diff --git a/updater/lib/dependabot/updater/operations/refresh_security_update_pull_request.rb b/updater/lib/dependabot/updater/operations/refresh_security_update_pull_request.rb index 6202dc7a358..98819ce6adc 100644 --- a/updater/lib/dependabot/updater/operations/refresh_security_update_pull_request.rb +++ b/updater/lib/dependabot/updater/operations/refresh_security_update_pull_request.rb @@ -142,7 +142,9 @@ def check_and_update_pull_request(dependencies) checker = update_checker_for(lead_dependency) log_checking_for_update(lead_dependency) - Dependabot.logger.info("Latest version is #{checker.latest_version}") + lead_dep_latest_available_ver = checker.latest_version + + Dependabot.logger.info("Latest version is #{lead_dep_latest_available_ver}") return close_pull_request(reason: :up_to_date) if checker.up_to_date? @@ -170,6 +172,15 @@ def check_and_update_pull_request(dependencies) # Note that only notices with notice.show_alert set to true will be sent. record_warning_notices(notices) if notices.any? + # Dependabot::Experiments.register(:existing_pr_version_match, false) + + if Dependabot::Experiments.enabled?(:existing_pr_version_match) && (lead_dep_name && + job.existing_pull_requests && pr_lead_dep_latest_ver(lead_dep_name, + lead_dep_latest_available_ver.to_s)) + Dependabot.logger.info("Lead dependency version is already upto date in existing pr, Skipping updating PR.") + return + end + # NOTE: Gradle, Maven and Nuget dependency names can be case-insensitive # and the dependency name in the security advisory often doesn't match # what users have specified in their manifest. @@ -197,6 +208,19 @@ def check_and_update_pull_request(dependencies) # rubocop:enable Metrics/MethodLength # rubocop:enable Metrics/CyclomaticComplexity + sig { params(lead_dep_name: String, existing_pr_lead_dep_ver: String).returns(T::Boolean) } + def pr_lead_dep_latest_ver(lead_dep_name, existing_pr_lead_dep_ver) + job.existing_pull_requests.each do |existing_pr| + existing_pr.dependencies.each do |deps| + next unless (deps.name.eql? lead_dep_name) && (deps.version.eql? existing_pr_lead_dep_ver) + + Dependabot.logger.info("Matching entry found in existing PR. Dependency name: #{deps.name}, version: #{deps.version}") # rubocop:disable Layout/LineLength + return true + end + end + false + end + sig { params(checker: Dependabot::UpdateCheckers::Base).returns(Symbol) } def requirements_to_unlock(checker) if !checker.requirements_unlocked_or_can_be?