Support security updates for indirect deps

go_modules/lib/dependabot/go_modules/file_updater.rb

@@ -28,7 +28,7 @@ def self.updated_files_regex
       def updated_dependency_files
         updated_files = []
 
-        if go_mod && file_changed?(go_mod)
+        if go_mod && dependency_changed?(go_mod)
           updated_files <<
             updated_file(
               file: go_mod,
@@ -56,6 +56,11 @@ def updated_dependency_files
 
       private
 
+      def dependency_changed?(go_mod)
+        # file_changed? only checks for changed requirements. Need to check for indirect dep version changes too.
+        file_changed?(go_mod) || dependencies.any? { |dep| dep.previous_version != dep.version }
+      end
+
       def check_required_files
         return if go_mod
 

go_modules/lib/dependabot/go_modules/update_checker.rb

@@ -26,12 +26,6 @@ def latest_version
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        unless dependency.top_level?
-          return unless dependency.version
-
-          return current_version
-        end
-
         lowest_security_fix_version
       end
 

go_modules/spec/dependabot/go_modules/file_updater_spec.rb

@@ -84,6 +84,19 @@
       expect(updated_files.find { |f| f.name == "go.sum" }).to_not be_nil
     end
 
+    context "with an indirect dependency update" do
+      let(:requirements) { [] }
+      let(:previous_requirements) { [] }
+
+      it "includes an updated go.mod" do
+        expect(updated_files.find { |f| f.name == "go.mod" }).to_not be_nil
+      end
+
+      it "includes an updated go.sum" do
+        expect(updated_files.find { |f| f.name == "go.sum" }).to_not be_nil
+      end
+    end
+
     context "with an invalid module path" do
       let(:stderr) do
         <<~STDERR

go_modules/spec/dependabot/go_modules/update_checker_spec.rb

@@ -63,12 +63,11 @@ module foobar
       end
     end
 
-    context "doesn't update indirect dependencies (not supported)" do
+    context "updates indirect dependencies" do
       let(:requirements) { [] }
-      it do
-        is_expected.to eq(
-          Dependabot::GoModules::Version.new(dependency.version)
-        )
+
+      it "updates to the newer version" do
+        is_expected.to eq(Dependabot::GoModules::Version.new("1.1.0"))
       end
     end
 
@@ -123,12 +122,11 @@ module foobar
       end
     end
 
-    context "doesn't update indirect dependencies (not supported)" do
+    context "updates indirect dependencies" do
       let(:requirements) { [] }
-      it do
-        is_expected.to eq(
-          Dependabot::GoModules::Version.new(dependency.version)
-        )
+
+      it "updates to the least new supported version" do
+        is_expected.to eq(Dependabot::GoModules::Version.new("1.0.5"))
       end
     end