dependabot-bundler 0.275.0 → 0.277.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32a209d032e7f6caf7f9f41b846d7e6897607b8952b1035a385f41594a849700
-  data.tar.gz: f3559e260e9cf8b437b363151b9a0001789a7fe0f360c95d9f5cb5aedf83f998
+  metadata.gz: 2ba910356220b16a8bda60a3e69d01cd417c50c465e5dc4567c3960830f21faf
+  data.tar.gz: cd8db75e7f1cf13698e32ee547b428624b65ed6d430a1f3c03f54f40b1ee0630
 SHA512:
-  metadata.gz: 4b6016702987249bb6bc68e91360464c54765b2f6fd553eabcb157c04a26bb71ce85f2e48ed742979cb7d73a58d84bc74d82855c1616dc9928a364f9557d4e3f
-  data.tar.gz: 07aad64b7613b1efa409a73b405af03d9b1927ed0f6b67887a9e15ea1802f4059d17dce61664d74fa96b56353902d75c7ce491f499c46b7dee79a92257131b64
+  metadata.gz: 4b47edb3160e25fbc0fe83b421d8e72b2d70319fb97c12de5e450e3faa20fb5dbe19d76ed112f825368499c0e2f84b75b092b538433fb56dc98017b731ea7e83
+  data.tar.gz: b2a73717966b5eb3cb9b768a7a2345ded3406e89c53b0e600ca9c06f559db0be6ce21637119070d53211ba8cc53bd8915acb7e6ff7e50f77c67f589c04df5488

data/lib/dependabot/bundler/helpers.rb

@@ -1,35 +1,47 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 module Dependabot
   module Bundler
     module Helpers
+      extend T::Sig
+      extend T::Helpers
+
       V1 = "1"
       V2 = "2"
       # If we are updating a project with no Gemfile.lock, we default to the
       # newest version we support
       DEFAULT = V2
-      # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, we failover to V1 on the assumption
-      # it was created with an old version that didn't add this information
-      FAILOVER = V1
-
       BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i >= 2 ? V2 : V1
+        elsif Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+          DEFAULT
         else
-          FAILOVER
+          failover_version
         end
       end
 
+      # If we are updating a project with a Gemfile.lock that does not specify
+      # the version it was bundled with, we failover to V1 on the assumption
+      # it was created with an old version that didn't add this information
+      sig { returns(String) }
+      def self.failover_version
+        return V2 if Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        V1
+      end
+
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.detected_bundler_version(lockfile)
         return "unknown" unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i.to_s
         else
           "unspecified"

data/lib/dependabot/bundler/package_manager.rb

@@ -9,9 +9,8 @@ module Dependabot
   module Bundler
     PACKAGE_MANAGER = "bundler"
 
-    SUPPORTED_BUNDLER_VERSIONS = T.let([
-      Version.new("2")
-    ].freeze, T::Array[Dependabot::Version])
+    # Keep versions in ascending order
+    SUPPORTED_BUNDLER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
 
     DEPRECATED_BUNDLER_VERSIONS = T.let([
       Version.new("1")
@@ -40,13 +39,12 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::Version]) }
       attr_reader :supported_versions
 
-      sig { override.returns(T::Boolean) }
-      def deprecated?
-        deprecated_versions.include?(version)
-      end
       sig { override.returns(T::Boolean) }
       def unsupported?
-        !deprecated? && version < supported_versions.first
+        # Check if the feature flag for Bundler v1 unsupported error is enabled.
+        return false unless Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        supported_versions.all? { |supported| supported > version }
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.275.0
+  version: 0.277.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-12 00:00:00.000000000 Z
+date: 2024-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.277.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.277.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.277.0
 post_install_message: 
 rdoc_options: []
 require_paths: