dependabot-bundler 0.119.6 → 0.120.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d9f79ddbfc27c5ea8aa7fda0a99b8afd752cca7e81f977220cc3ae726062392
-  data.tar.gz: c504685e24e13a311b25226f3837a3216e35d39444f290de53697221bb11c860
+  metadata.gz: 844875783a5d336c1dfea2c6d9cb7d361de7ce4fc9bf7a815bcf9f138b4e6f4c
+  data.tar.gz: 3df2eec05bdf3aef1494f2f6b51e5765fb1e0236cb211d308537cc063354e44e
 SHA512:
-  metadata.gz: c05c3936752d1a8c013f68559719c4f195d54f43915ded1baa47828bccf3a9178093317db16f4ee84806232642d285af039601eaea0e6122154f02ec7a88bc6e
-  data.tar.gz: dda65bb81159dafd236f6cf792fcb68345883dc17fee2ee07243e8bd01d425e0ac94c0c973c77b1fe885b0e70eda28cb12af3a0010a45696b1315ec9eb8096ab
+  metadata.gz: 9f9fc1f0770689916d255af31777ea273f7bdfba30909f77d1ddd48256140ac133fded85d5c4592ede6db7ca64944dc9c018dc2ffdc307d9710a6e59de9980fc
+  data.tar.gz: 3d7b39566577e5ea2f78e7daae5992440eb8b0b12bd9df8393ac849d82c28dd8ffb046cc7f3fdc35e9c223ba13b219362bef9c516dd68771d4e5e642375bc1f9

data/lib/dependabot/bundler/metadata_finder.rb

@@ -131,9 +131,8 @@ module Dependabot
         response =
           Excon.get(
             gemspec_uri,
-            headers: registry_auth_headers,
             idempotent: true,
-            **SharedHelpers.excon_defaults
+            **SharedHelpers.excon_defaults(headers: registry_auth_headers)
           )
 
         if response.status >= 400
@@ -152,9 +151,8 @@ module Dependabot
         response =
           Excon.get(
             "#{registry_url}api/v1/gems/#{dependency.name}.json",
-            headers: registry_auth_headers,
             idempotent: true,
-            **SharedHelpers.excon_defaults
+            **SharedHelpers.excon_defaults(headers: registry_auth_headers)
           )
         return @rubygems_api_response = {} if response.status >= 400
 

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -10,14 +10,13 @@ require "dependabot/bundler/update_checker"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/bundler/update_checker/latest_version_finder/" \
+        "dependency_source"
 
 module Dependabot
   module Bundler
     class UpdateChecker
       class LatestVersionFinder
-        require_relative "shared_bundler_helpers"
-        include SharedBundlerHelpers
-
         def initialize(dependency:, dependency_files:, repo_contents_path: nil,
                        credentials:, ignored_versions:, raise_on_ignored: false,
                        security_advisories:)
@@ -44,11 +43,11 @@ module Dependabot
                     :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
-          if dependency_source.is_a?(::Bundler::Source::Git)
-            return latest_git_version_details
+          if dependency_source.git?
+            return dependency_source.latest_git_version_details
           end
 
-          relevant_versions = registry_versions
+          relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
 
@@ -56,9 +55,9 @@ module Dependabot
         end
 
         def fetch_lowest_security_fix_version
-          return if dependency_source.is_a?(::Bundler::Source::Git)
+          return if dependency_source.git?
 
-          relevant_versions = registry_versions
+          relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_vulnerable_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
@@ -93,71 +92,6 @@ module Dependabot
             select { |version| version > Gem::Version.new(dependency.version) }
         end
 
-        def registry_versions
-          return rubygems_versions if dependency.name == "bundler"
-          return rubygems_versions unless dependency_source
-          return [] unless dependency_source.is_a?(::Bundler::Source::Rubygems)
-
-          remote = dependency_source.remotes.first
-          return rubygems_versions if remote.nil?
-          return rubygems_versions if remote.to_s == "https://rubygems.org/"
-
-          private_registry_versions
-        end
-
-        def rubygems_versions
-          @rubygems_versions ||=
-            begin
-              response = Excon.get(
-                "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
-                idempotent: true,
-                **SharedHelpers.excon_defaults
-              )
-
-              JSON.parse(response.body).
-                map { |d| Gem::Version.new(d["number"]) }
-            end
-        rescue JSON::ParserError, Excon::Error::Timeout
-          @rubygems_versions = []
-        end
-
-        def private_registry_versions
-          @private_registry_versions ||=
-            in_a_temporary_bundler_context do
-              dependency_source.
-                fetchers.flat_map do |fetcher|
-                  fetcher.
-                    specs_with_retry([dependency.name], dependency_source).
-                    search_all(dependency.name)
-                end.
-                map(&:version)
-            end
-        end
-
-        def latest_git_version_details
-          dependency_source_details =
-            dependency.requirements.map { |r| r.fetch(:source) }.
-            uniq.compact.first
-
-          in_a_temporary_bundler_context do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              # Note: we don't set `ref`, as we want to unpin the dependency
-              source = ::Bundler::Source::Git.new(
-                "uri" => dependency_source_details[:url],
-                "branch" => dependency_source_details[:branch],
-                "name" => dependency.name,
-                "submodules" => true
-              )
-
-              # Tell Bundler we're fine with fetching the source remotely
-              source.instance_variable_set(:@allow_remote, true)
-
-              spec = source.specs.first
-              { version: spec.version, commit_sha: spec.source.revision }
-            end
-          end
-        end
-
         def wants_prerelease?
           @wants_prerelease ||=
             begin
@@ -174,18 +108,11 @@ module Dependabot
         end
 
         def dependency_source
-          return nil unless gemfile
-
-          @dependency_source ||=
-            in_a_temporary_bundler_context do
-              definition = ::Bundler::Definition.build(gemfile.name, nil, {})
-
-              specified_source =
-                definition.dependencies.
-                find { |dep| dep.name == dependency.name }&.source
-
-              specified_source || definition.send(:sources).default_source
-            end
+          @dependency_source ||= DependencySource.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials
+          )
         end
 
         def ignore_reqs

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Bundler
+    class UpdateChecker
+      class LatestVersionFinder
+        class DependencySource
+          require_relative "../shared_bundler_helpers"
+          include SharedBundlerHelpers
+
+          RUBYGEMS = "rubygems"
+          PRIVATE_REGISTRY = "private"
+          GIT = "git"
+          OTHER = "other"
+
+          attr_reader :dependency, :dependency_files, :repo_contents_path,
+                      :credentials
+
+          def initialize(dependency:,
+                         dependency_files:,
+                         credentials:)
+            @dependency          = dependency
+            @dependency_files    = dependency_files
+            @credentials         = credentials
+          end
+
+          # The latest version details for the dependency from a registry
+          #
+          # @return [Array<Gem::Version>]
+          def versions
+            return rubygems_versions if dependency.name == "bundler"
+            return rubygems_versions unless gemfile
+
+            case source_type
+            when OTHER, GIT
+              []
+            when PRIVATE_REGISTRY
+              private_registry_versions
+            else
+              rubygems_versions
+            end
+          end
+
+          # The latest version details for the dependency from a git repo
+          #
+          # @return [Hash{Symbol => String}, nil]
+          def latest_git_version_details
+            return unless git?
+
+            dependency_source_details =
+              dependency.requirements.map { |r| r.fetch(:source) }.
+              uniq.compact.first
+
+            in_a_temporary_bundler_context do
+              SharedHelpers.with_git_configured(credentials: credentials) do
+                # Note: we don't set `ref`, as we want to unpin the dependency
+                source = ::Bundler::Source::Git.new(
+                  "uri" => dependency_source_details[:url],
+                  "branch" => dependency_source_details[:branch],
+                  "name" => dependency.name,
+                  "submodules" => true
+                )
+
+                # Tell Bundler we're fine with fetching the source remotely
+                source.instance_variable_set(:@allow_remote, true)
+
+                spec = source.specs.first
+                { version: spec.version, commit_sha: spec.source.revision }
+              end
+            end
+          end
+
+          def git?
+            source_type == GIT
+          end
+
+          private
+
+          def rubygems_versions
+            @rubygems_versions ||=
+              begin
+                response = Excon.get(
+                  dependency_rubygems_uri,
+                  idempotent: true,
+                  **SharedHelpers.excon_defaults
+                )
+
+                JSON.parse(response.body).
+                  map { |d| Gem::Version.new(d["number"]) }
+              end
+          rescue JSON::ParserError, Excon::Error::Timeout
+            @rubygems_versions = []
+          end
+
+          def dependency_rubygems_uri
+            "https://rubygems.org/api/v1/versions/#{dependency.name}.json"
+          end
+
+          def private_registry_versions
+            @private_registry_versions ||=
+              in_a_temporary_bundler_context do
+                bundler_source.
+                  fetchers.flat_map do |fetcher|
+                    fetcher.
+                      specs_with_retry([dependency.name], bundler_source).
+                      search_all(dependency.name)
+                  end.
+                  map(&:version)
+              end
+          end
+
+          def bundler_source
+            return nil unless gemfile
+
+            @bundler_source ||=
+              in_a_temporary_bundler_context do
+                definition = ::Bundler::Definition.build(gemfile.name, nil, {})
+
+                specified_source =
+                  definition.dependencies.
+                  find { |dep| dep.name == dependency.name }&.source
+
+                specified_source || definition.send(:sources).default_source
+              end
+          end
+
+          def source_type
+            @source_type ||= case bundler_source
+                             when ::Bundler::Source::Rubygems
+                               remote = bundler_source.remotes.first
+                               if remote.nil? || remote.to_s == "https://rubygems.org/"
+                                 RUBYGEMS
+                               else
+                                 PRIVATE_REGISTRY
+                               end
+                             when ::Bundler::Source::Git
+                               GIT
+                             else
+                               OTHER
+                             end
+          end
+
+          def gemfile
+            dependency_files.find { |f| f.name == "Gemfile" } ||
+              dependency_files.find { |f| f.name == "gems.rb" }
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.119.6
+  version: 0.120.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-21 00:00:00.000000000 Z
+date: 2020-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.119.6
+        version: 0.120.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.119.6
+        version: 0.120.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.90.0
+        version: 0.91.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.90.0
+        version: 0.91.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -168,6 +168,7 @@ files:
 - lib/dependabot/bundler/update_checker/file_preparer.rb
 - lib/dependabot/bundler/update_checker/force_updater.rb
 - lib/dependabot/bundler/update_checker/latest_version_finder.rb
+- lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb
 - lib/dependabot/bundler/update_checker/requirements_updater.rb
 - lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb
 - lib/dependabot/bundler/update_checker/version_resolver.rb