dependabot-bundler 0.293.0 → 0.295.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c55f6a2180b66147c8e9a848447d253edbc94e067e93664e2bf299adee37d1c7
-  data.tar.gz: 2836e8a29140eba59fdb5e6a16e3e460c236007c9d2c1f9c2b7444f0500510f9
+  metadata.gz: 532e630972469774f8e29af1f314691ee4ed0ad880860c01675d54c1f10590d8
+  data.tar.gz: 2912cadecb1d9fec7fd793ec2ab7e17bf5e807fe0ab86d3cda574e6acbe569d8
 SHA512:
-  metadata.gz: 77ebfa910168259f5ce8228794e090aee255720ce2f1b9ba39b734909d1fdc148b6536d83cc405930e2df4eb6aeb8d48f86837d7aa5a5d73ab001fbb4413788c
-  data.tar.gz: 6daa5c21ed5d6fb37e1c9dc3f41385bf43e90e66934bd346f2262641202681727b6915539deef5f60e423bdef0a932a5efbc9922b9473533183fbba559ba61a4
+  metadata.gz: 335795149b582fdc7ed996ad5ed20e3ca5736facc4f557aaddb811198eb319ba8ae30dbbf31ae36bba9e06eb67e509c21a6543f8154a7827dea28f2992cc0474
+  data.tar.gz: 25e3ca306fecb0e2f4ca0f1c66682d6b43336bbfec71b73674dca2cfbc7d1ee15f03b7110d74639872496692729cad18a613a5ba00fa0050554e880550e13086

data/helpers/v2/monkey_patches/git_source_patch.rb

@@ -55,7 +55,7 @@ module Bundler
           spec = Bundler.load_gemspec(spec_path)
           next unless spec
 
-          Bundler.rubygems.set_installed_by_version(spec)
+          spec.installed_by_version = Gem::VERSION
           Bundler.rubygems.validate(spec)
           File.binwrite(spec_path, spec.to_ruby)
         end

data/lib/dependabot/bundler/file_parser/file_preparer.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -7,19 +7,23 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemfileUpdater
+        extend T::Sig
+
         GEMFILE_FILENAMES = %w(Gemfile gems.rb).freeze
 
         require_relative "git_pin_replacer"
         require_relative "git_source_remover"
         require_relative "requirement_replacer"
 
+        sig { params(dependencies: T::Array[Dependabot::Dependency], gemfile: Dependabot::DependencyFile).void }
         def initialize(dependencies:, gemfile:)
           @dependencies = dependencies
           @gemfile = gemfile
         end
 
+        sig { returns(String) }
         def updated_gemfile_content
-          content = gemfile.content
+          content = T.must(gemfile.content)
 
           dependencies.each do |dependency|
             content = replace_gemfile_version_requirement(
@@ -38,21 +42,27 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemfile
 
+        sig do
+          params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile, content: String).returns(String)
+        end
         def replace_gemfile_version_requirement(dependency, file, content)
           return content unless requirement_changed?(file, dependency)
 
           updated_requirement =
             dependency.requirements
                       .find { |r| r[:file] == file.name }
-                      .fetch(:requirement)
+                      &.fetch(:requirement)
 
           previous_requirement =
             dependency.previous_requirements
-                      .find { |r| r[:file] == file.name }
-                      .fetch(:requirement)
+                      &.find { |r| r[:file] == file.name }
+                      &.fetch(:requirement)
 
           RequirementReplacer.new(
             dependency: dependency,
@@ -62,17 +72,19 @@ module Dependabot
           ).rewrite(content)
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def remove_git_source?(dependency)
           old_gemfile_req =
             dependency.previous_requirements
-                      .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      &.find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
 
           return false unless old_gemfile_req&.dig(:source, :type) == "git"
 
@@ -80,9 +92,10 @@ module Dependabot
             dependency.requirements
                       .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
 
-          new_gemfile_req[:source].nil?
+          T.must(new_gemfile_req)[:source].nil?
         end
 
+        sig { params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile).returns(T::Boolean) }
         def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements
@@ -91,18 +104,23 @@ module Dependabot
 
           # If the new requirement is a git dependency with a ref then there's
           # no harm in doing an update
-          new_gemfile_req.dig(:source, :ref)
+          !T.must(new_gemfile_req).dig(:source, :ref).nil?
         end
 
+        sig { params(dependency: Dependabot::Dependency, content: String).returns(String) }
         def remove_gemfile_git_source(dependency, content)
           GitSourceRemover.new(dependency: dependency).rewrite(content)
         end
 
+        sig do
+          params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile, content: String).returns(String)
+        end
         def update_gemfile_git_pin(dependency, file, content)
           new_pin =
             dependency.requirements
                       .find { |f| f[:file] == file.name }
-                      .fetch(:source).fetch(:ref)
+                      &.fetch(:source)
+                      &.fetch(:ref)
 
           GitPinReplacer
             .new(dependency: dependency, new_pin: new_pin)

data/lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -8,13 +8,20 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemspecDependencyNameFinder
+        extend T::Sig
+
+        ChildNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, String, Integer, Float)) }
+
+        sig { returns(String) }
         attr_reader :gemspec_content
 
+        sig { params(gemspec_content: String).void }
         def initialize(gemspec_content:)
           @gemspec_content = gemspec_content
         end
 
         # rubocop:disable Security/Eval
+        sig { returns(T.nilable(String)) }
         def dependency_name
           ast = Parser::CurrentRuby.parse(gemspec_content)
           dependency_name_node = find_dependency_name_node(ast)
@@ -30,6 +37,7 @@ module Dependabot
 
         private
 
+        sig { params(node: ChildNode).returns(T.nilable(Parser::AST::Node)) }
         def find_dependency_name_node(node)
           return unless node.is_a?(Parser::AST::Node)
           return node if declares_dependency_name?(node)
@@ -40,6 +48,7 @@ module Dependabot
           end
         end
 
+        sig { params(node: ChildNode).returns(T::Boolean) }
         def declares_dependency_name?(node)
           return false unless node.is_a?(Parser::AST::Node)
 

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -8,6 +8,8 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemspecSanitizer
+        extend T::Sig
+
         UNNECESSARY_ASSIGNMENTS = %i(
           bindir=
           cert_chain=
@@ -23,12 +25,15 @@ module Dependabot
           rdoc_options=
         ).freeze
 
+        sig { returns(String) }
         attr_reader :replacement_version
 
+        sig { params(replacement_version: T.any(String, Integer, Gem::Version)).void }
         def initialize(replacement_version:)
-          @replacement_version = replacement_version
+          @replacement_version = T.let(replacement_version.to_s, String)
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemspec_content)")
           buffer.source = content
@@ -47,10 +52,16 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
+          extend T::Sig
+
+          ParserNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, Integer, String, Float)) }
+
+          sig { params(replacement_version: String).void }
           def initialize(replacement_version:)
             @replacement_version = replacement_version
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def on_send(node)
             # Wrap any `require` or `require_relative` calls in a rescue
             # block, as we might not have the required files
@@ -82,12 +93,15 @@ module Dependabot
 
           private
 
+          sig { returns(String) }
           attr_reader :replacement_version
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def requires_file?(node)
             %i(require require_relative).include?(node.children[1])
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def wrap_require(node)
             replace(
               node.loc.expression,
@@ -98,6 +112,7 @@ module Dependabot
             )
           end
 
+          sig { params(node: ParserNode).void }
           def replace_version_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -106,6 +121,7 @@ module Dependabot
             node.children.each { |child| replace_version_assignments(child) }
           end
 
+          sig { params(node: ParserNode).void }
           def replace_version_constant_references(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -116,6 +132,7 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).void }
           def replace_file_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -124,6 +141,7 @@ module Dependabot
             node.children.each { |child| replace_file_assignments(child) }
           end
 
+          sig { params(node: ParserNode).void }
           def replace_require_paths_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -134,6 +152,7 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_to_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -146,6 +165,7 @@ module Dependabot
             node_interpolates_version_constant?(node.children.last)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_files_to_var?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -155,6 +175,7 @@ module Dependabot
             node_dynamically_lists_files?(node.children[2])
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_dynamically_lists_files?(node)
             return false unless node.is_a?(Parser::AST::Node)
 
@@ -163,6 +184,7 @@ module Dependabot
             node.type == :block && node.children.first&.type == :send
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_require_paths?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -171,6 +193,7 @@ module Dependabot
             node.children[1] == :require_paths=
           end
 
+          sig { params(node: ParserNode).void }
           def replace_file_reads(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -180,6 +203,7 @@ module Dependabot
             node.children.each { |child| replace_file_reads(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_reads_a_file?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -189,6 +213,7 @@ module Dependabot
             node.children[1] == :read
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_uses_readlines?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -198,6 +223,7 @@ module Dependabot
             node.children[1] == :readlines
           end
 
+          sig { params(node: ParserNode).void }
           def replace_json_parses(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -206,6 +232,7 @@ module Dependabot
             node.children.each { |child| replace_json_parses(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_parses_json?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -215,6 +242,7 @@ module Dependabot
             node.children[1] == :parse
           end
 
+          sig { params(node: ParserNode).void }
           def remove_find_dot_find_args(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -223,6 +251,7 @@ module Dependabot
             node.children.each { |child| remove_find_dot_find_args(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_calls_find_dot_find?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -232,6 +261,7 @@ module Dependabot
             node.children[1] == :find
           end
 
+          sig { params(node: ParserNode).void }
           def remove_unnecessary_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -247,8 +277,9 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_includes_heredoc?(node)
-            find_heredoc_end_range(node)
+            !!find_heredoc_end_range(node)
           end
 
           # Performs a depth-first search for the first heredoc in the given
@@ -256,6 +287,7 @@ module Dependabot
           #
           # Returns a Parser::Source::Range identifying the location of the end
           #   of the heredoc, or nil if no heredoc was found.
+          sig { params(node: ParserNode).returns(T.nilable(Parser::Source::Range)) }
           def find_heredoc_end_range(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -271,6 +303,7 @@ module Dependabot
             nil
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def unnecessary_assignment?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -278,9 +311,10 @@ module Dependabot
             return true if node.children.first.type == :lvar &&
                            UNNECESSARY_ASSIGNMENTS.include?(node.children[1])
 
-            node.children[1] == :[]= && node.children.first.children.last
+            !!(node.children[1] == :[]= && node.children.first.children.last)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_is_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :const
@@ -288,6 +322,7 @@ module Dependabot
             node.children.last.to_s.match?(/version/i)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_calls_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :send
@@ -295,6 +330,7 @@ module Dependabot
             node.children.any? { |n| node_is_version_constant?(n) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_interpolates_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :dstr
@@ -305,6 +341,7 @@ module Dependabot
                 .any? { |n| node_is_version_constant?(n) }
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_constant(node)
             case node.children.last&.type
             when :str, :int then nil # no-op
@@ -318,18 +355,22 @@ module Dependabot
             end
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_assignment(node)
             replace(node.children.last.loc.expression, "[]")
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_require_paths_assignment(node)
             replace(node.children.last.loc.expression, "['lib']")
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_read(node)
             replace(node.loc.expression, %("#{replacement_version}"))
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_json_parse(node)
             replace(
               node.loc.expression,
@@ -337,10 +378,12 @@ module Dependabot
             )
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_readlines(node)
             replace(node.loc.expression, %(["#{replacement_version}"]))
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def remove_find_args(node)
             last_arg = node.children.last
 

data/lib/dependabot/bundler/file_updater/gemspec_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -9,13 +9,17 @@ module Dependabot
       class GemspecUpdater
         require_relative "requirement_replacer"
 
+        extend T::Sig
+
+        sig { params(dependencies: T::Array[Dependabot::Dependency], gemspec: Dependabot::DependencyFile).void }
         def initialize(dependencies:, gemspec:)
-          @dependencies = dependencies
-          @gemspec = gemspec
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @gemspec = T.let(gemspec, Dependabot::DependencyFile)
         end
 
+        sig { returns(String) }
         def updated_gemspec_content
-          content = gemspec.content
+          content = T.let(T.must(gemspec.content), String)
 
           dependencies.each do |dependency|
             content = replace_gemspec_version_requirement(
@@ -28,21 +32,28 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemspec
 
+        sig do
+          params(gemspec: Dependabot::DependencyFile, dependency: Dependabot::Dependency,
+                 content: String).returns(String)
+        end
         def replace_gemspec_version_requirement(gemspec, dependency, content)
           return content unless requirement_changed?(gemspec, dependency)
 
           updated_requirement =
-            dependency.requirements
-                      .find { |r| r[:file] == gemspec.name }
-                      .fetch(:requirement)
+            T.must(dependency.requirements
+                      .find { |r| r[:file] == gemspec.name })
+             .fetch(:requirement)
 
           previous_requirement =
-            dependency.previous_requirements
-                      .find { |r| r[:file] == gemspec.name }
-                      .fetch(:requirement)
+            T.must(T.must(dependency.previous_requirements)
+                      .find { |r| r[:file] == gemspec.name })
+             .fetch(:requirement)
 
           RequirementReplacer.new(
             dependency: dependency,
@@ -52,9 +63,10 @@ module Dependabot
           ).rewrite(content)
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -9,12 +9,12 @@ module Dependabot
   module Bundler
     class FileUpdater
       class RubyRequirementSetter
-        class RubyVersionNotFound < StandardError; end
-
         RUBY_VERSIONS = %w(
           1.8.7 1.9.3 2.0.0 2.1.10 2.2.10 2.3.8 2.4.10 2.5.9 2.6.9 2.7.6 3.0.6 3.1.6 3.2.4 3.3.6
         ).freeze
 
+        LANGUAGE = "ruby"
+
         attr_reader :gemspec
 
         def initialize(gemspec:)
@@ -62,7 +62,13 @@ module Dependabot
             .map { |v| Gem::Version.new(v) }.sort
             .find { |v| requirement.satisfied_by?(v) }
 
-          raise RubyVersionNotFound unless ruby_version
+          unless ruby_version
+            raise ToolVersionNotSupported.new(
+              LANGUAGE,
+              requirement.to_s,
+              RUBY_VERSIONS.join(", ")
+            )
+          end
 
           ruby_version
         end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -52,6 +52,9 @@ module Dependabot
 
         def force_update
           requirement = dependency.requirements.find { |req| req[:file] == gemfile.name }
+
+          valid_gem_version?(target_version)
+
           manifest_requirement_not_satisfied = requirement && !Requirement.satisfied_by?(requirement, target_version)
 
           if manifest_requirement_not_satisfied && requirements_update_strategy.lockfile_only?
@@ -80,6 +83,15 @@ module Dependabot
           end
         end
 
+        def valid_gem_version?(target_version)
+          # to rule out empty, non gem info ending up in as target_version
+          return true if target_version.is_a?(Gem::Version)
+
+          Dependabot.logger.warn("Bundler force update called with a non-Gem::Version #{target_version}")
+
+          raise Dependabot::DependencyFileNotResolvable
+        end
+
         def original_dependencies
           @original_dependencies ||=
             FileParser.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.293.0
+  version: 0.295.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-16 00:00:00.000000000 Z
+date: 2025-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.293.0
+        version: 0.295.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.293.0
+        version: 0.295.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.293.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
 post_install_message:
 rdoc_options: []
 require_paths: