Teach updater how to do multi-directory version pull requests

updater/lib/dependabot/dependency_change.rb

@@ -81,7 +81,7 @@ def should_replace_existing_pr?
       # NOTE: Gradle, Maven and Nuget dependency names can be case-insensitive
       # and the dependency name injected from a security advisory often doesn't
       # match what users have specified in their manifest.
-      updated_dependencies.map { |x| x.name.downcase } != job.dependencies.map(&:downcase)
+      updated_dependencies.map { |x| x.name.downcase }.uniq.sort != job.dependencies.map(&:downcase).uniq.sort
     end
 
     def matches_existing_pr?

updater/lib/dependabot/updater/operations/create_group_update_pull_request.rb

@@ -41,8 +41,6 @@ def perform
 
           Dependabot.logger.info("Starting update group for '#{group.name}'")
 
-          dependency_change = compile_all_dependency_changes_for(group)
-
           if dependency_change.updated_dependencies.any?
             Dependabot.logger.info("Creating a pull request for '#{group.name}'")
             begin
@@ -64,6 +62,26 @@ def perform
                     :dependency_snapshot,
                     :error_handler,
                     :group
+
+        def dependency_change
+          return @dependency_change if defined?(@dependency_change)
+
+          if job.source.directories.nil?
+            @dependency_change = compile_all_dependency_changes_for(group)
+          else
+            dependency_changes = job.source.directories.map do |directory|
+              job.source.directory = directory
+              # Fixes not updating because it already updated in a previous group
+              dependency_snapshot.handled_dependencies.clear
+              compile_all_dependency_changes_for(group)
+            end
+
+            # merge the changes together into one
+            @dependency_change = dependency_changes.first
+            @dependency_change.merge_changes!(dependency_changes[1..-1]) if dependency_changes.count > 1
+            @dependency_change
+          end
+        end
       end
     end
   end

updater/lib/dependabot/updater/operations/refresh_group_update_pull_request.rb

@@ -87,7 +87,7 @@ def perform # rubocop:disable Metrics/AbcSize
               )
             end
 
-            dependency_change = compile_all_dependency_changes_for(dependency_snapshot.job_group)
+            dependency_change
 
             upsert_pull_request_with_error_handling(dependency_change, dependency_snapshot.job_group)
           end
@@ -99,6 +99,26 @@ def perform # rubocop:disable Metrics/AbcSize
                     :service,
                     :dependency_snapshot,
                     :error_handler
+
+        def dependency_change
+          return @dependency_change if defined?(@dependency_change)
+
+          if job.source.directories.nil?
+            @dependency_change = compile_all_dependency_changes_for(dependency_snapshot.job_group)
+          else
+            dependency_changes = job.source.directories.map do |directory|
+              job.source.directory = directory
+              # Fixes not updating because it already updated in a previous group
+              dependency_snapshot.handled_dependencies.clear
+              compile_all_dependency_changes_for(dependency_snapshot.job_group)
+            end
+
+            # merge the changes together into one
+            @dependency_change = dependency_changes.first
+            @dependency_change.merge_changes!(dependency_changes[1..-1]) if dependency_changes.count > 1
+            @dependency_change
+          end
+        end
       end
     end
   end

updater/spec/dependabot/dependency_change_spec.rb

@@ -139,6 +139,107 @@
     end
   end
 
+  describe "#should_replace_existing_pr" do
+    context "when not updating a pull request" do
+      let(:job) do
+        instance_double(Dependabot::Job, updating_a_pull_request?: false)
+      end
+
+      it "is false" do
+        expect(dependency_change.should_replace_existing_pr?).to be false
+      end
+    end
+
+    context "when updating a pull request with all dependencies matching" do
+      let(:job) do
+        instance_double(Dependabot::Job,
+                        dependencies: ["business"],
+                        updating_a_pull_request?: true)
+      end
+
+      it "returns false" do
+        expect(dependency_change.should_replace_existing_pr?).to be false
+      end
+    end
+
+    context "when updating a pull request with duplicate dependencies" do
+      let(:job) do
+        instance_double(Dependabot::Job,
+                        dependencies: %w(business business),
+                        updating_a_pull_request?: true)
+      end
+
+      it "returns false" do
+        expect(dependency_change.should_replace_existing_pr?).to be false
+      end
+    end
+
+    context "when updating a pull request with non-matching casing" do
+      let(:job) do
+        instance_double(Dependabot::Job,
+                        dependencies: ["BuSiNeSS"],
+                        updating_a_pull_request?: true)
+      end
+
+      it "returns false" do
+        expect(dependency_change.should_replace_existing_pr?).to be false
+      end
+    end
+
+    context "when updating a pull request with out of order dependencies" do
+      let(:job) do
+        instance_double(Dependabot::Job,
+                        dependencies: %w(PkgB PkgA),
+                        updating_a_pull_request?: true)
+      end
+
+      let(:updated_dependencies) do
+        [
+          Dependabot::Dependency.new(
+            name: "PkgA",
+            package_manager: "bundler",
+            version: "1.8.0",
+            previous_version: "1.7.0",
+            requirements: [
+              { file: "Gemfile", requirement: "~> 1.8.0", groups: [], source: nil }
+            ],
+            previous_requirements: [
+              { file: "Gemfile", requirement: "~> 1.7.0", groups: [], source: nil }
+            ]
+          ),
+          Dependabot::Dependency.new(
+            name: "PkgB",
+            package_manager: "bundler",
+            version: "1.8.0",
+            previous_version: "1.7.0",
+            requirements: [
+              { file: "Gemfile", requirement: "~> 1.8.0", groups: [], source: nil }
+            ],
+            previous_requirements: [
+              { file: "Gemfile", requirement: "~> 1.7.0", groups: [], source: nil }
+            ]
+          )
+        ]
+      end
+
+      it "returns false" do
+        expect(dependency_change.should_replace_existing_pr?).to be false
+      end
+    end
+
+    context "when updating a pull request with different dependencies" do
+      let(:job) do
+        instance_double(Dependabot::Job,
+                        dependencies: ["contoso"],
+                        updating_a_pull_request?: true)
+      end
+
+      it "returns true" do
+        expect(dependency_change.should_replace_existing_pr?).to be true
+      end
+    end
+  end
+
   describe "#grouped_update?" do
     it "is false by default" do
       expect(dependency_change.grouped_update?).to be false