dependabot-bundler 0.301.1 → 0.312.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d816583905f4a13461e10631cb7b53faad446fe64136a8aa4502a71bf510fc51
-  data.tar.gz: '08d1569ce573e759213d6da1de4d17f10c28dc1bdc111578eb64b4c298a009ea'
+  metadata.gz: 549146f0c01d6f1805e3f7b2df0224005cfaea8fd95f57d369196d472293209b
+  data.tar.gz: db901d1622be4c70afe115d2e89764dcab968ca27b1d024c1c5b04c2a318519b
 SHA512:
-  metadata.gz: 35b1a7f68f2d5b6dfdf28c36840cc3179f7a42a78fd5085bba118e67c6803d11241d9073bfaa40bb72516a37d95d1bdae3aa0a22233c2e29b9e28d77a1046439
-  data.tar.gz: dfcafaff2b37f3f90e2291a2dd09a111e2e257fc9cb3835b00c37182adb83ce4669ec44a534862cdad460d154390e7ca9a7b42f3c325c92002be7b133d9eb5ee
+  metadata.gz: 3b7f9f31ac2932af8a31ab6b04282500d99381f77daeb55169a59742d69b10ad2b2bea49137073ba02a49be9f60a757950b39963f9b161cbcd51873a10342a2e
+  data.tar.gz: f6acae736ca5bc9449bed970b5da4861909873198ad434c30d5d6b6db96a3778df54ef1f1e75a123afe1d9c10b45581a98a77d1df04f03f51fe6e78e33fa479b

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -59,7 +59,7 @@ module Dependabot
 
           ruby_version =
             RUBY_VERSIONS
-            .map { |v| Gem::Version.new(v) }.sort
+            .map { |v| Dependabot::Bundler::Version.new(v) }.sort
             .find { |v| requirement.satisfied_by?(v) }
 
           unless ruby_version

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -0,0 +1,228 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "cgi"
+require "excon"
+require "nokogiri"
+require "sorbet-runtime"
+require "dependabot/registry_client"
+require "dependabot/bundler"
+require "dependabot/package/package_release"
+require "dependabot/package/package_details"
+
+module Dependabot
+  module Bundler
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        require_relative "../update_checker/shared_bundler_helpers"
+        include Dependabot::Bundler::UpdateChecker::SharedBundlerHelpers
+
+        RELEASES_URL = "https://rubygems.org/api/v1/versions/%s.json"
+        GEM_URL = "https://rubygems.org/gems/%s.gem"
+        PACKAGE_TYPE = "gem"
+        PACKAGE_LANGUAGE = "ruby"
+        APPLICATION_JSON = "application/json"
+
+        RUBYGEMS = "rubygems"
+        PRIVATE_REGISTRY = "private"
+        GIT = "git"
+        OTHER = "other"
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:)
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
+
+          @source_type = T.let(nil, T.nilable(String))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[T.untyped]) }
+        attr_reader :credentials
+
+        sig { returns(Dependabot::Package::PackageDetails) }
+        def fetch
+          return rubygems_versions if dependency.name == "bundler"
+          return rubygems_versions unless gemfile
+
+          case source_type
+          when OTHER, GIT, PRIVATE_REGISTRY
+            package_details([])
+          else
+            rubygems_versions
+          end
+        end
+
+        private
+
+        # Example JSON Response Format:
+        # eg https://rubygems.org/api/v1/versions/dependabot-common.json
+        # response:
+        # [
+        # {
+        #   authors: "Dependabot",
+        #   built_at: "2025-03-20T00:00:00.000Z",
+        #   created_at: "2025-03-20T14:48:33.295Z",
+        #   description: "Dependabot-Common provides the shared code used across Dependabot. If you want support for
+        #                 multiple package managers, you probably want the meta-gem dependabot-omnibus.",
+        #   downloads_count: 382,
+        #   metadata: {
+        #   changelog_uri: "https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0",
+        #   bug_tracker_uri: "https://github.com/dependabot/dependabot-core/issues"
+        #   },
+        #   number: "0.302.0",
+        #   summary: "Shared code used across Dependabot Core",
+        #   platform: "ruby",
+        #   rubygems_version: ">= 3.3.7",
+        #   ruby_version: ">= 3.1.0",
+        #   prerelease: false,
+        #   licenses: [
+        #   "MIT"
+        #   ],
+        #   requirements: [ ],
+        #   sha: "e8ef286a91add81534c297425f2f2efc0c5671f3307307f7fad62c059ed8fca2",
+        #   spec_sha: "cd0ac8f3462449bf19e7356dbc2ec83eec378b41702e03221ededc49875b1e1c"
+        #   },
+        #   {
+        #   authors: "Dependabot",
+        #   built_at: "2025-03-14T00:00:00.000Z",
+        #   created_at: "2025-03-14T18:46:18.547Z",
+        #   description: "Dependabot-Common provides the shared code used across Dependabot. If you want support for
+        #                 multiple package managers, you probably want the meta-gem dependabot-omnibus.",
+        #   downloads_count: 324,
+        #   metadata: {
+        #   changelog_uri: "https://github.com/dependabot/dependabot-core/releases/tag/v0.301.1",
+        #   bug_tracker_uri: "https://github.com/dependabot/dependabot-core/issues"
+        #   },
+        #   number: "0.301.1",
+        #   summary: "Shared code used across Dependabot Core",
+        #   platform: "ruby",
+        #   rubygems_version: ">= 3.3.7",
+        #   ruby_version: ">= 3.1.0",
+        #   prerelease: false,
+        #   licenses: [
+        #   "MIT"
+        #   ],
+        #   requirements: [ ],
+        #   sha: "47e5948069571271d72c12f8c03106b415a00550857b6c5fb22aeb780cfe1da7",
+        #   spec_sha: "7191388ac6fa0ea72ed7588f848b2b244a0dc5a4ec3e6b7c9d395296b0fa93d9"
+        #   },
+        # ...
+        # ]
+        sig { returns(Dependabot::Package::PackageDetails) }
+        def rubygems_versions
+          response = registry_json_response_for_dependency
+          raise unless response.status == 200
+
+          package_releases = JSON.parse(response.body).map do |release|
+            package_release(
+              version: release["number"],
+              released_at: Time.parse(release["created_at"]),
+              downloads: release["downloads_count"],
+              url: GEM_URL % "#{@dependency.name}-#{release['number']}",
+              ruby_version: release["ruby_version"]
+            )
+          end
+
+          package_details(package_releases)
+        end
+
+        sig { returns(Excon::Response) }
+        def registry_json_response_for_dependency
+          url = RELEASES_URL % dependency.name
+          Dependabot::RegistryClient.get(
+            url: url,
+            headers: { "Accept" => APPLICATION_JSON }
+          )
+        end
+
+        sig { params(req_string: String).returns(Requirement) }
+        def language_requirement(req_string)
+          Requirement.new(req_string)
+        end
+
+        sig { returns(String) }
+        def source_type
+          @source_type ||= begin
+            return @source_type = RUBYGEMS unless gemfile
+
+            @source_type = in_a_native_bundler_context do |tmp_dir|
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
+                function: "dependency_source_type",
+                options: {}, # options,
+                args: {
+                  dir: tmp_dir,
+                  gemfile_name: gemfile.name,
+                  dependency_name: dependency.name,
+                  credentials: credentials
+                }
+              )
+            end
+          end
+        end
+
+        sig { override.returns(String) }
+        def bundler_version
+          @bundler_version ||= T.let(Helpers.bundler_version(lockfile), T.nilable(String))
+        end
+
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(Dependabot::Package::PackageDetails)
+        end
+        def package_details(releases)
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: releases.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
+        end
+
+        sig do
+          params(
+            version: String,
+            released_at: Time,
+            downloads: Integer,
+            url: String,
+            ruby_version: T.nilable(String),
+            yanked: T::Boolean
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def package_release(version:, released_at:, downloads:, url:, ruby_version:, yanked: false)
+          Dependabot::Package::PackageRelease.new(
+            version: Dependabot::Bundler::Version.new(version),
+            released_at: released_at,
+            yanked: yanked,
+            yanked_reason: nil,
+            downloads: downloads,
+            url: url,
+            package_type: PACKAGE_TYPE,
+            language: Dependabot::Package::PackageLanguage.new(
+              name: PACKAGE_LANGUAGE,
+              version: nil,
+              requirement: ruby_version ? language_requirement(ruby_version) : nil
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -215,13 +215,13 @@ module Dependabot
           lower_bound_req = updated_version_req_lower_bound(filename)
 
           return lower_bound_req if latest_allowable_version.nil?
-          return lower_bound_req unless Gem::Version.correct?(latest_allowable_version)
+          return lower_bound_req unless Bundler::Version.correct?(latest_allowable_version)
 
           lower_bound_req + ", <= #{latest_allowable_version}"
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        def updated_version_req_lower_bound(filename)
+        def updated_version_req_lower_bound(filename) # rubocop:disable Metrics/CyclomaticComplexity
           original_req = dependency.requirements
                                    .find { |r| r.fetch(:file) == filename }
                                    &.fetch(:requirement)
@@ -234,9 +234,9 @@ module Dependabot
               dependency.requirements.map { |r| r[:requirement] }
                         .reject { |req_string| req_string.start_with?("<") }
                         .select { |req_string| req_string.match?(VERSION_REGEX) }
-                        .map { |req_string| req_string.match(VERSION_REGEX) }
-                        .select { |version| Gem::Version.correct?(version) }
-                        .max_by { |version| Gem::Version.new(version) }
+                        .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
+                        .select { |version| Bundler::Version.correct?(version) }
+                        .max_by { |version| Bundler::Version.new(version) }
 
             ">= #{version_for_requirement || 0}"
           end

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -4,12 +4,13 @@
 require "dependabot/registry_client"
 require "dependabot/bundler/native_helpers"
 require "dependabot/bundler/helpers"
+require "dependabot/bundler/update_checker/latest_version_finder"
 require "sorbet-runtime"
 
 module Dependabot
   module Bundler
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         class DependencySource
           extend T::Sig
 
@@ -39,7 +40,7 @@ module Dependabot
 
           # The latest version details for the dependency from a registry
           #
-          sig { returns(T::Array[Gem::Version]) }
+          sig { returns(T::Array[Dependabot::Bundler::Version]) }
           def versions
             return rubygems_versions if dependency.name == "bundler"
             return rubygems_versions unless gemfile
@@ -98,7 +99,7 @@ module Dependabot
                 )
 
                 JSON.parse(response.body)
-                    .map { |d| Gem::Version.new(d["number"]) }
+                    .map { |d| Dependabot::Bundler::Version.new(d["number"]) }
               end
           rescue JSON::ParserError, Excon::Error::Timeout
             @rubygems_versions = []
@@ -122,7 +123,7 @@ module Dependabot
                     credentials: credentials
                   }
                 ).map do |version_string|
-                  Gem::Version.new(version_string)
+                  Dependabot::Bundler::Version.new(version_string)
                 end
               end
           end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -8,105 +8,135 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/package/package_latest_version_finder"
 require "dependabot/bundler/update_checker/latest_version_finder/" \
         "dependency_source"
+require "dependabot/bundler/package/package_details_fetcher"
 require "sorbet-runtime"
 
 module Dependabot
   module Bundler
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
-        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
-                       credentials:, ignored_versions:, raise_on_ignored: false,
-                       security_advisories:, options:)
-          @dependency          = dependency
-          @dependency_files    = dependency_files
-          @repo_contents_path  = repo_contents_path
-          @credentials         = credentials
-          @ignored_versions    = ignored_versions
-          @raise_on_ignored    = raise_on_ignored
-          @security_advisories = security_advisories
-          @options             = options
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+            raise_on_ignored: T::Boolean,
+            options: T::Hash[Symbol, T.untyped]
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          cooldown_options: nil,
+          raise_on_ignored: false,
+          options: {}
+        )
+          @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @releases_from_dependency_source = T.let(nil, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+          super
+        end
+
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details
+          @package_details ||= Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).fetch
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_details
-          @latest_version_details ||= fetch_latest_version_details
+          @latest_version_details ||= if cooldown_enabled?
+                                        latest_version = fetch_latest_version(language_version: nil)
+                                        latest_version ? { version: latest_version } : nil
+                                      else
+                                        fetch_latest_version_details
+                                      end
         end
 
-        def lowest_security_fix_version
-          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_bundler)
         end
 
-        private
+        sig { override.returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def available_versions
+          return nil if package_details&.releases.nil?
+
+          source_versions = releases_from_dependency_source
+          return [] if source_versions.empty?
+
+          T.must(package_details).releases.select do |release|
+            source_versions.any? { |v| v.to_s == release.version.to_s }
+          end
+        end
 
-        attr_reader :dependency
-        attr_reader :dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
-        attr_reader :ignored_versions
-        attr_reader :security_advisories
-        attr_reader :options
+        private
 
+        sig { returns(T.nilable(T::Hash[Symbol, Dependabot::Version])) }
         def fetch_latest_version_details
           return dependency_source.latest_git_version_details if dependency_source.git?
 
-          relevant_versions = dependency_source.versions
+          relevant_versions = releases_from_dependency_source
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
 
-          relevant_versions.empty? ? nil : { version: relevant_versions.max }
+          return if relevant_versions.empty?
+
+          release = relevant_versions.max_by(&:version)
+
+          { version: release&.version }
         end
 
-        def fetch_lowest_security_fix_version
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_lowest_security_fix_version(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
           return if dependency_source.git?
 
-          relevant_versions = dependency_source.versions
+          relevant_versions = releases_from_dependency_source
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
-                                                                                                    security_advisories)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters
+                              .filter_vulnerable_versions(
+                                relevant_versions,
+                                security_advisories
+                              )
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
-          relevant_versions.min
+          relevant_versions.min_by(&:version)&.version
         end
 
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-        def filter_prerelease_versions(versions_array)
-          return versions_array if wants_prerelease?
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def releases_from_dependency_source
+          return @releases_from_dependency_source if @releases_from_dependency_source
 
-          filtered = versions_array.reject(&:prerelease?)
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
-          end
-          filtered
-        end
-
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-        def filter_ignored_versions(versions_array)
-          filtered = versions_array
-                     .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
-          if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
-            raise AllVersionsIgnored
-          end
-
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
-          end
-
-          filtered
-        end
-
-        def filter_lower_versions(versions_array)
-          return versions_array unless dependency.numeric_version
-
-          versions_array
-            .select { |version| version > dependency.numeric_version }
+          @releases_from_dependency_source =
+            dependency_source.versions.map do |version|
+              Dependabot::Package::PackageRelease.new(
+                version: version
+              )
+            end
+          @releases_from_dependency_source
         end
 
+        sig { returns(T::Boolean) }
         def wants_prerelease?
-          @wants_prerelease ||=
+          @wants_prerelease ||= T.let(
             begin
               current_version = dependency.numeric_version
               if current_version&.prerelease?
@@ -116,30 +146,21 @@ module Dependabot
                   req[:requirement].match?(/[a-z]/i)
                 end
               end
-            end
+            end, T.nilable(T::Boolean)
+          )
         end
 
+        sig { returns(DependencySource) }
         def dependency_source
-          @dependency_source ||= DependencySource.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            options: options
+          @dependency_source ||= T.let(
+            DependencySource.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              options: options
+            ), T.nilable(DependencySource)
           )
         end
-
-        def ignore_requirements
-          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
-        end
-
-        def requirement_class
-          dependency.requirement_class
-        end
-
-        def gemfile
-          dependency_files.find { |f| f.name == "Gemfile" } ||
-            dependency_files.find { |f| f.name == "gems.rb" }
-        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -26,7 +26,7 @@ module Dependabot
         def initialize(requirements:, update_strategy:, updated_source:,
                        latest_version:, latest_resolvable_version:)
           @requirements = requirements
-          @latest_version = Gem::Version.new(latest_version) if latest_version
+          @latest_version = Dependabot::Bundler::Version.new(latest_version) if latest_version
           @updated_source = updated_source
           @update_strategy = update_strategy
 
@@ -35,7 +35,7 @@ module Dependabot
           return unless latest_resolvable_version
 
           @latest_resolvable_version =
-            Gem::Version.new(latest_resolvable_version)
+            Dependabot::Bundler::Version.new(latest_resolvable_version)
         end
 
         def updated_requirements
@@ -267,7 +267,9 @@ module Dependabot
         # Updates the version in a "<" or "<=" constraint to allow the given
         # version
         def update_greatest_version(requirement, version_to_be_permitted)
-          version_to_be_permitted = Gem::Version.new(version_to_be_permitted) if version_to_be_permitted.is_a?(String)
+          if version_to_be_permitted.is_a?(String)
+            version_to_be_permitted = Dependabot::Bundler::Version.new(version_to_be_permitted)
+          end
           op, version = requirement.requirements.first
           version = version.release if version.prerelease?
 

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -26,6 +26,7 @@ module Dependabot
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
                        latest_allowable_version: nil,
+                       cooldown_options: nil,
                        options:)
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
@@ -37,6 +38,7 @@ module Dependabot
           @remove_git_source           = remove_git_source
           @unlock_requirement          = unlock_requirement
           @latest_allowable_version    = latest_allowable_version
+          @cooldown_options            = cooldown_options
           @options                     = options
 
           @latest_allowable_version_incompatible_with_ruby = false
@@ -116,7 +118,7 @@ module Dependabot
                 # mismatch
                 return nil if ruby_version_incompatible?(details)
 
-                details[:version] = Gem::Version.new(details[:version])
+                details[:version] = Dependabot::Bundler::Version.new(details[:version])
               end
               details
             end
@@ -183,11 +185,11 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: dependency_files,
-              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,
               security_advisories: [],
+              cooldown_options: @cooldown_options,
               options: options
             ).latest_version_details
         end

data/lib/dependabot/bundler/update_checker.rb

@@ -130,10 +130,10 @@ module Dependabot
 
         updated_dependencies.none? do |dep|
           old_version = dep.previous_version
-          next unless Gem::Version.correct?(old_version)
-          next if Gem::Version.new(old_version).prerelease?
+          next unless Dependabot::Bundler::Version.correct?(old_version)
+          next if Dependabot::Bundler::Version.new(old_version).prerelease?
 
-          Gem::Version.new(dep.version).prerelease?
+          Dependabot::Bundler::Version.new(dep.version).prerelease?
         end
       rescue Dependabot::DependencyFileNotResolvable
         false
@@ -189,6 +189,7 @@ module Dependabot
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
               replacement_git_pin: tag,
+              cooldown_options: update_cooldown,
               options: options
             ).latest_resolvable_version_details
             true
@@ -351,6 +352,7 @@ module Dependabot
             remove_git_source: remove_git_source,
             unlock_requirement: unlock_requirement,
             latest_allowable_version: latest_version,
+            cooldown_options: update_cooldown,
             options: options
           )
       end
@@ -367,11 +369,11 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: prepared_dependency_files,
-              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,
               security_advisories: security_advisories,
+              cooldown_options: update_cooldown,
               options: options
             )
           end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.301.1
+  version: 0.312.0
 platform: ruby
 authors:
 - Dependabot
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-14 00:00:00.000000000 Z
+date: 2025-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.312.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.312.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -44,14 +43,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -72,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -114,98 +113,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -238,16 +237,16 @@ dependencies:
   name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.7'
+        version: '1.9'
 description: Dependabot-Bundler provides support for bumping Ruby (bundler) gems via
   Dependabot. If you want support for multiple package managers, you probably want
   the meta-gem dependabot-omnibus.
@@ -305,6 +304,7 @@ files:
 - lib/dependabot/bundler/language.rb
 - lib/dependabot/bundler/metadata_finder.rb
 - lib/dependabot/bundler/native_helpers.rb
+- lib/dependabot/bundler/package/package_details_fetcher.rb
 - lib/dependabot/bundler/package_manager.rb
 - lib/dependabot/bundler/requirement.rb
 - lib/dependabot/bundler/update_checker.rb
@@ -322,8 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.301.1
-post_install_message:
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.312.0
 rdoc_options: []
 require_paths:
 - lib
@@ -338,8 +337,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.1.0
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.3
 specification_version: 4
 summary: Provides Dependabot support for Ruby (bundler)
 test_files: []