dependabot-bundler 0.120.1 → 0.121.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50db4a32a04cf54b6b13ee62ff605c7be11709dec289eda59b5397b77668fc75
-  data.tar.gz: 28ba6fd108db18f20c64bc957aa9b3e5f73d1f873597d87ab70154811a9dcb1a
+  metadata.gz: 6bc52373798c13a207c93c926fa89fc1ba7f072c950895b0457e9303cce433ac
+  data.tar.gz: 0645a89f44241cd6a91eb4b887d7c38abf9a9801112b8c410abbfb8980e3dd82
 SHA512:
-  metadata.gz: f04527b19e19942e1bf8390c5dfd447dc82176ab2fbc69834c517b20375591d28865fd1adad1ef5afa75fa25381c4b5ea54ee0be91f4eeca91a4b16d8ba78011
-  data.tar.gz: 91efbb5752728eba17b8c8f99e1eb37b3a3a9b374ad5e4d4b6da45ad3aef0bcc31da41f1884e90130f3ddaa44c28b2c431a14cef00ff1fe84d15a699d3d2f0a7
+  metadata.gz: d8f9b85f728adcfef047bcbcbd28ed85280db7c8e03f62e573713940bda2cdeb4061bf20466846f956ad71332469faffa4c6d9b44c28254fb2f17e91590ad0dc
+  data.tar.gz: 56970fff452967df6a30678eabd61fea04013381fb380b98b2e2bfa929ce69e0ca0c68e0517daf53155bc12e77ad91b195e6938bca45a848907ad3800903079b

data/lib/dependabot/bundler/metadata_finder.rb

@@ -131,9 +131,8 @@ module Dependabot
         response =
           Excon.get(
             gemspec_uri,
-            headers: registry_auth_headers,
             idempotent: true,
-            **SharedHelpers.excon_defaults
+            **SharedHelpers.excon_defaults(headers: registry_auth_headers)
           )
 
         if response.status >= 400
@@ -152,9 +151,8 @@ module Dependabot
         response =
           Excon.get(
             "#{registry_url}api/v1/gems/#{dependency.name}.json",
-            headers: registry_auth_headers,
             idempotent: true,
-            **SharedHelpers.excon_defaults
+            **SharedHelpers.excon_defaults(headers: registry_auth_headers)
           )
         return @rubygems_api_response = {} if response.status >= 400
 

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -10,14 +10,13 @@ require "dependabot/bundler/update_checker"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/bundler/update_checker/latest_version_finder/" \
+        "dependency_source"
 
 module Dependabot
   module Bundler
     class UpdateChecker
       class LatestVersionFinder
-        require_relative "shared_bundler_helpers"
-        include SharedBundlerHelpers
-
         def initialize(dependency:, dependency_files:, repo_contents_path: nil,
                        credentials:, ignored_versions:, raise_on_ignored: false,
                        security_advisories:)
@@ -44,11 +43,11 @@ module Dependabot
                     :credentials, :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
-          if dependency_source.is_a?(::Bundler::Source::Git)
-            return latest_git_version_details
+          if dependency_source.git?
+            return dependency_source.latest_git_version_details
           end
 
-          relevant_versions = registry_versions
+          relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
 
@@ -56,9 +55,9 @@ module Dependabot
         end
 
         def fetch_lowest_security_fix_version
-          return if dependency_source.is_a?(::Bundler::Source::Git)
+          return if dependency_source.git?
 
-          relevant_versions = registry_versions
+          relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_vulnerable_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
@@ -93,71 +92,6 @@ module Dependabot
             select { |version| version > Gem::Version.new(dependency.version) }
         end
 
-        def registry_versions
-          return rubygems_versions if dependency.name == "bundler"
-          return rubygems_versions unless dependency_source
-          return [] unless dependency_source.is_a?(::Bundler::Source::Rubygems)
-
-          remote = dependency_source.remotes.first
-          return rubygems_versions if remote.nil?
-          return rubygems_versions if remote.to_s == "https://rubygems.org/"
-
-          private_registry_versions
-        end
-
-        def rubygems_versions
-          @rubygems_versions ||=
-            begin
-              response = Excon.get(
-                "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
-                idempotent: true,
-                **SharedHelpers.excon_defaults
-              )
-
-              JSON.parse(response.body).
-                map { |d| Gem::Version.new(d["number"]) }
-            end
-        rescue JSON::ParserError, Excon::Error::Timeout
-          @rubygems_versions = []
-        end
-
-        def private_registry_versions
-          @private_registry_versions ||=
-            in_a_temporary_bundler_context do
-              dependency_source.
-                fetchers.flat_map do |fetcher|
-                  fetcher.
-                    specs_with_retry([dependency.name], dependency_source).
-                    search_all(dependency.name)
-                end.
-                map(&:version)
-            end
-        end
-
-        def latest_git_version_details
-          dependency_source_details =
-            dependency.requirements.map { |r| r.fetch(:source) }.
-            uniq.compact.first
-
-          in_a_temporary_bundler_context do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              # Note: we don't set `ref`, as we want to unpin the dependency
-              source = ::Bundler::Source::Git.new(
-                "uri" => dependency_source_details[:url],
-                "branch" => dependency_source_details[:branch],
-                "name" => dependency.name,
-                "submodules" => true
-              )
-
-              # Tell Bundler we're fine with fetching the source remotely
-              source.instance_variable_set(:@allow_remote, true)
-
-              spec = source.specs.first
-              { version: spec.version, commit_sha: spec.source.revision }
-            end
-          end
-        end
-
         def wants_prerelease?
           @wants_prerelease ||=
             begin
@@ -174,18 +108,11 @@ module Dependabot
         end
 
         def dependency_source
-          return nil unless gemfile
-
-          @dependency_source ||=
-            in_a_temporary_bundler_context do
-              definition = ::Bundler::Definition.build(gemfile.name, nil, {})
-
-              specified_source =
-                definition.dependencies.
-                find { |dep| dep.name == dependency.name }&.source
-
-              specified_source || definition.send(:sources).default_source
-            end
+          @dependency_source ||= DependencySource.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials
+          )
         end
 
         def ignore_reqs

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Bundler
+    class UpdateChecker
+      class LatestVersionFinder
+        class DependencySource
+          require_relative "../shared_bundler_helpers"
+          include SharedBundlerHelpers
+
+          RUBYGEMS = "rubygems"
+          PRIVATE_REGISTRY = "private"
+          GIT = "git"
+          OTHER = "other"
+
+          attr_reader :dependency, :dependency_files, :repo_contents_path,
+                      :credentials
+
+          def initialize(dependency:,
+                         dependency_files:,
+                         credentials:)
+            @dependency          = dependency
+            @dependency_files    = dependency_files
+            @credentials         = credentials
+          end
+
+          # The latest version details for the dependency from a registry
+          #
+          # @return [Array<Gem::Version>]
+          def versions
+            return rubygems_versions if dependency.name == "bundler"
+            return rubygems_versions unless gemfile
+
+            case source_type
+            when OTHER, GIT
+              []
+            when PRIVATE_REGISTRY
+              private_registry_versions
+            else
+              rubygems_versions
+            end
+          end
+
+          # The latest version details for the dependency from a git repo
+          #
+          # @return [Hash{Symbol => String}, nil]
+          def latest_git_version_details
+            return unless git?
+
+            dependency_source_details =
+              dependency.requirements.map { |r| r.fetch(:source) }.
+              uniq.compact.first
+
+            in_a_temporary_bundler_context do
+              SharedHelpers.with_git_configured(credentials: credentials) do
+                # Note: we don't set `ref`, as we want to unpin the dependency
+                source = ::Bundler::Source::Git.new(
+                  "uri" => dependency_source_details[:url],
+                  "branch" => dependency_source_details[:branch],
+                  "name" => dependency.name,
+                  "submodules" => true
+                )
+
+                # Tell Bundler we're fine with fetching the source remotely
+                source.instance_variable_set(:@allow_remote, true)
+
+                spec = source.specs.first
+                { version: spec.version, commit_sha: spec.source.revision }
+              end
+            end
+          end
+
+          def git?
+            source_type == GIT
+          end
+
+          private
+
+          def rubygems_versions
+            @rubygems_versions ||=
+              begin
+                response = Excon.get(
+                  dependency_rubygems_uri,
+                  idempotent: true,
+                  **SharedHelpers.excon_defaults
+                )
+
+                JSON.parse(response.body).
+                  map { |d| Gem::Version.new(d["number"]) }
+              end
+          rescue JSON::ParserError, Excon::Error::Timeout
+            @rubygems_versions = []
+          end
+
+          def dependency_rubygems_uri
+            "https://rubygems.org/api/v1/versions/#{dependency.name}.json"
+          end
+
+          def private_registry_versions
+            @private_registry_versions ||=
+              in_a_temporary_bundler_context do
+                bundler_source.
+                  fetchers.flat_map do |fetcher|
+                    fetcher.
+                      specs_with_retry([dependency.name], bundler_source).
+                      search_all(dependency.name)
+                  end.
+                  map(&:version)
+              end
+          end
+
+          def bundler_source
+            return nil unless gemfile
+
+            @bundler_source ||=
+              in_a_temporary_bundler_context do
+                definition = ::Bundler::Definition.build(gemfile.name, nil, {})
+
+                specified_source =
+                  definition.dependencies.
+                  find { |dep| dep.name == dependency.name }&.source
+
+                specified_source || definition.send(:sources).default_source
+              end
+          end
+
+          def source_type
+            @source_type ||= case bundler_source
+                             when ::Bundler::Source::Rubygems
+                               remote = bundler_source.remotes.first
+                               if remote.nil? || remote.to_s == "https://rubygems.org/"
+                                 RUBYGEMS
+                               else
+                                 PRIVATE_REGISTRY
+                               end
+                             when ::Bundler::Source::Git
+                               GIT
+                             else
+                               OTHER
+                             end
+          end
+
+          def gemfile
+            dependency_files.find { |f| f.name == "Gemfile" } ||
+              dependency_files.find { |f| f.name == "gems.rb" }
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.120.1
+  version: 0.121.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-25 00:00:00.000000000 Z
+date: 2020-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.120.1
+        version: 0.121.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.120.1
+        version: 0.121.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.91.0
+        version: 0.92.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.91.0
+        version: 0.92.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -168,6 +168,7 @@ files:
 - lib/dependabot/bundler/update_checker/file_preparer.rb
 - lib/dependabot/bundler/update_checker/force_updater.rb
 - lib/dependabot/bundler/update_checker/latest_version_finder.rb
+- lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb
 - lib/dependabot/bundler/update_checker/requirements_updater.rb
 - lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb
 - lib/dependabot/bundler/update_checker/version_resolver.rb