dependabot-hex 0.169.1 → 0.169.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 584a8467d4817fba890ad17a7fbaa00642d80fa82f1dcc848ceace76d5b55781
-  data.tar.gz: 8a6e92e9ca46b8a66f1dec3ab71eab60b6c902bd9bfd6ef132669298f5134c6a
+  metadata.gz: 9b9799fa6238a1a959e94783b78739bc02569e1a877033f176a32716d27af5e0
+  data.tar.gz: ba315304ce2f933a7f80d42e92f5d8276bdd42f89cb68a3fabf2dc045270f8ee
 SHA512:
-  metadata.gz: 4846fd156ee69159b57f699b2e72144063bba32319e24491eabbeae11018ebf0493abcda3dc60b33e601149eb5bebf8817d78796954402ac91ff7ba97aff6a73
-  data.tar.gz: 8822c6cf5e5babd13191e05eeb7730b37ba0919715c4e38b6956347d26458b72a89f8144c6ea33995a6afed70f45d26328636f83a6f879ca71cc74b8ee85b29e
+  metadata.gz: a58dbda1e4418fad851bfc91d82024dd8d8f64c98556f2079cc0a5d24c0b6c850b3e3083760c677f1af0f48598f1079d029d93f54aa2b0181103490091e61d9f
+  data.tar.gz: 466e136ff32c8b16e6732518c7af63a82bf9052a4e41bed70e1d6fdc5c2cd527e70c74a0294ad2a73333f4454beee5c7dc16f0d52e65c096e6757610efee385c

data/lib/dependabot/hex/file_updater/mixfile_sanitizer.rb

@@ -11,16 +11,40 @@ module Dependabot
           @mixfile_content = mixfile_content
         end
 
+        FILE_READ      = /File.read\(.*?\)/.freeze
+        FILE_READ_BANG = /File.read!\(.*?\)/.freeze
+        PIPE           = Regexp.escape("|>").freeze
+        VERSION_FILE   = /"VERSION"/i.freeze
+
+        NESTED_VERSION_FILE_READ = /String\.trim\(#{FILE_READ}\)/.freeze
+        NESTED_VERSION_FILE_READ_BANG = /String\.trim\(#{FILE_READ_BANG}\)/.freeze
+        PIPED_VERSION_FILE_READ =
+          /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ}/.freeze
+        PIPED_VERSION_FILE_READ_BANG =
+          /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ_BANG}/.freeze
+
         def sanitized_content
           mixfile_content.
-            gsub(/File\.read!\(.*?\)/, '"0.0.1"').
-            gsub(/File\.read\(.*?\)/, '{:ok, "0.0.1"}').
-            gsub(/^\s*config_path:.*(?:,|$)/, "")
+            yield_self(&method(:prevent_version_file_loading)).
+            yield_self(&method(:prevent_config_path_loading))
         end
 
         private
 
         attr_reader :mixfile_content
+
+        def prevent_version_file_loading(configuration)
+          configuration.
+            gsub(NESTED_VERSION_FILE_READ_BANG, 'String.trim("0.0.1")').
+            gsub(NESTED_VERSION_FILE_READ, 'String.trim({:ok, "0.0.1"})').
+            gsub(PIPED_VERSION_FILE_READ, '{:ok, "0.0.1"}').
+            gsub(PIPED_VERSION_FILE_READ_BANG, '"0.0.1"')
+        end
+
+        def prevent_config_path_loading(configuration)
+          configuration.
+            gsub(/^\s*config_path:.*(?:,|$)/, "")
+        end
       end
     end
   end

data/lib/dependabot/hex/update_checker/requirements_updater.rb

@@ -136,7 +136,8 @@ module Dependabot
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
               version_to_be_permitted.segments[index] + 1
-            else 0
+            else
+              0
             end
           end
 

data/lib/dependabot/hex/update_checker/version_resolver.rb

@@ -134,7 +134,8 @@ module Dependabot
 
         def write_temporary_sanitized_dependency_files(prepared: true)
           files = if prepared then prepared_dependency_files
-                  else original_dependency_files
+                  else
+                    original_dependency_files
                   end
 
           files.each do |file|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.169.1
+  version: 0.169.5
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-29 00:00:00.000000000 Z
+date: 2021-12-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.169.1
+        version: 0.169.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.169.1
+        version: 0.169.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.18.0
+        version: 1.23.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.18.0
+        version: 1.23.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -228,7 +228,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.2.22
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Elixir (Hex) support for dependabot