dependabot-bundler 0.119.0.beta1 → 0.119.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b80518519da7e1a3143ede4da6e1a7dd4df2f926b7fa6a9e8e7afbaab88a578a
-  data.tar.gz: b3192111c15926ee5ce6bff535654c89f5e6b6f9e4bae4782d65093362b867d5
+  metadata.gz: b553f381d51096abea464d29db31481e5e9d0d115994defaedc34817215cd036
+  data.tar.gz: 7316b4fc824c9c0d2d8f503926cced66c76334bd271f866cc296f2ff5892d22e
 SHA512:
-  metadata.gz: 99e0ae19b66182dda191654dde09ee6c18453c9ae5a6a3c67e3666335b595cd4ee12b3562e651b7f9a8edfd326266014b14667e97d2a57be3c5f71b876fc9c12
-  data.tar.gz: a48f701129cf5eaf3c44215fe32964a4a27e4c1198909b1e3e910635deba3d219f482227c7f84d64b62a96f1faa69bf40a70ab31295e5209a38a128736bd5559
+  metadata.gz: 715c7aa1a560d963e73feee11280cab3ce03aa3662ae7bfe4d6b2bb0f0a5bf39355ff3446259dbeb671b02cb170e14791d6a8f08c8d94a3c3b7932d57561145b
+  data.tar.gz: 59d1dbd6c9e8fcdd73dc62b27e2a56def85ccc0fdabe56ac2042e1fae07af158493c5bdd83e5abfaf98283259c9862a3fe4464357be53e9ab3c97ddc2e71363e

data/lib/dependabot/bundler/file_updater.rb

@@ -20,6 +20,7 @@ module Dependabot
         ]
       end
 
+      # rubocop:disable Metrics/PerceivedComplexity
       def updated_dependency_files
         updated_files = []
 
@@ -59,6 +60,7 @@ module Dependabot
 
         updated_files
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
       private
 
@@ -84,13 +86,17 @@ module Dependabot
         Dir.chdir(repo_contents_path) do
           relative_dir = vendor_cache_dir.sub("#{repo_contents_path}/", "")
           status = SharedHelpers.run_shell_command(
-            "git status --porcelain=v1 #{relative_dir}"
+            "git status --untracked-files=all --porcelain=v1 #{relative_dir}"
           )
           changed_paths = status.split("\n").map { |l| l.split(" ") }
           changed_paths.map do |type, path|
             deleted = type == "D"
-            encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
-            encoded_content = Base64.encode64(File.read(path)) unless deleted
+            encoding = ""
+            encoded_content = File.read(path) unless deleted
+            if binary_file?(path)
+              encoding = Dependabot::DependencyFile::ContentEncoding::BASE64
+              encoded_content = Base64.encode64(encoded_content) unless deleted
+            end
             Dependabot::DependencyFile.new(
               name: path,
               content: encoded_content,
@@ -102,6 +108,39 @@ module Dependabot
         end
       end
 
+      # notable filenames without a reliable extension:
+      TEXT_FILE_NAMES = [
+        "Gemfile",
+        "Gemfile.lock",
+        ".bundlecache",
+        ".gitignore"
+      ].freeze
+
+      TEXT_FILE_EXTS = [
+        # code
+        ".rb",
+        ".erb",
+        ".gemspec",
+        ".js",
+        ".html",
+        # config
+        ".json",
+        ".xml",
+        ".toml",
+        ".yaml",
+        ".yml",
+        # docs
+        ".md",
+        ".txt"
+      ].freeze
+
+      def binary_file?(path)
+        return false if TEXT_FILE_NAMES.include?(File.basename(path))
+        return false if TEXT_FILE_EXTS.include?(File.extname(path))
+
+        true
+      end
+
       def check_required_files
         file_names = dependency_files.map(&:name)
 

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -170,6 +170,7 @@ module Dependabot
           unlocked_gems = definition.instance_variable_get(:@unlock).
                           fetch(:gems)
           bundler_opts = {
+            cache_all: true,
             cache_all_platforms: true,
             no_prune: true
           }
@@ -203,10 +204,7 @@ module Dependabot
 
           return unless outdated_gems.any?
 
-          puts "Removing outdated .gem files from #{cache_path}"
-
           outdated_gems.each do |path|
-            puts "  * #{File.basename(path)}"
             File.delete(path)
           end
         end
@@ -226,11 +224,8 @@ module Dependabot
 
           return unless outdated_git_and_path.any?
 
-          puts "Removing outdated git and path gems from #{cache_path}"
-
           outdated_git_and_path.each do |path|
             path = File.dirname(path)
-            puts "  * #{File.basename(path)}"
             FileUtils.rm_rf(path)
           end
         end
@@ -245,6 +240,7 @@ module Dependabot
           dependencies_to_unlock << gem_name
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def unlock_blocking_subdeps(dependencies_to_unlock, error)
           all_deps =  ::Bundler::LockfileParser.new(sanitized_lockfile_body).
                       specs.map(&:name).map(&:to_s)
@@ -273,6 +269,7 @@ module Dependabot
           # information to chart the full path through all conflicts unwound
           dependencies_to_unlock.append(*allowed_new_unlocks)
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def build_definition(dependencies_to_unlock)
           defn = ::Bundler::Definition.build(
@@ -412,6 +409,7 @@ module Dependabot
             rewrite(gemspec_content)
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def replacement_version_for_gemspec(gemspec_content)
           return "0.0.1" unless lockfile
 
@@ -428,6 +426,7 @@ module Dependabot
           spec = gemspec_specs.find { |s| s.name == gem_name }
           spec&.version || gemspec_specs.first&.version || "0.0.1"
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def relevant_credentials
           credentials.

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -214,6 +214,7 @@ module Dependabot
           lower_bound_req + ", <= #{latest_allowable_version}"
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def updated_version_req_lower_bound(filename)
           original_req = dependency.requirements.
                          find { |r| r.fetch(:file) == filename }&.
@@ -234,6 +235,7 @@ module Dependabot
             ">= #{version_for_requirement || 0}"
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def remove_git_source(content)
           FileUpdater::GitSourceRemover.new(
@@ -261,6 +263,7 @@ module Dependabot
           @lock_ruby_version && file == gemfile
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         def replacement_version_for_gemspec(gemspec_content)
           return "0.0.1" unless lockfile
 
@@ -278,6 +281,7 @@ module Dependabot
           spec = gemspec_specs.find { |s| s.name == gem_name }
           spec&.version || gemspec_specs.first&.version || "0.0.1"
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         def sanitized_lockfile_content
           re = FileUpdater::LockfileUpdater::LOCKFILE_ENDING

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -252,7 +252,6 @@ module Dependabot
 
         # Updates the version in a "<" or "<=" constraint to allow the given
         # version
-        # rubocop:disable Metrics/PerceivedComplexity
         def update_greatest_version(requirement, version_to_be_permitted)
           if version_to_be_permitted.is_a?(String)
             version_to_be_permitted = Gem::Version.new(version_to_be_permitted)
@@ -278,8 +277,6 @@ module Dependabot
 
           Gem::Requirement.new("#{op} #{new_segments.join('.')}")
         end
-
-        # rubocop:enable Metrics/PerceivedComplexity
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.119.0.beta1
+  version: 0.119.4
 platform: ruby
 authors:
 - Dependabot
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-20 00:00:00.000000000 Z
+date: 2020-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.119.0.beta1
+        version: 0.119.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.119.0.beta1
+        version: 0.119.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 0.90.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.88.0
+        version: 0.90.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -179,7 +179,7 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -194,8 +194,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.1.2
+signing_key: 
 specification_version: 4
 summary: Ruby (bundler) support for dependabot
 test_files: []