dependabot-bundler 0.133.3 → 0.134.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 212c884e9579a099ec28d7ccc570b2f5ba24deadd8f72558e447e33059b65e63
-  data.tar.gz: b49f984f1613e820be45c628906784ffda745a1d67982c2868524f19ce378b10
+  metadata.gz: bd78c19685f05d6c7e43ce4c90534222628ae2643f85c0e9e782564ad9c103f5
+  data.tar.gz: d6d3b64c7fe549a55393b3f8fc7abc8f4ab47beeedff11693b55f3063dd574c1
 SHA512:
-  metadata.gz: 5038730db8a10dd57a983cbb8be12f713b2d19308a5566c7f1e6f70b30eed2dbf43bdfed19aeb34cac19edb3af13f262a4044218ed8be48b1b96e5f75091b492
-  data.tar.gz: fa78e53c720edfe3a3c2c2e3ac1a27594c6018c9affafc585d8153408ea6c4c5297b65af3bffec4d5c3b46cca28535ba8b9e9cee67a2f90107564ac2210ec655
+  metadata.gz: fbd76caef56c07824885903d9d17f435143889e7e7e8923a11290ba1e532e80a7808de62f775eebf513e71620062bc70a9609b8e28d48310abcbde05dc79fcaa
+  data.tar.gz: c73e87e7383c1ea48dbd58e97dde9011c83eefb3f3730c4f98756c64793ae374e102577ca911418edc8d8553a629d72356663062c39d44678513c3f47e11a6b2

data/helpers/v1/.gitignore

@@ -0,0 +1,8 @@
+/.bundle/
+/.env
+/tmp
+/dependabot-*.gem
+Gemfile.lock
+spec/fixtures/projects/*/.bundle/
+!spec/fixtures/projects/**/Gemfile.lock
+!spec/fixtures/projects/**/vendor

data/helpers/v1/Gemfile

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# TODO: Look into removing this. "find" used to get required from common's
+# gemspec so we've added it here for backwards compatability during bundler 2
+# rollout.
+#
+# NOTE: If we don't require it and a customers `.gemspec` uses Find without
+# requiring it, we'll start raising a DependencyFileNotEvaluatable error which
+# is probably the right thing to do
+require "find"
+
+source "https://rubygems.org"
+
+# NOTE: This is intentionally left blank as it's currently only used to force
+# bundler to use v1 when executing native helpers by pointing the BUNDLE_GEMFILE
+# env to this Gemfile in Dependabot::Bundler::NativeHelpers

data/helpers/{build → v1/build}

@@ -8,11 +8,20 @@ if [ -z "$install_dir" ]; then
   exit 1
 fi
 
+if [ ! -d "$install_dir" ]; then
+  mkdir -p "$install_dir"
+fi
+
 helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
 cp -r \
   "$helpers_dir/lib" \
   "$helpers_dir/monkey_patches" \
   "$helpers_dir/run.rb" \
+  "$helpers_dir/Gemfile" \
   "$install_dir"
 
 cd "$install_dir"
+
+# NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
+# forcing specs and native helpers to run with the same version
+BUNDLER_VERSION=1 bundle install

data/lib/dependabot/bundler/file_parser.rb

@@ -5,6 +5,7 @@ require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/version"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -129,8 +130,8 @@ module Dependabot
                                                       repo_contents_path) do
             write_temporary_dependency_files
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "parsed_gemfile",
               args: {
                 gemfile_name: gemfile.name,
@@ -159,8 +160,8 @@ module Dependabot
                                                       repo_contents_path) do
             write_temporary_dependency_files
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "parsed_gemspec",
               args: {
                 gemspec_name: file.name,
@@ -298,6 +299,10 @@ module Dependabot
           select { |f| f.name.end_with?(".rb") }.
           reject { |f| f.name == "gems.rb" }
       end
+
+      def bundler_version
+        @bundler_version ||= Helpers.bundler_version(lockfile)
+      end
     end
   end
 end

data/lib/dependabot/bundler/file_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/file_updaters/vendor_updater"
 
 module Dependabot
@@ -75,8 +76,8 @@ module Dependabot
         return @vendor_cache_dir if defined?(@vendor_cache_dir)
 
         @vendor_cache_dir =
-          SharedHelpers.run_helper_subprocess(
-            command: NativeHelpers.helper_path,
+          NativeHelpers.run_bundler_subprocess(
+            bundler_version: bundler_version,
             function: "vendor_cache_dir",
             args: {
               dir: repo_contents_path
@@ -159,6 +160,10 @@ module Dependabot
           select { |file| file.name.end_with?(".gemspec") }.
           reject(&:support_file?)
       end
+
+      def bundler_version
+        @bundler_version ||= Helpers.bundler_version(lockfile)
+      end
     end
   end
 end

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -6,6 +6,7 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/bundler/file_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 
 module Dependabot
   module Bundler
@@ -64,8 +65,8 @@ module Dependabot
             ) do |tmp_dir|
               write_temporary_dependency_files
 
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "update_lockfile",
                 args: {
                   gemfile_name: gemfile.name,
@@ -301,6 +302,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/helpers.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Bundler
+    module Helpers
+      V1 = "1"
+      V2 = "2"
+
+      # TODO: Add support for bundler v2
+      # return "v2" if lockfile.content.match?(/BUNDLED WITH\s+2/m)
+      def self.bundler_version(_lockfile)
+        V1
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/native_helpers.rb

@@ -1,10 +1,39 @@
 # frozen_string_literal: true
 
+require "dependabot/shared_helpers"
+
 module Dependabot
   module Bundler
     module NativeHelpers
-      def self.helper_path
-        "bundle exec ruby #{File.join(native_helpers_root, 'run.rb')}"
+      def self.run_bundler_subprocess(function:, args:, bundler_version:)
+        SharedHelpers.run_helper_subprocess(
+          command: helper_path(bundler_version: bundler_version),
+          function: function,
+          args: args,
+          env: {
+            # Bundler will pick the matching installed major version
+            "BUNDLER_VERSION" => bundler_version,
+            # Force bundler to use the helper Gemfile that has been bundled with
+            # v1, otherwise it will point to core's bundler/Gemfile which will
+            # be bundled with v2 once it's installed
+            "BUNDLE_GEMFILE" => File.join(versioned_helper_path(bundler_version: bundler_version), "Gemfile"),
+            # Unset ruby env set by running dependabot-core with bundle exec,
+            # forcing bundler to reset them from helpers/v1
+            "RUBYLIB" => nil,
+            "RUBYOPT" => nil,
+            "GEM_PATH" => nil,
+            "GEM_HOME" => nil
+          }
+        )
+      end
+
+      def self.versioned_helper_path(bundler_version:)
+        native_helper_version = "v#{bundler_version}"
+        File.join(native_helpers_root, native_helper_version)
+      end
+
+      def self.helper_path(bundler_version:)
+        "bundle exec ruby #{File.join(versioned_helper_path(bundler_version: bundler_version), 'run.rb')}"
       end
 
       def self.native_helpers_root

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -28,8 +29,8 @@ module Dependabot
         #   * requirement [String] the requirement on the target_dependency
         def conflicting_dependencies(dependency:, target_version:)
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "conflicting_dependencies",
               args: {
                 dir: tmp_dir,
@@ -42,6 +43,12 @@ module Dependabot
             )
           end
         end
+
+        private
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/bundler/file_parser"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/update_checker/requirements_updater"
 require "dependabot/errors"
@@ -43,8 +44,8 @@ module Dependabot
 
         def force_update
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            updated_deps, specs = SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            updated_deps, specs = NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "force_update",
               args: {
                 dir: tmp_dir,
@@ -146,6 +147,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
+
 module Dependabot
   module Bundler
     class UpdateChecker
@@ -53,8 +56,8 @@ module Dependabot
 
             SharedHelpers.with_git_configured(credentials: credentials) do
               in_a_native_bundler_context do |tmp_dir|
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
+                NativeHelpers.run_bundler_subprocess(
+                  bundler_version: bundler_version,
                   function: "depencency_source_latest_git_version",
                   args: {
                     dir: tmp_dir,
@@ -98,8 +101,8 @@ module Dependabot
           def private_registry_versions
             @private_registry_versions ||=
               in_a_native_bundler_context do |tmp_dir|
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
+                NativeHelpers.run_bundler_subprocess(
+                  bundler_version: bundler_version,
                   function: "private_registry_versions",
                   args: {
                     dir: tmp_dir,
@@ -118,8 +121,8 @@ module Dependabot
             return @source_type = RUBYGEMS unless gemfile
 
             @source_type = in_a_native_bundler_context do |tmp_dir|
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "dependency_source_type",
                 args: {
                   dir: tmp_dir,
@@ -135,6 +138,15 @@ module Dependabot
             dependency_files.find { |f| f.name == "Gemfile" } ||
               dependency_files.find { |f| f.name == "gems.rb" }
           end
+
+          def lockfile
+            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
+              dependency_files.find { |f| f.name == "gems.locked" }
+          end
+
+          def bundler_version
+            @bundler_version ||= Helpers.bundler_version(lockfile)
+          end
         end
       end
     end

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -4,6 +4,7 @@ require "excon"
 
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 
@@ -163,8 +164,8 @@ module Dependabot
 
         def inaccessible_git_dependencies
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            git_specs = SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            git_specs = NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "git_specs",
               args: {
                 dir: tmp_dir,
@@ -187,8 +188,8 @@ module Dependabot
 
         def jfrog_source
           in_a_native_bundler_context(error_handling: false) do |dir|
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "jfrog_source",
               args: {
                 dir: dir,
@@ -236,6 +237,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -2,6 +2,7 @@
 
 require "excon"
 
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/requirement"
@@ -75,8 +76,8 @@ module Dependabot
             # some errors we want to handle specifically ourselves, including
             # potentially retrying in the case of the Ruby version being locked
             in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-              details =  SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              details = NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "resolve_version",
                 args: {
                   dependency_name: dependency.name,
@@ -218,6 +219,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.133.3
+  version: 0.134.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-16 00:00:00.000000000 Z
+date: 2021-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.133.3
+        version: 0.134.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.133.3
+        version: 0.134.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.10.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.10.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -185,18 +185,20 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- helpers/build
-- helpers/lib/functions.rb
-- helpers/lib/functions/conflicting_dependency_resolver.rb
-- helpers/lib/functions/dependency_source.rb
-- helpers/lib/functions/file_parser.rb
-- helpers/lib/functions/force_updater.rb
-- helpers/lib/functions/lockfile_updater.rb
-- helpers/lib/functions/version_resolver.rb
-- helpers/monkey_patches/definition_bundler_version_patch.rb
-- helpers/monkey_patches/definition_ruby_version_patch.rb
-- helpers/monkey_patches/git_source_patch.rb
-- helpers/run.rb
+- helpers/v1/.gitignore
+- helpers/v1/Gemfile
+- helpers/v1/build
+- helpers/v1/lib/functions.rb
+- helpers/v1/lib/functions/conflicting_dependency_resolver.rb
+- helpers/v1/lib/functions/dependency_source.rb
+- helpers/v1/lib/functions/file_parser.rb
+- helpers/v1/lib/functions/force_updater.rb
+- helpers/v1/lib/functions/lockfile_updater.rb
+- helpers/v1/lib/functions/version_resolver.rb
+- helpers/v1/monkey_patches/definition_bundler_version_patch.rb
+- helpers/v1/monkey_patches/definition_ruby_version_patch.rb
+- helpers/v1/monkey_patches/git_source_patch.rb
+- helpers/v1/run.rb
 - lib/dependabot/bundler.rb
 - lib/dependabot/bundler/file_fetcher.rb
 - lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb
@@ -216,6 +218,7 @@ files:
 - lib/dependabot/bundler/file_updater/lockfile_updater.rb
 - lib/dependabot/bundler/file_updater/requirement_replacer.rb
 - lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb
+- lib/dependabot/bundler/helpers.rb
 - lib/dependabot/bundler/metadata_finder.rb
 - lib/dependabot/bundler/native_helpers.rb
 - lib/dependabot/bundler/requirement.rb