fix(dep update): helm dep update is not respecting the "version" stipulated in the requirements

Signed-off-by: cndoit18 <cndoit18@outlook.com>

internal/resolver/resolver.go

@@ -57,6 +57,11 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string
 	locked := make([]*chart.Dependency, len(reqs))
 	missing := []string{}
 	for i, d := range reqs {
+		constraint, err := semver.NewConstraint(d.Version)
+		if err != nil {
+			return nil, errors.Wrapf(err, "dependency %q has an invalid version/constraint format", d.Name)
+		}
+
 		if d.Repository == "" {
 			// Local chart subfolder
 			if _, err := GetLocalPath(filepath.Join("charts", d.Name), r.chartpath); err != nil {
@@ -77,13 +82,22 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string
 				return nil, err
 			}
 
-			// The version of the chart locked will be the version of the chart
-			// currently listed in the file system within the chart.
 			ch, err := loader.LoadDir(chartpath)
 			if err != nil {
 				return nil, err
 			}
 
+			v, err := semver.NewVersion(ch.Metadata.Version)
+			if err != nil {
+				// Not a legit entry.
+				continue
+			}
+
+			if !constraint.Check(v) {
+				missing = append(missing, d.Name)
+				continue
+			}
+
 			locked[i] = &chart.Dependency{
 				Name:       d.Name,
 				Repository: d.Repository,
@@ -92,11 +106,6 @@ func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string
 			continue
 		}
 
-		constraint, err := semver.NewConstraint(d.Version)
-		if err != nil {
-			return nil, errors.Wrapf(err, "dependency %q has an invalid version/constraint format", d.Name)
-		}
-
 		repoName := repoNames[d.Name]
 		// if the repository was not defined, but the dependency defines a repository url, bypass the cache
 		if repoName == "" && d.Repository != "" {

internal/resolver/resolver_test.go

@@ -28,6 +28,18 @@ func TestResolve(t *testing.T) {
 		expect *chart.Lock
 		err    bool
 	}{
+		{
+			name: "repo from invalid version",
+			req: []*chart.Dependency{
+				{Name: "base", Repository: "file://base", Version: "1.1.0"},
+			},
+			expect: &chart.Lock{
+				Dependencies: []*chart.Dependency{
+					{Name: "base", Repository: "file://base", Version: "0.1.0"},
+				},
+			},
+			err: true,
+		},
 		{
 			name: "version failure",
 			req: []*chart.Dependency{