bundler 1.13.0.rc.1 → 1.13.0.rc.2

data/lib/bundler/cli/update.rb

@@ -10,6 +10,8 @@ module Bundler
     def run
       Bundler.ui.level = "error" if options[:quiet]
 
+      Plugin.gemfile_install(Bundler.default_gemfile) if Bundler.settings[:plugins]
+
       sources = Array(options[:source])
       groups  = Array(options[:group]).map(&:to_sym)
 
@@ -37,6 +39,13 @@ module Bundler
         Bundler.definition(:gems => gems, :sources => sources, :ruby => options[:ruby])
       end
 
+      patch_level = [:major, :minor, :patch].select {|v| options.keys.include?(v.to_s) }
+      raise ProductionError, "Provide only one of the following options: #{patch_level.join(", ")}" unless patch_level.length <= 1
+      Bundler.definition.gem_version_promoter.tap do |gvp|
+        gvp.level = patch_level.first || :major
+        gvp.strict = options[:strict]
+      end
+
       Bundler::Fetcher.disable_endpoint = options["full-index"]
 
       opts = options.dup

data/lib/bundler/definition.rb

@@ -7,7 +7,15 @@ module Bundler
   class Definition
     include GemHelpers
 
-    attr_reader :dependencies, :platforms, :ruby_version, :locked_deps
+    attr_reader(
+      :dependencies,
+      :gem_version_promoter,
+      :locked_deps,
+      :locked_gems,
+      :platforms,
+      :requires,
+      :ruby_version
+    )
 
     # Given a gemfile and lockfile creates a Bundler definition
     #
@@ -60,15 +68,15 @@ module Bundler
 
       if lockfile && File.exist?(lockfile)
         @lockfile_contents = Bundler.read_file(lockfile)
-        locked = LockfileParser.new(@lockfile_contents)
-        @platforms = locked.platforms
-        @locked_bundler_version = locked.bundler_version
-        @locked_ruby_version = locked.ruby_version
+        @locked_gems = LockfileParser.new(@lockfile_contents)
+        @platforms = @locked_gems.platforms
+        @locked_bundler_version = @locked_gems.bundler_version
+        @locked_ruby_version = @locked_gems.ruby_version
 
         if unlock != true
-          @locked_deps    = locked.dependencies
-          @locked_specs   = SpecSet.new(locked.specs)
-          @locked_sources = locked.sources
+          @locked_deps    = @locked_gems.dependencies
+          @locked_specs   = SpecSet.new(@locked_gems.specs)
+          @locked_sources = @locked_gems.sources
         else
           @unlock         = {}
           @locked_deps    = []
@@ -78,6 +86,7 @@ module Bundler
       else
         @unlock         = {}
         @platforms      = []
+        @locked_gems    = nil
         @locked_deps    = []
         @locked_specs   = SpecSet.new([])
         @locked_sources = []
@@ -94,6 +103,8 @@ module Bundler
       end
       @unlocking ||= @unlock[:ruby] ||= (!@locked_ruby_version ^ !@ruby_version)
 
+      @gem_version_promoter = create_gem_version_promoter
+
       current_platform = Bundler.rubygems.platforms.map {|p| generic(p) }.compact.last
       add_platform(current_platform)
 
@@ -105,6 +116,8 @@ module Bundler
       @dependency_changes = converge_dependencies
       @local_changes = converge_locals
 
+      @requires = compute_requires
+
       fixup_dependency_types!
     end
 
@@ -123,6 +136,21 @@ module Bundler
       end
     end
 
+    def create_gem_version_promoter
+      locked_specs = begin
+        if @unlocking && @locked_specs.empty? && !@lockfile_contents.empty?
+          # Definition uses an empty set of locked_specs to indicate all gems
+          # are unlocked, but GemVersionPromoter needs the locked_specs
+          # for conservative comparison.
+          locked = Bundler::LockfileParser.new(@lockfile_contents)
+          Bundler::SpecSet.new(locked.specs)
+        else
+          @locked_specs
+        end
+      end
+      GemVersionPromoter.new(locked_specs, @unlock[:gems])
+    end
+
     def resolve_with_cache!
       raise "Specs already loaded" if @specs
       sources.cached!
@@ -198,7 +226,7 @@ module Bundler
     end
 
     def current_dependencies
-      dependencies.reject {|d| !d.should_include? }
+      dependencies.select(&:should_include?)
     end
 
     def specs_for(groups)
@@ -221,7 +249,7 @@ module Bundler
         else
           # Run a resolve against the locally available gems
           Bundler.ui.debug("Found changes from the lockfile, re-resolving dependencies because #{change_reason}")
-          last_resolve.merge Resolver.resolve(expanded_dependencies, index, source_requirements, last_resolve, ruby_version)
+          last_resolve.merge Resolver.resolve(expanded_dependencies, index, source_requirements, last_resolve, ruby_version, gem_version_promoter, additional_base_requirements_for_resolve)
         end
       end
     end
@@ -453,6 +481,11 @@ module Bundler
       @platforms |= [platform]
     end
 
+    def remove_platform(platform)
+      return if @platforms.delete(Gem::Platform.new(platform))
+      raise InvalidOption, "Unable to remove the platform `#{platform}` since the only platforms are #{@platforms.join ", "}"
+    end
+
     attr_reader :sources
     private :sources
 
@@ -493,14 +526,14 @@ module Bundler
     # Check if the specs of the given source changed
     # according to the locked source.
     def specs_changed?(source)
-      locked = @locked_sources.find(source)
+      locked = @locked_sources.find {|s| s == source }
 
-      !locked || dependencies_for_source_changed?(source) || specs_for_source_changed?(source)
+      !locked || dependencies_for_source_changed?(source, locked) || specs_for_source_changed?(source)
     end
 
-    def dependencies_for_source_changed?(source)
+    def dependencies_for_source_changed?(source, locked_source = source)
       deps_for_source = @dependencies.select {|s| s.source == source }
-      locked_deps_for_source = @locked_deps.select {|s| s.source == source }
+      locked_deps_for_source = @locked_deps.select {|s| s.source == locked_source }
 
       Set.new(deps_for_source) != Set.new(locked_deps_for_source)
     end
@@ -527,9 +560,10 @@ module Bundler
         end
       end
 
-      locals.any? do |source, changed|
+      sources_with_changes = locals.select do |source, changed|
         changed || specs_changed?(source)
-      end
+      end.map(&:first)
+      !sources_with_changes.each {|source| @unlock[:sources] << source.name }.empty?
     end
 
     def converge_paths
@@ -538,9 +572,22 @@ module Bundler
       end
     end
 
+    def converge_path_source_to_gemspec_source(source)
+      return source unless source.instance_of?(Source::Path)
+      gemspec_source = sources.path_sources.find {|s| s.is_a?(Source::Gemspec) && s.as_path_source == source }
+      gemspec_source || source
+    end
+
     def converge_sources
       changes = false
 
+      @locked_sources.map! do |source|
+        converge_path_source_to_gemspec_source(source)
+      end
+      @locked_specs.each do |spec|
+        spec.source &&= converge_path_source_to_gemspec_source(spec.source)
+      end
+
       # Get the Rubygems sources from the Gemfile.lock
       locked_gem_sources = @locked_sources.select {|s| s.is_a?(Source::Rubygems) }
       # Get the Rubygems remotes from the Gemfile
@@ -585,6 +632,9 @@ module Bundler
         elsif dep.source
           dep.source = sources.get(dep.source)
         end
+        if dep.source.is_a?(Source::Gemspec)
+          dep.platforms.concat(@platforms.map {|p| Dependency::REVERSE_PLATFORM_MAP[p] }.flatten(1)).uniq!
+        end
       end
       Set.new(@dependencies) != Set.new(@locked_deps)
     end
@@ -636,7 +686,7 @@ module Bundler
         # then we unlock it.
 
         # Path sources have special logic
-        if s.source.instance_of?(Source::Path)
+        if s.source.instance_of?(Source::Path) || s.source.instance_of?(Source::Gemspec)
           other = s.source.specs[s].first
 
           # If the spec is no longer in the path source, unlock it. This
@@ -751,5 +801,24 @@ module Bundler
       # to an array. The first element will be the gem name (e.g. foo), the second will be the version number.
       error.message.scan(/Could not find (\w+)-(\d+(?:\.\d+)+)/).flatten
     end
+
+    def compute_requires
+      dependencies.reduce({}) do |requires, dep|
+        next requires unless dep.should_include?
+        requires[dep.name] = Array(dep.autorequire || dep.name).map do |file|
+          # Allow `require: true` as an alias for `require: <name>`
+          file == true ? dep.name : file
+        end
+        requires
+      end
+    end
+
+    def additional_base_requirements_for_resolve
+      return [] unless @locked_gems && Bundler.settings[:only_update_to_newer_versions]
+      @locked_gems.specs.reduce({}) do |requirements, locked_spec|
+        requirements[locked_spec.name] = Gem::Dependency.new(locked_spec.name, ">= #{locked_spec.version}")
+        requirements
+      end.values
+    end
   end
 end

data/lib/bundler/deployment.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+
+require "bundler/shared_helpers"
+Bundler::SharedHelpers.major_deprecation "Bundler no longer integrates with " \
+  "Capistrano, but Capistrano provides its own integration with " \
+  "Bundler via the capistrano-bundler gem. Use it instead."
+
 module Bundler
   class Deployment
     def self.define_task(context, task_method = :task, opts = {})

data/lib/bundler/dsl.rb

@@ -38,7 +38,7 @@ module Bundler
       original_gemfile = @gemfile
       @gemfile = expanded_gemfile_path
       contents ||= Bundler.read_file(gemfile.to_s)
-      instance_eval(contents, gemfile.to_s, 1)
+      instance_eval(contents.dup.untaint, gemfile.to_s, 1)
     rescue Exception => e
       message = "There was an error " \
         "#{e.is_a?(GemfileEvalError) ? "evaluating" : "parsing"} " \
@@ -50,22 +50,22 @@ module Bundler
     end
 
     def gemspec(opts = nil)
-      path              = opts && opts[:path] || "."
-      glob              = opts && opts[:glob]
-      name              = opts && opts[:name] || "{,*}"
-      development_group = opts && opts[:development_group] || :development
+      opts ||= {}
+      path              = opts[:path] || "."
+      glob              = opts[:glob]
+      name              = opts[:name]
+      development_group = opts[:development_group] || :development
       expanded_path     = gemfile_root.join(path)
 
-      gemspecs = Dir[File.join(expanded_path, "#{name}.gemspec")]
+      gemspecs = Dir[File.join(expanded_path, "{,*}.gemspec")].map {|g| Bundler.load_gemspec(g) }.compact
+      gemspecs.reject! {|s| s.name != name } if name
+      Index.sort_specs(gemspecs)
+      specs_by_name_and_version = gemspecs.group_by {|s| [s.name, s.version] }
 
-      case gemspecs.size
+      case specs_by_name_and_version.size
       when 1
-        spec = Bundler.load_gemspec(gemspecs.first)
-
-        unless spec
-          raise InvalidOption, "There was an error loading the gemspec at " \
-            "#{file}. Make sure you can build the gem, then try again"
-        end
+        specs = specs_by_name_and_version.values.first
+        spec = specs.find {|s| s.match_platform(Gem::Platform.local) } || specs.first
 
         @gemspecs << spec
 
@@ -74,7 +74,7 @@ module Bundler
 
         group(development_group) do
           spec.development_dependencies.each do |dep|
-            gem dep.name, *(dep.requirement.as_list + [:type => :development, :platforms => gem_platforms])
+            gem dep.name, *(dep.requirement.as_list + [:type => :development])
           end
         end
       when 0
@@ -125,11 +125,26 @@ module Bundler
       @dependencies << dep
     end
 
-    def source(source, &blk)
-      source = normalize_source(source)
-      if block_given?
+    def source(source, *args, &blk)
+      options = args.last.is_a?(Hash) ? args.pop.dup : {}
+      options = normalize_hash(options)
+      if options.key?("type")
+        options["type"] = options["type"].to_s
+        unless Plugin.source?(options["type"])
+          raise "No sources available for #{options["type"]}"
+        end
+
+        unless block_given?
+          raise InvalidOption, "You need to pass a block to #source with :type option"
+        end
+
+        source_opts = options.merge("uri" => source)
+        with_source(@sources.add_plugin_source(options["type"], source_opts), &blk)
+      elsif block_given?
+        source = normalize_source(source)
         with_source(@sources.add_rubygems_source("remotes" => source), &blk)
       else
+        source = normalize_source(source)
         check_primary_source_safety(@sources)
         @sources.add_rubygems_remote(source)
       end
@@ -250,13 +265,25 @@ module Bundler
         #     "https://github.com/#{repo_name}.git"
         #   end
         repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
-        "git://github.com/#{repo_name}.git"
+        # TODO: 2.0 upgrade this setting to the default
+        if Bundler.settings["github.https"]
+          "https://github.com/#{repo_name}.git"
+        else
+          warn_github_source_change(repo_name)
+          "git://github.com/#{repo_name}.git"
+        end
       end
 
-      git_source(:gist) {|repo_name| "https://gist.github.com/#{repo_name}.git" }
+      # TODO: 2.0 remove this deprecated git source
+      git_source(:gist) do |repo_name|
+        warn_deprecated_git_source(:gist, 'https://gist.github.com/#{repo_name}.git')
+        "https://gist.github.com/#{repo_name}.git"
+      end
 
+      # TODO: 2.0 remove this deprecated git source
       git_source(:bitbucket) do |repo_name|
         user_name, repo_name = repo_name.split "/"
+        warn_deprecated_git_source(:bitbucket, 'https://#{user_name}@bitbucket.org/#{user_name}/#{repo_name}.git')
         repo_name ||= user_name
         "https://#{user_name}@bitbucket.org/#{user_name}/#{repo_name}.git"
       end
@@ -388,13 +415,14 @@ module Bundler
     def check_primary_source_safety(source)
       return unless source.rubygems_primary_remotes.any?
 
+      # TODO: 2.0 upgrade from setting to default
       if Bundler.settings[:disable_multisource]
-        raise GemspecError, "Warning: this Gemfile contains multiple primary sources. " \
+        raise GemfileError, "Warning: this Gemfile contains multiple primary sources. " \
           "Each source after the first must include a block to indicate which gems " \
           "should come from that source. To downgrade this error to a warning, run " \
           "`bundle config --delete disable_multisource`"
       else
-        Bundler.ui.warn "Warning: this Gemfile contains multiple primary sources. " \
+        Bundler::SharedHelpers.major_deprecation "Your Gemfile contains multiple primary sources. " \
           "Using `source` more than once without a block is a security risk, and " \
           "may result in installing unexpected gems. To resolve this warning, use " \
           "a block to indicate which gems should come from the secondary source. " \
@@ -403,6 +431,23 @@ module Bundler
       end
     end
 
+    def warn_github_source_change(repo_name)
+      # TODO: 2.0 remove deprecation
+      Bundler::SharedHelpers.major_deprecation "The :github option uses the git: protocol, which is not secure. " \
+        "Bundler 2.0 will use the https: protocol, which is secure. Enable this change now by " \
+        "running `bundle config github.https true`."
+    end
+
+    def warn_deprecated_git_source(name, repo_string)
+      # TODO: 2.0 remove deprecation
+      Bundler::SharedHelpers.major_deprecation <<-EOS
+The :#{name} git source is deprecated, and will be removed in Bundler 2.0. Add this code to your Gemfile to ensure it continues to work:
+    git_source(:#{name}) do |repo_name|
+      "#{repo_string}"
+    end
+      EOS
+    end
+
     class DSLError < GemfileError
       # @return [String] the description that should be presented to the user.
       #
@@ -477,7 +522,7 @@ module Bundler
 
           lines      = contents.lines.to_a
           indent     = " #  "
-          indicator  = indent.tr('#', ">")
+          indicator  = indent.tr("#", ">")
           first_line = (line_numer.zero?)
           last_line  = (line_numer == (lines.count - 1))
 

data/lib/bundler/env.rb

@@ -75,7 +75,7 @@ module Bundler
     end
 
     def git_version
-      Bundler::Source::Git::GitProxy.new(nil, nil, nil).version
+      Bundler::Source::Git::GitProxy.new(nil, nil, nil).full_version
     rescue Bundler::Source::Git::GitNotInstalledError
       "not installed"
     end

data/lib/bundler/environment_preserver.rb

@@ -6,7 +6,7 @@ module Bundler
     def initialize(env, keys)
       @original = env.to_hash
       @keys = keys
-      @prefix = "BUNDLE_ORIG_"
+      @prefix = "BUNDLER_ORIG_"
     end
 
     # @return [Hash]

data/lib/bundler/errors.rb

@@ -3,6 +3,16 @@ module Bundler
   class BundlerError < StandardError
     def self.status_code(code)
       define_method(:status_code) { code }
+      if match = BundlerError.all_errors.find {|_k, v| v == code }
+        error, _ = match
+        raise ArgumentError,
+          "Trying to register #{self} for status code #{code} but #{error} is already registered"
+      end
+      BundlerError.all_errors[self] = code
+    end
+
+    def self.all_errors
+      @all_errors ||= {}
     end
   end
 
@@ -41,7 +51,7 @@ module Bundler
   class LockfileError < BundlerError; status_code(20); end
   class CyclicDependencyError < BundlerError; status_code(21); end
   class GemfileLockNotFound < BundlerError; status_code(22); end
-  class PluginError < BundlerError; status_code(23); end
+  class PluginError < BundlerError; status_code(29); end
   class GemfileEvalError < GemfileError; end
   class MarshalError < StandardError; end
 

data/lib/bundler/fetcher.rb

@@ -131,10 +131,10 @@ module Bundler
         @use_api = false if fetchers.none?(&:api_fetcher?)
       end
 
-      specs.each do |name, version, platform, dependencies|
+      specs.each do |name, version, platform, dependencies, metadata|
         next if name == "bundler"
         spec = if dependencies
-          EndpointSpecification.new(name, version, platform, dependencies)
+          EndpointSpecification.new(name, version, platform, dependencies, metadata)
         else
           RemoteSpecification.new(name, version, platform, self)
         end
@@ -255,6 +255,7 @@ module Bundler
         end
 
         con.read_timeout = Fetcher.api_timeout
+        con.open_timeout = Fetcher.api_timeout
         con.override_headers["User-Agent"] = user_agent
         con.override_headers["X-Gemfile-Source"] = @remote.original_uri.to_s if @remote.original_uri
         con