dependabot-bundler 0.138.3 → 0.139.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 6fe43d8a687e3405df9f2704529fe54f9e79cdb75b6246d43a32e32e5a7b1928
4
- data.tar.gz: 67b1b3afd35f559613e57f6ef2a26ef9ee0c50910072b40c5d9ac412b830ed91
3
+ metadata.gz: 3c54dffe91f0389e710f63d92516f50b80d33c39f16ac16e5bf5d69dbf743cad
4
+ data.tar.gz: 2deecb17658d7f9f3833d54ae8359d1c177bd4840c771dd3eae175b455baec45
5
5
  SHA512:
6
- metadata.gz: 55bd706fffed2c9caa866237eea57fde3f91a83f465014865dacf2252094ad31e9098d0894c9b85da77f08e5ae0941f8a74ca1f1cfecec447775aa20541bcfae
7
- data.tar.gz: 563832a40283d4c9f29175b0cddc850ac88e461e65905e255f94234aee9c913690525016a2d12cbfdedb17f4d5c0873214863b324207277bbfc80bccee7c7f8f
6
+ metadata.gz: e25cba7a7f5d7f1c234a431b5a2aa7539a99e50c2e6865b659d0aeb82cbd9a69a7ef0d32ec2fe1d552f154ea8482270ca7899a7989b3ef72509c6d699d065827
7
+ data.tar.gz: 3e4cb3481a025eda7bb85440dfcef2d12a1dd5413176555953c695c9bdb03371c196d7432d7e9ec23ed16b2c19a3261dccfc1fc0ed0713ec50a56537b2ebeca6
data/helpers/v1/run.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "bundler"
2
4
  require "json"
3
5
 
@@ -27,6 +27,9 @@ LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
27
27
 
28
28
  def project_dependency_files(project)
29
29
  project_path = File.expand_path(File.join("../../spec/fixtures/projects/bundler1", project))
30
+
31
+ raise "Fixture does not exist for project: '#{project}'" unless Dir.exist?(project_path)
32
+
30
33
  Dir.chdir(project_path) do
31
34
  # NOTE: Include dotfiles (e.g. .npmrc)
32
35
  files = Dir.glob("**/*", File::FNM_DOTMATCH)
data/helpers/v2/build CHANGED
@@ -11,6 +11,7 @@ fi
11
11
  helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
12
12
  cp -r \
13
13
  "$helpers_dir/lib" \
14
+ "$helpers_dir/monkey_patches" \
14
15
  "$helpers_dir/run.rb" \
15
16
  "$helpers_dir/Gemfile" \
16
17
  "$install_dir"
@@ -1,67 +1,140 @@
1
- require "functions/file_parser"
1
+ # frozen_string_literal: true
2
+
2
3
  require "functions/conflicting_dependency_resolver"
4
+ require "functions/dependency_source"
5
+ require "functions/file_parser"
6
+ require "functions/force_updater"
7
+ require "functions/lockfile_updater"
8
+ require "functions/version_resolver"
3
9
 
4
10
  module Functions
5
11
  class NotImplementedError < StandardError; end
6
12
 
7
13
  def self.parsed_gemfile(lockfile_name:, gemfile_name:, dir:)
8
14
  set_bundler_flags_and_credentials(dir: dir, credentials: [],
9
- using_bundler2: false)
15
+ using_bundler2: false)
10
16
  FileParser.new(lockfile_name: lockfile_name).
11
17
  parsed_gemfile(gemfile_name: gemfile_name)
12
18
  end
13
19
 
14
20
  def self.parsed_gemspec(lockfile_name:, gemspec_name:, dir:)
15
21
  set_bundler_flags_and_credentials(dir: dir, credentials: [],
16
- using_bundler2: false)
22
+ using_bundler2: false)
17
23
  FileParser.new(lockfile_name: lockfile_name).
18
24
  parsed_gemspec(gemspec_name: gemspec_name)
19
25
  end
20
26
 
21
27
  def self.vendor_cache_dir(dir:)
22
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
28
+ set_bundler_flags_and_credentials(dir: dir, credentials: [],
29
+ using_bundler2: false)
30
+ Bundler.app_cache
23
31
  end
24
32
 
25
33
  def self.update_lockfile(dir:, gemfile_name:, lockfile_name:, using_bundler2:,
26
34
  credentials:, dependencies:)
27
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
35
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
36
+ using_bundler2: using_bundler2)
37
+ LockfileUpdater.new(
38
+ gemfile_name: gemfile_name,
39
+ lockfile_name: lockfile_name,
40
+ dependencies: dependencies
41
+ ).run
28
42
  end
29
43
 
30
44
  def self.force_update(dir:, dependency_name:, target_version:, gemfile_name:,
31
45
  lockfile_name:, using_bundler2:, credentials:,
32
46
  update_multiple_dependencies:)
33
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
47
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
48
+ using_bundler2: using_bundler2)
49
+ ForceUpdater.new(
50
+ dependency_name: dependency_name,
51
+ target_version: target_version,
52
+ gemfile_name: gemfile_name,
53
+ lockfile_name: lockfile_name,
54
+ update_multiple_dependencies: update_multiple_dependencies
55
+ ).run
34
56
  end
35
57
 
36
58
  def self.dependency_source_type(gemfile_name:, dependency_name:, dir:,
37
59
  credentials:)
38
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
60
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
61
+ using_bundler2: false)
62
+
63
+ DependencySource.new(
64
+ gemfile_name: gemfile_name,
65
+ dependency_name: dependency_name
66
+ ).type
39
67
  end
40
68
 
41
69
  def self.depencency_source_latest_git_version(gemfile_name:, dependency_name:,
42
70
  dir:, credentials:,
43
71
  dependency_source_url:,
44
72
  dependency_source_branch:)
45
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
73
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
74
+ using_bundler2: false)
75
+ DependencySource.new(
76
+ gemfile_name: gemfile_name,
77
+ dependency_name: dependency_name
78
+ ).latest_git_version(
79
+ dependency_source_url: dependency_source_url,
80
+ dependency_source_branch: dependency_source_branch
81
+ )
46
82
  end
47
83
 
48
84
  def self.private_registry_versions(gemfile_name:, dependency_name:, dir:,
49
85
  credentials:)
50
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
86
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
87
+ using_bundler2: false)
88
+
89
+ DependencySource.new(
90
+ gemfile_name: gemfile_name,
91
+ dependency_name: dependency_name
92
+ ).private_registry_versions
51
93
  end
52
94
 
53
95
  def self.resolve_version(dependency_name:, dependency_requirements:,
54
96
  gemfile_name:, lockfile_name:, using_bundler2:,
55
97
  dir:, credentials:)
56
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
98
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials, using_bundler2: using_bundler2)
99
+ VersionResolver.new(
100
+ dependency_name: dependency_name,
101
+ dependency_requirements: dependency_requirements,
102
+ gemfile_name: gemfile_name,
103
+ lockfile_name: lockfile_name
104
+ ).version_details
57
105
  end
58
106
 
59
107
  def self.jfrog_source(dir:, gemfile_name:, credentials:, using_bundler2:)
60
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
108
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials, using_bundler2: using_bundler2)
109
+
110
+ Bundler::Definition.build(gemfile_name, nil, {}).
111
+ send(:sources).
112
+ rubygems_remotes.
113
+ find { |uri| uri.host.include?("jfrog") }&.
114
+ host
61
115
  end
62
116
 
63
117
  def self.git_specs(dir:, gemfile_name:, credentials:, using_bundler2:)
64
- raise NotImplementedError, "Bundler 2 adapter does not yet implement #{__method__}"
118
+ set_bundler_flags_and_credentials(dir: dir, credentials: credentials,
119
+ using_bundler2: using_bundler2)
120
+
121
+ git_specs = Bundler::Definition.build(gemfile_name, nil, {}).dependencies.
122
+ select do |spec|
123
+ spec.source.is_a?(Bundler::Source::Git)
124
+ end
125
+ git_specs.map do |spec|
126
+ # Piggy-back off some private Bundler methods to configure the
127
+ # URI with auth details in the same way Bundler does.
128
+ git_proxy = spec.source.send(:git_proxy)
129
+ auth_uri = spec.source.uri.gsub("git://", "https://")
130
+ auth_uri = git_proxy.send(:configured_uri_for, auth_uri)
131
+ auth_uri += ".git" unless auth_uri.end_with?(".git")
132
+ auth_uri += "/info/refs?service=git-upload-pack"
133
+ {
134
+ uri: spec.source.uri,
135
+ auth_uri: auth_uri
136
+ }
137
+ end
65
138
  end
66
139
 
67
140
  def self.set_bundler_flags_and_credentials(dir:, credentials:,
@@ -0,0 +1,86 @@
1
+ module Functions
2
+ class DependencySource
3
+ attr_reader :gemfile_name, :dependency_name
4
+
5
+ RUBYGEMS = "rubygems"
6
+ PRIVATE_REGISTRY = "private"
7
+ GIT = "git"
8
+ OTHER = "other"
9
+
10
+ def initialize(gemfile_name:, dependency_name:)
11
+ @gemfile_name = gemfile_name
12
+ @dependency_name = dependency_name
13
+ end
14
+
15
+ def type
16
+ bundler_source = specified_source || default_source
17
+ type_of(bundler_source)
18
+ end
19
+
20
+ def latest_git_version(dependency_source_url:, dependency_source_branch:)
21
+ source = Bundler::Source::Git.new(
22
+ "uri" => dependency_source_url,
23
+ "branch" => dependency_source_branch,
24
+ "name" => dependency_name,
25
+ "submodules" => true
26
+ )
27
+
28
+ # Tell Bundler we're fine with fetching the source remotely
29
+ source.instance_variable_set(:@allow_remote, true)
30
+
31
+ spec = source.specs.first
32
+ { version: spec.version, commit_sha: spec.source.revision }
33
+ end
34
+
35
+ def private_registry_versions
36
+ bundler_source = specified_source || default_source
37
+
38
+ bundler_source.
39
+ fetchers.flat_map do |fetcher|
40
+ fetcher.
41
+ specs_with_retry([dependency_name], bundler_source).
42
+ search_all(dependency_name)
43
+ end.
44
+ map(&:version)
45
+ end
46
+
47
+ private
48
+
49
+ def type_of(bundler_source)
50
+ case bundler_source
51
+ when Bundler::Source::Rubygems
52
+ remote = bundler_source.remotes.first
53
+ if remote.nil? || remote.to_s == "https://rubygems.org/"
54
+ RUBYGEMS
55
+ else
56
+ PRIVATE_REGISTRY
57
+ end
58
+ when Bundler::Source::Git
59
+ GIT
60
+ else
61
+ OTHER
62
+ end
63
+ end
64
+
65
+ def specified_source
66
+ return @specified_source if defined? @specified_source
67
+
68
+ @specified_source = definition.dependencies.
69
+ find { |dep| dep.name == dependency_name }&.source
70
+ end
71
+
72
+ def default_source
73
+ definition.send(:sources).default_source
74
+ end
75
+
76
+ def definition
77
+ @definition ||= Bundler::Definition.build(gemfile_name, nil, {})
78
+ end
79
+
80
+ def serialize_bundler_source(source)
81
+ {
82
+ type: source.class.to_s
83
+ }
84
+ end
85
+ end
86
+ end
@@ -0,0 +1,167 @@
1
+ module Functions
2
+ class ForceUpdater
3
+ class TransitiveDependencyError < StandardError; end
4
+
5
+ def initialize(dependency_name:, target_version:, gemfile_name:,
6
+ lockfile_name:, update_multiple_dependencies:)
7
+ @dependency_name = dependency_name
8
+ @target_version = target_version
9
+ @gemfile_name = gemfile_name
10
+ @lockfile_name = lockfile_name
11
+ @update_multiple_dependencies = update_multiple_dependencies
12
+ end
13
+
14
+ def run
15
+ # Only allow upgrades. Otherwise it's unlikely that this
16
+ # resolution will be found by the FileUpdater
17
+ Bundler.settings.set_command_option(
18
+ "only_update_to_newer_versions",
19
+ true
20
+ )
21
+
22
+ dependencies_to_unlock = []
23
+
24
+ begin
25
+ definition = build_definition(dependencies_to_unlock: dependencies_to_unlock)
26
+ definition.resolve_remotely!
27
+ specs = definition.resolve
28
+ updates = [{ name: dependency_name }] +
29
+ dependencies_to_unlock.map { |dep| { name: dep.name } }
30
+ specs = specs.map do |dep|
31
+ {
32
+ name: dep.name,
33
+ version: dep.version
34
+ }
35
+ end
36
+ [updates, specs]
37
+ rescue Bundler::VersionConflict => e
38
+ raise unless update_multiple_dependencies?
39
+
40
+ # TODO: Not sure this won't unlock way too many things...
41
+ new_dependencies_to_unlock =
42
+ new_dependencies_to_unlock_from(
43
+ error: e,
44
+ already_unlocked: dependencies_to_unlock
45
+ )
46
+
47
+ raise if new_dependencies_to_unlock.none?
48
+
49
+ dependencies_to_unlock += new_dependencies_to_unlock
50
+ retry
51
+ end
52
+ end
53
+
54
+ private
55
+
56
+ attr_reader :dependency_name, :target_version, :gemfile_name,
57
+ :lockfile_name, :credentials,
58
+ :update_multiple_dependencies
59
+ alias update_multiple_dependencies? update_multiple_dependencies
60
+
61
+ def new_dependencies_to_unlock_from(error:, already_unlocked:)
62
+ potentials_deps =
63
+ relevant_conflicts(error, already_unlocked).
64
+ flat_map(&:requirement_trees).
65
+ reject do |tree|
66
+ # If the final requirement wasn't specific, it can't be binding
67
+ next true if tree.last.requirement == Gem::Requirement.new(">= 0")
68
+
69
+ # If the conflict wasn't for the dependency we're updating then
70
+ # we don't have enough info to reject it
71
+ next false unless tree.last.name == dependency_name
72
+
73
+ # If the final requirement *was* for the dependency we're updating
74
+ # then we can ignore the tree if it permits the target version
75
+ tree.last.requirement.satisfied_by?(
76
+ Gem::Version.new(target_version)
77
+ )
78
+ end.map(&:first)
79
+
80
+ potentials_deps.
81
+ reject { |dep| already_unlocked.map(&:name).include?(dep.name) }.
82
+ reject { |dep| [dependency_name, "ruby\0"].include?(dep.name) }.
83
+ uniq
84
+ end
85
+
86
+ def relevant_conflicts(error, dependencies_being_unlocked)
87
+ names = [*dependencies_being_unlocked.map(&:name), dependency_name]
88
+
89
+ # For a conflict to be relevant to the updates we're making it must be
90
+ # 1) caused by a new requirement introduced by our unlocking, or
91
+ # 2) caused by an old requirement that prohibits the update.
92
+ # Hence, we look at the beginning and end of the requirement trees
93
+ error.cause.conflicts.values.
94
+ select do |conflict|
95
+ conflict.requirement_trees.any? do |t|
96
+ names.include?(t.last.name) || names.include?(t.first.name)
97
+ end
98
+ end
99
+ end
100
+
101
+ def build_definition(dependencies_to_unlock:)
102
+ gems_to_unlock = dependencies_to_unlock.map(&:name) + [dependency_name]
103
+ definition = Bundler::Definition.build(
104
+ gemfile_name,
105
+ lockfile_name,
106
+ gems: gems_to_unlock + subdependencies,
107
+ lock_shared_dependencies: true
108
+ )
109
+
110
+ # Remove the Gemfile / gemspec requirements on the gems we're
111
+ # unlocking (i.e., completely unlock them)
112
+ gems_to_unlock.each do |gem_name|
113
+ unlock_gem(definition: definition, gem_name: gem_name)
114
+ end
115
+
116
+ dep = definition.dependencies.
117
+ find { |d| d.name == dependency_name }
118
+
119
+ # If the dependency is not found in the Gemfile it means this is a
120
+ # transitive dependency that we can't force update.
121
+ raise TransitiveDependencyError unless dep
122
+
123
+ # Set the requirement for the gem we're forcing an update of
124
+ new_req = Gem::Requirement.create("= #{target_version}")
125
+ dep.instance_variable_set(:@requirement, new_req)
126
+ dep.source = nil if dep.source.is_a?(Bundler::Source::Git)
127
+
128
+ definition
129
+ end
130
+
131
+ def lockfile
132
+ return @lockfile if defined?(@lockfile)
133
+
134
+ @lockfile =
135
+ begin
136
+ return unless lockfile_name && File.exist?(lockfile_name)
137
+
138
+ File.read(lockfile_name)
139
+ end
140
+ end
141
+
142
+ def subdependencies
143
+ # If there's no lockfile we don't need to worry about
144
+ # subdependencies
145
+ return [] unless lockfile
146
+
147
+ all_deps = Bundler::LockfileParser.new(lockfile).
148
+ specs.map(&:name).map(&:to_s)
149
+ top_level = Bundler::Definition.
150
+ build(gemfile_name, lockfile_name, {}).
151
+ dependencies.map(&:name).map(&:to_s)
152
+
153
+ all_deps - top_level
154
+ end
155
+
156
+ def unlock_gem(definition:, gem_name:)
157
+ dep = definition.dependencies.find { |d| d.name == gem_name }
158
+ version = definition.locked_gems.specs.
159
+ find { |d| d.name == gem_name }.version
160
+
161
+ dep&.instance_variable_set(
162
+ :@requirement,
163
+ Gem::Requirement.create(">= #{version}")
164
+ )
165
+ end
166
+ end
167
+ end
@@ -0,0 +1,224 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Functions
4
+ class LockfileUpdater
5
+ RETRYABLE_ERRORS = [Bundler::HTTPError].freeze
6
+ GEM_NOT_FOUND_ERROR_REGEX =
7
+ /
8
+ locked\sto\s(?<name>[^\s]+)\s\(|
9
+ not\sfind\s(?<name>[^\s]+)-\d|
10
+ has\s(?<name>[^\s]+)\slocked\sat
11
+ /x.freeze
12
+
13
+ def initialize(gemfile_name:, lockfile_name:, dependencies:)
14
+ @gemfile_name = gemfile_name
15
+ @lockfile_name = lockfile_name
16
+ @dependencies = dependencies
17
+ end
18
+
19
+ def run
20
+ generate_lockfile
21
+ end
22
+
23
+ private
24
+
25
+ attr_reader :gemfile_name, :lockfile_name, :dependencies
26
+
27
+ def generate_lockfile
28
+ dependencies_to_unlock = dependencies.map { |d| d.fetch("name") }
29
+
30
+ begin
31
+ definition = build_definition(dependencies_to_unlock)
32
+
33
+ old_reqs = lock_deps_being_updated_to_exact_versions(definition)
34
+
35
+ definition.resolve_remotely!
36
+
37
+ old_reqs.each do |dep_name, old_req|
38
+ d_dep = definition.dependencies.find { |d| d.name == dep_name }
39
+ if old_req == :none then definition.dependencies.delete(d_dep)
40
+ else
41
+ d_dep.instance_variable_set(:@requirement, old_req)
42
+ end
43
+ end
44
+
45
+ cache_vendored_gems(definition) if Bundler.app_cache.exist?
46
+
47
+ definition.to_lock
48
+ rescue Bundler::GemNotFound => e
49
+ unlock_yanked_gem(dependencies_to_unlock, e) && retry
50
+ rescue Bundler::VersionConflict => e
51
+ unlock_blocking_subdeps(dependencies_to_unlock, e) && retry
52
+ rescue *RETRYABLE_ERRORS
53
+ raise if @retrying
54
+
55
+ @retrying = true
56
+ sleep(rand(1.0..5.0))
57
+ retry
58
+ end
59
+ end
60
+
61
+ def cache_vendored_gems(definition)
62
+ # Dependencies that have been unlocked for the update (including
63
+ # sub-dependencies)
64
+ unlocked_gems = definition.instance_variable_get(:@unlock).
65
+ fetch(:gems).reject { |gem| __keep_on_prune?(gem) }
66
+ bundler_opts = {
67
+ cache_all: true,
68
+ cache_all_platforms: true,
69
+ no_prune: true
70
+ }
71
+
72
+ Bundler.settings.temporary(**bundler_opts) do
73
+ # Fetch and cache gems on all platforms without pruning
74
+ Bundler::Runtime.new(nil, definition).cache
75
+
76
+ # Only prune unlocked gems (the original implementation is in
77
+ # Bundler::Runtime)
78
+ cache_path = Bundler.app_cache
79
+ resolve = definition.resolve
80
+ prune_gem_cache(resolve, cache_path, unlocked_gems)
81
+ prune_git_and_path_cache(resolve, cache_path)
82
+ end
83
+ end
84
+
85
+ # This is not officially supported and may be removed without notice.
86
+ def __keep_on_prune?(spec_name)
87
+ unless (specs = Bundler.settings[:persistent_gems_after_clean])
88
+ return false
89
+ end
90
+
91
+ specs.include?(spec_name)
92
+ end
93
+
94
+ # Copied from Bundler::Runtime: Modified to only prune gems that have
95
+ # been unlocked
96
+ def prune_gem_cache(resolve, cache_path, unlocked_gems)
97
+ cached_gems = Dir["#{cache_path}/*.gem"]
98
+
99
+ outdated_gems = cached_gems.reject do |path|
100
+ spec = Bundler.rubygems.spec_from_gem path
101
+
102
+ !unlocked_gems.include?(spec.name) || resolve.any? do |s|
103
+ s.name == spec.name && s.version == spec.version &&
104
+ !s.source.is_a?(Bundler::Source::Git)
105
+ end
106
+ end
107
+
108
+ return unless outdated_gems.any?
109
+
110
+ outdated_gems.each do |path|
111
+ File.delete(path)
112
+ end
113
+ end
114
+
115
+ # Copied from Bundler::Runtime
116
+ def prune_git_and_path_cache(resolve, cache_path)
117
+ cached_git_and_path = Dir["#{cache_path}/*/.bundlecache"]
118
+
119
+ outdated_git_and_path = cached_git_and_path.reject do |path|
120
+ name = File.basename(File.dirname(path))
121
+
122
+ resolve.any? do |s|
123
+ s.source.respond_to?(:app_cache_dirname) &&
124
+ s.source.app_cache_dirname == name
125
+ end
126
+ end
127
+
128
+ return unless outdated_git_and_path.any?
129
+
130
+ outdated_git_and_path.each do |path|
131
+ path = File.dirname(path)
132
+ FileUtils.rm_rf(path)
133
+ end
134
+ end
135
+
136
+ def unlock_yanked_gem(dependencies_to_unlock, error)
137
+ raise unless error.message.match?(GEM_NOT_FOUND_ERROR_REGEX)
138
+
139
+ gem_name = error.message.match(GEM_NOT_FOUND_ERROR_REGEX).
140
+ named_captures["name"]
141
+ raise if dependencies_to_unlock.include?(gem_name)
142
+
143
+ dependencies_to_unlock << gem_name
144
+ end
145
+
146
+ # rubocop:disable Metrics/PerceivedComplexity
147
+ def unlock_blocking_subdeps(dependencies_to_unlock, error)
148
+ all_deps = Bundler::LockfileParser.new(lockfile).
149
+ specs.map(&:name).map(&:to_s)
150
+ top_level = build_definition([]).dependencies.
151
+ map(&:name).map(&:to_s)
152
+ allowed_new_unlocks = all_deps - top_level - dependencies_to_unlock
153
+
154
+ raise if allowed_new_unlocks.none?
155
+
156
+ # Unlock any sub-dependencies that Bundler reports caused the
157
+ # conflict
158
+ potentials_deps =
159
+ error.cause.conflicts.values.
160
+ flat_map(&:requirement_trees).
161
+ map do |tree|
162
+ tree.find { |req| allowed_new_unlocks.include?(req.name) }
163
+ end.compact.map(&:name)
164
+
165
+ # If there are specific dependencies we can unlock, unlock them
166
+ return dependencies_to_unlock.append(*potentials_deps) if potentials_deps.any?
167
+
168
+ # Fall back to unlocking *all* sub-dependencies. This is required
169
+ # because Bundler's VersionConflict objects don't include enough
170
+ # information to chart the full path through all conflicts unwound
171
+ dependencies_to_unlock.append(*allowed_new_unlocks)
172
+ end
173
+ # rubocop:enable Metrics/PerceivedComplexity
174
+
175
+ def build_definition(dependencies_to_unlock)
176
+ defn = Bundler::Definition.build(
177
+ gemfile_name,
178
+ lockfile_name,
179
+ gems: dependencies_to_unlock
180
+ )
181
+
182
+ # Bundler unlocks the sub-dependencies of gems it is passed even
183
+ # if those sub-deps are top-level dependencies. We only want true
184
+ # subdeps unlocked, like they were in the UpdateChecker, so we
185
+ # mutate the unlocked gems array.
186
+ unlocked = defn.instance_variable_get(:@unlock).fetch(:gems)
187
+ must_not_unlock = defn.dependencies.map(&:name).map(&:to_s) -
188
+ dependencies_to_unlock
189
+ unlocked.reject! { |n| must_not_unlock.include?(n) }
190
+
191
+ defn
192
+ end
193
+
194
+ def lock_deps_being_updated_to_exact_versions(definition)
195
+ dependencies.each_with_object({}) do |dep, old_reqs|
196
+ defn_dep = definition.dependencies.find do |d|
197
+ d.name == dep.fetch("name")
198
+ end
199
+
200
+ if defn_dep.nil?
201
+ definition.dependencies <<
202
+ Bundler::Dependency.new(dep.fetch("name"), dep.fetch("version"))
203
+ old_reqs[dep.fetch("name")] = :none
204
+ elsif git_dependency?(dep) &&
205
+ defn_dep.source.is_a?(Bundler::Source::Git)
206
+ defn_dep.source.unlock!
207
+ elsif Gem::Version.correct?(dep.fetch("version"))
208
+ new_req = Gem::Requirement.create("= #{dep.fetch('version')}")
209
+ old_reqs[dep.fetch("name")] = defn_dep.requirement
210
+ defn_dep.instance_variable_set(:@requirement, new_req)
211
+ end
212
+ end
213
+ end
214
+
215
+ def git_dependency?(dep)
216
+ sources = dep.fetch("requirements").map { |r| r.fetch("source") }
217
+ sources.all? { |s| s&.fetch("type", nil) == "git" }
218
+ end
219
+
220
+ def lockfile
221
+ @lockfile ||= File.read(lockfile_name)
222
+ end
223
+ end
224
+ end