dependabot-bundler 0.213.0 → 0.214.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55546e82f289d523c8f13d59a6c60863c9771ebfb0e2e3fd1df0ba7057a5c745
-  data.tar.gz: e3e912ae9743390b574d72c93867618838526335ae43f165db59686af1339139
+  metadata.gz: aeeaf55a8d471bff5aa808882909ea46525bc6e77ec7ed897539f88b37e77378
+  data.tar.gz: da7945db8b40b9236c17d09b052689a1bd59a895dba5a9669b6d858416d189ed
 SHA512:
-  metadata.gz: b4097b5de54f37b1a1e237ead1dc4c9d62c30f5e49b86597715dd776e827a82358ffcfefaa23cefd0f1fa69a6c1170d547a8720efe6b5f27231c201660a53a27
-  data.tar.gz: 9ac94050be3a3d3a35deb72a24ae6884848a736b501cc5d4ae980ec9817d5d13e40cd37b2dd8be1264e03f583a77f38c681496e11622fd46a9e5c1aa0b68734c
+  metadata.gz: 920be492f53f96a03f29299fd58b044164c8362ddc1dd569d479ed559b817e46c19d4fffbbd2d941ff92febc72bac0da9452ef8bc8716d4158b22b3a4b1f1211
+  data.tar.gz: 5e46553edaf768e6dfbbd67d12ae2d57112d28ba3f44405d2df788e0790aa9fa2adfdcd597e1edbddfc7b8b47ed3a786c33b79d773ce404f0c562f4f700c4b02

data/helpers/v1/lib/functions/file_parser.rb

@@ -66,7 +66,7 @@ module Functions
     def git_source_details(source)
       {
         url: source.uri,
-        branch: source.branch || "master",
+        branch: source.branch,
         ref: source.ref
       }
     end

data/helpers/v1/monkey_patches/definition_ruby_version_patch.rb

@@ -11,8 +11,9 @@ module BundlerDefinitionRubyVersionPatch
           Gem::Specification.new("ruby\0", requested_version)
       end
 
-      sources.metadata_source.specs <<
-        Gem::Specification.new("ruby\0", "2.5.3p105")
+      %w(2.5.3p105 2.6.10p210 2.7.6p219 3.0.4p208).each do |version|
+        sources.metadata_source.specs << Gem::Specification.new("ruby\0", version)
+      end
     end
   end
 end

data/helpers/v2/lib/functions/file_parser.rb

@@ -63,12 +63,11 @@ module Functions
       details
     end
 
-    # TODO: Remove default `master` branch
     def git_source_details(source)
       {
         url: source.uri,
-        branch: source.branch || "master",
-        ref: source.ref || "master"
+        branch: source.branch,
+        ref: source.ref
       }
     end
 

data/helpers/v2/monkey_patches/definition_bundler_version_patch.rb

@@ -6,9 +6,7 @@ require "bundler/definition"
 # version available to us is the one we're using).
 module BundlerDefinitionBundlerVersionPatch
   def expanded_dependencies
-    @expanded_dependencies ||=
-      expand_dependencies(dependencies + metadata_dependencies, @remote).
-      reject { |d| d.name == "bundler" }
+    @expanded_dependencies ||= (dependencies + metadata_dependencies).reject { |d| d.name == "bundler" }
   end
 end
 

data/helpers/v2/monkey_patches/definition_ruby_version_patch.rb

@@ -10,8 +10,9 @@ module BundlerDefinitionRubyVersionPatch
         Gem::Specification.new("Ruby\0", requested_version)
     end
 
-    sources.metadata_source.specs <<
-      Gem::Specification.new("Ruby\0", "2.5.3")
+    %w(2.5.3 2.6.10 2.7.6 3.0.4).each do |version|
+      sources.metadata_source.specs << Gem::Specification.new("Ruby\0", version)
+    end
 
     super
   end

data/helpers/v2/spec/functions/file_parser_spec.rb

@@ -51,7 +51,7 @@ RSpec.describe Functions::FileParser do
             name: "business",
             requirement: Gem::Requirement.new("~> 1.6.0"),
             source: {
-              branch: "master",
+              branch: nil,
               ref: "a1b78a9",
               type: "git",
               url: "git@github.com:dependabot-fixtures/business"
@@ -70,8 +70,8 @@ RSpec.describe Functions::FileParser do
             name: "prius",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
-              ref: "master",
+              branch: nil,
+              ref: nil,
               type: "git",
               url: "https://github.com/dependabot-fixtures/prius"
             },
@@ -82,7 +82,7 @@ RSpec.describe Functions::FileParser do
             name: "que",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
+              branch: nil,
               ref: "v0.11.6",
               type: "git",
               url: "git@github.com:dependabot-fixtures/que"
@@ -94,8 +94,8 @@ RSpec.describe Functions::FileParser do
             name: "uk_phone_numbers",
             requirement: Gem::Requirement.new(">= 0"),
             source: {
-              branch: "master",
-              ref: "master",
+              branch: nil,
+              ref: nil,
               type: "git",
               url: "http://github.com/dependabot-fixtures/uk_phone_numbers"
             },

data/lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "parser/current"
+
+module Dependabot
+  module Bundler
+    class FileParser
+      # Checks whether a dependency is declared in a gemspec file
+      class GemspecDeclarationFinder
+        def initialize(gemspec:)
+          @gemspec = gemspec
+          @declaration_nodes = {}
+        end
+
+        def gemspec_includes_dependency?(dependency)
+          !declaration_node(dependency).nil?
+        end
+
+        private
+
+        attr_reader :gemspec
+
+        def parsed_gemspec
+          @parsed_gemspec ||= Parser::CurrentRuby.parse(gemspec.content)
+        end
+
+        def declaration_node(dependency)
+          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+          return unless parsed_gemspec
+
+          @declaration_nodes[dependency] = nil
+          parsed_gemspec.children.any? do |node|
+            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
+          end
+          @declaration_nodes[dependency]
+        end
+
+        def deep_search_for_gem(node, dependency)
+          return node if declares_targeted_gem?(node, dependency)
+          return unless node.is_a?(Parser::AST::Node)
+
+          declaration_node = nil
+          node.children.find do |child_node|
+            declaration_node = deep_search_for_gem(child_node, dependency)
+          end
+          declaration_node
+        end
+
+        def declares_targeted_gem?(node, dependency)
+          return false unless node.is_a?(Parser::AST::Node)
+
+          second_child = node.children[1]
+          allowed_declarations = %i(add_dependency add_runtime_dependency add_development_dependency)
+          return false unless allowed_declarations.include?(second_child)
+
+          node.children[2].children.first == dependency.fetch("name")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/file_parser.rb

@@ -16,6 +16,7 @@ module Dependabot
       require "dependabot/file_parsers/base/dependency_set"
       require "dependabot/bundler/file_parser/file_preparer"
       require "dependabot/bundler/file_parser/gemfile_declaration_finder"
+      require "dependabot/bundler/file_parser/gemspec_declaration_finder"
 
       def parse
         dependency_set = DependencySet.new
@@ -87,7 +88,11 @@ module Dependabot
         dependencies = DependencySet.new
 
         gemspecs.each do |gemspec|
+          gemspec_declaration_finder = GemspecDeclarationFinder.new(gemspec: gemspec)
+
           parsed_gemspec(gemspec).each do |dependency|
+            next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
+
             dependencies <<
               Dependency.new(
                 name: dependency.fetch("name"),

data/lib/dependabot/bundler/metadata_finder.rb

@@ -196,12 +196,22 @@ module Dependabot
       end
 
       def registry_url
-        return "https://rubygems.org/" if new_source_type == "default"
+        return base_url if new_source_type == "default"
 
         info = dependency.requirements.filter_map { |r| r[:source] }.first
         info[:url] || info.fetch("url")
       end
 
+      def base_url
+        return @base_url if defined?(@base_url)
+
+        credential = credentials.find do |cred|
+          cred["type"] == "rubygems_server" && cred["replaces-base"] == true
+        end
+        host = credential ? credential["host"] : "rubygems.org"
+        @base_url = "https://#{host}" + ("/" unless host.end_with?("/"))
+      end
+
       def registry_auth_headers
         return {} unless new_source_type == "rubygems"
 

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -31,6 +31,8 @@ module Dependabot
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
         def conflicting_dependencies(dependency:, target_version:)
+          return [] if lockfile.nil?
+
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
             NativeHelpers.run_bundler_subprocess(
               bundler_version: bundler_version,

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -81,18 +81,17 @@ module Dependabot
         end
 
         def filter_lower_versions(versions_array)
-          return versions_array unless dependency.version && Gem::Version.correct?(dependency.version)
+          return versions_array unless dependency.numeric_version
 
           versions_array.
-            select { |version| version > Gem::Version.new(dependency.version) }
+            select { |version| version > dependency.numeric_version }
         end
 
         def wants_prerelease?
           @wants_prerelease ||=
             begin
-              current_version = dependency.version
-              if current_version && Gem::Version.correct?(current_version) &&
-                 Gem::Version.new(current_version).prerelease?
+              current_version = dependency.numeric_version
+              if current_version&.prerelease?
                 true
               else
                 dependency.requirements.any? do |req|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.213.0
+  version: 0.214.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-10-31 00:00:00.000000000 Z
+date: 2022-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.213.0
+        version: 0.214.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.213.0
+        version: 0.214.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.37.1
+        version: 1.39.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.37.1
+        version: 1.39.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -267,6 +267,7 @@ files:
 - lib/dependabot/bundler/file_parser.rb
 - lib/dependabot/bundler/file_parser/file_preparer.rb
 - lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb
+- lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb
 - lib/dependabot/bundler/file_updater.rb
 - lib/dependabot/bundler/file_updater/gemfile_updater.rb
 - lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb