bundler-patch 0.7.2 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 22e0f2d411e2e52b0a3d2ba2344d2f1c9bb9ceca
-  data.tar.gz: 37235b8053d27fa07a6fc48c74934ca8c8d8cf3f
+  metadata.gz: 7518b9a8efc98963b564ce984cb46ffd3b89a0b2
+  data.tar.gz: 462eb26c0f399dc220f70d3ef4a0de0ba567e581
 SHA512:
-  metadata.gz: 5e21f129bd9b325e8d5f576f935795c7b6a590cfb0c5c0881e7dcc8742f660964efb2915b4afd9ac999980695dd322486bf2785f2f9e6139b5e24f4d929bc1be
-  data.tar.gz: 380d5b23d3d55da4cff3e7cfc862696bb074867f22e5ccef024d36c469c4f858b0fe532d86b027bf472347cbf8fd741e29d909a6b441a217c7acd27801d9de51
+  metadata.gz: d1d2bab0114e7a132890cf30755d9a96eb400ecaaf5bdc65a44ad522208a43e3e72e7f81a6773254969b924055e7b5673e11bf755c3c26b7b3679ac39d4ed6a7
+  data.tar.gz: 72e9bea210641f7d9307256997300a94d1b228e48f682dc441aac3979968faf71fdbf8c99fb7a1db634da5c5d4fe40e97b639fff73d191e1081d2c3540ae19ad

data/.travis.yml

@@ -1,7 +1,21 @@
 language: ruby
-rvm:
-  - 2.1.10
-  - 2.2.5
-  - 2.3.1
+
 before_install:
-  - gem install bundler -v 1.11.2
+  - for dir in $(echo $GEM_PATH | tr ':' ' '); do gem uninstall -i $dir bundler -a -x; done
+  - gem install bundler -v $BUNDLER_TEST_VERSION
+  - bundle --version
+
+matrix:
+  include:
+    - rvm: 2.1.10
+      env: BUNDLER_TEST_VERSION=1.12.5
+    - rvm: 2.2.5
+      env: BUNDLER_TEST_VERSION=1.12.5
+    - rvm: 2.3.1
+      env: BUNDLER_TEST_VERSION=1.10.5
+    - rvm: 2.3.1
+      env: BUNDLER_TEST_VERSION=1.11.2
+    - rvm: 2.3.1
+      env: BUNDLER_TEST_VERSION=1.12.5
+    - rvm: 2.3.1
+      env: BUNDLER_TEST_VERSION=1.13.0.rc.1

data/README.md

@@ -8,7 +8,7 @@ current version, over the latest minor releases or the latest major releases.
 This is somewhat opposite from `bundle update` which prefers newest/major
 versions first.
 
-Works with Bundler 1.10.x and higher. Last confirmed with 1.12.0.rc.4.
+Works with Bundler 1.10.x and higher.
 
 [![Build Status](https://travis-ci.org/livingsocial/bundler-patch.svg?branch=master)](https://travis-ci.org/livingsocial/bundler-patch)
 
@@ -125,31 +125,33 @@ Gemfile.lock:
       bar (~> 2.0)
     bar (2.0.3)
 
-| # | Command Line | Result                    |
-|---|--------------|---------------------------|
-| 1 |              | 'foo 1.4.5', 'bar 2.1.1'  |
-| 2 | foo          | 'foo 1.4.4', 'bar 2.0.3'  |
-| 3 | -m           | 'foo 1.5.1', 'bar 3.0.0'  |
-| 4 | -m -s        | 'foo 1.5.0', 'bar 2.1.1'  |
-| 5 | -s           | 'foo 1.4.4', 'bar 2.0.4'  |
-| 6 | -p           | 'foo 1.4.4', 'bar 2.0.4'  |
-| 7 | -p -m        | 'foo 1.5.0', 'bar 2.1.0'  |
-
-In case 1, `bar` is upgraded to 2.1.0, a minor version increase, because the
+| # | Command Line              | Result                    |
+|---|---------------------------|---------------------------|
+| 1 | bundle patch              | 'foo 1.4.5', 'bar 2.1.1'  |
+| 2 | bundle patch foo          | 'foo 1.4.4', 'bar 2.0.3'  |
+| 3 | bundle patch -m           | 'foo 1.5.1', 'bar 3.0.0'  |
+| 4 | bundle patch -m -s        | 'foo 1.5.0', 'bar 2.1.1'  |
+| 5 | bundle patch -s           | 'foo 1.4.4', 'bar 2.0.4'  |
+| 6 | bundle patch -p           | 'foo 1.4.4', 'bar 2.0.4'  |
+| 7 | bundle patch -p -m        | 'foo 1.5.0', 'bar 2.1.0'  |
+
+In case 1, `bar` is upgraded to 2.1.1, a minor version increase, because the
 dependency from `foo` 1.4.5 required it.
 
-In case 2, only `foo` is unlocked, so `bar` can only go to 1.4.4 to satisfy
-the dependency from `foo`.
+In case 2, only `foo` is unlocked, so `foo` can only go to 1.4.4 to maintain
+the dependency to `bar`.
 
 In case 3, `bar` goes up a whole major release, because a minor increase is
-preferred now for `foo`.
+preferred now for `foo`, and when it goes to 1.5.1, it requires 3.0.0 of
+`bar`.
 
 In case 4, `foo` is preferred up to a 1.5.x, but 1.5.1 won't work because the
 strict `-s` flag removes `bar` 3.0.0 from consideration since it's a major
 increment.
 
 In case 5, both `foo` and `bar` have any minor or major increments removed
-from consideration, so the most they can move is up to 1.4.4 and 2.0.4.
+from consideration because of the `-s` strict flag, so the most they can
+move is up to 1.4.4 and 2.0.4.
 
 In case 6, the prefer minimal switch `-p` means they only increment to the
 next available release.
@@ -178,8 +180,8 @@ logic to the resolution process to achieve its goals. If there's a bug
 involved, it's almost certainly in the `bundler-patch` code as Bundler has
 been around a long time and has thorough testing and real world experience.
 
-In particular, grep for 'Unwinding for conflict' to isolate some key issues
-that may be preventing the outcome you expect.
+In particular, grep for 'Unwinding for conflict' in the debug output to
+isolate some key issues that may be preventing the outcome you expect.
 
 `bundler-patch` can dump its own debug output, potentially helpful, with
 `DEBUG_PATCH_RESOLVER`.
@@ -188,6 +190,10 @@ To get additional Bundler debugging output, enable the `DEBUG` env variable.
 This will include all of the details of the downloading the full dependency
 data from remote sources.
 
+At the end of all of this though, the requirements in the Gemfile trump
+anything else, and the most control you have is by modifying those in the
+Gemfile.
+
 
 ## Development
 

data/lib/bundler/patch/advisory_consolidator.rb

@@ -11,7 +11,7 @@ module Bundler::Patch
     def vulnerable_gems
       @all_ads.map do |ads|
         ads.update if ads.repo
-        Bundler::Advise::GemAdviser.new(advisories: ads).scan_lockfile
+        File.exist?(Bundler.default_lockfile) ? Bundler::Advise::GemAdviser.new(advisories: ads).scan_lockfile : []
       end.flatten.map do |advisory|
         patched = advisory.patched_versions.map do |pv|
           # this is a little stupid for compound requirements, but works itself out in consolidate_gemfiles
@@ -27,7 +27,8 @@ module Bundler::Patch
 
     def patch_gemfile_and_get_gem_specs_to_patch
       gem_update_specs = vulnerable_gems
-      locked = Bundler::LockfileParser.new(Bundler.read_file(Bundler.default_lockfile)).specs
+      locked = File.exist?(Bundler.default_lockfile) ?
+        Bundler::LockfileParser.new(Bundler.read_file(Bundler.default_lockfile)).specs : []
 
       gem_update_specs.map(&:update) # modify requirements in Gemfile if necessary
 

data/lib/bundler/patch/cli.rb

@@ -12,6 +12,8 @@ module Bundler::Patch
         on '-l', '--list', 'List vulnerable gems and new version target. No updates will be performed.'
         on '-v', '--vulnerable_gems_only', 'Only update vulnerable gems.'
         on '-a=', '--advisory_db_path=', 'Optional custom advisory db path. `gems` dir will be appended to this path.'
+        on '-r', '--ruby', 'Update Ruby version in related files.'
+        on '--rubies=', 'Supported Ruby versions. Comma delimited or multiple switches.', as: Array, delimiter: ','
         on '-h', 'Show this help'
         on '--help', 'Show README.md'
       end
@@ -45,20 +47,13 @@ module Bundler::Patch
 
       return list(options) if options[:list]
 
-      _patch(options)
+      patch_ruby(options[:rubies]) if options[:ruby]
+
+      patch_gems(options)
     end
 
     private
 
-    def conservative_update(gem_patches, options={}, bundler_def=nil)
-      prep = DefinitionPrep.new(bundler_def, gem_patches, options).tap { |p| p.prep }
-
-      # update => true is very important, otherwise without any Gemfile changes, the installer
-      # may end up concluding everything can be resolved locally, nothing is changing,
-      # and then nothing is done. lib/bundler/cli/update.rb also hard-codes this.
-      Bundler::Installer.install(Bundler.root, prep.bundler_def, {'update' => true})
-    end
-
     def list(options)
       gem_patches = AdvisoryConsolidator.new(options).vulnerable_gems
 
@@ -72,7 +67,11 @@ module Bundler::Patch
       end
     end
 
-    def _patch(options)
+    def patch_ruby(supported)
+      RubyVersion.new(patched_versions: supported).update
+    end
+
+    def patch_gems(options)
       vulnerable_patches = AdvisoryConsolidator.new(options).patch_gemfile_and_get_gem_specs_to_patch
       requested_patches = (options.delete(:gems_to_update) || []).map { |gem_name| GemPatch.new(gem_name: gem_name) }
 
@@ -104,6 +103,15 @@ module Bundler::Patch
       end
       conservative_update(all_gem_patches, options)
     end
+
+    def conservative_update(gem_patches, options={}, bundler_def=nil)
+      prep = DefinitionPrep.new(bundler_def, gem_patches, options).tap { |p| p.prep }
+
+      # update => true is very important, otherwise without any Gemfile changes, the installer
+      # may end up concluding everything can be resolved locally, nothing is changing,
+      # and then nothing is done. lib/bundler/cli/update.rb also hard-codes this.
+      Bundler::Installer.install(Bundler.root, prep.bundler_def, {'update' => true})
+    end
   end
 end
 

data/lib/bundler/patch/conservative_resolver.rb

@@ -3,7 +3,7 @@ module Bundler::Patch
     attr_accessor :locked_specs, :gems_to_update, :strict, :minor_preferred, :prefer_minimal
 
     def initialize(index, source_requirements, base)
-      # hack for 1.10 and 1.11 support
+      # hack for 1.10 and 1.11+ support
       case Bundler::Resolver.instance_method(:initialize).arity
       when 3
         super(index, source_requirements, base)
@@ -17,7 +17,7 @@ module Bundler::Patch
 
       dep = dependency.dep unless dependency.is_a? Gem::Dependency
 
-      STDERR.puts "super search_for: #{debug_format_result(dep, res).inspect}" if ENV['DEBUG_RESOLVER']
+      super_result = "super search_for: #{debug_format_result(dep, res).inspect}"
 
       @conservative_search_for ||= {}
       res = @conservative_search_for[dep] ||= begin
@@ -29,8 +29,11 @@ module Bundler::Patch
 
         (@strict ?
           filter_specs(res, locked_spec) :
-          sort_specs(res, locked_spec)).tap do |res|
-          STDERR.puts "after search_for: #{debug_format_result(dep, res).inspect}" if ENV['DEBUG_PATCH_RESOLVER']
+          sort_specs(res, locked_spec)).tap do |result|
+          if ENV['DEBUG_PATCH_RESOLVER']
+            STDERR.puts super_result
+            STDERR.puts "after search_for: #{debug_format_result(dep, result).inspect}"
+          end
         end
       end
 

data/lib/bundler/patch/ruby_version.rb

@@ -3,7 +3,7 @@ module Bundler::Patch
     def self.files
       {
         '.ruby-version' => [/.*/],
-        '.jenkins.xml' => [/\<string\>(.*)\<\/string\>/, /rvm.*\>ruby-(.*)@/, /version.*rbenv.*\>(.*)\</]
+        'Gemfile' => [/ruby\s+["'](.*)['"]/]
       }
     end
 

data/lib/bundler/patch/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Patch
-    VERSION = '0.7.2'
+    VERSION = '0.8.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bundler-patch
 version: !ruby/object:Gem::Version
-  version: 0.7.2
+  version: 0.8.0
 platform: ruby
 authors:
 - chrismo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-29 00:00:00.000000000 Z
+date: 2016-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-advise