dependabot-bundler 0.154.1 → 0.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4c7a6dabbb638051a34a81c9763343a4e598ab7e87b91c870f54aa1e6312cd7
-  data.tar.gz: eb54e6a2653c30591b9030bc45af955e6a8686c4e6d9e1884c4c255a4322f8cd
+  metadata.gz: 151177d2265192564ccf99d2dbc692f62638be0dbfbbc885ee103eea3859c7b2
+  data.tar.gz: 2bb1f7f8193cdde62b1b6fb699cbfc9b5d85b2a0b8c09275632fede4d14f6c6c
 SHA512:
-  metadata.gz: '083566caefd79a0cb3ecea7fbae3c879e069b4a1271a861d3844e950b2315f7f02a57bd5da74e877d63b6788c9b4b4e9781495a832f9579da36027c1062c744d'
-  data.tar.gz: 6d737f4077de2c9715fc9f12b340b5e97e999ed19d6762eaea54061b15f9c48e2ab6285eab640c79207991a4357121c28e568e9d0b25ee8376f44ea2aeebbb7f
+  metadata.gz: b5b4dfae6b4266a2b05b6a7d4ff133d5ea750521c6861f9a53eacc9207bc7668853704d2640c0a3ebd21ac5ecd9d75c967df3e73a69133d5fce46d413a103b05
+  data.tar.gz: f11e8fc386f6ea3b3cc2382e5a91cd5ba024d3b2e838a46c783bffa98aa7d20f9d088fc6217eb238d4f1b78ef4aee4d138f01573a2147c166dce5c3e370cb6e1

data/helpers/v1/spec/functions/force_updater_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "native_spec_helper"
+require "shared_contexts"
+
+RSpec.describe Functions::ForceUpdater do
+  include_context "in a temporary bundler directory"
+  include_context "stub rubygems compact index"
+
+  let(:force_updater) do
+    described_class.new(
+      dependency_name: dependency_name,
+      target_version: target_version,
+      gemfile_name: gemfile_name,
+      lockfile_name: lockfile_name,
+      update_multiple_dependencies: update_multiple_dependencies
+    )
+  end
+  let(:gemfile_name) { "Gemfile" }
+  let(:lockfile_name) { "Gemfile.lock" }
+  let(:update_multiple_dependencies) { true }
+
+  describe "#run" do
+    subject(:force_update) do
+      in_tmp_folder { force_updater.run }
+    end
+
+    context "with a version conflict" do
+      let(:target_version) { "3.6.0" }
+      let(:dependency_name) { "rspec-support" }
+      let(:project_name) { "version_conflict" }
+
+      it "updates the conflicting dependencies" do
+        updated_deps, _specs = force_update
+        expect(updated_deps).to eq([{ name: "rspec-support" }, { name: "rspec-mocks" }])
+      end
+
+      context "when updating a single dependency" do
+        let(:update_multiple_dependencies) { false }
+
+        it { expect { force_update }.to raise_error(Bundler::VersionConflict) }
+      end
+    end
+
+    context "with a version conflict in gems rb" do
+      let(:target_version) { "3.6.0" }
+      let(:dependency_name) { "rspec-support" }
+      let(:project_name) { "version_conflict_gems_rb" }
+      let(:gemfile_name) { "gems.rb" }
+      let(:lockfile_name) { "gems.locked" }
+
+      it "updates the conflicting dependencies" do
+        updated_deps, _specs = force_update
+        expect(updated_deps).to eq([{ name: "rspec-support" }, { name: "rspec-mocks" }])
+      end
+    end
+  end
+end

data/helpers/v1/spec/functions/version_resolver_spec.rb

@@ -92,5 +92,13 @@ RSpec.describe Functions::VersionResolver do
       its([:version]) { is_expected.to eq(Gem::Version.new("1.4.0")) }
       its([:fetcher]) { is_expected.to eq("Bundler::Fetcher::Dependency") }
     end
+
+    context "with no update possible due to a version conflict" do
+      let(:project_name) { "version_conflict_with_listed_subdep" }
+      let(:dependency_name) { "rspec-mocks" }
+      let(:requirement_string) { ">= 0" }
+
+      its([:version]) { is_expected.to eq(Gem::Version.new("3.6.0")) }
+    end
   end
 end

data/helpers/v2/spec/functions/force_updater_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "native_spec_helper"
+require "shared_contexts"
+
+RSpec.describe Functions::ForceUpdater do
+  include_context "in a temporary bundler directory"
+  include_context "stub rubygems compact index"
+
+  let(:force_updater) do
+    described_class.new(
+      dependency_name: dependency_name,
+      target_version: target_version,
+      gemfile_name: gemfile_name,
+      lockfile_name: lockfile_name,
+      update_multiple_dependencies: update_multiple_dependencies
+    )
+  end
+  let(:gemfile_name) { "Gemfile" }
+  let(:lockfile_name) { "Gemfile.lock" }
+  let(:update_multiple_dependencies) { true }
+
+  describe "#run" do
+    subject(:force_update) do
+      in_tmp_folder { force_updater.run }
+    end
+
+    context "with a version conflict" do
+      let(:target_version) { "3.6.0" }
+      let(:dependency_name) { "rspec-support" }
+      let(:project_name) { "version_conflict" }
+
+      it "updates the conflicting dependencies" do
+        updated_deps, _specs = force_update
+        expect(updated_deps).to eq([{ name: "rspec-support" }, { name: "rspec-mocks" }])
+      end
+
+      context "when updating a single dependency" do
+        let(:update_multiple_dependencies) { false }
+
+        it { expect { force_update }.to raise_error(Bundler::VersionConflict) }
+      end
+    end
+
+    context "with a version conflict in gems rb" do
+      let(:target_version) { "3.6.0" }
+      let(:dependency_name) { "rspec-support" }
+      let(:project_name) { "version_conflict_gems_rb" }
+      let(:gemfile_name) { "gems.rb" }
+      let(:lockfile_name) { "gems.locked" }
+
+      it "updates the conflicting dependencies" do
+        updated_deps, _specs = force_update
+        expect(updated_deps).to eq([{ name: "rspec-support" }, { name: "rspec-mocks" }])
+      end
+    end
+  end
+end

data/helpers/v2/spec/functions/version_resolver_spec.rb

@@ -92,5 +92,13 @@ RSpec.describe Functions::VersionResolver do
       its([:version]) { is_expected.to eq(Gem::Version.new("1.4.0")) }
       its([:fetcher]) { is_expected.to eq("Bundler::Fetcher::Dependency") }
     end
+
+    context "with no update possible due to a version conflict" do
+      let(:project_name) { "version_conflict_with_listed_subdep" }
+      let(:dependency_name) { "rspec-mocks" }
+      let(:requirement_string) { ">= 0" }
+
+      its([:version]) { is_expected.to eq(Gem::Version.new("3.6.0")) }
+    end
   end
 end

data/helpers/v2/spec/functions_spec.rb

@@ -21,4 +21,37 @@ RSpec.describe Functions do
       end
     end
   end
+
+  describe "#git_specs" do
+    let(:project_name) { "git_source" }
+    subject(:git_specs) do
+      in_tmp_folder do
+        Functions.git_specs(
+          dir: tmp_path,
+          gemfile_name: "Gemfile",
+          credentials: {}
+        )
+      end
+    end
+
+    def expect_specs(count)
+      expect(git_specs.size).to eq(count)
+      git_specs.each do |gs|
+        uri = URI.parse(gs[:auth_uri])
+        expect(uri.scheme).to(satisfy { |s| %w(http https).include?(s) })
+      end
+    end
+
+    it "returns git specs" do
+      expect_specs(4)
+    end
+
+    context "with github shorthand" do
+      let(:project_name) { "github_source" }
+
+      it "returns git specs" do
+        expect_specs(1)
+      end
+    end
+  end
 end

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -50,10 +50,10 @@ module Dependabot
         end
 
         def ruby_version
-          requirement = if !ruby_requirement.is_a?(Gem::Requirement)
-                          Dependabot::Bundler::Requirement.new(ruby_requirement)
-                        else
+          requirement = if ruby_requirement.is_a?(Gem::Requirement)
                           ruby_requirement
+                        else
+                          Dependabot::Bundler::Requirement.new(ruby_requirement)
                         end
 
           ruby_version =

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -3,6 +3,7 @@
 require "excon"
 
 require "dependabot/bundler/update_checker"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -55,7 +56,8 @@ module Dependabot
 
           relevant_versions = dependency_source.versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = filter_vulnerable_versions(relevant_versions)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
+                                                                                                    security_advisories)
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
@@ -78,11 +80,6 @@ module Dependabot
           filtered
         end
 
-        def filter_vulnerable_versions(versions_array)
-          versions_array.
-            reject { |v| security_advisories.any? { |a| a.vulnerable?(v) } }
-        end
-
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.version && Gem::Version.correct?(dependency.version)
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -174,8 +174,11 @@ module Dependabot
               }
             )
             git_specs.reject do |spec|
+              uri = URI.parse(spec.fetch("auth_uri"))
+              next false unless %w(http https).include?(uri.scheme)
+
               Excon.get(
-                spec.fetch("auth_uri"),
+                uri.to_s,
                 idempotent: true,
                 **SharedHelpers.excon_defaults
               ).status == 200

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.154.1
+  version: 0.155.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-16 00:00:00.000000000 Z
+date: 2021-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.154.1
+        version: 0.155.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -202,6 +202,7 @@ files:
 - helpers/v1/spec/functions/conflicting_dependency_resolver_spec.rb
 - helpers/v1/spec/functions/dependency_source_spec.rb
 - helpers/v1/spec/functions/file_parser_spec.rb
+- helpers/v1/spec/functions/force_updater_spec.rb
 - helpers/v1/spec/functions/version_resolver_spec.rb
 - helpers/v1/spec/native_spec_helper.rb
 - helpers/v1/spec/shared_contexts.rb
@@ -222,6 +223,7 @@ files:
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
 - helpers/v2/spec/functions/dependency_source_spec.rb
 - helpers/v2/spec/functions/file_parser_spec.rb
+- helpers/v2/spec/functions/force_updater_spec.rb
 - helpers/v2/spec/functions/version_resolver_spec.rb
 - helpers/v2/spec/functions_spec.rb
 - helpers/v2/spec/native_spec_helper.rb