dependabot-go_modules 0.162.0 → 0.163.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7aab8c78ea12a9a0155f762dc481856867365cdd86c7913c44f25fc494013612
-  data.tar.gz: aa42e06829b845744fd182b147d8e48bac7a4b2c1f066a99390358ccc43146dc
+  metadata.gz: bdfb4eacbdae87ba38737db94e4e51fe552a0c69aa19e31031be52d0ac8f59c0
+  data.tar.gz: 0b1e28c6038a99ce129e44789da9aa5e0bba283505cf3c7a836ff6828a3513a8
 SHA512:
-  metadata.gz: 609284118149e380e030bebe4525710116a0bbd0f89218809491c915ea0a22a671b05b7c323fca0ce7d53427b95f47f5086964d5d59115243c8db4e9a68d9500
-  data.tar.gz: 6b8f16f99f554285363954d0f4eeddf91603665976d48e2bf2a4e6f7af0aad405cb3fb0a44bca6ec4e56931c02f76c8df7c3e1813fcce7c12aa2e6837417b37d
+  metadata.gz: 67100787e080baccd6fd10b1c047ea26d8218afae2b8973be38bd7b73ee0a179e9b3cb612ed0eace940f51b4f510ad52bae28f827d07dd812de2332231a07a75
+  data.tar.gz: 29d8ab45efd54e572b6afee6bccf6d224a2b39ece979f4d5f35fdfb1c203724fee2182f2d2676765370f0b8e519cefe3e129ff63d5be1cff8a90dae0ad5d54b7

data/helpers/go.mod

@@ -4,6 +4,6 @@ go 1.16
 
 require (
 	github.com/Masterminds/vcs v1.13.1
-	github.com/dependabot/gomodules-extracted v1.4.1
-	golang.org/x/mod v0.5.0
+	github.com/dependabot/gomodules-extracted v1.4.2
+	golang.org/x/mod v0.5.1
 )

data/helpers/go.sum

@@ -1,12 +1,12 @@
 github.com/Masterminds/vcs v1.13.1 h1:NL3G1X7/7xduQtA2sJLpVpfHTNBALVNSjob6KEjPXNQ=
 github.com/Masterminds/vcs v1.13.1/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
-github.com/dependabot/gomodules-extracted v1.4.1 h1:GbodKHQWk7P7whnNlM1DgphYibwEDHW320SMpLjjTl0=
-github.com/dependabot/gomodules-extracted v1.4.1/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
+github.com/dependabot/gomodules-extracted v1.4.2 h1:3IxvHARuuSojSNUHguc6kzWgs+uQN3fdRCowJMU1kDE=
+github.com/dependabot/gomodules-extracted v1.4.2/go.mod h1:cpzrmDX1COyhSDQXHfkRMw0STb0vmguBFqmrkr51h1I=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/mod v0.5.0 h1:UG21uOlmZabA4fW5i7ZX6bjw1xELEGg/ZLgZq9auk/Q=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

data/lib/dependabot/go_modules/file_parser.rb

@@ -52,7 +52,7 @@ module Dependabot
         Dependency.new(
           name: details["Path"],
           version: version,
-          requirements: details["Indirect"] ? [] : reqs,
+          requirements: details["Indirect"] || dependency_is_replaced(details) ? [] : reqs,
           package_manager: "go_modules"
         )
       end
@@ -92,6 +92,15 @@ module Dependabot
 
       def local_replacements
         @local_replacements ||=
+          # Find all the local replacements, and return them with a stub path
+          # we can use in their place. Using generated paths is safer as it
+          # means we don't need to worry about references to parent
+          # directories, etc.
+          ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+      end
+
+      def manifest
+        @manifest ||=
           SharedHelpers.in_a_temporary_directory do |path|
             File.write("go.mod", go_mod.content)
 
@@ -106,12 +115,7 @@ module Dependabot
             stdout, stderr, status = Open3.capture3(env, command)
             handle_parser_error(path, stderr) unless status.success?
 
-            # Find all the local replacements, and return them with a stub path
-            # we can use in their place. Using generated paths is safer as it
-            # means we don't need to worry about references to parent
-            # directories, etc.
-            manifest = JSON.parse(stdout)
-            ReplaceStubber.new(repo_contents_path).stub_paths(manifest, go_mod.directory)
+            JSON.parse(stdout)
           end
       end
 
@@ -172,6 +176,24 @@ module Dependabot
           false
         end
       end
+
+      def dependency_is_replaced(details)
+        # Mark dependency as replaced if the requested dependency has a
+        # "replace" directive and that either has the same version, or no
+        # version mentioned. This mimics the behaviour of go get -u, and
+        # prevents that we change dependency versions without any impact since
+        # the actual version that is being imported is defined by the replace
+        # directive.
+        if manifest["Replace"]
+          dep_replace = manifest["Replace"].find do |replace|
+            replace["Old"]["Path"] == details["Path"] &&
+              (!replace["Old"]["Version"] || replace["Old"]["Version"] == details["Version"])
+          end
+
+          return true if dep_replace
+        end
+        false
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.162.0
+  version: 0.163.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-07 00:00:00.000000000 Z
+date: 2021-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.162.0
+        version: 0.163.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.162.0
+        version: 0.163.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement