dependabot-bundler 0.118.16 → 0.119.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0bbc086a9909c34ab34f8a001e6f64902cfb631e3d9206c4e1c03c6c82e992b
-  data.tar.gz: 3d76afd7d9fded083bd3b09b8aa254235b7d284870876624a3ca46ebc29f1486
+  metadata.gz: b80518519da7e1a3143ede4da6e1a7dd4df2f926b7fa6a9e8e7afbaab88a578a
+  data.tar.gz: b3192111c15926ee5ce6bff535654c89f5e6b6f9e4bae4782d65093362b867d5
 SHA512:
-  metadata.gz: 9bf4c6a45f132f0fba4db457010c48f8abd8378f90457db87bf41e1ca75bb0f97c8cc9ae9a3941369583bc28a211518d2fb9967728812ba408e3a908dc2c3892
-  data.tar.gz: e6fc9e39f83abfd64d22002b3ce3a8885b014c6d8527ce8104e11c6bf8c3ffbd3453248ad5a00d712433312c3ab4e318f98ecd77e43685407a40677d81f73db6
+  metadata.gz: 99e0ae19b66182dda191654dde09ee6c18453c9ae5a6a3c67e3666335b595cd4ee12b3562e651b7f9a8edfd326266014b14667e97d2a57be3c5f71b876fc9c12
+  data.tar.gz: a48f701129cf5eaf3c44215fe32964a4a27e4c1198909b1e3e910635deba3d219f482227c7f84d64b62a96f1faa69bf40a70ab31295e5209a38a128736bd5559

data/lib/dependabot/bundler/file_parser.rb

@@ -118,7 +118,8 @@ module Dependabot
 
       def parsed_gemfile
         @parsed_gemfile ||=
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do
@@ -150,7 +151,8 @@ module Dependabot
       def parsed_gemspec(file)
         @parsed_gemspecs ||= {}
         @parsed_gemspecs[file.name] ||=
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             [file, *imported_ruby_files].each do |f|
               path = f.name
               FileUtils.mkdir_p(Pathname.new(path).dirname)

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -13,6 +13,7 @@ require "dependabot/git_commit_checker"
 module Dependabot
   module Bundler
     class FileUpdater
+      # rubocop:disable Metrics/ClassLength
       class LockfileUpdater
         require_relative "gemfile_updater"
         require_relative "gemspec_updater"
@@ -41,9 +42,11 @@ module Dependabot
           ]
         end
 
-        def initialize(dependencies:, dependency_files:, credentials:)
+        def initialize(dependencies:, dependency_files:,
+                       repo_contents_path: nil, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
           @credentials = credentials
         end
 
@@ -62,12 +65,16 @@ module Dependabot
 
         private
 
-        attr_reader :dependencies, :dependency_files, :credentials
+        attr_reader :dependencies, :dependency_files, :repo_contents_path,
+                    :credentials
 
         def build_updated_lockfile
           base_dir = dependency_files.first.directory
           lockfile_body =
-            SharedHelpers.in_a_temporary_directory(base_dir) do |tmp_dir|
+            SharedHelpers.in_a_temporary_repo_directory(
+              base_dir,
+              repo_contents_path
+            ) do |tmp_dir|
               write_temporary_dependency_files
 
               SharedHelpers.in_a_forked_process do
@@ -122,6 +129,7 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def generate_lockfile
           dependencies_to_unlock = dependencies.map(&:name)
 
@@ -139,6 +147,8 @@ module Dependabot
               end
             end
 
+            cache_vendored_gems(definition) if ::Bundler.app_cache.exist?
+
             definition.to_lock
           rescue ::Bundler::GemNotFound => e
             unlock_yanked_gem(dependencies_to_unlock, e) && retry
@@ -152,6 +162,78 @@ module Dependabot
             retry
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+
+        def cache_vendored_gems(definition)
+          # Dependencies that have been unlocked for the update (including
+          # sub-dependencies)
+          unlocked_gems = definition.instance_variable_get(:@unlock).
+                          fetch(:gems)
+          bundler_opts = {
+            cache_all_platforms: true,
+            no_prune: true
+          }
+
+          ::Bundler.settings.temporary(**bundler_opts) do
+            # Fetch and cache gems on all platforms without pruning
+            ::Bundler::Runtime.new(nil, definition).cache
+
+            # Only prune unlocked gems (the original implementation is in
+            # Bundler::Runtime)
+            cache_path = ::Bundler.app_cache
+            resolve = definition.resolve
+            prune_gem_cache(resolve, cache_path, unlocked_gems)
+            prune_git_and_path_cache(resolve, cache_path)
+          end
+        end
+
+        # Copied from Bundler::Runtime: Modified to only prune gems that have
+        # been unlocked
+        def prune_gem_cache(resolve, cache_path, unlocked_gems)
+          cached_gems = Dir["#{cache_path}/*.gem"]
+
+          outdated_gems = cached_gems.reject do |path|
+            spec = ::Bundler.rubygems.spec_from_gem path
+
+            !unlocked_gems.include?(spec.name) || resolve.any? do |s|
+              s.name == spec.name && s.version == spec.version &&
+                !s.source.is_a?(::Bundler::Source::Git)
+            end
+          end
+
+          return unless outdated_gems.any?
+
+          puts "Removing outdated .gem files from #{cache_path}"
+
+          outdated_gems.each do |path|
+            puts "  * #{File.basename(path)}"
+            File.delete(path)
+          end
+        end
+
+        # Copied from Bundler::Runtime
+        def prune_git_and_path_cache(resolve, cache_path)
+          cached_git_and_path = Dir["#{cache_path}/*/.bundlecache"]
+
+          outdated_git_and_path = cached_git_and_path.reject do |path|
+            name = File.basename(File.dirname(path))
+
+            resolve.any? do |s|
+              s.source.respond_to?(:app_cache_dirname) &&
+                s.source.app_cache_dirname == name
+            end
+          end
+
+          return unless outdated_git_and_path.any?
+
+          puts "Removing outdated git and path gems from #{cache_path}"
+
+          outdated_git_and_path.each do |path|
+            path = File.dirname(path)
+            puts "  * #{File.basename(path)}"
+            FileUtils.rm_rf(path)
+          end
+        end
 
         def unlock_yanked_gem(dependencies_to_unlock, error)
           raise unless error.message.match?(GEM_NOT_FOUND_ERROR_REGEX)
@@ -453,6 +535,7 @@ module Dependabot
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/bundler/file_updater.rb

@@ -51,11 +51,57 @@ module Dependabot
         end
 
         check_updated_files(updated_files)
+
+        base_dir = updated_files.first.directory
+        updated_vendor_cache_files(base_directory: base_dir).each do |file|
+          updated_files << file
+        end
+
         updated_files
       end
 
       private
 
+      # Dynamically fetch the vendor cache folder from bundler
+      def vendor_cache_dir
+        return @vendor_cache_dir if defined?(@vendor_cache_dir)
+
+        @vendor_cache_dir =
+          SharedHelpers.in_a_forked_process do
+            # Set the path for path gemspec correctly
+            ::Bundler.instance_variable_set(:@root, repo_contents_path)
+            ::Bundler.app_cache
+          end
+      end
+
+      # Returns changed files in the vendor/cache folder
+      #
+      # @param base_directory [String] Update config base directory
+      # @return [Array<Dependabot::DependencyFile>]
+      def updated_vendor_cache_files(base_directory:)
+        return [] unless repo_contents_path && vendor_cache_dir
+
+        Dir.chdir(repo_contents_path) do
+          relative_dir = vendor_cache_dir.sub("#{repo_contents_path}/", "")
+          status = SharedHelpers.run_shell_command(
+            "git status --porcelain=v1 #{relative_dir}"
+          )
+          changed_paths = status.split("\n").map { |l| l.split(" ") }
+          changed_paths.map do |type, path|
+            deleted = type == "D"
+            encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
+            encoded_content = Base64.encode64(File.read(path)) unless deleted
+            Dependabot::DependencyFile.new(
+              name: path,
+              content: encoded_content,
+              directory: base_directory,
+              deleted: deleted,
+              content_encoding: encoding
+            )
+          end
+        end
+      end
+
       def check_required_files
         file_names = dependency_files.map(&:name)
 
@@ -116,6 +162,7 @@ module Dependabot
           LockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
+            repo_contents_path: repo_contents_path,
             credentials: credentials
           ).updated_lockfile_content
       end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -15,11 +15,13 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class ForceUpdater
-        def initialize(dependency:, dependency_files:, credentials:,
-                       target_version:, requirements_update_strategy:,
+        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
+                       credentials:, target_version:,
+                       requirements_update_strategy:,
                        update_multiple_dependencies: true)
           @dependency                   = dependency
           @dependency_files             = dependency_files
+          @repo_contents_path           = repo_contents_path
           @credentials                  = credentials
           @target_version               = target_version
           @requirements_update_strategy = requirements_update_strategy
@@ -32,8 +34,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :target_version, :requirements_update_strategy
+        attr_reader :dependency, :dependency_files, :repo_contents_path,
+                    :credentials, :target_version, :requirements_update_strategy
 
         def update_multiple_dependencies?
           @update_multiple_dependencies
@@ -74,7 +76,8 @@ module Dependabot
 
         def in_a_temporary_bundler_context
           base_directory = dependency_files.first.directory
-          SharedHelpers.in_a_temporary_directory(base_directory) do
+          SharedHelpers.in_a_temporary_repo_directory(base_directory,
+                                                      repo_contents_path) do
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -18,11 +18,12 @@ module Dependabot
         require_relative "shared_bundler_helpers"
         include SharedBundlerHelpers
 
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
+        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
+                       credentials:, ignored_versions:, raise_on_ignored: false,
                        security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
+          @repo_contents_path  = repo_contents_path
           @credentials         = credentials
           @ignored_versions    = ignored_versions
           @raise_on_ignored    = raise_on_ignored
@@ -39,8 +40,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions, :security_advisories
+        attr_reader :dependency, :dependency_files, :repo_contents_path,
+                    :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
           if dependency_source.is_a?(::Bundler::Source::Git)

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -29,14 +29,16 @@ module Dependabot
           Bundler::Fetcher::FallbackError
         ).freeze
 
-        attr_reader :dependency_files, :credentials
+        attr_reader :dependency_files, :repo_contents_path, :credentials
 
         #########################
         # Bundler context setup #
         #########################
 
         def in_a_temporary_bundler_context(error_handling: true)
-          SharedHelpers.in_a_temporary_directory(base_directory) do |tmp_dir|
+          SharedHelpers.
+            in_a_temporary_repo_directory(base_directory,
+                                          repo_contents_path) do |tmp_dir|
             write_temporary_dependency_files
 
             SharedHelpers.in_a_forked_process do

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -24,7 +24,7 @@ module Dependabot
         GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
 
         def initialize(dependency:, unprepared_dependency_files:,
-                       credentials:, ignored_versions:,
+                       repo_contents_path: nil, credentials:, ignored_versions:,
                        raise_on_ignored: false,
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
@@ -32,6 +32,7 @@ module Dependabot
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
           @credentials                 = credentials
+          @repo_contents_path          = repo_contents_path
           @ignored_versions            = ignored_versions
           @raise_on_ignored            = raise_on_ignored
           @replacement_git_pin         = replacement_git_pin
@@ -47,9 +48,9 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :unprepared_dependency_files, :credentials,
-                    :ignored_versions, :replacement_git_pin,
-                    :latest_allowable_version
+        attr_reader :dependency, :unprepared_dependency_files,
+                    :repo_contents_path, :credentials, :ignored_versions,
+                    :replacement_git_pin, :latest_allowable_version
 
         def remove_git_source?
           @remove_git_source
@@ -268,6 +269,7 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,

data/lib/dependabot/bundler/update_checker.rb

@@ -145,6 +145,7 @@ module Dependabot
             ForceUpdater.new(
               dependency: dependency,
               dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               target_version: version,
               requirements_update_strategy: requirements_update_strategy,
@@ -165,6 +166,7 @@ module Dependabot
             VersionResolver.new(
               dependency: dependency,
               unprepared_dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
@@ -325,6 +327,7 @@ module Dependabot
           ForceUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            repo_contents_path: repo_contents_path,
             credentials: credentials,
             target_version: latest_version,
             requirements_update_strategy: requirements_update_strategy
@@ -347,6 +350,7 @@ module Dependabot
             VersionResolver.new(
               dependency: dependency,
               unprepared_dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
@@ -369,6 +373,7 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: prepared_dependency_files,
+              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.118.16
+  version: 0.119.0.beta1
 platform: ruby
 authors:
 - Dependabot
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
 date: 2020-08-20 00:00:00.000000000 Z
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.16
+        version: 0.119.0.beta1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.16
+        version: 0.119.0.beta1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -179,7 +179,7 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -194,8 +194,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Ruby (bundler) support for dependabot
 test_files: []