dependabot-bundler 0.138.2 → 0.138.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2eb2653cea8a396b9d65f20ea24e8680bdcb0909c2e28ad045beca904f2a984b
-  data.tar.gz: d7ffc19ecc9db88a04e5222f132e18f94f353eb806ef454d0e958c531531dbd5
+  metadata.gz: b879a336288560d831472f3d6163c9fc391159001388ce2b1454154af3b7e026
+  data.tar.gz: cd9f4ca835e065ba322f6edf43830954714396e2e33a292cbdb0ca8defe776bb
 SHA512:
-  metadata.gz: 28ea0b95452a1c7bc2cf7fe5d3c211c678a89d5b062f7184dc23fd06dd5f8df8a61ccd9e66abb3a807fc10958f74623245ef4809830600a44ce6472095ce369a
-  data.tar.gz: 46c21b5dbc8ddaac57a40c1a6e48c16427562c829d6b29879a5b1b6d77b9d3c16ebdef515ef32c6f71d4c57c4feeed57ff22ee7f78a6839991e3444cefd44181
+  metadata.gz: e688088af198726160d18a81d649ced5627ac3311b80449698d1854ca656d9bf411f792553a99ad9cc45b012af97df82c5cac0753bed375c5a4009867759df3e
+  data.tar.gz: aa6730e552463a32bef72bc0ceb7209ead39f327994b547fb3345a167cbbf7f7cc0c10a8e5f756b2d2ec41e7227e11fffef60e716bb158e7e40025c77fa1a39a

data/helpers/v1/build

@@ -21,4 +21,5 @@ cd "$install_dir"
 
 # NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
 # forcing native helpers to run with the same version
-BUNDLER_VERSION=1 bundle install --without test
+BUNDLER_VERSION=1 bundle config set --local without "test"
+BUNDLER_VERSION=1 bundle install

data/helpers/v1/run.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "bundler"
 require "json"
 
@@ -11,11 +13,25 @@ require "git_source_patch"
 
 require "functions"
 
+MAX_BUNDLER_VERSION="2.0.0"
+
+def validate_bundler_version!
+  return true if correct_bundler_version?
+
+  raise StandardError, "Called with Bundler '#{Bundler::VERSION}', expected < '#{MAX_BUNDLER_VERSION}'"
+end
+
+def correct_bundler_version?
+  Gem::Version.new(Bundler::VERSION) < Gem::Version.new(MAX_BUNDLER_VERSION)
+end
+
 def output(obj)
   print JSON.dump(obj)
 end
 
 begin
+  validate_bundler_version!
+
   request = JSON.parse($stdin.read)
 
   function = request["function"]

data/helpers/v1/spec/native_spec_helper.rb

@@ -27,6 +27,9 @@ LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
 
 def project_dependency_files(project)
   project_path = File.expand_path(File.join("../../spec/fixtures/projects/bundler1", project))
+
+  raise "Fixture does not exist for project: '#{project}'" unless Dir.exist?(project_path)
+
   Dir.chdir(project_path) do
     # NOTE: Include dotfiles (e.g. .npmrc)
     files = Dir.glob("**/*", File::FNM_DOTMATCH)

data/helpers/v2/build

@@ -11,6 +11,7 @@ fi
 helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
 cp -r \
   "$helpers_dir/lib" \
+  "$helpers_dir/monkey_patches" \
   "$helpers_dir/run.rb" \
   "$helpers_dir/Gemfile" \
   "$install_dir"
@@ -20,4 +21,5 @@ cd "$install_dir"
 # NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
 # forcing specs and native helpers to run with the same version
 BUNDLER_VERSION=2 bundle config set --local path ".bundle"
-BUNDLER_VERSION=2 bundle install --without test
+BUNDLER_VERSION=2 bundle config set --local without "test"
+BUNDLER_VERSION=2 bundle install

data/helpers/v2/lib/functions.rb

@@ -1,66 +1,140 @@
+# frozen_string_literal: true
+
+require "functions/conflicting_dependency_resolver"
+require "functions/dependency_source"
 require "functions/file_parser"
+require "functions/force_updater"
+require "functions/lockfile_updater"
+require "functions/version_resolver"
 
 module Functions
   class NotImplementedError < StandardError; end
 
   def self.parsed_gemfile(lockfile_name:, gemfile_name:, dir:)
     set_bundler_flags_and_credentials(dir: dir, credentials: [],
-      using_bundler2: false)
+                                      using_bundler2: false)
     FileParser.new(lockfile_name: lockfile_name).
       parsed_gemfile(gemfile_name: gemfile_name)
   end
 
   def self.parsed_gemspec(lockfile_name:, gemspec_name:, dir:)
     set_bundler_flags_and_credentials(dir: dir, credentials: [],
-      using_bundler2: false)
+                                      using_bundler2: false)
     FileParser.new(lockfile_name: lockfile_name).
       parsed_gemspec(gemspec_name: gemspec_name)
   end
 
   def self.vendor_cache_dir(dir:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: [],
+                                      using_bundler2: false)
+    Bundler.app_cache
   end
 
   def self.update_lockfile(dir:, gemfile_name:, lockfile_name:, using_bundler2:,
                            credentials:, dependencies:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: using_bundler2)
+    LockfileUpdater.new(
+      gemfile_name: gemfile_name,
+      lockfile_name: lockfile_name,
+      dependencies: dependencies
+    ).run
   end
 
   def self.force_update(dir:, dependency_name:, target_version:, gemfile_name:,
                         lockfile_name:, using_bundler2:, credentials:,
                         update_multiple_dependencies:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: using_bundler2)
+    ForceUpdater.new(
+      dependency_name: dependency_name,
+      target_version: target_version,
+      gemfile_name: gemfile_name,
+      lockfile_name: lockfile_name,
+      update_multiple_dependencies: update_multiple_dependencies
+    ).run
   end
 
   def self.dependency_source_type(gemfile_name:, dependency_name:, dir:,
                                   credentials:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: false)
+
+    DependencySource.new(
+      gemfile_name: gemfile_name,
+      dependency_name: dependency_name
+    ).type
   end
 
   def self.depencency_source_latest_git_version(gemfile_name:, dependency_name:,
                                                 dir:, credentials:,
                                                 dependency_source_url:,
                                                 dependency_source_branch:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: false)
+    DependencySource.new(
+      gemfile_name: gemfile_name,
+      dependency_name: dependency_name
+    ).latest_git_version(
+      dependency_source_url: dependency_source_url,
+      dependency_source_branch: dependency_source_branch
+    )
   end
 
   def self.private_registry_versions(gemfile_name:, dependency_name:, dir:,
                                      credentials:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: false)
+
+    DependencySource.new(
+      gemfile_name: gemfile_name,
+      dependency_name: dependency_name
+    ).private_registry_versions
   end
 
   def self.resolve_version(dependency_name:, dependency_requirements:,
                            gemfile_name:, lockfile_name:, using_bundler2:,
                            dir:, credentials:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials, using_bundler2: using_bundler2)
+    VersionResolver.new(
+      dependency_name: dependency_name,
+      dependency_requirements: dependency_requirements,
+      gemfile_name: gemfile_name,
+      lockfile_name: lockfile_name
+    ).version_details
   end
 
   def self.jfrog_source(dir:, gemfile_name:, credentials:, using_bundler2:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials, using_bundler2: using_bundler2)
+
+    Bundler::Definition.build(gemfile_name, nil, {}).
+      send(:sources).
+      rubygems_remotes.
+      find { |uri| uri.host.include?("jfrog") }&.
+      host
   end
 
   def self.git_specs(dir:, gemfile_name:, credentials:, using_bundler2:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: using_bundler2)
+
+    git_specs = Bundler::Definition.build(gemfile_name, nil, {}).dependencies.
+                select do |spec|
+      spec.source.is_a?(Bundler::Source::Git)
+    end
+    git_specs.map do |spec|
+      # Piggy-back off some private Bundler methods to configure the
+      # URI with auth details in the same way Bundler does.
+      git_proxy = spec.source.send(:git_proxy)
+      auth_uri = spec.source.uri.gsub("git://", "https://")
+      auth_uri = git_proxy.send(:configured_uri_for, auth_uri)
+      auth_uri += ".git" unless auth_uri.end_with?(".git")
+      auth_uri += "/info/refs?service=git-upload-pack"
+      {
+        uri: spec.source.uri,
+        auth_uri: auth_uri
+      }
+    end
   end
 
   def self.set_bundler_flags_and_credentials(dir:, credentials:,
@@ -110,6 +184,12 @@ module Functions
 
   def self.conflicting_dependencies(dir:, dependency_name:, target_version:,
                                     lockfile_name:, using_bundler2:, credentials:)
-    raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
+    set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
+                                      using_bundler2: using_bundler2)
+    ConflictingDependencyResolver.new(
+      dependency_name: dependency_name,
+      target_version: target_version,
+      lockfile_name: lockfile_name
+    ).conflicting_dependencies
   end
 end

data/helpers/v2/lib/functions/conflicting_dependency_resolver.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module Functions
+  class ConflictingDependencyResolver
+    def initialize(dependency_name:, target_version:, lockfile_name:)
+      @dependency_name = dependency_name
+      @target_version = target_version
+      @lockfile_name = lockfile_name
+    end
+
+    # Finds any dependencies in the lockfile that have a subdependency on the
+    # given dependency that does not satisfly the target_version.
+    # @return [Array<Hash{String => String}]
+    #   * explanation [String] a sentence explaining the conflict
+    #   * name [String] the blocking dependencies name
+    #   * version [String] the version of the blocking dependency
+    #   * requirement [String] the requirement on the target_dependency
+    def conflicting_dependencies
+      Bundler.settings.set_command_option("only_update_to_newer_versions", true)
+
+      parent_specs.flat_map do |parent_spec|
+        top_level_specs_for(parent_spec).map do |top_level|
+          dependency = parent_spec.dependencies.find { |bd| bd.name == dependency_name }
+          {
+            "explanation" => explanation(parent_spec, dependency, top_level),
+            "name" => parent_spec.name,
+            "version" => parent_spec.version.to_s,
+            "requirement" => dependency.requirement.to_s
+          }
+        end
+      end
+    end
+
+    private
+
+    attr_reader :dependency_name, :target_version, :lockfile_name
+
+    def parent_specs
+      version = Gem::Version.new(target_version)
+      parsed_lockfile.specs.filter do |spec|
+        spec.dependencies.any? do |dep|
+          dep.name == dependency_name &&
+            !dep.requirement.satisfied_by?(version)
+        end
+      end
+    end
+
+    def top_level_specs_for(parent_spec)
+      return [parent_spec] if top_level?(parent_spec)
+
+      parsed_lockfile.specs.filter do |spec|
+        spec.dependencies.any? do |dep|
+          dep.name == parent_spec.name && top_level?(spec)
+        end
+      end
+    end
+
+    def top_level?(spec)
+      parsed_lockfile.dependencies.key?(spec.name)
+    end
+
+    def explanation(spec, dependency, top_level)
+      if spec.name == top_level.name
+        "#{spec.name} (#{spec.version}) requires #{dependency_name} (#{dependency.requirement})"
+      else
+        "#{top_level.name} (#{top_level.version}) requires #{dependency_name} "\
+          "(#{dependency.requirement}) via #{spec.name} (#{spec.version})"
+      end
+    end
+
+    def parsed_lockfile
+      @parsed_lockfile ||= Bundler::LockfileParser.new(lockfile)
+    end
+
+    def lockfile
+      return @lockfile if defined?(@lockfile)
+
+      @lockfile =
+        begin
+          return unless lockfile_name && File.exist?(lockfile_name)
+
+          File.read(lockfile_name)
+        end
+    end
+  end
+end

data/helpers/v2/lib/functions/dependency_source.rb

@@ -0,0 +1,86 @@
+module Functions
+  class DependencySource
+    attr_reader :gemfile_name, :dependency_name
+
+    RUBYGEMS = "rubygems"
+    PRIVATE_REGISTRY = "private"
+    GIT = "git"
+    OTHER = "other"
+
+    def initialize(gemfile_name:, dependency_name:)
+      @gemfile_name = gemfile_name
+      @dependency_name = dependency_name
+    end
+
+    def type
+      bundler_source = specified_source || default_source
+      type_of(bundler_source)
+    end
+
+    def latest_git_version(dependency_source_url:, dependency_source_branch:)
+      source = Bundler::Source::Git.new(
+        "uri" => dependency_source_url,
+        "branch" => dependency_source_branch,
+        "name" => dependency_name,
+        "submodules" => true
+      )
+
+      # Tell Bundler we're fine with fetching the source remotely
+      source.instance_variable_set(:@allow_remote, true)
+
+      spec = source.specs.first
+      { version: spec.version, commit_sha: spec.source.revision }
+    end
+
+    def private_registry_versions
+      bundler_source = specified_source || default_source
+
+      bundler_source.
+        fetchers.flat_map do |fetcher|
+          fetcher.
+            specs_with_retry([dependency_name], bundler_source).
+            search_all(dependency_name)
+        end.
+        map(&:version)
+    end
+
+    private
+
+    def type_of(bundler_source)
+      case bundler_source
+      when Bundler::Source::Rubygems
+        remote = bundler_source.remotes.first
+        if remote.nil? || remote.to_s == "https://rubygems.org/"
+          RUBYGEMS
+        else
+          PRIVATE_REGISTRY
+        end
+      when Bundler::Source::Git
+        GIT
+      else
+        OTHER
+      end
+    end
+
+    def specified_source
+      return @specified_source if defined? @specified_source
+
+      @specified_source = definition.dependencies.
+        find { |dep| dep.name == dependency_name }&.source
+    end
+
+    def default_source
+      definition.send(:sources).default_source
+    end
+
+    def definition
+      @definition ||= Bundler::Definition.build(gemfile_name, nil, {})
+    end
+
+    def serialize_bundler_source(source)
+      {
+        type: source.class.to_s
+      }
+    end
+  end
+end

data/helpers/v2/lib/functions/force_updater.rb

@@ -0,0 +1,167 @@
+module Functions
+  class ForceUpdater
+    class TransitiveDependencyError < StandardError; end
+
+    def initialize(dependency_name:, target_version:, gemfile_name:,
+                   lockfile_name:, update_multiple_dependencies:)
+      @dependency_name = dependency_name
+      @target_version = target_version
+      @gemfile_name = gemfile_name
+      @lockfile_name = lockfile_name
+      @update_multiple_dependencies = update_multiple_dependencies
+    end
+
+    def run
+      # Only allow upgrades. Otherwise it's unlikely that this
+      # resolution will be found by the FileUpdater
+      Bundler.settings.set_command_option(
+        "only_update_to_newer_versions",
+        true
+      )
+
+      dependencies_to_unlock = []
+
+      begin
+        definition = build_definition(dependencies_to_unlock: dependencies_to_unlock)
+        definition.resolve_remotely!
+        specs = definition.resolve
+        updates = [{ name: dependency_name }] +
+                  dependencies_to_unlock.map { |dep| { name: dep.name } }
+        specs = specs.map do |dep|
+          {
+            name: dep.name,
+            version: dep.version
+          }
+        end
+        [updates, specs]
+      rescue Bundler::VersionConflict => e
+        raise unless update_multiple_dependencies?
+
+        # TODO: Not sure this won't unlock way too many things...
+        new_dependencies_to_unlock =
+          new_dependencies_to_unlock_from(
+            error: e,
+            already_unlocked: dependencies_to_unlock
+          )
+
+        raise if new_dependencies_to_unlock.none?
+
+        dependencies_to_unlock += new_dependencies_to_unlock
+        retry
+      end
+    end
+
+    private
+
+    attr_reader :dependency_name, :target_version, :gemfile_name,
+                :lockfile_name, :credentials,
+                :update_multiple_dependencies
+    alias update_multiple_dependencies? update_multiple_dependencies
+
+    def new_dependencies_to_unlock_from(error:, already_unlocked:)
+      potentials_deps =
+        relevant_conflicts(error, already_unlocked).
+        flat_map(&:requirement_trees).
+        reject do |tree|
+          # If the final requirement wasn't specific, it can't be binding
+          next true if tree.last.requirement == Gem::Requirement.new(">= 0")
+
+          # If the conflict wasn't for the dependency we're updating then
+          # we don't have enough info to reject it
+          next false unless tree.last.name == dependency_name
+
+          # If the final requirement *was* for the dependency we're updating
+          # then we can ignore the tree if it permits the target version
+          tree.last.requirement.satisfied_by?(
+            Gem::Version.new(target_version)
+          )
+        end.map(&:first)
+
+      potentials_deps.
+        reject { |dep| already_unlocked.map(&:name).include?(dep.name) }.
+        reject { |dep| [dependency_name, "ruby\0"].include?(dep.name) }.
+        uniq
+    end
+
+    def relevant_conflicts(error, dependencies_being_unlocked)
+      names = [*dependencies_being_unlocked.map(&:name), dependency_name]
+
+      # For a conflict to be relevant to the updates we're making it must be
+      # 1) caused by a new requirement introduced by our unlocking, or
+      # 2) caused by an old requirement that prohibits the update.
+      # Hence, we look at the beginning and end of the requirement trees
+      error.cause.conflicts.values.
+        select do |conflict|
+          conflict.requirement_trees.any? do |t|
+            names.include?(t.last.name) || names.include?(t.first.name)
+          end
+        end
+    end
+
+    def build_definition(dependencies_to_unlock:)
+      gems_to_unlock = dependencies_to_unlock.map(&:name) + [dependency_name]
+      definition = Bundler::Definition.build(
+        gemfile_name,
+        lockfile_name,
+        gems: gems_to_unlock + subdependencies,
+        lock_shared_dependencies: true
+      )
+
+      # Remove the Gemfile / gemspec requirements on the gems we're
+      # unlocking (i.e., completely unlock them)
+      gems_to_unlock.each do |gem_name|
+        unlock_gem(definition: definition, gem_name: gem_name)
+      end
+
+      dep = definition.dependencies.
+            find { |d| d.name == dependency_name }
+
+      # If the dependency is not found in the Gemfile it means this is a
+      # transitive dependency that we can't force update.
+      raise TransitiveDependencyError unless dep
+
+      # Set the requirement for the gem we're forcing an update of
+      new_req = Gem::Requirement.create("= #{target_version}")
+      dep.instance_variable_set(:@requirement, new_req)
+      dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
+
+      definition
+    end
+
+    def lockfile
+      return @lockfile if defined?(@lockfile)
+
+      @lockfile =
+        begin
+          return unless lockfile_name && File.exist?(lockfile_name)
+
+          File.read(lockfile_name)
+        end
+    end
+
+    def subdependencies
+      # If there's no lockfile we don't need to worry about
+      # subdependencies
+      return [] unless lockfile
+
+      all_deps =  Bundler::LockfileParser.new(lockfile).
+                  specs.map(&:name).map(&:to_s)
+      top_level = Bundler::Definition.
+                  build(gemfile_name, lockfile_name, {}).
+                  dependencies.map(&:name).map(&:to_s)
+
+      all_deps - top_level
+    end
+
+    def unlock_gem(definition:, gem_name:)
+      dep = definition.dependencies.find { |d| d.name == gem_name }
+      version = definition.locked_gems.specs.
+                find { |d| d.name == gem_name }.version
+
+      dep&.instance_variable_set(
+        :@requirement,
+        Gem::Requirement.create(">= #{version}")
+      )
+    end
+  end
+end