dependabot-bundler 0.285.0 → 0.287.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46bd8d058b090759dfbdef246960dd68aaf6805eca3e8ed86dcbbe24bae02f05
-  data.tar.gz: 0104dce3ac3823fb75626420bf71eabebba6cc6a43a5a01a3ab4475c73f5090f
+  metadata.gz: e82d72780ee002e2dc657652b78afba6525449918026b1823f14557be293bc89
+  data.tar.gz: 232a148baddee6db29ade4252a5a9999c8cb5612fd176a919e5830d019e1e007
 SHA512:
-  metadata.gz: 29cc464b42b25ae071d77180e16b91e151cc5fb5a5b8fb3375a94908dd6189539b5b23e02d5be93b999fe7e3256671fa4718adc5c63107f18b08332d2f2b0950
-  data.tar.gz: a1ca65abcce69cac328b4d99d1e4fe5319abc1c6fc7f8f3ffd5b99f70f1a3887e07434ba8a69521c7fed2c952c3e6cbb745fa55da547148a09c56408cbecac21
+  metadata.gz: bc67b575fbf0dac6e227acf07a4a47dbfc1b96da67523aedcef81e3ad3d045798c4d2b0408860befdee5bc3593ce19214664214c2e5f9172069d048715886876
+  data.tar.gz: 3fadee57fbab8282108e2467bbceceadb89130ed4c5c6faf57139c9a6136938e5793bf438ddaa6d671ffb1b755d2bc9d1a4500814d4503d952f513f87b4cea87

data/lib/dependabot/bundler/file_parser.rb

@@ -54,7 +54,9 @@ module Dependabot
       end
 
       def package_manager_requirement
-        @package_manager_requirement ||= Helpers.bundler_dependency_requirement(dependency_files)
+        @package_manager_requirement ||= Helpers.dependency_requirement(
+          Helpers::BUNDLER_GEM_NAME, dependency_files
+        )
       end
 
       sig { returns(T.nilable(Ecosystem::VersionManager)) }
@@ -63,7 +65,13 @@ module Dependabot
 
         return nil if package_manager.unsupported?
 
-        Language.new(ruby_raw_version)
+        Language.new(ruby_raw_version, language_requirement)
+      end
+
+      def language_requirement
+        @language_requirement ||= Helpers.dependency_requirement(
+          Helpers::LANGUAGE, dependency_files
+        )
       end
 
       def check_external_code(dependencies)

data/lib/dependabot/bundler/helpers.rb

@@ -13,10 +13,13 @@ module Dependabot
       V2 = "2"
       DEFAULT = V2
       BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
+      RUBY_GEMFILE_REGEX = /^ruby\s+['"]([^'"]+)['"]/
+      RUBY_GEMSPEC_REGEX = /required_ruby_version\s+=\s+['"]([^'"]+)['"]/
 
       GEMFILE = "Gemfile"
       GEMSPEC_EXTENSION = ".gemspec"
       BUNDLER_GEM_NAME = "bundler"
+      LANGUAGE = "ruby"
 
       sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.bundler_version(lockfile)
@@ -42,10 +45,13 @@ module Dependabot
 
       # Method to get the Requirement object for the 'bundler' dependency
       sig do
-        params(files: T::Array[Dependabot::DependencyFile]).returns(T.nilable(Dependabot::Bundler::Requirement))
+        params(
+          dependency_name: String,
+          files: T::Array[Dependabot::DependencyFile]
+        ).returns(T.nilable(Dependabot::Bundler::Requirement))
       end
-      def self.bundler_dependency_requirement(files)
-        constraints = combined_dependency_constraints(files, BUNDLER_GEM_NAME)
+      def self.dependency_requirement(dependency_name, files)
+        constraints = combined_dependency_constraints(files, dependency_name)
         return nil if constraints.empty?
 
         combined_constraint = constraints.join(", ")
@@ -67,20 +73,35 @@ module Dependabot
           content = file.content
           next unless content
 
-          # Select the appropriate regex based on file type
-          regex = if file.name.end_with?(GEMFILE)
+          # Select the appropriate regex based on file type and dependency name
+          regex = if dependency_name == LANGUAGE
+                    ruby_version_regex(file.name)
+                  elsif file.name.end_with?(GEMFILE)
                     gemfile_dependency_regex(dependency_name)
                   elsif file.name.end_with?(GEMSPEC_EXTENSION)
                     gemspec_dependency_regex(dependency_name)
                   else
-                    next # Skip unsupported file types
+                    next # Skip unsupported file types, including .ruby-version
                   end
 
+          # If regex is nil (unsupported for this file type), skip to the next file
+          next unless regex
+
           # Extract constraints using the chosen regex
           result.concat(extract_constraints_from_file(content, regex))
         end.uniq
       end
 
+      # Method to generate the regex pattern for Ruby version in Gemfile or gemspec
+      sig { params(file_name: String).returns(T.nilable(Regexp)) }
+      def self.ruby_version_regex(file_name)
+        if file_name.end_with?(GEMFILE)
+          RUBY_GEMFILE_REGEX
+        elsif file_name.end_with?(GEMSPEC_EXTENSION)
+          RUBY_GEMSPEC_REGEX
+        end
+      end
+
       # Method to generate the regex pattern for a dependency in a Gemfile
       sig { params(dependency_name: String).returns(Regexp) }
       def self.gemfile_dependency_regex(dependency_name)

data/lib/dependabot/bundler/language.rb

@@ -12,12 +12,9 @@ module Dependabot
     class Language < Dependabot::Ecosystem::VersionManager
       extend T::Sig
 
-      sig { params(raw_version: String).void }
-      def initialize(raw_version)
-        super(
-          LANGUAGE,
-          Version.new(raw_version)
-        )
+      sig { params(raw_version: String, requirement: T.nilable(Requirement)).void }
+      def initialize(raw_version, requirement = nil)
+        super(LANGUAGE, Version.new(raw_version), [], [], requirement)
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.285.0
+  version: 0.287.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-07 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.285.0
+        version: 0.287.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.285.0
+        version: 0.287.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.285.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.287.0
 post_install_message: 
 rdoc_options: []
 require_paths: