dependabot-bundler 0.283.0 → 0.285.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3772984b030e3e8ce2c64572c9a790f7842a3429a785837e556ad8963924ed84
-  data.tar.gz: 35bdd5240c4eb546f8a9919bf5ce4a0b7043f3ce26af25fd6968d5cf35e88c47
+  metadata.gz: 46bd8d058b090759dfbdef246960dd68aaf6805eca3e8ed86dcbbe24bae02f05
+  data.tar.gz: 0104dce3ac3823fb75626420bf71eabebba6cc6a43a5a01a3ab4475c73f5090f
 SHA512:
-  metadata.gz: 3086d857acaf430af46933a16f00de5fdeac7ff80a06593009988e8daa0a2f5cb962857b8ff8c3992fa995b471ae88aaa870a8ccf455ff5b85052ba378a8cc6b
-  data.tar.gz: c88f11281d9455805ae80db5d3a5ebd16bef0dd9dcebf1cd645f02c00a9826f8e8e67812b7f011cf5057a8f913a6211450ab997c927502c3fac11d2c3ae0e380
+  metadata.gz: 29cc464b42b25ae071d77180e16b91e151cc5fb5a5b8fb3375a94908dd6189539b5b23e02d5be93b999fe7e3256671fa4718adc5c63107f18b08332d2f2b0950
+  data.tar.gz: a1ca65abcce69cac328b4d99d1e4fe5319abc1c6fc7f8f3ffd5b99f70f1a3887e07434ba8a69521c7fed2c952c3e6cbb745fa55da547148a09c56408cbecac21

data/helpers/v2/lib/functions.rb

@@ -173,4 +173,12 @@ module Functions
     credentials
       .select { |cred| cred["type"] == "git_source" }
   end
+
+  def self.bundler_raw_version
+    Bundler::VERSION
+  end
+
+  def self.ruby_raw_version
+    RUBY_VERSION
+  end
 end

data/lib/dependabot/bundler/file_parser.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 require "parallel"
+require "dependabot/bundler/language"
+require "dependabot/bundler/package_manager"
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
@@ -32,13 +34,38 @@ module Dependabot
         dependency_set.dependencies
       end
 
-      sig { returns(PackageManagerBase) }
-      def package_manager
-        PackageManager.new(bundler_version)
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          Ecosystem.new(
+            name: ECOSYSTEM,
+            package_manager: package_manager,
+            language: language
+          ),
+          T.nilable(Ecosystem)
+        )
       end
 
       private
 
+      sig { returns(Ecosystem::VersionManager) }
+      def package_manager
+        @package_manager ||= PackageManager.new(bundler_raw_version, package_manager_requirement)
+      end
+
+      def package_manager_requirement
+        @package_manager_requirement ||= Helpers.bundler_dependency_requirement(dependency_files)
+      end
+
+      sig { returns(T.nilable(Ecosystem::VersionManager)) }
+      def language
+        return @language if defined?(@language)
+
+        return nil if package_manager.unsupported?
+
+        Language.new(ruby_raw_version)
+      end
+
       def check_external_code(dependencies)
         return unless @reject_external_code
         return unless git_source?(dependencies)
@@ -309,12 +336,59 @@ module Dependabot
                       .select { |file| file.name.end_with?(".gemspec") }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def imported_ruby_files
         dependency_files
           .select { |f| f.name.end_with?(".rb") }
           .reject { |f| f.name == "gems.rb" }
       end
 
+      sig { returns(String) }
+      def bundler_raw_version
+        return bundler_raw_version if defined?(@bundler_raw_version)
+
+        package_manager = PackageManager.new(bundler_version)
+
+        # If the selected version is unsupported, an unsupported error will be raised,
+        # so there’s no need to attempt retrieving the raw version.
+        return bundler_version if package_manager.unsupported?
+
+        # read raw version directly from the ecosystem environment
+        bundler_raw_version = SharedHelpers.in_a_temporary_repo_directory(
+          base_directory,
+          repo_contents_path
+        ) do
+          write_temporary_dependency_files
+          NativeHelpers.run_bundler_subprocess(
+            function: "bundler_raw_version",
+            args: {},
+            bundler_version: bundler_version,
+            options: { timeout_per_operation_seconds: 10 }
+          )
+        end
+        bundler_raw_version || ::Bundler::VERSION
+      end
+
+      sig { returns(String) }
+      def ruby_raw_version
+        return @ruby_raw_version if defined?(@ruby_raw_version)
+
+        ruby_raw_version = SharedHelpers.in_a_temporary_repo_directory(
+          base_directory,
+          repo_contents_path
+        ) do
+          write_temporary_dependency_files
+          NativeHelpers.run_bundler_subprocess(
+            function: "ruby_raw_version",
+            args: {},
+            bundler_version: bundler_version,
+            options: { timeout_per_operation_seconds: 10 }
+          )
+        end
+        ruby_raw_version || RUBY_VERSION
+      end
+
+      sig { returns(String) }
       def bundler_version
         @bundler_version ||= Helpers.bundler_version(lockfile)
       end

data/lib/dependabot/bundler/helpers.rb

@@ -1,6 +1,8 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "dependabot/bundler/requirement"
+
 module Dependabot
   module Bundler
     module Helpers
@@ -9,16 +11,18 @@ module Dependabot
 
       V1 = "1"
       V2 = "2"
-      # If we are updating a project with no Gemfile.lock, we default to the
-      # newest version we support
       DEFAULT = V2
       BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
+      GEMFILE = "Gemfile"
+      GEMSPEC_EXTENSION = ".gemspec"
+      BUNDLER_GEM_NAME = "bundler"
+
       sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile
 
-        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = T.let(lockfile.content, T.nilable(String))&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i >= 2 ? V2 : V1
         else
           DEFAULT
@@ -29,12 +33,75 @@ module Dependabot
       def self.detected_bundler_version(lockfile)
         return "unknown" unless lockfile
 
-        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = T.let(lockfile.content, T.nilable(String))&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i.to_s
         else
           "unspecified"
         end
       end
+
+      # Method to get the Requirement object for the 'bundler' dependency
+      sig do
+        params(files: T::Array[Dependabot::DependencyFile]).returns(T.nilable(Dependabot::Bundler::Requirement))
+      end
+      def self.bundler_dependency_requirement(files)
+        constraints = combined_dependency_constraints(files, BUNDLER_GEM_NAME)
+        return nil if constraints.empty?
+
+        combined_constraint = constraints.join(", ")
+
+        Dependabot::Bundler::Requirement.new(combined_constraint)
+      rescue StandardError => e
+        Dependabot.logger.error(
+          "Failed to create Requirement with constraints '#{constraints&.join(', ')}': #{e.message}"
+        )
+        nil
+      end
+
+      # Method to gather and combine constraints for a specified dependency from multiple files
+      sig do
+        params(files: T::Array[Dependabot::DependencyFile], dependency_name: String).returns(T::Array[String])
+      end
+      def self.combined_dependency_constraints(files, dependency_name)
+        files.each_with_object([]) do |file, result|
+          content = file.content
+          next unless content
+
+          # Select the appropriate regex based on file type
+          regex = if file.name.end_with?(GEMFILE)
+                    gemfile_dependency_regex(dependency_name)
+                  elsif file.name.end_with?(GEMSPEC_EXTENSION)
+                    gemspec_dependency_regex(dependency_name)
+                  else
+                    next # Skip unsupported file types
+                  end
+
+          # Extract constraints using the chosen regex
+          result.concat(extract_constraints_from_file(content, regex))
+        end.uniq
+      end
+
+      # Method to generate the regex pattern for a dependency in a Gemfile
+      sig { params(dependency_name: String).returns(Regexp) }
+      def self.gemfile_dependency_regex(dependency_name)
+        /gem\s+['"]#{Regexp.escape(dependency_name)}['"](?:,\s*['"]([^'"]+)['"])?/
+      end
+
+      # Method to generate the regex pattern for a dependency in a gemspec file
+      sig { params(dependency_name: String).returns(Regexp) }
+      def self.gemspec_dependency_regex(dependency_name)
+        /add_(?:runtime_)?dependency\s+['"]#{Regexp.escape(dependency_name)}['"],\s*['"]([^'"]+)['"]/
+      end
+
+      # Extracts constraints from file content based on a dependency regex
+      sig { params(content: String, regex: Regexp).returns(T::Array[String]) }
+      def self.extract_constraints_from_file(content, regex)
+        if content.match(regex)
+          content.scan(regex).flatten
+        else
+          []
+        end
+      end
     end
   end
 end

data/lib/dependabot/bundler/language.rb

@@ -0,0 +1,24 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/bundler/version"
+require "dependabot/ecosystem"
+
+module Dependabot
+  module Bundler
+    LANGUAGE = "ruby"
+
+    class Language < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      sig { params(raw_version: String).void }
+      def initialize(raw_version)
+        super(
+          LANGUAGE,
+          Version.new(raw_version)
+        )
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/package_manager.rb

@@ -3,10 +3,12 @@
 
 require "sorbet-runtime"
 require "dependabot/bundler/version"
-require "dependabot/package_manager"
+require "dependabot/ecosystem"
+require "dependabot/bundler/requirement"
 
 module Dependabot
   module Bundler
+    ECOSYSTEM = "bundler"
     PACKAGE_MANAGER = "bundler"
 
     # Keep versions in ascending order
@@ -18,33 +20,23 @@ module Dependabot
     # DEPRECATED_BUNDLER_VERSIONS = T.let([Version.new("1")].freeze, T::Array[Dependabot::Version])
     DEPRECATED_BUNDLER_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
 
-    class PackageManager < PackageManagerBase
+    class PackageManager < Dependabot::Ecosystem::VersionManager
       extend T::Sig
 
-      sig { params(version: T.any(String, Dependabot::Version)).void }
-      def initialize(version)
-        @version = T.let(Version.new(version), Dependabot::Version)
-        @name = T.let(PACKAGE_MANAGER, String)
-        @deprecated_versions = T.let(DEPRECATED_BUNDLER_VERSIONS, T::Array[Dependabot::Version])
-        @supported_versions = T.let(SUPPORTED_BUNDLER_VERSIONS, T::Array[Dependabot::Version])
+      sig do
+        params(
+          raw_version: String,
+          requirement: T.nilable(Requirement)
+        ).void
       end
-
-      sig { override.returns(String) }
-      attr_reader :name
-
-      sig { override.returns(Dependabot::Version) }
-      attr_reader :version
-
-      sig { override.returns(T::Array[Dependabot::Version]) }
-      attr_reader :deprecated_versions
-
-      sig { override.returns(T::Array[Dependabot::Version]) }
-      attr_reader :supported_versions
-
-      sig { override.returns(T::Boolean) }
-      def unsupported?
-        # Check if the version is not supported
-        supported_versions.all? { |supported| supported > version }
+      def initialize(raw_version, requirement = nil)
+        super(
+          PACKAGE_MANAGER,
+          Version.new(raw_version),
+          DEPRECATED_BUNDLER_VERSIONS,
+          SUPPORTED_BUNDLER_VERSIONS,
+          requirement,
+       )
       end
     end
   end

data/lib/dependabot/bundler.rb

@@ -3,6 +3,8 @@
 
 # These all need to be required so the various classes can be registered in a
 # lookup table of package manager names to concrete classes.
+require "dependabot/bundler/language"
+require "dependabot/bundler/package_manager"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/bundler/file_parser"
 require "dependabot/bundler/update_checker"
@@ -10,7 +12,6 @@ require "dependabot/bundler/file_updater"
 require "dependabot/bundler/metadata_finder"
 require "dependabot/bundler/requirement"
 require "dependabot/bundler/version"
-require "dependabot/bundler/package_manager"
 
 require "dependabot/pull_request_creator/labeler"
 Dependabot::PullRequestCreator::Labeler

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.283.0
+  version: 0.285.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-31 00:00:00.000000000 Z
+date: 2024-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.283.0
+        version: 0.285.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.283.0
+        version: 0.285.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -302,6 +302,7 @@ files:
 - lib/dependabot/bundler/file_updater/requirement_replacer.rb
 - lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb
 - lib/dependabot/bundler/helpers.rb
+- lib/dependabot/bundler/language.rb
 - lib/dependabot/bundler/metadata_finder.rb
 - lib/dependabot/bundler/native_helpers.rb
 - lib/dependabot/bundler/package_manager.rb
@@ -321,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.283.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.285.0
 post_install_message: 
 rdoc_options: []
 require_paths: