dependabot-bundler 0.118.14 → 0.119.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf0c2e5d5e9b812a8867099e01722ff07bafd24aa38546ab8ba3624413407ab3
-  data.tar.gz: 93b728f0b7f563ec01ce7dd687ef6704c43c9c32b358292c26ccb86f5c52034b
+  metadata.gz: f919e2701e7212b322c404cbaad0bd3f4e956701a24061e5f5221119b72dcb55
+  data.tar.gz: f25342c61a6084654e8430342b0cb1b2d9c24daa9e4dc6dff00611623edf95cb
 SHA512:
-  metadata.gz: dde0403ef4aae7a13ee512cd6d57ee49718a62636387a31f5125ff39866e38ddee05996b9fb9c95fe67d608e2a6176cc6f98737550968b17ab0497d20ab9b8be
-  data.tar.gz: a2053d2f187fee45cde6ae86cd5fa0db131316c4922a727370e1a3a49f4cfaf9072895839158863bc1a3c6aada7bed54eaed55130a694e409a8c42d66f81a731
+  metadata.gz: f3e907de666befff04da6cf7114d3466bd44fdb5617da3566ed3f941aa0853b8894783b83c9c61e2f445b8db5bf3604d39babcf9f662b04ea0c7a866fcd9d25c
+  data.tar.gz: 624ca9a38656e9d9c6e1bc53b7affd15aef79fc9498694d6eff4a9885e9cae836d2826dd717f12ce3d9b49bdf78c715a5e2fa4c48e0ccbb7655350e5b6dc85e6

data/lib/dependabot/bundler/file_parser.rb

@@ -118,7 +118,8 @@ module Dependabot
 
       def parsed_gemfile
         @parsed_gemfile ||=
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do
@@ -150,7 +151,8 @@ module Dependabot
       def parsed_gemspec(file)
         @parsed_gemspecs ||= {}
         @parsed_gemspecs[file.name] ||=
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             [file, *imported_ruby_files].each do |f|
               path = f.name
               FileUtils.mkdir_p(Pathname.new(path).dirname)

data/lib/dependabot/bundler/file_updater.rb

@@ -51,11 +51,94 @@ module Dependabot
         end
 
         check_updated_files(updated_files)
+
+        base_dir = updated_files.first.directory
+        updated_vendor_cache_files(base_directory: base_dir).each do |file|
+          updated_files << file
+        end
+
         updated_files
       end
 
       private
 
+      # Dynamically fetch the vendor cache folder from bundler
+      def vendor_cache_dir
+        return @vendor_cache_dir if defined?(@vendor_cache_dir)
+
+        @vendor_cache_dir =
+          SharedHelpers.in_a_forked_process do
+            # Set the path for path gemspec correctly
+            ::Bundler.instance_variable_set(:@root, repo_contents_path)
+            ::Bundler.app_cache
+          end
+      end
+
+      # Returns changed files in the vendor/cache folder
+      #
+      # @param base_directory [String] Update config base directory
+      # @return [Array<Dependabot::DependencyFile>]
+      def updated_vendor_cache_files(base_directory:)
+        return [] unless repo_contents_path && vendor_cache_dir
+
+        Dir.chdir(repo_contents_path) do
+          relative_dir = vendor_cache_dir.sub("#{repo_contents_path}/", "")
+          status = SharedHelpers.run_shell_command(
+            "git status --untracked-files=all --porcelain=v1 #{relative_dir}"
+          )
+          changed_paths = status.split("\n").map { |l| l.split(" ") }
+          changed_paths.map do |type, path|
+            deleted = type == "D"
+            encoding = ""
+            encoded_content = File.read(path) unless deleted
+            if binary_file?(path)
+              encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
+              encoded_content = Base64.encode64(encoded_content) unless deleted
+            end
+            Dependabot::DependencyFile.new(
+              name: path,
+              content: encoded_content,
+              directory: base_directory,
+              deleted: deleted,
+              content_encoding: encoding
+            )
+          end
+        end
+      end
+
+      # notable filenames without a reliable extension:
+      TEXT_FILE_NAMES = [
+        "Gemfile",
+        "Gemfile.lock",
+        ".bundlecache",
+        ".gitignore"
+      ].freeze
+
+      TEXT_FILE_EXTS = [
+        # code
+        ".rb",
+        ".erb",
+        ".gemspec",
+        ".js",
+        ".html",
+        # config
+        ".json",
+        ".xml",
+        ".toml",
+        ".yaml",
+        ".yml",
+        # docs
+        ".md",
+        ".txt"
+      ].freeze
+
+      def binary_file?(path)
+        return false if TEXT_FILE_NAMES.include?(File.basename(path))
+        return false if TEXT_FILE_EXTS.include?(File.extname(path))
+
+        true
+      end
+
       def check_required_files
         file_names = dependency_files.map(&:name)
 
@@ -116,6 +199,7 @@ module Dependabot
           LockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
+            repo_contents_path: repo_contents_path,
             credentials: credentials
           ).updated_lockfile_content
       end

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -13,6 +13,7 @@ require "dependabot/git_commit_checker"
 module Dependabot
   module Bundler
     class FileUpdater
+      # rubocop:disable Metrics/ClassLength
       class LockfileUpdater
         require_relative "gemfile_updater"
         require_relative "gemspec_updater"
@@ -41,9 +42,11 @@ module Dependabot
           ]
         end
 
-        def initialize(dependencies:, dependency_files:, credentials:)
+        def initialize(dependencies:, dependency_files:,
+                       repo_contents_path: nil, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
           @credentials = credentials
         end
 
@@ -62,12 +65,16 @@ module Dependabot
 
         private
 
-        attr_reader :dependencies, :dependency_files, :credentials
+        attr_reader :dependencies, :dependency_files, :repo_contents_path,
+                    :credentials
 
         def build_updated_lockfile
           base_dir = dependency_files.first.directory
           lockfile_body =
-            SharedHelpers.in_a_temporary_directory(base_dir) do |tmp_dir|
+            SharedHelpers.in_a_temporary_repo_directory(
+              base_dir,
+              repo_contents_path
+            ) do |tmp_dir|
               write_temporary_dependency_files
 
               SharedHelpers.in_a_forked_process do
@@ -122,6 +129,7 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def generate_lockfile
           dependencies_to_unlock = dependencies.map(&:name)
 
@@ -139,6 +147,8 @@ module Dependabot
               end
             end
 
+            cache_vendored_gems(definition) if ::Bundler.app_cache.exist?
+
             definition.to_lock
           rescue ::Bundler::GemNotFound => e
             unlock_yanked_gem(dependencies_to_unlock, e) && retry
@@ -152,6 +162,73 @@ module Dependabot
             retry
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        def cache_vendored_gems(definition)
+          # Dependencies that have been unlocked for the update (including
+          # sub-dependencies)
+          unlocked_gems = definition.instance_variable_get(:@unlock).
+                          fetch(:gems)
+          bundler_opts = {
+            cache_all: true,
+            cache_all_platforms: true,
+            no_prune: true
+          }
+
+          ::Bundler.settings.temporary(**bundler_opts) do
+            # Fetch and cache gems on all platforms without pruning
+            ::Bundler::Runtime.new(nil, definition).cache
+
+            # Only prune unlocked gems (the original implementation is in
+            # Bundler::Runtime)
+            cache_path = ::Bundler.app_cache
+            resolve = definition.resolve
+            prune_gem_cache(resolve, cache_path, unlocked_gems)
+            prune_git_and_path_cache(resolve, cache_path)
+          end
+        end
+
+        # Copied from Bundler::Runtime: Modified to only prune gems that have
+        # been unlocked
+        def prune_gem_cache(resolve, cache_path, unlocked_gems)
+          cached_gems = Dir["#{cache_path}/*.gem"]
+
+          outdated_gems = cached_gems.reject do |path|
+            spec = ::Bundler.rubygems.spec_from_gem path
+
+            !unlocked_gems.include?(spec.name) || resolve.any? do |s|
+              s.name == spec.name && s.version == spec.version &&
+                !s.source.is_a?(::Bundler::Source::Git)
+            end
+          end
+
+          return unless outdated_gems.any?
+
+          outdated_gems.each do |path|
+            File.delete(path)
+          end
+        end
+
+        # Copied from Bundler::Runtime
+        def prune_git_and_path_cache(resolve, cache_path)
+          cached_git_and_path = Dir["#{cache_path}/*/.bundlecache"]
+
+          outdated_git_and_path = cached_git_and_path.reject do |path|
+            name = File.basename(File.dirname(path))
+
+            resolve.any? do |s|
+              s.source.respond_to?(:app_cache_dirname) &&
+                s.source.app_cache_dirname == name
+            end
+          end
+
+          return unless outdated_git_and_path.any?
+
+          outdated_git_and_path.each do |path|
+            path = File.dirname(path)
+            FileUtils.rm_rf(path)
+          end
+        end
 
         def unlock_yanked_gem(dependencies_to_unlock, error)
           raise unless error.message.match?(GEM_NOT_FOUND_ERROR_REGEX)
@@ -453,6 +530,7 @@ module Dependabot
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/bundler/update_checker.rb

@@ -145,6 +145,7 @@ module Dependabot
             ForceUpdater.new(
               dependency: dependency,
               dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               target_version: version,
               requirements_update_strategy: requirements_update_strategy,
@@ -165,6 +166,7 @@ module Dependabot
             VersionResolver.new(
               dependency: dependency,
               unprepared_dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
@@ -325,6 +327,7 @@ module Dependabot
           ForceUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            repo_contents_path: repo_contents_path,
             credentials: credentials,
             target_version: latest_version,
             requirements_update_strategy: requirements_update_strategy
@@ -347,6 +350,7 @@ module Dependabot
             VersionResolver.new(
               dependency: dependency,
               unprepared_dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
@@ -369,6 +373,7 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: prepared_dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -15,11 +15,13 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class ForceUpdater
-        def initialize(dependency:, dependency_files:, credentials:,
-                       target_version:, requirements_update_strategy:,
+        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
+                       credentials:, target_version:,
+                       requirements_update_strategy:,
                        update_multiple_dependencies: true)
           @dependency                   = dependency
           @dependency_files             = dependency_files
+          @repo_contents_path           = repo_contents_path
           @credentials                  = credentials
           @target_version               = target_version
           @requirements_update_strategy = requirements_update_strategy
@@ -32,8 +34,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :target_version, :requirements_update_strategy
+        attr_reader :dependency, :dependency_files, :repo_contents_path,
+                    :credentials, :target_version, :requirements_update_strategy
 
         def update_multiple_dependencies?
           @update_multiple_dependencies
@@ -74,7 +76,8 @@ module Dependabot
 
         def in_a_temporary_bundler_context
           base_directory = dependency_files.first.directory
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -18,11 +18,12 @@ module Dependabot
         require_relative "shared_bundler_helpers"
         include SharedBundlerHelpers
 
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
+        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
+                       credentials:, ignored_versions:, raise_on_ignored: false,
                        security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
+          @repo_contents_path  = repo_contents_path
           @credentials         = credentials
           @ignored_versions    = ignored_versions
           @raise_on_ignored    = raise_on_ignored
@@ -39,8 +40,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions, :security_advisories
+        attr_reader :dependency, :dependency_files, :repo_contents_path,
+                    :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
           if dependency_source.is_a?(::Bundler::Source::Git)

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -29,14 +29,16 @@ module Dependabot
           Bundler::Fetcher::FallbackError
         ).freeze
 
-        attr_reader :dependency_files, :credentials
+        attr_reader :dependency_files, :repo_contents_path, :credentials
 
         #########################
         # Bundler context setup #
         #########################
 
         def in_a_temporary_bundler_context(error_handling: true)
-          SharedHelpers.in_a_temporary_directory(base_directory) do |tmp_dir|
+          SharedHelpers.
+            in_a_temporary_repo_directory(base_directory,
+                                          repo_contents_path) do |tmp_dir|
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -24,7 +24,7 @@ module Dependabot
         GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
 
         def initialize(dependency:, unprepared_dependency_files:,
-                       credentials:, ignored_versions:,
+                       repo_contents_path: nil, credentials:, ignored_versions:,
                        raise_on_ignored: false,
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
@@ -32,6 +32,7 @@ module Dependabot
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
           @credentials                 = credentials
+          @repo_contents_path          = repo_contents_path
           @ignored_versions            = ignored_versions
           @raise_on_ignored            = raise_on_ignored
           @replacement_git_pin         = replacement_git_pin
@@ -47,9 +48,9 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :unprepared_dependency_files, :credentials,
-                    :ignored_versions, :replacement_git_pin,
-                    :latest_allowable_version
+        attr_reader :dependency, :unprepared_dependency_files,
+                    :repo_contents_path, :credentials, :ignored_versions,
+                    :replacement_git_pin, :latest_allowable_version
 
         def remove_git_source?
           @remove_git_source
@@ -268,6 +269,7 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.118.14
+  version: 0.119.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-20 00:00:00.000000000 Z
+date: 2020-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.14
+        version: 0.119.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.14
+        version: 0.119.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement