dependabot-bundler 0.212.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b08c43d9300e9e7fa9b6d5f0e3e0631638a6e9785385688079fdc91fa4ad5aaf
-  data.tar.gz: 4958a4a8e3a18c4b533891917c85b71f75fe94c002faac703240eef60e24cfad
+  metadata.gz: aeeaf55a8d471bff5aa808882909ea46525bc6e77ec7ed897539f88b37e77378
+  data.tar.gz: da7945db8b40b9236c17d09b052689a1bd59a895dba5a9669b6d858416d189ed
 SHA512:
-  metadata.gz: c808f814bde969264d27a002a03839c07b7654f013154b3287b9b3259568c795bcd1b4a4fd346a3c9496aee2e8364243832baad5cdf02bfbeb2add6f844fc885
-  data.tar.gz: 5caf001d47e54cca9efac60192e772aafdc5038add498779d96e5f722568d260e0adbc3503c382600805d9c2ea012101bc346e1f9c62607dfc1506763e008de7
+  metadata.gz: 920be492f53f96a03f29299fd58b044164c8362ddc1dd569d479ed559b817e46c19d4fffbbd2d941ff92febc72bac0da9452ef8bc8716d4158b22b3a4b1f1211
+  data.tar.gz: 5e46553edaf768e6dfbbd67d12ae2d57112d28ba3f44405d2df788e0790aa9fa2adfdcd597e1edbddfc7b8b47ed3a786c33b79d773ce404f0c562f4f700c4b02

data/helpers/v1/build

@@ -2,26 +2,34 @@
 
 set -e
 
+helpers_dir=$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
 if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  echo "Unable to build, DEPENDABOT_NATIVE_HELPERS_PATH is not set"
-  exit 1
+  install_dir="$helpers_dir"
+else
+  install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v1"
+  mkdir -p "$install_dir"
+
+  cp -r \
+    "$helpers_dir/lib" \
+    "$helpers_dir/monkey_patches" \
+    "$helpers_dir/run.rb" \
+    "$helpers_dir/Gemfile" \
+    "$install_dir"
 fi
 
-install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v1"
-mkdir -p "$install_dir"
+cd "$install_dir"
 
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cp -r \
-  "$helpers_dir/lib" \
-  "$helpers_dir/monkey_patches" \
-  "$helpers_dir/run.rb" \
-  "$helpers_dir/Gemfile" \
-  "$install_dir"
+export GEM_HOME=$install_dir/.bundle
 
-cd "$install_dir"
+gem install bundler -v 1.17.3 --no-document
+
+BUNDLER_VERSION=1.17.3 bundle config --local path.system true
+
+if [ -n "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
+  BUNDLER_VERSION=1.17.3 bundle config --local without "test"
+fi
 
 # NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
 # forcing native helpers to run with the same version
-BUNDLER_VERSION=1.17.3 bundle config --local path ".bundle"
-BUNDLER_VERSION=1.17.3 bundle config --local without "test"
 BUNDLER_VERSION=1.17.3 bundle install

data/helpers/v1/lib/functions/file_parser.rb

@@ -66,7 +66,7 @@ module Functions
     def git_source_details(source)
       {
         url: source.uri,
-        branch: source.branch || "master",
+        branch: source.branch,
         ref: source.ref
       }
     end

data/helpers/v1/lib/functions/lockfile_updater.rb

@@ -10,7 +10,7 @@ module Functions
         locked\sto\s(?<name>[^\s]+)\s\(|
         not\sfind\s(?<name>[^\s]+)-\d|
         has\s(?<name>[^\s]+)\slocked\sat
-      /x.freeze
+      /x
 
     def initialize(gemfile_name:, lockfile_name:, dependencies:)
       @gemfile_name = gemfile_name

data/helpers/v1/lib/functions/version_resolver.rb

@@ -2,7 +2,7 @@
 
 module Functions
   class VersionResolver
-    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
+    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/
 
     attr_reader :dependency_name, :dependency_requirements,
                 :gemfile_name, :lockfile_name

data/helpers/v1/monkey_patches/definition_ruby_version_patch.rb

@@ -11,8 +11,9 @@ module BundlerDefinitionRubyVersionPatch
           Gem::Specification.new("ruby\0", requested_version)
       end
 
-      sources.metadata_source.specs <<
-        Gem::Specification.new("ruby\0", "2.5.3p105")
+      %w(2.5.3p105 2.6.10p210 2.7.6p219 3.0.4p208).each do |version|
+        sources.metadata_source.specs << Gem::Specification.new("ruby\0", version)
+      end
     end
   end
 end

data/helpers/v1/spec/native_spec_helper.rb

@@ -25,7 +25,7 @@ end
 
 # Duplicated in lib/dependabot/bundler/file_updater/lockfile_updater.rb
 # TODO: Stop sanitizing the lockfile once we have bundler 2 installed
-LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
+LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m
 
 def project_dependency_files(project)
   project_path = File.expand_path(File.join("../../spec/fixtures/projects/bundler1", project))

data/helpers/v2/build

@@ -2,24 +2,34 @@
 
 set -e
 
+helpers_dir=$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
 if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  echo "Unable to build, DEPENDABOT_NATIVE_HELPERS_PATH is not set"
-  exit 1
+  install_dir="$helpers_dir"
+else
+  install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v2"
+  mkdir -p "$install_dir"
+
+  cp -r \
+    "$helpers_dir/lib" \
+    "$helpers_dir/monkey_patches" \
+    "$helpers_dir/run.rb" \
+    "$helpers_dir/Gemfile" \
+    "$install_dir"
 fi
 
-install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v2"
-mkdir -p "$install_dir"
+cd "$install_dir"
 
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cp -r \
-  "$helpers_dir/lib" \
-  "$helpers_dir/monkey_patches" \
-  "$helpers_dir/run.rb" \
-  "$helpers_dir/Gemfile" \
-  "$install_dir"
+default_version=$(ruby -rbundler -e'print Bundler::VERSION')
 
-cd "$install_dir"
+export GEM_HOME=$install_dir/.bundle
+
+gem install bundler -v "$default_version" --no-document
+
+bundle config --local path.system true
+
+if [ -n "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
+  bundle config --local without "test"
+fi
 
-bundle config --local path ".bundle"
-bundle config --local without "test"
 bundle install

data/helpers/v2/lib/functions/file_parser.rb

@@ -63,12 +63,11 @@ module Functions
       details
     end
 
-    # TODO: Remove default `master` branch
     def git_source_details(source)
       {
         url: source.uri,
-        branch: source.branch || "master",
-        ref: source.ref || "master"
+        branch: source.branch,
+        ref: source.ref
       }
     end
 

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -10,7 +10,7 @@ module Functions
         locked\sto\s(?<name>[^\s]+)\s\(|
         not\sfind\s(?<name>[^\s]+)-\d|
         has\s(?<name>[^\s]+)\slocked\sat
-      /x.freeze
+      /x
     DEPENDENCY_DROPPED = "_dependency_dropped_"
 
     def initialize(gemfile_name:, lockfile_name:, dependencies:)

data/helpers/v2/lib/functions/version_resolver.rb

@@ -2,7 +2,7 @@
 
 module Functions
   class VersionResolver
-    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
+    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/
 
     attr_reader :dependency_name, :dependency_requirements,
                 :gemfile_name, :lockfile_name
@@ -16,6 +16,11 @@ module Functions
     end
 
     def version_details
+      # If the dependency is Bundler itself then we can't trust the
+      # version that has been returned (it's the version Dependabot is
+      # running on, rather than the true latest resolvable version).
+      return nil if dependency_name == "bundler"
+
       dep = dependency_from_definition
 
       # If the dependency wasn't found in the definition, but *is*
@@ -28,11 +33,6 @@ module Functions
       # subdependency that was removed when attempting to update it.
       return nil if dep.nil?
 
-      # If the dependency is Bundler itself then we can't trust the
-      # version that has been returned (it's the version Dependabot is
-      # running on, rather than the true latest resolvable version).
-      return nil if dep.name == "bundler"
-
       details = {
         version: dep.version,
         ruby_version: ruby_version,

data/helpers/v2/monkey_patches/definition_bundler_version_patch.rb

@@ -6,9 +6,7 @@ require "bundler/definition"
 # version available to us is the one we're using).
 module BundlerDefinitionBundlerVersionPatch
   def expanded_dependencies
-    @expanded_dependencies ||=
-      expand_dependencies(dependencies + metadata_dependencies, @remote).
-      reject { |d| d.name == "bundler" }
+    @expanded_dependencies ||= (dependencies + metadata_dependencies).reject { |d| d.name == "bundler" }
   end
 end
 

data/helpers/v2/monkey_patches/definition_ruby_version_patch.rb

@@ -10,8 +10,9 @@ module BundlerDefinitionRubyVersionPatch
         Gem::Specification.new("Ruby\0", requested_version)
     end
 
-    sources.metadata_source.specs <<
-      Gem::Specification.new("Ruby\0", "2.5.3")
+    %w(2.5.3 2.6.10 2.7.6 3.0.4).each do |version|
+      sources.metadata_source.specs << Gem::Specification.new("Ruby\0", version)
+    end
 
     super
   end

data/helpers/v2/run.rb

@@ -15,7 +15,6 @@ end
 # Bundler monkey patches
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
-require "endpoint_specification_patch"
 require "git_source_patch"
 
 require "functions"

data/helpers/v2/spec/functions/file_parser_spec.rb

@@ -51,7 +51,7 @@ RSpec.describe Functions::FileParser do
             name: "business",
             requirement: Gem::Requirement.new("~> 1.6.0"),
             source: {
-              branch: "master",
+              branch: nil,
               ref: "a1b78a9",
               type: "git",
               url: "git@github.com:dependabot-fixtures/business"
@@ -70,8 +70,8 @@ RSpec.describe Functions::FileParser do
             name: "prius",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
-              ref: "master",
+              branch: nil,
+              ref: nil,
               type: "git",
               url: "https://github.com/dependabot-fixtures/prius"
             },
@@ -82,7 +82,7 @@ RSpec.describe Functions::FileParser do
             name: "que",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
+              branch: nil,
               ref: "v0.11.6",
               type: "git",
               url: "git@github.com:dependabot-fixtures/que"
@@ -94,8 +94,8 @@ RSpec.describe Functions::FileParser do
             name: "uk_phone_numbers",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
-              ref: "master",
+              branch: nil,
+              ref: nil,
               type: "git",
               url: "http://github.com/dependabot-fixtures/uk_phone_numbers"
             },

data/lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb

@@ -8,20 +8,20 @@ module Dependabot
     class FileParser
       # Checks whether a dependency is declared in a Gemfile
       class GemfileDeclarationFinder
-        def initialize(dependency:, gemfile:)
-          @dependency = dependency
+        def initialize(gemfile:)
           @gemfile = gemfile
+          @declaration_nodes = {}
         end
 
-        def gemfile_includes_dependency?
-          !declaration_node.nil?
+        def gemfile_includes_dependency?(dependency)
+          !declaration_node(dependency).nil?
         end
 
-        def enhanced_req_string
-          return unless gemfile_includes_dependency?
+        def enhanced_req_string(dependency)
+          return unless gemfile_includes_dependency?(dependency)
 
           fallback_string = dependency.fetch("requirement")
-          req_nodes = declaration_node.children[3..-1]
+          req_nodes = declaration_node(dependency).children[3..-1]
           req_nodes = req_nodes.reject { |child| child.type == :hash }
 
           return fallback_string if req_nodes.none?
@@ -39,31 +39,35 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :gemfile
+        attr_reader :gemfile
 
-        def declaration_node
-          return @declaration_node if defined?(@declaration_node)
-          return unless Parser::CurrentRuby.parse(gemfile.content)
+        def parsed_gemfile
+          @parsed_gemfile ||= Parser::CurrentRuby.parse(gemfile.content)
+        end
+
+        def declaration_node(dependency)
+          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+          return unless parsed_gemfile
 
-          @declaration_node = nil
-          Parser::CurrentRuby.parse(gemfile.content).children.any? do |node|
-            @declaration_node = deep_search_for_gem(node)
+          @declaration_nodes[dependency] = nil
+          parsed_gemfile.children.any? do |node|
+            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
-          @declaration_node
+          @declaration_nodes[dependency]
         end
 
-        def deep_search_for_gem(node)
-          return node if declares_targeted_gem?(node)
+        def deep_search_for_gem(node, dependency)
+          return node if declares_targeted_gem?(node, dependency)
           return unless node.is_a?(Parser::AST::Node)
 
           declaration_node = nil
           node.children.find do |child_node|
-            declaration_node = deep_search_for_gem(child_node)
+            declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
         end
 
-        def declares_targeted_gem?(node)
+        def declares_targeted_gem?(node, dependency)
           return false unless node.is_a?(Parser::AST::Node)
           return false unless node.children[1] == :gem
 

data/lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "parser/current"
+
+module Dependabot
+  module Bundler
+    class FileParser
+      # Checks whether a dependency is declared in a gemspec file
+      class GemspecDeclarationFinder
+        def initialize(gemspec:)
+          @gemspec = gemspec
+          @declaration_nodes = {}
+        end
+
+        def gemspec_includes_dependency?(dependency)
+          !declaration_node(dependency).nil?
+        end
+
+        private
+
+        attr_reader :gemspec
+
+        def parsed_gemspec
+          @parsed_gemspec ||= Parser::CurrentRuby.parse(gemspec.content)
+        end
+
+        def declaration_node(dependency)
+          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+          return unless parsed_gemspec
+
+          @declaration_nodes[dependency] = nil
+          parsed_gemspec.children.any? do |node|
+            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
+          end
+          @declaration_nodes[dependency]
+        end
+
+        def deep_search_for_gem(node, dependency)
+          return node if declares_targeted_gem?(node, dependency)
+          return unless node.is_a?(Parser::AST::Node)
+
+          declaration_node = nil
+          node.children.find do |child_node|
+            declaration_node = deep_search_for_gem(child_node, dependency)
+          end
+          declaration_node
+        end
+
+        def declares_targeted_gem?(node, dependency)
+          return false unless node.is_a?(Parser::AST::Node)
+
+          second_child = node.children[1]
+          allowed_declarations = %i(add_dependency add_runtime_dependency add_development_dependency)
+          return false unless allowed_declarations.include?(second_child)
+
+          node.children[2].children.first == dependency.fetch("name")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/file_parser.rb

@@ -16,6 +16,7 @@ module Dependabot
       require "dependabot/file_parsers/base/dependency_set"
       require "dependabot/bundler/file_parser/file_preparer"
       require "dependabot/bundler/file_parser/gemfile_declaration_finder"
+      require "dependabot/bundler/file_parser/gemspec_declaration_finder"
 
       def parse
         dependency_set = DependencySet.new
@@ -60,17 +61,17 @@ module Dependabot
         return dependencies unless gemfile
 
         [gemfile, *evaled_gemfiles].each do |file|
+          gemfile_declaration_finder = GemfileDeclarationFinder.new(gemfile: file)
+
           parsed_gemfile.each do |dep|
-            gemfile_declaration_finder =
-              GemfileDeclarationFinder.new(dependency: dep, gemfile: file)
-            next unless gemfile_declaration_finder.gemfile_includes_dependency?
+            next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
 
             dependencies <<
               Dependency.new(
                 name: dep.fetch("name"),
                 version: dependency_version(dep.fetch("name"))&.to_s,
                 requirements: [{
-                  requirement: gemfile_declaration_finder.enhanced_req_string,
+                  requirement: gemfile_declaration_finder.enhanced_req_string(dep),
                   groups: dep.fetch("groups").map(&:to_sym),
                   source: dep.fetch("source")&.transform_keys(&:to_sym),
                   file: file.name
@@ -87,7 +88,11 @@ module Dependabot
         dependencies = DependencySet.new
 
         gemspecs.each do |gemspec|
+          gemspec_declaration_finder = GemspecDeclarationFinder.new(gemspec: gemspec)
+
           parsed_gemspec(gemspec).each do |dependency|
+            next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
+
             dependencies <<
               Dependency.new(
                 name: dependency.fetch("name"),

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -29,7 +29,7 @@ module Dependabot
 
             content = remove_gemfile_git_source(dependency, content) if remove_git_source?(dependency)
 
-            content = update_gemfile_git_pin(dependency, gemfile, content) if update_git_pin?(dependency)
+            content = update_gemfile_git_pin(dependency, gemfile, content) if update_git_pin?(dependency, gemfile)
           end
 
           content
@@ -81,10 +81,10 @@ module Dependabot
           new_gemfile_req[:source].nil?
         end
 
-        def update_git_pin?(dependency)
+        def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements.
-            find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+            find { |f| f[:file] == file.name }
           return false unless new_gemfile_req&.dig(:source, :type) == "git"
 
           # If the new requirement is a git dependency with a ref then there's

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -18,10 +18,9 @@ module Dependabot
         require_relative "gemspec_dependency_name_finder"
         require_relative "ruby_requirement_setter"
 
-        LOCKFILE_ENDING =
-          /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
-        GIT_DEPENDENCIES_SECTION = /GIT\n.*?\n\n(?!GIT)/m.freeze
-        GIT_DEPENDENCY_DETAILS = /GIT\n.*?\n\n/m.freeze
+        LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m
+        GIT_DEPENDENCIES_SECTION = /GIT\n.*?\n\n(?!GIT)/m
+        GIT_DEPENDENCY_DETAILS = /GIT\n.*?\n\n/m
 
         # Can't be a constant because some of these don't exist in bundler
         # 1.15, which Heroku uses, which causes an exception on boot.

data/lib/dependabot/bundler/file_updater/requirement_replacer.rb

@@ -167,7 +167,7 @@ module Dependabot
             req_string.include?(" ")
           end
 
-          EQUALITY_OPERATOR = /(?<![<>!])=/.freeze
+          EQUALITY_OPERATOR = /(?<![<>!])=/
 
           def use_equality_operator?(requirement_nodes)
             return true if requirement_nodes.none?

data/lib/dependabot/bundler/helpers.rb

@@ -13,7 +13,7 @@ module Dependabot
       # it was created with an old version that didn't add this information
       FAILOVER = V1
 
-      BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m.freeze
+      BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile

data/lib/dependabot/bundler/metadata_finder.rb

@@ -196,12 +196,22 @@ module Dependabot
       end
 
       def registry_url
-        return "https://rubygems.org/" if new_source_type == "default"
+        return base_url if new_source_type == "default"
 
         info = dependency.requirements.filter_map { |r| r[:source] }.first
         info[:url] || info.fetch("url")
       end
 
+      def base_url
+        return @base_url if defined?(@base_url)
+
+        credential = credentials.find do |cred|
+          cred["type"] == "rubygems_server" && cred["replaces-base"] == true
+        end
+        host = credential ? credential["host"] : "rubygems.org"
+        @base_url = "https://#{host}" + ("/" unless host.end_with?("/"))
+      end
+
       def registry_auth_headers
         return {} unless new_source_type == "rubygems"
 

data/lib/dependabot/bundler/requirement.rb

@@ -5,7 +5,7 @@ require "dependabot/utils"
 module Dependabot
   module Bundler
     class Requirement < Gem::Requirement
-      # For consistency with other langauges, we define a requirements array.
+      # For consistency with other languages, we define a requirements array.
       # Ruby doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
       def self.requirements_array(requirement_string)

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -31,6 +31,8 @@ module Dependabot
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
         def conflicting_dependencies(dependency:, target_version:)
+          return [] if lockfile.nil?
+
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
             NativeHelpers.run_bundler_subprocess(
               bundler_version: bundler_version,

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -24,7 +24,7 @@ module Dependabot
       #   version allowed by the gemspec, if the gemspec has a required ruby
       #   version range
       class FilePreparer
-        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
+        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
 
         # Can't be a constant because some of these don't exist in bundler
         # 1.15, which Heroku uses, which causes an exception on boot.

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -81,18 +81,17 @@ module Dependabot
         end
 
         def filter_lower_versions(versions_array)
-          return versions_array unless dependency.version && Gem::Version.correct?(dependency.version)
+          return versions_array unless dependency.numeric_version
 
           versions_array.
-            select { |version| version > Gem::Version.new(dependency.version) }
+            select { |version| version > dependency.numeric_version }
         end
 
         def wants_prerelease?
           @wants_prerelease ||=
             begin
-              current_version = dependency.version
-              if current_version && Gem::Version.correct?(current_version) &&
-                 Gem::Version.new(current_version).prerelease?
+              current_version = dependency.numeric_version
+              if current_version&.prerelease?
                 true
               else
                 dependency.requirements.any? do |req|

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -14,19 +14,15 @@ module Dependabot
   module Bundler
     class UpdateChecker
       module SharedBundlerHelpers
-        GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/.freeze
-        GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./.freeze
-        PATH_REGEX = /The path `(?<path>.*)` does not exist/.freeze
+        GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/
+        GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./
+        PATH_REGEX = /The path `(?<path>.*)` does not exist/
 
         module BundlerErrorPatterns
-          MISSING_AUTH_REGEX =
-            /bundle config (?<source>.*) username:password/.freeze
-          BAD_AUTH_REGEX =
-            /Bad username or password for (?<source>.*)\.$/.freeze
-          BAD_CERT_REGEX =
-            /verify the SSL certificate for (?<source>.*)\.$/.freeze
-          HTTP_ERR_REGEX =
-            /Could not fetch specs from (?<source>.*)$/.freeze
+          MISSING_AUTH_REGEX = /bundle config (?<source>.*) username:password/
+          BAD_AUTH_REGEX = /Bad username or password for (?<source>.*)\.$/
+          BAD_CERT_REGEX = /verify the SSL certificate for (?<source>.*)\.$/
+          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>.*)$/
         end
 
         RETRYABLE_ERRORS = %w(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.212.0
+  version: 0.214.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-06 00:00:00.000000000 Z
+date: 2022-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,42 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.39.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.14.2
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +248,6 @@ files:
 - helpers/v2/lib/functions/version_resolver.rb
 - helpers/v2/monkey_patches/definition_bundler_version_patch.rb
 - helpers/v2/monkey_patches/definition_ruby_version_patch.rb
-- helpers/v2/monkey_patches/endpoint_specification_patch.rb
 - helpers/v2/monkey_patches/git_source_patch.rb
 - helpers/v2/run.rb
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
@@ -310,6 +267,7 @@ files:
 - lib/dependabot/bundler/file_parser.rb
 - lib/dependabot/bundler/file_parser/file_preparer.rb
 - lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb
+- lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb
 - lib/dependabot/bundler/file_updater.rb
 - lib/dependabot/bundler/file_updater/gemfile_updater.rb
 - lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb
@@ -346,14 +304,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Ruby (bundler) support for dependabot

data/helpers/v2/monkey_patches/endpoint_specification_patch.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/endpoint_specification"
-
-module EndpointSpecificationPatch
-  def required_ruby_version
-    @required_ruby_version ||= Gem::Requirement.default
-  end
-
-  def required_rubygems_version
-    @required_rubygems_version ||= Gem::Requirement.default
-  end
-end
-
-Bundler::EndpointSpecification.prepend(EndpointSpecificationPatch)