Bumper modifies dependency version instead of project version in TOML files #52

Summary

When using bumper to update the version of a python package using a pyproject.toml and specifying the path project.version, the plugin modified the version of an unrelated dependency rather than the project’s own version.

This specific issue occurred on our 0.1.0 release, where bumper was supposed to set project version = “0.1.0” (which already happened to be 0.1.0 - this is important), but instead bumper found the next occurrence of 0.0.0 which happened to be django-structlog = “^10.0.0” leading to “^10.1.0” in [toml.poetry.dependencies]. In this scenario, I would expect a no-op.

Steps to reproduce

I’ve added a couple of unit tests to reproduce this issue and another in this commit. Prior to the suggested changes in #53 they failed.

Root cause

A regex is used to modify the version in TOML files. For latest_version = “0.0.0” the regex expands to /version[\W\w]+?(0\.0\.0)/.

There a few issues with this implementation:

• The full path for TOML path is discarded.
• The lazy [\W\w]+? skips across sections i.e. after finding version it walks forward until it finds the first 0.0.0 regardless of where it is in the file.
• No word boundary on the captured version -> i.e. ^10.0.0 matched for 0.0.0.

Suggested Solution

Use a TOML patching engine to modify the version rather than using regex. I've opened an PR with a possible solution.