dependabot-bundler 0.274.0 → 0.276.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca51e9dd43359009a3941eaf8ba9389aabc813139747fff330f82ba75d9db2eb
-  data.tar.gz: 7fa7e865f3af4b7fe8ff4a4bf8c38727fc65bb312fbc9ac67e41b3777d372bdb
+  metadata.gz: 79a19d7a225becc8cf4c031542f0243f76aafbc06e7bddc5f07c18e81b0fa72f
+  data.tar.gz: 3ad916573eab9a1b62ec84183a1a1d8189a091bed5fe4c458c0154e238b1a3b0
 SHA512:
-  metadata.gz: 4769051b517e8e27aa49227d7790862c20fe4e3d22c626fbd632a93abd8bce18effe2c2b0f4cca08318660a4288d588fef95d72b9f34649342ce9a62347bb2b4
-  data.tar.gz: d04d6fded3eae30e71fb74f1c82443d674a316d06f0ae3af5c9e3775dd0b4b95679d5f738445ef62e90719153f33c6bc5a33204d7dbbb0f5caf25a3eec0c43a9
+  metadata.gz: d9e71142cd9048c31cf4ab29084b78f6e5612b0672b4afe0c23dd814b8d0f2470a0684b7c6675d03d14c698a40f569f8e7ac752879c0e65da204e5ef956b8c95
+  data.tar.gz: 443ba8a0babf33f236c6430087a5a3166abbf3d79cb915c388e4862301a3cf5bc6e566de3115ae2b1060636a5ca62a1b801220993bd9f83f461e58ca85f482bd

data/lib/dependabot/bundler/helpers.rb

@@ -1,35 +1,47 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 module Dependabot
   module Bundler
     module Helpers
+      extend T::Sig
+      extend T::Helpers
+
       V1 = "1"
       V2 = "2"
       # If we are updating a project with no Gemfile.lock, we default to the
       # newest version we support
       DEFAULT = V2
-      # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, we failover to V1 on the assumption
-      # it was created with an old version that didn't add this information
-      FAILOVER = V1
-
       BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i >= 2 ? V2 : V1
+        elsif Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+          DEFAULT
         else
-          FAILOVER
+          failover_version
         end
       end
 
+      # If we are updating a project with a Gemfile.lock that does not specify
+      # the version it was bundled with, we failover to V1 on the assumption
+      # it was created with an old version that didn't add this information
+      sig { returns(String) }
+      def self.failover_version
+        return V2 if Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        V1
+      end
+
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.detected_bundler_version(lockfile)
         return "unknown" unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i.to_s
         else
           "unspecified"

data/lib/dependabot/bundler/package_manager.rb

@@ -9,9 +9,8 @@ module Dependabot
   module Bundler
     PACKAGE_MANAGER = "bundler"
 
-    SUPPORTED_BUNDLER_VERSIONS = T.let([
-      Version.new("2")
-    ].freeze, T::Array[Dependabot::Version])
+    # Keep versions in ascending order
+    SUPPORTED_BUNDLER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
 
     DEPRECATED_BUNDLER_VERSIONS = T.let([
       Version.new("1")
@@ -40,13 +39,12 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::Version]) }
       attr_reader :supported_versions
 
-      sig { override.returns(T::Boolean) }
-      def deprecated?
-        deprecated_versions.include?(version)
-      end
       sig { override.returns(T::Boolean) }
       def unsupported?
-        !deprecated? && version < supported_versions.first
+        # Check if the feature flag for Bundler v1 unsupported error is enabled.
+        return false unless Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        supported_versions.all? { |supported| supported > version }
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.274.0
+  version: 0.276.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-05 00:00:00.000000000 Z
+date: 2024-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.274.0
+        version: 0.276.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.274.0
+        version: 0.276.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.274.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.276.0
 post_install_message: 
 rdoc_options: []
 require_paths: