dependabot-python 0.154.1 → 0.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23e8f0e648ea98d4da09deb82eabe02afb2f90a3935a19d4dc2bad01e5cb1b1d
-  data.tar.gz: addb2939fce52d56ad87a3dd5ad15dbdd7014040219f67f9f9d6cf44d687ba96
+  metadata.gz: 02be9dd87e3cfff7fd1e2e8013ffd32ab4b8eac65680c3813d7d07a9dedfc8f1
+  data.tar.gz: 5c8d7ca7fb855a43363e95960fdd831aba2305f1fefd94b1b77fd24af3882547
 SHA512:
-  metadata.gz: 35e801aa5e64a76472970852d2dc170bfab0d2addf9bdbfb84c6d569484af38f3f532310d838f1987c97d65a071db0efd538705e530f50fe44e4d709db2ece5f
-  data.tar.gz: 498bd75ebaa0ba1b44b58c540d40b29c29f17420a5cf9d54584c03132d05df2ba51a327efde36fd34741366b9a0b7874e04442e369952d034094ee83ae805484
+  metadata.gz: 4ee05c4b28b04b31353a5bb1c9ded2e9a356845a26bc2ac2ff8faf4b7dc2680d5b55f3faa4b452d05d26c0b321a547f3e7c9f4812aca11d5c225672a5de15bd0
+  data.tar.gz: b1478f0eb4340fe4eaee70be83bbe788b9186f7f256ea81be11d121c59f885d866b950e930c8a6873f594e84226794cffc547941dedc5e1ec6a8ee070ce4f4c7

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -131,7 +131,7 @@ module Dependabot
                   reject { |file| updated_filenames.include?(file.name) }
 
           args = dependency.to_h
-          args = Hash[args.keys.map { |k| [k.to_sym, args[k]] }]
+          args = args.keys.map { |k| [k.to_sym, args[k]] }.to_h
           args[:requirements] = new_reqs
           args[:previous_requirements] = old_reqs
 

data/lib/dependabot/python/update_checker.rb

@@ -175,16 +175,16 @@ module Dependabot
       end
 
       def pipenv_version_resolver
-        @pipenv_version_resolver ||= PipenvVersionResolver.new(resolver_args)
+        @pipenv_version_resolver ||= PipenvVersionResolver.new(**resolver_args)
       end
 
       def pip_compile_version_resolver
         @pip_compile_version_resolver ||=
-          PipCompileVersionResolver.new(resolver_args)
+          PipCompileVersionResolver.new(**resolver_args)
       end
 
       def poetry_version_resolver
-        @poetry_version_resolver ||= PoetryVersionResolver.new(resolver_args)
+        @poetry_version_resolver ||= PoetryVersionResolver.new(**resolver_args)
       end
 
       def pip_version_resolver

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -6,6 +6,7 @@ require "nokogiri"
 
 require "dependabot/dependency"
 require "dependabot/python/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/shared_helpers"
 require "dependabot/python/authed_url_builder"
 require "dependabot/python/name_normaliser"
@@ -71,9 +72,11 @@ module Dependabot
           versions = filter_yanked_versions(versions)
           versions = filter_unsupported_versions(versions, python_version)
           versions = filter_prerelease_versions(versions)
-          versions = filter_vulnerable_versions(versions)
+          versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(versions,
+                                                                                           security_advisories)
           versions = filter_ignored_versions(versions)
           versions = filter_lower_versions(versions)
+
           versions.min
         end
 
@@ -108,11 +111,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(versions_array)
-          versions_array.
-            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && version_class.correct?(dependency.version)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.154.1
+  version: 0.155.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-16 00:00:00.000000000 Z
+date: 2021-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement