3b4ddcbdb82948f03daf6ca33710741623b69d69f5c48f
 SHA512:
-  metadata.gz: 8cf529c037c40d13e9f9a402621c7aaffec8c47757c2d05578b538267ce90e19352d1cf8a28ac8247c417f9e8cd3313c6d6706a49a2412e3ab7183c8230627a3
-  data.tar.gz: be20e3c9bba14cff778890c81341b752ac7e05bc9ad3f0391c74079f6b539a9102c029ea0515e9b7f1aaea24b2f7eaa7f02314b08ac7dcbb67b2672408832f3e
+  metadata.gz: 3f48e2d80de95069e219f79c0e0d597b69c6c19db2969cce03f4b8edeef4324dadc1c4841a271e9305baf22e6f4727aa0b31f244869bd89865a4f833973bd91b
+  data.tar.gz: 03cb5281e811b8a2a1f6429f1eb13faf61d34993bed2e28991d48431f4397ef7d5167e12b1911e4c45846d85dcf5dc20d419e18f8a431f12691a150a41d0309d

data/helpers/go.mod

@@ -4,6 +4,6 @@ go 1.16
 
 require (
 	github.com/Masterminds/vcs v1.13.1
-	github.com/dependabot/gomodules-extracted v1.4.1
+	github.com/dependabot/gomodules-extracted v1.4.2
 	golang.org/x/mod v0.5.0
 )

data/helpers/go.sum

@@ -1,7 +1,7 @@
 github.com/Masterminds/vcs v1.13.1 h1:NL3G1X7/7xduQtA2sJLpVpfHTNBALVNSjob6KEjPXNQ=
 github.com/Masterminds/vcs v1.13.1/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
-github.com/dependabot/gomodules-extracted v1.4.1 h1:GbodKHQWk7P7whnNlM1DgphYibwEDHW320SMpLjjTl0=
-github.com/dependabot/gomodules-extracted v1.4.1/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
+github.com/dependabot/gomodules-extracted v1.4.2 h1:3IxvHARuuSojSNUHguc6kzWgs+uQN3fdRCowJMU1kDE=
+github.com/dependabot/gomodules-extracted v1.4.2/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=

data/lib/dependabot/go_modules/file_parser.rb

@@ -52,7 +52,7 @@ module Dependabot
         Dependency.new(
           name: details["Path"],
           version: version,
-          requirements: details["Indirect"] ? [] : reqs,
+          requirements: details["Indirect"] || dependency_is_replaced(details) ? [] : reqs,
           package_manager: "go_modules"
         )
       end
@@ -92,6 +92,15 @@ module Dependabot
 
       def local_replacements
         @local_replacements ||=
+          # Find all the local replacements, and return them with a stub path
+          # we can use in their place. Using generated paths is safer as it
+          # means we don't need to worry about references to parent
+          # directories, etc.
+          ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+      end
+
+      def manifest
+        @manifest ||=
           SharedHelpers.in_a_temporary_directory do |path|
             File.write("go.mod", go_mod.content)
 
@@ -106,12 +115,7 @@ module Dependabot
             stdout, stderr, status = Open3.capture3(env, command)
             handle_parser_error(path, stderr) unless status.success?
 
-            # Find all the local replacements, and return them with a stub path
-            # we can use in their place. Using generated paths is safer as it
-            # means we don't need to worry about references to parent
-            # directories, etc.
-            manifest = JSON.parse(stdout)
-            ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+            JSON.parse(stdout)
           end
       end
 
@@ -172,6 +176,24 @@ module Dependabot
           false
         end
       end
+
+      def dependency_is_replaced(details)
+        # Mark dependency as replaced if the requested dependency has a
+        # "replace" directive and that either has the same version, or no
+        # version mentioned. This mimics the behaviour of go get -u, and
+        # prevents that we change dependency versions without any impact since
+        # the actual version that is being imported is defined by the replace
+        # directive.
+        if manifest["Replace"]
+          dep_replace = manifest["Replace"].find do |replace|
+            replace["Old"]["Path"] == details["Path"] &&
+              (!replace["Old"]["Version"] || replace["Old"]["Version"] == details["Version"])
+          end
+
+          return true if dep_replace
+        end
+        false
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.161.0
+  version: 0.163.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-01 00:00:00.000000000 Z
+date: 2021-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.161.0
+        version: 0.163.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.161.0
+        version: 0.163.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement