dependabot-terraform 0.365.0 → 0.366.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb3eef223ce70a65c3de66a93209df19dc8ac8898fc4dffc091c66bfdff1dc9a
-  data.tar.gz: a10a26c245f8a187a57146bd332c15664d040d4ce9de37c65e182fedfc8d3426
+  metadata.gz: 56789c562ec73d04e7007932c0e43de547846052b5c6b733bb8c8f8e03c1c135
+  data.tar.gz: 28b9548394102c654c739c418f26687f546e527410cded37a6df51f628a930f9
 SHA512:
-  metadata.gz: 64938389feb66563e83693ff30ce181950422b59ed5e1728d75b87f607748bff3fa66a780e7b2d7fdde3522eebf17287bf75d2e2d6a648bea14353b5f5c122ab
-  data.tar.gz: cd5cdc41084be1998a9f2b598b57037462d39077ad6ae36cea7dcbbb14d36017acc93722657fcaccacf83b778b31a56efb621fe8e0a0aad5f7f737a2b67a6b39
+  metadata.gz: 5dab7a30b4f667ddb928da2a9cd8b9720f489d0a0c16f5c0a50e464737e5c3cd8c5e50c864a5b79f5b227efc1d884e1e931d18b2fbe77ca2d36fa0525ad23eec
+  data.tar.gz: 48067bf39c1f9e2d2e1aefd331f71894c226d89b3be6ecd7f13761b621e24cb488c0cb97ca77d6c82e5eccc6e1b9a33b1bc211cc32cf88353350e378fe575dd7

data/lib/dependabot/terraform/file_parser.rb

@@ -245,10 +245,13 @@ module Dependabot
         matches = source_address&.match(PROVIDER_SOURCE_ADDRESS)
         matches = {} if matches.nil?
 
+        # Terraform provider source addresses are case-insensitive, so we normalize
+        # to lowercase to avoid treating e.g. "Azure/azapi" and "azure/azapi" as
+        # different sources when merging dependencies across multiple files.
         [
-          matches[:hostname] || DEFAULT_REGISTRY,
-          matches[:namespace] || DEFAULT_NAMESPACE,
-          matches[:name] || name
+          (matches[:hostname] || DEFAULT_REGISTRY).downcase,
+          (matches[:namespace] || DEFAULT_NAMESPACE).downcase,
+          (matches[:name] || name).downcase
         ]
       end
 
@@ -256,17 +259,19 @@ module Dependabot
       def registry_source_details_from(source_string)
         parts = source_string.split("//").first.split("/")
 
+        # Registry module source addresses are case-insensitive, so we normalize
+        # to lowercase to avoid treating case-variant declarations as different sources.
         if parts.count == 3
           {
             type: "registry",
             registry_hostname: "registry.terraform.io",
-            module_identifier: source_string.split("//").first
+            module_identifier: source_string.split("//").first.downcase
           }
         elsif parts.count == 4
           {
             type: "registry",
-            registry_hostname: parts.first,
-            module_identifier: parts[1..3].join("/")
+            registry_hostname: parts.first.downcase,
+            module_identifier: parts[1..3].join("/").downcase
           }
         else
           msg = "Invalid registry source specified: '#{source_string}'"

data/lib/dependabot/terraform/file_updater.rb

@@ -372,11 +372,11 @@ module Dependabot
         regex_version_preceeds = %r{
           (((?<!required_)version\s=\s*["'].*["'])
           (\s*source\s*=\s*["'](#{registry_host}/)?#{name}["']|\s*#{name}\s*=\s*\{.*))
-        }mx
+        }mxi
         regex_source_preceeds = %r{
           ((source\s*=\s*["'](#{registry_host}/)?#{name}["']|\s*#{name}\s*=\s*\{.*)
           (?:(?!^\}).)+)
-        }mx
+        }mxi
 
         if updated_content.match(regex_version_preceeds)
           regex_version_preceeds
@@ -396,7 +396,7 @@ module Dependabot
             (//modules/\S+)?
             ["']
           (?:(?!^\}).)*
-        }mx
+        }mxi
       end
 
       sig { params(filename: String).returns(Regexp) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-terraform
 version: !ruby/object:Gem::Version
-  version: 0.365.0
+  version: 0.366.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.366.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.366.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.365.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
 rdoc_options: []
 require_paths:
 - lib