dependabot-pub 0.176.0 → 0.178.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55f5860d255487229cc4277f0efc5cdc7811ca4e541ec722a9d657d4212b7f3e
-  data.tar.gz: a263996e7b0081a8557a20ee97f20fc09635a88733c80c4250ba89611e81bf26
+  metadata.gz: 31ffa4593f22cc94484726e6e07659a3496a59dfbb0c436cf66257d9d0f93b0c
+  data.tar.gz: 7eebb17b499d5e9bb230401b10daf6600da5b43da1afab1311d00f163603da3e
 SHA512:
-  metadata.gz: 3befba7ade7037906a01793ada0cb3736e101c689bb877486d151b8fcac1b6d5c041227b0a1360c9f823026ebcd0e86625d76fd309f15acc616b78cb4dc35b20
-  data.tar.gz: 65555682c69b9360e6aa9a3ea82bda54047ebd245545289299aa59348f25796df749e235c6f18f114584139e1f7b2004771a8a3f564a49caaa3b5d9f1842eae3
+  metadata.gz: bb123ba84f206fb13dd704382c7d117826cff3ba35cb4826b010f48b290b588b3c4a493ac9604ff3fae9e3f17b5df11a11de07ee9be5e45769f00cc2af9f2314
+  data.tar.gz: 132a51dd172e134988cd438b962b30ce2026b48525a56be5a86860d2cc1470de459b452b357afe819d26ab6e7b4e19b9936648e1038fb9e43d864b07f960b682

data/lib/dependabot/pub/file_parser.rb

@@ -15,7 +15,7 @@ module Dependabot
       def parse
         dependency_set = DependencySet.new
         list.map do |d|
-          dependency_set << to_dependency(d)
+          dependency_set << parse_listed_dependency(d)
         end
         dependency_set.dependencies.sort_by(&:name)
       end

data/lib/dependabot/pub/helpers.rb

@@ -77,13 +77,15 @@ module Dependabot
         end
       end
 
-      def to_dependency(json)
+      # Parses a dependency as listed by `dependency_services list`.
+      def parse_listed_dependency(json)
         params = {
           name: json["name"],
           version: json["version"],
           package_manager: "pub",
           requirements: []
         }
+
         if json["kind"] != "transitive" && !json["constraint"].nil?
           constraint = json["constraint"]
           params[:requirements] << {
@@ -93,6 +95,33 @@ module Dependabot
             file: "pubspec.yaml"
           }
         end
+        Dependency.new(**params)
+      end
+
+      # Parses the updated dependencies returned by
+      # `dependency_services report`.
+      #
+      # The `requirements_update_strategy`` is
+      # used to chose the right updated constraint.
+      def parse_updated_dependency(json, requirements_update_strategy: nil)
+        params = {
+          name: json["name"],
+          version: json["version"],
+          package_manager: "pub",
+          requirements: []
+        }
+        constraint_field = constraint_field_from_update_strategy(requirements_update_strategy)
+
+        if json["kind"] != "transitive" && !json[constraint_field].nil?
+          constraint = json[constraint_field]
+          params[:requirements] << {
+            requirement: constraint,
+            groups: [json["kind"]],
+            source: nil, # TODO: Expose some information about the source
+            file: "pubspec.yaml"
+          }
+        end
+
         if json["previousVersion"]
           params = {
             **params,
@@ -112,6 +141,19 @@ module Dependabot
         Dependency.new(**params)
       end
 
+      # expects "auto" to already have been resolved to one of the other
+      # strategies.
+      def constraint_field_from_update_strategy(requirements_update_strategy)
+        case requirements_update_strategy
+        when "widen_ranges"
+          "constraintWidened"
+        when "bump_versions"
+          "constraintBumped"
+        when "bump_versions_if_necessary"
+          "constraintBumpedIfNeeded"
+        end
+      end
+
       def dependencies_to_json(dependencies)
         if dependencies.nil?
           nil

data/lib/dependabot/pub/update_checker.rb

@@ -3,7 +3,7 @@
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/pub/helpers"
-
+require "yaml"
 module Dependabot
   module Pub
     class UpdateChecker < Dependabot::UpdateCheckers::Base
@@ -49,7 +49,8 @@ module Dependabot
         entry = current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
         return unless entry
 
-        to_dependency(entry).requirements
+        parse_updated_dependency(entry, requirements_update_strategy: resolved_requirements_update_strategy).
+          requirements
       end
 
       private
@@ -67,7 +68,7 @@ module Dependabot
           d["kind"] == "transitive"
         end
         direct_deps.map do |d|
-          to_dependency(d)
+          parse_updated_dependency(d, requirements_update_strategy: resolved_requirements_update_strategy)
         end
       end
 
@@ -78,6 +79,35 @@ module Dependabot
       def current_report
         report.find { |d| d["name"] == dependency.name }
       end
+
+      def resolved_requirements_update_strategy
+        @resolved_requirements_update_strategy ||= resolve_requirements_update_strategy
+      end
+
+      def resolve_requirements_update_strategy
+        raise "Unexpected requirements_update_strategy #{requirements_update_strategy}" unless
+          [nil, "widen_ranges", "bump_versions", "bump_versions_if_necessary"].include? requirements_update_strategy
+
+        if requirements_update_strategy.nil?
+          # Check for a version field in the pubspec.yaml. If it is present
+          # we assume the package is a library, and the requirement update
+          # strategy is widening. Otherwise we assume it is an application, and
+          # go for "bump_versions".
+          pubspec = dependency_files.find { |d| d.name == "pubspec.yaml" }
+          begin
+            parsed_pubspec = YAML.safe_load(pubspec.content, aliases: false)
+          rescue ScriptError
+            return "bump_versions"
+          end
+          if parsed_pubspec["version"].nil?
+            "bump_versions"
+          else
+            "widen_ranges"
+          end
+        else
+          requirements_update_strategy
+        end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.176.0
+  version: 0.178.1
 platform: ruby
 authors:
 - Dependabot
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-28 00:00:00.000000000 Z
+date: 2022-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.176.0
+        version: 0.178.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.176.0
+        version: 0.178.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -198,7 +198,7 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -213,8 +213,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.2.32
+signing_key: 
 specification_version: 4
 summary: Dart (pub) support for dependabot
 test_files: []