dependabot-bundler 0.235.0 → 0.237.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38176c3434d5010be520cb43bc4c56a9932269422551b38ccd6e37dabd23e3d6
-  data.tar.gz: bfd86e1e458314109a1694c60c663d0f487696400d8b7f69b8cd14e873b8ab78
+  metadata.gz: be50dcf437b4b6c5a4570e0c34f106900f8f8ba0ffd7e270b8fdef2a503859e6
+  data.tar.gz: fbaf4ba7a14c4c709cb669ecbd48268e51ba9ee82710edf4fdf6304fb114224d
 SHA512:
-  metadata.gz: 1d347d3d714957801878e9953f21dfe1607bf870cb4dca6954e18f5a10bbcd115784ba2a3544b5007917ac02c212b50a1aea94426066826116e2c7673e015a4e
-  data.tar.gz: 1d6fbeb3dbd3adf3fa5731aa49bd3efdf24dee0c6c985bb07646ff0b55a15b5d4de8bf8aa5be5d6be9979ce7a7f3b077e9f330308686bac2b312980fbbb85c75
+  metadata.gz: 26af90911a7dec4e6179c4b58d0504ce47f08e0e34583ed9d5c105e128c4b9c24608abb343f46c42ebc5204112968d394c8bd6b44d14cf02828bb4534270bd09
+  data.tar.gz: '0099faad52d13445a1c946ed9f66391278f062ae90bee7cfe6253d72b9a5dbce1c7f59972edaef4f8a99c1762b9447788146bafccb1f9537fdfec93684790ec3'

data/helpers/v1/lib/functions.rb

@@ -148,6 +148,9 @@ module Functions
 
     # Use HTTPS for GitHub if lockfile
     Bundler.settings.set_command_option("github.https", "true")
+
+    # Native helpers rely on dependency unlocking, so Bundler should never be frozen
+    Bundler.settings.set_command_option("frozen", "false")
   end
 
   def self.relevant_credentials(credentials)

data/helpers/v2/lib/functions/dependency_source.rb

@@ -42,9 +42,8 @@ module Functions
         .fetchers.flat_map do |fetcher|
           fetcher
             .specs([dependency_name], bundler_source)
-            .search_all(dependency_name)
+            .search_all(dependency_name).map(&:version)
         end
-        .map(&:version)
     end
 
     private

data/helpers/v2/lib/functions/force_updater.rb

@@ -4,6 +4,7 @@
 module Functions
   class ForceUpdater
     class TransitiveDependencyError < StandardError; end
+    class TopLevelDependencyDowngradedError < StandardError; end
 
     def initialize(dependency_name:, target_version:, gemfile_name:,
                    lockfile_name:, update_multiple_dependencies:)
@@ -21,13 +22,21 @@ module Functions
         definition = build_definition(dependencies_to_unlock: dependencies_to_unlock)
         definition.resolve_remotely!
         specs = definition.resolve
-        updates = ([dependency_name, *dependencies_to_unlock] - subdependencies).uniq.map { |name| { name: name } }
+        updates = ([dependency_name, *dependencies_to_unlock] - subdependencies + extra_top_level_deps(specs)).uniq
+
+        updates = updates.map do |name|
+          {
+            name: name
+          }
+        end
+
         specs = specs.map do |dep|
           {
             name: dep.name,
             version: dep.version
           }
         end
+
         [updates, specs]
       rescue Bundler::SolveFailure => e
         raise unless update_multiple_dependencies?
@@ -53,6 +62,24 @@ module Functions
                 :update_multiple_dependencies
     alias update_multiple_dependencies? update_multiple_dependencies
 
+    def extra_top_level_deps(specs)
+      top_level_dep_names.reject do |name|
+        original_version = original_specs.find { |s| s.name == name }&.version
+        new_version = specs[name].first&.version
+
+        if original_version == new_version
+          true
+        else
+          original_version = Gem::Version.new(original_version)
+          new_version = Gem::Version.new(new_version)
+
+          raise TopLevelDependencyDowngradedError if new_version < original_version
+
+          false
+        end
+      end
+    end
+
     def new_dependencies_to_unlock_from(error:, already_unlocked:)
       names = [*already_unlocked, dependency_name]
       extra_names_to_unlock = []
@@ -118,13 +145,15 @@ module Functions
       # subdependencies
       return [] unless lockfile
 
-      all_deps =  Bundler::LockfileParser.new(lockfile)
-                                         .specs.map(&:name)
-      top_level = Bundler::Definition
-                  .build(gemfile_name, lockfile_name, {})
-                  .dependencies.map(&:name)
+      original_specs.map(&:name) - top_level_dep_names
+    end
+
+    def top_level_dep_names
+      @top_level_dep_names ||= Bundler::Definition.build(gemfile_name, lockfile_name, {}).dependencies.map(&:name)
+    end
 
-      all_deps - top_level
+    def original_specs
+      @original_specs ||= Bundler::LockfileParser.new(lockfile).specs
     end
 
     def unlock_gem(definition:, gem_name:)

data/helpers/v2/lib/functions/version_resolver.rb

@@ -127,7 +127,7 @@ module Functions
     def fetcher_class(dep)
       return unless dep.source.is_a?(::Bundler::Source::Rubygems)
 
-      dep.source.fetchers.first.fetchers.first.class.to_s
+      dep.source.fetchers.first.send(:fetchers).first.class.to_s
     end
 
     def ruby_version

data/helpers/v2/lib/functions.rb

@@ -152,6 +152,9 @@ module Functions
     Bundler.ui = Bundler::UI::Silent.new
 
     Bundler.settings.set_command_option("forget_cli_options", "true")
+
+    # Native helpers rely on dependency unlocking, so Bundler should never be frozen
+    Bundler.settings.set_command_option("frozen", "false")
   end
 
   def self.relevant_credentials(credentials)

data/helpers/v2/spec/functions/dependency_source_spec.rb

@@ -96,11 +96,11 @@ RSpec.describe Functions::DependencySource do
       end
 
       it "blows up with a useful error" do
-        error_class = Bundler::Fetcher::BadAuthenticationError
+        error_class = Bundler::Fetcher::AuthenticationForbiddenError
         expect { private_registry_versions }
           .to raise_error do |error|
             expect(error).to be_a(error_class)
-            expect(error.message).to include("Bad username or password for")
+            expect(error.message).to include("Access token could not be authenticated for")
           end
       end
     end
@@ -126,7 +126,7 @@ RSpec.describe Functions::DependencySource do
           .to raise_error do |error|
             expect(error).to be_a(Bundler::HTTPError)
             expect(error.message)
-              .to include("Could not fetch specs from")
+              .to include("Could not fetch specs from #{registry_url} due to underlying error")
           end
       end
     end

data/lib/dependabot/bundler/file_fetcher.rb

@@ -1,6 +1,7 @@
 # typed: false
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 require "dependabot/bundler/file_updater/lockfile_updater"
@@ -9,6 +10,9 @@ require "dependabot/errors"
 module Dependabot
   module Bundler
     class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
       require "dependabot/bundler/file_fetcher/gemspec_finder"
       require "dependabot/bundler/file_fetcher/path_gemspec_finder"
       require "dependabot/bundler/file_fetcher/child_gemfile_finder"
@@ -32,8 +36,7 @@ module Dependabot
         }
       end
 
-      private
-
+      sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files << gemfile if gemfile
@@ -55,6 +58,8 @@ module Dependabot
         fetched_files
       end
 
+      private
+
       def uniq_files(fetched_files)
         uniq_files = fetched_files.reject(&:support_file?).uniq
         uniq_files += fetched_files

data/lib/dependabot/bundler/native_helpers.rb

@@ -1,32 +1,43 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "bundler"
+require "sorbet-runtime"
 require "dependabot/shared_helpers"
 
 module Dependabot
   module Bundler
     module NativeHelpers
+      extend T::Sig
+      extend T::Generic
+
       class BundleCommand
+        extend T::Sig
+
         MAX_SECONDS = 1800
         MIN_SECONDS = 60
 
+        sig { params(timeout_seconds: T.nilable(Integer)).void }
         def initialize(timeout_seconds)
-          @timeout_seconds = clamp(timeout_seconds)
+          @timeout_seconds = T.let(clamp(timeout_seconds), Integer)
         end
 
+        sig { params(script: String).returns(String) }
         def build(script)
           [timeout_command, :ruby, script].compact.join(" ")
         end
 
         private
 
+        sig { returns(Integer) }
         attr_reader :timeout_seconds
 
+        sig { returns(T.nilable(String)) }
         def timeout_command
           "timeout -s HUP #{timeout_seconds}" unless timeout_seconds.zero?
         end
 
+        sig { params(seconds: T.nilable(Integer)).returns(Integer) }
         def clamp(seconds)
           return 0 unless seconds
 
@@ -34,6 +45,15 @@ module Dependabot
         end
       end
 
+      sig do
+        params(
+          function: String,
+          args: T::Hash[Symbol, String],
+          bundler_version: String,
+          options: T::Hash[Symbol, T.untyped]
+        )
+          .returns(T.untyped)
+      end
       def self.run_bundler_subprocess(function:, args:, bundler_version:, options: {})
         # Run helper suprocess with all bundler-related ENV variables removed
         helpers_path = versioned_helper_path(bundler_version)
@@ -60,10 +80,12 @@ module Dependabot
         end
       end
 
+      sig { params(bundler_major_version: String).returns(String) }
       def self.versioned_helper_path(bundler_major_version)
         File.join(native_helpers_root, "v#{bundler_major_version}")
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "bundler") unless helpers_root.nil?

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -78,15 +78,6 @@ module Dependabot
             ).parse
         end
 
-        def top_level_dependencies
-          @top_level_dependencies ||=
-            FileParser.new(
-              dependency_files: dependency_files.reject { |file| file.name == lockfile.name },
-              credentials: credentials,
-              source: nil
-            ).parse
-        end
-
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -95,17 +86,14 @@ module Dependabot
           #
           # This is kind of a bug in Bundler, and we should try to fix it,
           # but resolving it won't necessarily be easy.
+          updated_deps.filter_map do |dep|
+            original_dep =
+              original_dependencies.find { |d| d.name == dep.fetch("name") }
+            spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-          # put the lead dependency first
-          index = specs.index { |dep| dep["name"] == updated_deps.first["name"] }
-          specs.unshift(specs.delete_at(index))
-          specs.filter_map do |dep|
-            next unless top_level_dependencies.find { |d| d.name == dep.fetch("name") }
-
-            original_dep = original_dependencies.find { |d| d.name == dep.fetch("name") }
-            next if dep.fetch("version") == original_dep.version
+            next if spec.fetch("version") == original_dep.version
 
-            build_dependency(original_dep, dep)
+            build_dependency(original_dep, spec)
           end
         end
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -24,8 +24,9 @@ module Dependabot
           MISSING_AUTH_REGEX = /bundle config (?:set --global )?(?<source>.*) username:password/
 
           BAD_AUTH_REGEX = /Bad username or password for (?<source>.*)\.$/
+          FORBIDDEN_AUTH_REGEX = /Access token could not be authenticated for (?<source>.*)\.$/
           BAD_CERT_REGEX = /verify the SSL certificate for (?<source>.*)\.$/
-          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>.*)$/
+          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>\S+)/
         end
 
         RETRYABLE_ERRORS = %w(
@@ -133,6 +134,10 @@ module Dependabot
             regex = BundlerErrorPatterns::MISSING_AUTH_REGEX
             source = error.message.match(regex)[:source]
             raise Dependabot::PrivateSourceAuthenticationFailure, source
+          when "Bundler::Fetcher::AuthenticationForbiddenError"
+            regex = BundlerErrorPatterns::FORBIDDEN_AUTH_REGEX
+            source = error.message.match(regex)[:source]
+            raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::BadAuthenticationError"
             regex = BundlerErrorPatterns::BAD_AUTH_REGEX
             source = error.message.match(regex)[:source]

data/lib/dependabot/bundler/version.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/version"

data/lib/dependabot/bundler.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 # These all need to be required so the various classes can be registered in a

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.235.0
+  version: 0.237.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-19 00:00:00.000000000 Z
+date: 2023-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.237.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.235.0
+        version: 0.237.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -94,20 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec-sorbet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -282,7 +296,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.235.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
 post_install_message: 
 rdoc_options: []
 require_paths: