bundler-resolutions 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25173fc2b7df9fe3efd07150e315f38c6584199627bef4ea1ec44ec44e3fbb2d
-  data.tar.gz: 7728a62a42e3c9244932cb568e6a918d745a2bf9003f61d62bfb6402061610df
+  metadata.gz: 7a6def9961c77861086b6b58177a934945938362e2125ba5dc49b8a6c06efdff
+  data.tar.gz: ccef554f38761f9916843d675f70ef7189ef8a7070bdb3d9b2e466e2eed998de
 SHA512:
-  metadata.gz: dc87f9b2c8feea662f00ef0a7340aae3355c7b3e10864fb70214c970d600d7602e19745eb6882886b5fd84726371ce9caf2ef67ee5e8ff5e9b0f451ee3c4a2fc
-  data.tar.gz: 741b9f3f5b10ad0a896b0776a0d4807f6eef446e5941554f6b95c6530f0df99e4cfc50223f848f4371639abc1e0912b9c7f8ef9b440b22b1841e12fd6c8a7f59
+  metadata.gz: '01507905d1b9402c1efc92f9509b5aeef2b858d18c3b3e8555af937e1b479dc4b2711f87eed3ef87b8d64bfb7285bb299322a5925d43013e6dac6afa2128b5ba'
+  data.tar.gz: c85660a42a9149ffcded4f649ef8b2d9413da63eb435d9c8231be3fcdf26dc6aebea0a6608bd1206298ac3caf47b01681a573cecc4e92b0dc3b6638a893b219d

data/README.md

@@ -53,6 +53,24 @@ gem 'bundler-resolutions'
 gem "thor"
 ```
 
+## Config file
+
+The config file is a YAML file with a `gems` key that contains a mapping of gem names to version
+requirements. The version requirements are the same as those used in the `Gemfile`.
+
+Example:
+
+```yaml
+gems:
+  nokogiri: ">= 1.16.5" # CVE-2024-34459
+  thor: ">= 1.0.1, < 2.0"
+```
+
+By default, `bundler-resolutions` will look for a file named `.bundler-resolutions.yml` in the
+current directory, or the parent, and continue looking up to the root dir.
+
+You can also specify a file location by setting the `BUNDLER_RESOLUTIONS_CONFIG` ENV var.
+
 ## Detail
 
 `bundler-resolutions` allows you to specify version requirements in a config file 

data/lib/bundler/resolutions/config.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Bundler
+  class Resolutions
+    class Config
+      CONFIG_FILE_NAME = ".bundler-resolutions.yml"
+
+      class << self
+        def load_config(config = nil)
+          raw_hash = if config.is_a?(Hash)
+                       config
+                     else
+                       YAML.safe_load_file(find_config(config))
+                     end
+          gems = raw_hash.fetch("gems")
+          gems.transform_values { |version| Gem::Requirement.new(version.split(",")) }
+        end
+
+        private def find_config(config = nil)
+          return config if config # If present, assume it is a location
+
+          # Use the ENV if present
+          env_file = ENV["BUNDLER_RESOLUTIONS_CONFIG"]
+          return env_file if env_file
+
+          # Otherwise find it in the file tree
+          dir = Dir.pwd
+          until File.exist?(File.join(dir, CONFIG_FILE_NAME))
+            dir = File.dirname(dir)
+            raise "Could not find #{CONFIG_FILE_NAME}" if dir == "/"
+          end
+          File.join(dir, CONFIG_FILE_NAME)
+        end
+      end
+    end
+  end
+end

data/lib/bundler/resolutions/version.rb

@@ -4,6 +4,6 @@ require_relative "../resolutions"
 
 module Bundler
   class Resolutions
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/bundler/resolutions.rb

@@ -1,15 +1,16 @@
 # frozen_string_literal: true
 
 require "yaml"
+require_relative "resolutions/config"
 
 module Bundler
   class Resolutions
-    CONFIG_FILE_NAME = ".bundler-resolutions.yml"
+    DEFAULT_GEM_REQUIREMENT = Gem::Requirement.default
 
-    attr_reader :resolutions
+    attr_reader :config
 
     def initialize(config = nil)
-      load_config(config)
+      @config = Bundler::Resolutions::Config.load_config(config)
     end
 
     class << self
@@ -19,7 +20,14 @@ module Bundler
     end
 
     # A module we prepend to Bundler::Resolutions::Resolver
+    # :reek:ModuleInitialize
     module Resolver
+      # Override the initializer in the resolver
+      def initialize(*args)
+        Bundler::Resolutions.instance.add_concrete_resolutions_for(args.first)
+        super
+      end
+
       # This overrides the default behaviour of the resolver to filter out versions that don't
       # satisfy the requirements specified in .bundler-resolutions.yml.
       def filtered_versions_for(package)
@@ -29,11 +37,9 @@ module Bundler
 
     def constrain_versions_for(results, package)
       results.select do |pkg|
-        req = resolutions[package.name]
+        req = resolutions_for(package.name)
         if req
-          if ENV["BUNDLER_RESOLUTIONS_DEBUG"] == "true"
-            puts "bundler-resolutions making sure #{package} is satisfied by #{req}"
-          end
+          log("making sure #{package} is satisfied by #{req}")
           req.satisfied_by?(pkg.version)
         else
           true
@@ -41,33 +47,66 @@ module Bundler
       end
     end
 
-    private def load_config(config = nil)
-      # Safe load yaml file whose location is given by an argument, an ENV, and if no
-      # env given then work up dir hierarchy until found.
-      # The file should be called .bundler-resolutions.yml
-      raw_hash = if config.is_a?(Hash)
-                   config
-                 else
-                   YAML.safe_load_file(find_config(config))
-                 end
-      gems = raw_hash.fetch("gems")
-      @resolutions = gems.transform_values { |version| Gem::Requirement.new(version.split(",")) }
+    def add_concrete_resolutions_for(base)
+      base.requirements.each do |bundler_dependency|
+        requirement_name = bundler_dependency.name
+        resolutions = resolutions_for(requirement_name)
+
+        if resolutions
+          log(<<~MSG, requirement_name)
+            has resolutions for concrete dependency '#{requirement_name}': #{resolutions}
+          MSG
+        else
+          log("has no resolutions for concrete dependency '#{requirement_name}'", requirement_name)
+          next
+        end
+
+        bundler_resolutions_reqs = resolutions.requirements
+        apply_resolutions_for_concrete_gem(bundler_dependency, bundler_resolutions_reqs)
+      end
     end
 
-    private def find_config(config = nil)
-      return config if config # If present, assume it is a location
+    private def resolutions_for(package_name)
+      config[package_name]
+    end
+
+    # You can debug with BUNDLER_RESOLUTIONS_DEBUG=gem_name or BUNDLER_RESOLUTIONS_DEBUG=true
+    # to see all messages.
+    private def log(message, gem = nil)
+      return unless ENV["BUNDLER_RESOLUTIONS_DEBUG"]
+      return if gem && !ENV["BUNDLER_RESOLUTIONS_DEBUG"].split(",").include?(gem)
+
+      puts "bundler-resolutions: #{message}"
+    end
+
+    private def apply_resolutions_for_concrete_gem(bundler_dependency, bundler_resolutions_reqs)
+      requirement_name = bundler_dependency.name
+      bundler_resolutions_reqs.each do |r|
+        # If the concrete requirement is already in the Gemfile, skip it
+        requirements = bundler_dependency.requirement.requirements
+        if requirements.include?(r)
+          # We don't want to double up / dupe the same requirements
+          log(<<~MSG, requirement_name)
+            Skipping adding requirements to gem concretely specified in Gemfile as it
+            was already present: #{requirement_name}: #{bundler_dependency}
+          MSG
+          next
+        end
 
-      # Use the ENV if present
-      env_file = ENV["BUNDLER_RESOLUTIONS_CONFIG"]
-      return env_file if env_file
+        # Otherwise add the additional requirement
+        before_req = bundler_dependency.to_s
+        # If there were no requirements before, there is a default one for ">= 0". We need to
+        # remove that so when we add the new one the implicit ">= 0" is not present, as it normally
+        # isn't written out to lockfiles.
+        requirements.clear if bundler_dependency.requirement == DEFAULT_GEM_REQUIREMENT
+        # Add the new requirement
+        requirements << r
+        after_req = bundler_dependency.to_s
 
-      # Otherwise find it in the file tree
-      dir = Dir.pwd
-      until File.exist?(File.join(dir, CONFIG_FILE_NAME))
-        dir = File.dirname(dir)
-        raise "Could not find #{CONFIG_FILE_NAME}" if dir == "/"
+        log(<<~MSG, requirement_name)
+          Adding concrete constraints for #{requirement_name}. Before: #{before_req}. After: #{after_req}.
+        MSG
       end
-      File.join(dir, CONFIG_FILE_NAME)
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bundler-resolutions
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Harry Lascelles
 bindir: bin
 cert_chain: []
-date: 2025-03-23 00:00:00.000000000 Z
+date: 2025-05-03 00:00:00.000000000 Z
 dependencies: []
 description: A bundler plugin to enforce resolutions without specifying a concrete
   dependency
@@ -19,6 +19,7 @@ extra_rdoc_files: []
 files:
 - README.md
 - lib/bundler/resolutions.rb
+- lib/bundler/resolutions/config.rb
 - lib/bundler/resolutions/version.rb
 - plugins.rb
 homepage: https://github.com/hlascelles/bundler-resolutions
@@ -38,7 +39,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="