dependabot-maven 0.87.2 → 0.87.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0861282fee6432fa42a3595a5f5b6ecee800914448d29c13dec0a78f4beec5c
-  data.tar.gz: 76e5c2039a949d4fc68c5ed2203fbf4fe68586e3f353dd7447ffd526506b6535
+  metadata.gz: 1880be235fef169b863fc185a925cab74b63ec98a28d08e79fd5c6ea2bc70138
+  data.tar.gz: 8bc1db86af51d6c635994e87e4c1faf4a445f2afef91b5490dfdb1da9720c9d6
 SHA512:
-  metadata.gz: e295d7ccc8f13b11e1a06073464e1cc8e4899d1b589444f1737f30a65ec35b2950e06b18e95b56d975cdf80178852ac356ab595bc4101c87a79885adbacc9307
-  data.tar.gz: 91a912ef4b4edfc3195070660df943586a6bc55fd5fd7749c5ba652194ded8098aaa23544047eb3e7512ec72b0c78761440ced039a73e47af9e02ae60d986755
+  metadata.gz: dc07baff07e7cd071a77f761f039af005d5a8e85154857c3e8ff92e80e37d20ecb41606d1d48ab41d540cc30c22c63b8c786b5e0cd79f40baa014f324cf8b93d
+  data.tar.gz: d8b90a1b75ef6feabc5fb3ec147b3cf4927cae47419947f75809dbbc9c90ba41cf80b49c4639d43d51bc47b97940f2388971acbe08c10f27cc3e4517b9e0a4ce

data/lib/dependabot/maven/file_parser.rb

@@ -186,7 +186,8 @@ module Dependabot
                         named_captures.fetch("property")
         property_value = value_for_property(property_name, pom)
 
-        value.gsub(PROPERTY_REGEX, property_value)
+        new_value = value.gsub(value.match(PROPERTY_REGEX).to_s, property_value)
+        evaluated_value(new_value, pom)
       end
 
       def property_source(dependency_node, pom)

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -128,7 +128,10 @@ module Dependabot
 
           return value unless property_value
 
-          value.gsub(Maven::FileParser::PROPERTY_REGEX, property_value)
+          value.gsub(
+            value.match(Maven::FileParser::PROPERTY_REGEX).to_s,
+            property_value
+          )
         end
 
         def property_value_finder

data/lib/dependabot/maven/metadata_finder.rb

@@ -81,7 +81,7 @@ module Dependabot
             nm = nm.sub(DOT_SEPARATOR_REGEX, "/")
           end
 
-        source_url.gsub("${#{property_name}}", property_value)
+        source_url.gsub(source_url.match(regex).to_s, property_value)
       end
 
       def source_from_anywhere_in_pom(pom)

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -26,6 +26,8 @@ module Dependabot
 
           @update_possible ||=
             dependencies_using_property.all? do |dep|
+              next false if includes_property_reference?(updated_version(dep))
+
               versions = VersionFinder.new(
                 dependency: dep,
                 dependency_files: dependency_files,
@@ -33,7 +35,7 @@ module Dependabot
                 ignored_versions: ignored_versions
               ).versions.map { |v| v.fetch(:version) }
 
-              versions.include?(target_version) || versions.none?
+              versions.include?(updated_version(dep)) || versions.none?
             end
         end
 
@@ -89,6 +91,10 @@ module Dependabot
             dig(:metadata, :property_source)
         end
 
+        def includes_property_reference?(string)
+          string.match?(Maven::FileParser::PROPERTY_REGEX)
+        end
+
         def version_string(dep)
           declaring_requirement =
             dep.requirements.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.87.2
+  version: 0.87.3
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.87.2
+        version: 0.87.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.87.2
+        version: 0.87.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement