dependabot-bundler 0.259.0 → 0.261.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cf058014268b3cfec697930e773369e1f2f1edfe1b4cd6a4c43a33af020a3a6
-  data.tar.gz: ef3f4b5ccd9bed22f52b4408d2097ee0709089db43baa21763a8093d684f69ef
+  metadata.gz: a8b215bdea5dc17ab35848e557529c8e22851f703a5fe3ef8965cf5bf9e15331
+  data.tar.gz: d453d01dccec321c438dff7c8f2107b4f6b75cbecaf67823e250988b860f78cd
 SHA512:
-  metadata.gz: 1699556eb7cdf17c530f580620f88f14452c750e6ba426dbe192a885a0d029ad054d7304378a482deca2e09d988fee7db8f4ec17719cbadd83ceb89aede7828f
-  data.tar.gz: 70e5f1f22cb8ae1025fda30e255222daf55f69a44944217aa640b440759908ba5700f09c8049b5d1fbc82979b9db13d8a783c297408ffb886ffe97ec0708fa78
+  metadata.gz: 4319c06b8a84ade9b143ea5949e4be67d01e81a94d85d97f99d477f0fb2f836937bec1a752b61301fc2608183c38516bd13043d3f8fa12dcbc41dd717b262baa
+  data.tar.gz: 96ce46b41f6acec8899157a458fbe47f65812729bd2998d26c4241cb06e39c643b5935b53d358ed09374affb8df5b74862b8133c30419b4fa29ffb6881ec34c2

data/helpers/v1/spec/functions/conflicting_dependency_resolver_spec.rb

@@ -42,52 +42,42 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:target_version) { "6.0.0" }
 
       it "returns a list of dependencies that block the update" do
-        expect(conflicting_dependencies).to match_array(
-          [
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
-              "name" => "rails",
-              "requirement" => "= 5.2.0",
-              "version" => "5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
-              "name" => "actionpack",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
-              "name" => "actionview",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
-              "name" => "activejob",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
-              "name" => "activemodel",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
-              "name" => "activerecord",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
-              "name" => "railties",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            }
-          ]
-        )
+        expect(conflicting_dependencies).to contain_exactly({
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
+          "name" => "rails",
+          "requirement" => "= 5.2.0",
+          "version" => "5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
+          "name" => "actionpack",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
+          "name" => "actionview",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
+          "name" => "activejob",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
+          "name" => "activemodel",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
+          "name" => "activerecord",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
+          "name" => "railties",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        })
       end
     end
 
@@ -98,28 +88,22 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:project_name) { "multiple_blocking" }
 
       it "returns all of the blocking dependencies" do
-        expect(conflicting_dependencies).to match_array(
-          [
-            {
-              "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
-              "name" => "actionpack",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            },
-            {
-              "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
-              "name" => "actionview",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            },
-            {
-              "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
-              "name" => "activejob",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            }
-          ]
-        )
+        expect(conflicting_dependencies).to contain_exactly({
+          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
+          "name" => "actionpack",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        }, {
+          "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
+          "name" => "actionview",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        }, {
+          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
+          "name" => "activejob",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        })
       end
     end
 

data/helpers/v1/spec/functions/dependency_source_spec.rb

@@ -40,7 +40,7 @@ RSpec.describe Functions::DependencySource do
     end
 
     it "returns all versions from the private source" do
-      is_expected.to eq([
+      expect(private_registry_versions).to eq([
         Gem::Version.new("1.5.0"),
         Gem::Version.new("1.9.0"),
         Gem::Version.new("1.10.0.beta")
@@ -51,7 +51,7 @@ RSpec.describe Functions::DependencySource do
       let(:project_name) { "specified_default_source_no_lockfile" }
 
       it "returns all versions from the private source" do
-        is_expected.to eq([
+        expect(private_registry_versions).to eq([
           Gem::Version.new("1.5.0"),
           Gem::Version.new("1.9.0"),
           Gem::Version.new("1.10.0.beta")
@@ -179,7 +179,7 @@ RSpec.describe Functions::DependencySource do
       end
 
       it "returns all versions from the private source" do
-        expect(private_registry_versions.length).to eql(70)
+        expect(private_registry_versions.length).to be(70)
         expect(private_registry_versions.min).to eql(Gem::Version.new("1.0.0"))
         expect(private_registry_versions.max).to eql(Gem::Version.new("3.5.2"))
       end

data/helpers/v1/spec/functions/file_parser_spec.rb

@@ -39,7 +39,7 @@ RSpec.describe Functions::FileParser do
           type: :runtime
         }
       ]
-      is_expected.to eq(parsed_gemfile)
+      expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion
     end
   end
 
@@ -69,7 +69,7 @@ RSpec.describe Functions::FileParser do
           type: :runtime
         }
       ]
-      is_expected.to eq(parsed_gemspec)
+      expect(parsed_gemspec).not_to be_nil # to get past IdenticalEqualityAssertion
     end
   end
 end

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -189,7 +189,7 @@ module Functions
       # if those sub-deps are top-level dependencies. We only want true
       # subdeps unlocked, like they were in the UpdateChecker, so we
       # mutate the unlocked gems array.
-      unlocked = defn.instance_variable_get(:@unlock).fetch(:gems)
+      unlocked = defn.instance_variable_get(:@gems_to_unlock)
       must_not_unlock = defn.dependencies.map { |x| x.name.to_s } -
                         dependencies_to_unlock
       unlocked.reject! { |n| must_not_unlock.include?(n) }

data/helpers/v2/run.rb

@@ -17,7 +17,6 @@ end
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
 require "git_source_patch"
-require "definition_bundler_spec_set_patch"
 
 require "functions"
 

data/helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb

@@ -42,52 +42,42 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:target_version) { "6.0.0" }
 
       it "returns a list of dependencies that block the update" do
-        expect(conflicting_dependencies).to match_array(
-          [
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
-              "name" => "rails",
-              "requirement" => "= 5.2.0",
-              "version" => "5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
-              "name" => "actionpack",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
-              "name" => "actionview",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
-              "name" => "activejob",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
-              "name" => "activemodel",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
-              "name" => "activerecord",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            },
-            {
-              "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
-              "name" => "railties",
-              "version" => "5.2.0",
-              "requirement" => "= 5.2.0"
-            }
-          ]
-        )
+        expect(conflicting_dependencies).to contain_exactly({
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
+          "name" => "rails",
+          "requirement" => "= 5.2.0",
+          "version" => "5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
+          "name" => "actionpack",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
+          "name" => "actionview",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
+          "name" => "activejob",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
+          "name" => "activemodel",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
+          "name" => "activerecord",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        }, {
+          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
+          "name" => "railties",
+          "version" => "5.2.0",
+          "requirement" => "= 5.2.0"
+        })
       end
     end
 
@@ -98,28 +88,22 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:project_name) { "multiple_blocking" }
 
       it "returns all of the blocking dependencies" do
-        expect(conflicting_dependencies).to match_array(
-          [
-            {
-              "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
-              "name" => "actionpack",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            },
-            {
-              "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
-              "name" => "actionview",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            },
-            {
-              "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
-              "name" => "activejob",
-              "version" => "5.0.0",
-              "requirement" => "= 5.0.0"
-            }
-          ]
-        )
+        expect(conflicting_dependencies).to contain_exactly({
+          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
+          "name" => "actionpack",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        }, {
+          "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
+          "name" => "actionview",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        }, {
+          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
+          "name" => "activejob",
+          "version" => "5.0.0",
+          "requirement" => "= 5.0.0"
+        })
       end
     end
 

data/helpers/v2/spec/functions/dependency_source_spec.rb

@@ -40,7 +40,7 @@ RSpec.describe Functions::DependencySource do
     end
 
     it "returns all versions from the private source" do
-      is_expected.to eq([
+      expect(private_registry_versions).to eq([
         Gem::Version.new("1.5.0"),
         Gem::Version.new("1.9.0"),
         Gem::Version.new("1.10.0.beta")
@@ -51,7 +51,7 @@ RSpec.describe Functions::DependencySource do
       let(:project_name) { "specified_default_source_no_lockfile" }
 
       it "returns all versions from the private source" do
-        is_expected.to eq([
+        expect(private_registry_versions).to eq([
           Gem::Version.new("1.5.0"),
           Gem::Version.new("1.9.0"),
           Gem::Version.new("1.10.0.beta")
@@ -180,7 +180,7 @@ RSpec.describe Functions::DependencySource do
       end
 
       it "returns all versions from the private source" do
-        expect(private_registry_versions.length).to eql(70)
+        expect(private_registry_versions.length).to be(70)
         expect(private_registry_versions.min).to eql(Gem::Version.new("1.0.0"))
         expect(private_registry_versions.max).to eql(Gem::Version.new("3.5.2"))
       end

data/helpers/v2/spec/functions/file_parser_spec.rb

@@ -39,7 +39,7 @@ RSpec.describe Functions::FileParser do
           type: :runtime
         }
       ]
-      is_expected.to eq(parsed_gemfile)
+      expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
     end
 
     context "with a git source" do
@@ -103,7 +103,7 @@ RSpec.describe Functions::FileParser do
             type: :runtime
           }
         ]
-        is_expected.to eq(parsed_gemfile)
+        expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
       end
     end
   end
@@ -134,7 +134,7 @@ RSpec.describe Functions::FileParser do
           type: :runtime
         }
       ]
-      is_expected.to eq(parsed_gemspec)
+      expect(parsed_gemspec).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
     end
   end
 end

data/helpers/v2/spec/functions/version_resolver_spec.rb

@@ -36,6 +36,9 @@ RSpec.describe Functions::VersionResolver do
     stub_request(:get, "https://rubygems.org/quick/Marshal.4.8/statesman-1.2.1.gemspec.rz")
       .to_return(status: 200, body: fixture("rubygems_responses", "statesman-1.2.1.gemspec.rz"))
 
+    stub_request(:get, "https://rubygems.org/quick/Marshal.4.8/statesman-1.2.5.gemspec.rz")
+      .to_return(status: 200, body: fixture("rubygems_responses", "statesman-1.2.5.gemspec.rz"))
+
     stub_request(:get, %r{quick/Marshal.4.8/business-.*.gemspec.rz})
       .to_return(status: 200, body: fixture("rubygems_responses", "business-1.0.0.gemspec.rz"))
   end
@@ -102,12 +105,12 @@ RSpec.describe Functions::VersionResolver do
       its([:fetcher]) { is_expected.to eq("Bundler::Fetcher::Dependency") }
     end
 
-    context "with no update possible due to a version conflict" do
+    context "when there's a version conflict with a subdep also listed as a top level dependency" do
       let(:project_name) { "version_conflict_with_listed_subdep" }
       let(:dependency_name) { "rspec-mocks" }
       let(:requirement_string) { ">= 0" }
 
-      its([:version]) { is_expected.to eq(Gem::Version.new("3.6.0")) }
+      its([:version]) { is_expected.to be > Gem::Version.new("3.6.0") }
     end
   end
 end

data/helpers/v2/spec/functions_spec.rb

@@ -12,7 +12,7 @@ RSpec.describe Functions do
 
     it "returns the jfrog source" do
       in_tmp_folder do
-        jfrog_source = Functions.jfrog_source(
+        jfrog_source = described_class.jfrog_source(
           dir: tmp_path,
           gemfile_name: "Gemfile",
           credentials: {}
@@ -26,7 +26,7 @@ RSpec.describe Functions do
   describe "#git_specs" do
     subject(:git_specs) do
       in_tmp_folder do
-        Functions.git_specs(
+        described_class.git_specs(
           dir: tmp_path,
           gemfile_name: "Gemfile",
           credentials: {}

data/helpers/v2/spec/native_spec_helper.rb

@@ -12,7 +12,6 @@ $LOAD_PATH.unshift(File.expand_path("../../spec_helpers", __dir__))
 # Bundler monkey patches
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
-require "definition_bundler_spec_set_patch"
 require "git_source_patch"
 
 require "functions"

data/lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb

@@ -1,7 +1,9 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
+require "sorbet-runtime"
+
 require "dependabot/file_parsers/base"
 
 module Dependabot
@@ -9,20 +11,26 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       # Checks whether a dependency is declared in a Gemfile
       class GemfileDeclarationFinder
+        extend T::Sig
+
+        sig { params(gemfile: Dependabot::DependencyFile).void }
         def initialize(gemfile:)
           @gemfile = gemfile
-          @declaration_nodes = {}
+          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Parser::AST::Node)])
         end
 
+        sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
         def gemfile_includes_dependency?(dependency)
           !declaration_node(dependency).nil?
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(String)) }
         def enhanced_req_string(dependency)
           return unless gemfile_includes_dependency?(dependency)
 
           fallback_string = dependency.fetch("requirement")
-          req_nodes = declaration_node(dependency).children[3..-1]
+          req_nodes = declaration_node(dependency)&.children&.[](3..-1)
           req_nodes = req_nodes.reject { |child| child.type == :hash }
 
           return fallback_string if req_nodes.none?
@@ -37,37 +45,58 @@ module Dependabot
             fallback_string
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemfile
 
+        sig { returns(T.nilable(Parser::AST::Node)) }
         def parsed_gemfile
-          @parsed_gemfile ||= Parser::CurrentRuby.parse(gemfile.content)
+          @parsed_gemfile ||= T.let(
+            Parser::CurrentRuby.parse(gemfile.content),
+            T.nilable(Parser::AST::Node)
+          )
         end
 
+        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
         def declaration_node(dependency)
           return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
           return unless parsed_gemfile
 
           @declaration_nodes[dependency] = nil
-          parsed_gemfile.children.any? do |node|
+          T.must(parsed_gemfile).children.any? do |node|
             @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
           @declaration_nodes[dependency]
         end
 
+        sig do
+          params(
+            node: T.untyped,
+            dependency: T::Hash[String, String]
+          )
+            .returns(T.nilable(Parser::AST::Node))
+        end
         def deep_search_for_gem(node, dependency)
-          return node if declares_targeted_gem?(node, dependency)
+          return T.cast(node, Parser::AST::Node) if declares_targeted_gem?(node, dependency)
           return unless node.is_a?(Parser::AST::Node)
 
-          declaration_node = nil
+          declaration_node = T.let(nil, T.nilable(Parser::AST::Node))
           node.children.find do |child_node|
             declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
         end
 
+        sig do
+          params(
+            node: T.untyped,
+            dependency: T::Hash[String, String]
+          )
+            .returns(T::Boolean)
+        end
         def declares_targeted_gem?(node, dependency)
           return false unless node.is_a?(Parser::AST::Node)
           return false unless node.children[1] == :gem

data/lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb

@@ -1,7 +1,9 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
+require "sorbet-runtime"
+
 require "dependabot/file_parsers/base"
 
 module Dependabot
@@ -9,45 +11,54 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       # Checks whether a dependency is declared in a gemspec file
       class GemspecDeclarationFinder
+        extend T::Sig
+
+        sig { params(gemspec: Dependabot::DependencyFile).void }
         def initialize(gemspec:)
           @gemspec = gemspec
-          @declaration_nodes = {}
+          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Parser::AST::Node)])
         end
 
+        sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
         def gemspec_includes_dependency?(dependency)
           !declaration_node(dependency).nil?
         end
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemspec
 
+        sig { returns(T.nilable(Parser::AST::Node)) }
         def parsed_gemspec
-          @parsed_gemspec ||= Parser::CurrentRuby.parse(gemspec.content)
+          @parsed_gemspec ||= T.let(Parser::CurrentRuby.parse(gemspec.content), T.nilable(Parser::AST::Node))
         end
 
+        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
         def declaration_node(dependency)
           return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
           return unless parsed_gemspec
 
           @declaration_nodes[dependency] = nil
-          parsed_gemspec.children.any? do |node|
+          T.must(parsed_gemspec).children.any? do |node|
             @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
           @declaration_nodes[dependency]
         end
 
+        sig { params(node: T.untyped, dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
         def deep_search_for_gem(node, dependency)
-          return node if declares_targeted_gem?(node, dependency)
+          return T.cast(node, Parser::AST::Node) if declares_targeted_gem?(node, dependency)
           return unless node.is_a?(Parser::AST::Node)
 
-          declaration_node = nil
+          declaration_node = T.let(nil, T.nilable(Parser::AST::Node))
           node.children.find do |child_node|
             declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
         end
 
+        sig { params(node: T.untyped, dependency: T::Hash[String, String]).returns(T::Boolean) }
         def declares_targeted_gem?(node, dependency)
           return false unless node.is_a?(Parser::AST::Node)
 

data/lib/dependabot/bundler/file_updater/git_source_remover.rb

@@ -1,13 +1,17 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "parser/current"
+require "sorbet-runtime"
+
 require "dependabot/bundler/file_updater"
 
 module Dependabot
   module Bundler
     class FileUpdater
       class GitSourceRemover
+        extend T::Sig
+
         attr_reader :dependency
 
         def initialize(dependency:)
@@ -73,7 +77,7 @@ module Dependabot
           end
 
           def remove_git_related_kwargs(kwargs_node)
-            good_key_index = nil
+            good_key_index = T.let(nil, T.nilable(Integer))
             hash_pairs = kwargs_node.children
 
             hash_pairs.each_with_index do |hash_pair, index|

data/lib/dependabot/bundler/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -27,7 +27,7 @@ module Dependabot
       # rubocop:disable Metrics/PerceivedComplexity
       # rubocop:disable Metrics/AbcSize
       def updated_dependency_files
-        updated_files = []
+        updated_files = T.let([], T::Array[Dependabot::DependencyFile])
 
         if gemfile && file_changed?(gemfile)
           updated_files <<
@@ -58,7 +58,7 @@ module Dependabot
 
         check_updated_files(updated_files)
 
-        base_dir = updated_files.first.directory
+        base_dir = T.must(updated_files.first).directory
         vendor_updater
           .updated_vendor_cache_files(base_directory: base_dir)
           .each do |file|

data/lib/dependabot/bundler/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "excon"
@@ -87,7 +87,7 @@ module Dependabot
         end
 
         source_url = github_urls.find do |url|
-          repo = Source.from_url(url).repo
+          repo = T.must(Source.from_url(url)).repo
           repo.downcase.end_with?(dependency.name)
         end
         return unless source_url
@@ -102,7 +102,7 @@ module Dependabot
         rubygems_marshalled_gemspec_response.gsub("\x06;", "\n")
                                             .scan(Dependabot::Source::SOURCE_REGEX) do
           github_urls << (Regexp.last_match.to_s +
-                         Regexp.last_match.post_match.split("\n").first)
+                         T.must(T.must(Regexp.last_match).post_match.split("\n").first))
         end
 
         github_urls.find do |url|
@@ -204,7 +204,7 @@ module Dependabot
           cred["type"] == "rubygems_server" && cred.replaces_base?
         end
         host = credential ? credential["host"] : "rubygems.org"
-        @base_url = "https://#{host}" + ("/" unless host.end_with?("/"))
+        @base_url = "https://#{host}#{host&.end_with?('/') ? '' : '/'}"
       end
 
       def registry_auth_headers

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -1,7 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
 require "uri"
 
 require "dependabot/bundler/update_checker"
@@ -15,6 +16,16 @@ module Dependabot
   module Bundler
     class UpdateChecker
       module SharedBundlerHelpers
+        include Kernel
+
+        extend T::Sig
+        extend T::Helpers
+
+        abstract!
+
+        sig { returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
         GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/
         GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./
         PATH_REGEX = /The path `(?<path>.*)` does not exist/
@@ -217,6 +228,9 @@ module Dependabot
           end
         end
 
+        sig { abstract.returns(String) }
+        def bundler_version; end
+
         def write_temporary_dependency_files
           dependency_files.each do |file|
             path = file.name

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.259.0
+  version: 0.261.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-05-30 00:00:00.000000000 Z
+date: 2024-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.259.0
+        version: 0.261.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.259.0
+        version: 0.261.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -292,12 +292,10 @@ files:
 - helpers/v2/lib/functions/force_updater.rb
 - helpers/v2/lib/functions/lockfile_updater.rb
 - helpers/v2/lib/functions/version_resolver.rb
-- helpers/v2/monkey_patches/definition_bundler_spec_set_patch.rb
 - helpers/v2/monkey_patches/definition_bundler_version_patch.rb
 - helpers/v2/monkey_patches/definition_ruby_version_patch.rb
 - helpers/v2/monkey_patches/git_source_patch.rb
 - helpers/v2/run.rb
-- helpers/v2/spec/definition_bundler_spec_set_patch_spec.rb
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
 - helpers/v2/spec/functions/dependency_source_spec.rb
 - helpers/v2/spec/functions/file_parser_spec.rb
@@ -347,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.259.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.0
 post_install_message: 
 rdoc_options: []
 require_paths:

data/helpers/v2/monkey_patches/definition_bundler_spec_set_patch.rb

@@ -1,23 +0,0 @@
-# typed: false
-# frozen_string_literal: true
-
-require "bundler/spec_set"
-
-# monkey patch materialized_for_all_platforms for lazy specification issue resolution
-# https://github.com/dependabot/dependabot-core/pull/9807
-module BundlerSpecSetPatch
-  def materialized_for_all_platforms
-    @specs.map do |s|
-      next s unless s.is_a?(Bundler::LazySpecification)
-
-      s.source.cached!
-      s.source.remote!
-      spec = s.materialize_for_installation
-      raise Bundler::GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
-
-      spec
-    end
-  end
-end
-
-Bundler::SpecSet.prepend(BundlerSpecSetPatch)

data/helpers/v2/spec/definition_bundler_spec_set_patch_spec.rb

@@ -1,68 +0,0 @@
-# typed: false
-# frozen_string_literal: true
-
-# rubocop:disable RSpec/FilePath
-# rubocop:disable RSpec/SpecFilePathFormat
-
-require "native_spec_helper"
-require "shared_contexts"
-require "bundler/spec_set"
-
-RSpec.describe Bundler::SpecSet do
-  let(:primary_source) { instance_double(Bundler::Source::Git) }
-  let(:secondary_source) { instance_double(Bundler::Source::Path) }
-  let(:primary_spec_set) do
-    instance_double(Bundler::LazySpecification, full_name: "foo-1.0.0-x86_64-linux", source: primary_source)
-  end
-  let(:secondary_spec_set) do
-    instance_double(Bundler::LazySpecification, full_name: "foo-1.0.0-arm64-darwin", source: secondary_source)
-  end
-
-  before do
-    allow(primary_spec_set).to receive(:is_a?).with(Bundler::LazySpecification).and_return(true)
-    allow(secondary_spec_set).to receive(:is_a?).with(Bundler::LazySpecification).and_return(true)
-
-    allow(primary_source).to receive(:cached!)
-    allow(primary_source).to receive(:remote!)
-    allow(secondary_source).to receive(:cached!)
-    allow(secondary_source).to receive(:remote!)
-
-    allow(primary_spec_set).to receive(:materialize_for_installation).and_return(primary_spec_set)
-    allow(secondary_spec_set).to receive(:materialize_for_installation).and_return(secondary_spec_set)
-  end
-
-  describe "#materialized_for_all_platforms" do
-    context "when cache_all_platforms is enabled" do
-      let(:spec_set) { described_class.new([primary_spec_set, secondary_spec_set]) }
-
-      before do
-        described_class.prepend(BundlerSpecSetPatch)
-      end
-
-      it "uses cached gems for secondary sources" do
-        expect(primary_spec_set.source).to receive(:cached!).ordered
-        expect(primary_spec_set.source).to receive(:remote!).ordered
-        expect(primary_spec_set).to receive(:materialize_for_installation).and_return(primary_spec_set).ordered
-
-        expect(secondary_spec_set.source).to receive(:cached!).ordered
-        expect(secondary_spec_set.source).to receive(:remote!).ordered
-        expect(secondary_spec_set).to receive(:materialize_for_installation).and_return(secondary_spec_set).ordered
-
-        result = spec_set.materialized_for_all_platforms
-        expect(result).to include(primary_spec_set, secondary_spec_set)
-      end
-
-      it "raises an error if a gem cannot be found in any of the sources" do
-        allow(primary_spec_set).to receive(:materialize_for_installation).and_return(nil)
-
-        expect do
-          spec_set.materialized_for_all_platforms
-        end.to raise_error(Bundler::GemNotFound,
-                           "Could not find foo-1.0.0-x86_64-linux in any of the sources")
-      end
-    end
-  end
-end
-
-# rubocop:enable RSpec/FilePath
-# rubocop:enable RSpec/SpecFilePathFormat