dependabot-bundler 0.308.0 → 0.309.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f34662935a61fbc23f887a0b8ae372ecca9aff6ef21ee71a2b8ad0e28d06566d
-  data.tar.gz: a8a109ee39726181d6cd6ec4c506ae5e4a03c8e75778fdf934ef8071042e9f8f
+  metadata.gz: 98adda346a76e929779863234b449bde7f6a82d20fd06b276985733aba5a1b32
+  data.tar.gz: 72fa485c071bb1afaa4e28745cd61a869208a305efd87e0031f8f4d6c644a718
 SHA512:
-  metadata.gz: 7b983b93d53bb8b3ebd4343fc0d1251ed49ef46aa7bf9408b873a3a56da9b14eb20c809161cb0a42300d997d089b77081a29be535b6a36094b8bcc83821e661a
-  data.tar.gz: 78db663af451497232e62c570b30055cd6862303d81cc631add051f63464c00cf07c947083fb9fd93c921d906afe5e6c3f197ee02cb0cb2e8095067270aafccc
+  metadata.gz: 661373820c2f8824b479631641081b88dcea64b877ae6e98961419ce5ddfd75e8f8154eee095745c854c124aab1dc6bae539633474763b4f3077127659ea2d2a
+  data.tar.gz: af152a6768a8675641f02b3bd98019163e047c9fd5fc75928eefb427e1d9b7fade6a1727a652cc43d0a83f0bc6914181e76787aea8a0d753943465ef52af116f

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -59,7 +59,7 @@ module Dependabot
 
           ruby_version =
             RUBY_VERSIONS
-            .map { |v| Gem::Version.new(v) }.sort
+            .map { |v| Dependabot::Bundler::Version.new(v) }.sort
             .find { |v| requirement.satisfied_by?(v) }
 
           unless ruby_version

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -215,13 +215,13 @@ module Dependabot
           lower_bound_req = updated_version_req_lower_bound(filename)
 
           return lower_bound_req if latest_allowable_version.nil?
-          return lower_bound_req unless Gem::Version.correct?(latest_allowable_version)
+          return lower_bound_req unless Bundler::Version.correct?(latest_allowable_version)
 
           lower_bound_req + ", <= #{latest_allowable_version}"
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        def updated_version_req_lower_bound(filename)
+        def updated_version_req_lower_bound(filename) # rubocop:disable Metrics/CyclomaticComplexity
           original_req = dependency.requirements
                                    .find { |r| r.fetch(:file) == filename }
                                    &.fetch(:requirement)
@@ -234,9 +234,9 @@ module Dependabot
               dependency.requirements.map { |r| r[:requirement] }
                         .reject { |req_string| req_string.start_with?("<") }
                         .select { |req_string| req_string.match?(VERSION_REGEX) }
-                        .map { |req_string| req_string.match(VERSION_REGEX) }
-                        .select { |version| Gem::Version.correct?(version) }
-                        .max_by { |version| Gem::Version.new(version) }
+                        .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
+                        .select { |version| Bundler::Version.correct?(version) }
+                        .max_by { |version| Bundler::Version.new(version) }
 
             ">= #{version_for_requirement || 0}"
           end

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -40,7 +40,7 @@ module Dependabot
 
           # The latest version details for the dependency from a registry
           #
-          sig { returns(T::Array[Gem::Version]) }
+          sig { returns(T::Array[Dependabot::Bundler::Version]) }
           def versions
             return rubygems_versions if dependency.name == "bundler"
             return rubygems_versions unless gemfile
@@ -99,7 +99,7 @@ module Dependabot
                 )
 
                 JSON.parse(response.body)
-                    .map { |d| Gem::Version.new(d["number"]) }
+                    .map { |d| Dependabot::Bundler::Version.new(d["number"]) }
               end
           rescue JSON::ParserError, Excon::Error::Timeout
             @rubygems_versions = []
@@ -123,7 +123,7 @@ module Dependabot
                     credentials: credentials
                   }
                 ).map do |version_string|
-                  Gem::Version.new(version_string)
+                  Dependabot::Bundler::Version.new(version_string)
                 end
               end
           end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -20,6 +20,34 @@ module Dependabot
       class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+            raise_on_ignored: T::Boolean,
+            options: T::Hash[Symbol, T.untyped]
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          cooldown_options: nil,
+          raise_on_ignored: false,
+          options: {}
+        )
+          @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @releases_from_dependency_source = T.let(nil, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+          super
+        end
+
         sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
         def package_details
           @package_details ||= Package::PackageDetailsFetcher.new(
@@ -29,6 +57,7 @@ module Dependabot
           ).fetch
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_details
           @latest_version_details ||= if cooldown_enabled?
                                         latest_version = fetch_latest_version(language_version: nil)
@@ -47,7 +76,7 @@ module Dependabot
         def available_versions
           return nil if package_details&.releases.nil?
 
-          source_versions = dependency_source.versions
+          source_versions = releases_from_dependency_source
           return [] if source_versions.empty?
 
           T.must(package_details).releases.select do |release|
@@ -57,27 +86,52 @@ module Dependabot
 
         private
 
+        sig { returns(T.nilable(T::Hash[Symbol, Dependabot::Version])) }
         def fetch_latest_version_details
           return dependency_source.latest_git_version_details if dependency_source.git?
 
-          relevant_versions = dependency_source.versions
+          relevant_versions = releases_from_dependency_source
           relevant_versions = filter_prerelease_versions(relevant_versions)
           relevant_versions = filter_ignored_versions(relevant_versions)
 
-          relevant_versions.empty? ? nil : { version: relevant_versions.max }
+          return if relevant_versions.empty?
+
+          release = relevant_versions.max_by(&:version)
+
+          { version: release&.version }
         end
 
-        def fetch_lowest_security_fix_version(*)
+        sig do
+          params(language_version: T.nilable(T.any(String, Dependabot::Version)))
+            .returns(T.nilable(Dependabot::Version))
+        end
+        def fetch_lowest_security_fix_version(language_version: nil) # rubocop:disable Lint/UnusedMethodArgument
           return if dependency_source.git?
 
-          relevant_versions = dependency_source.versions
+          relevant_versions = releases_from_dependency_source
           relevant_versions = filter_prerelease_versions(relevant_versions)
-          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(relevant_versions,
-                                                                                                    security_advisories)
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters
+                              .filter_vulnerable_versions(
+                                relevant_versions,
+                                security_advisories
+                              )
           relevant_versions = filter_ignored_versions(relevant_versions)
           relevant_versions = filter_lower_versions(relevant_versions)
 
-          relevant_versions.min
+          relevant_versions.min_by(&:version)&.version
+        end
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def releases_from_dependency_source
+          return @releases_from_dependency_source if @releases_from_dependency_source
+
+          @releases_from_dependency_source =
+            dependency_source.versions.map do |version|
+              Dependabot::Package::PackageRelease.new(
+                version: version
+              )
+            end
+          @releases_from_dependency_source
         end
 
         sig { returns(T::Boolean) }
@@ -96,7 +150,7 @@ module Dependabot
           )
         end
 
-        # sig { returns(DependencySource) }
+        sig { returns(DependencySource) }
         def dependency_source
           @dependency_source ||= T.let(
             DependencySource.new(

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -26,7 +26,7 @@ module Dependabot
         def initialize(requirements:, update_strategy:, updated_source:,
                        latest_version:, latest_resolvable_version:)
           @requirements = requirements
-          @latest_version = Gem::Version.new(latest_version) if latest_version
+          @latest_version = Dependabot::Bundler::Version.new(latest_version) if latest_version
           @updated_source = updated_source
           @update_strategy = update_strategy
 
@@ -35,7 +35,7 @@ module Dependabot
           return unless latest_resolvable_version
 
           @latest_resolvable_version =
-            Gem::Version.new(latest_resolvable_version)
+            Dependabot::Bundler::Version.new(latest_resolvable_version)
         end
 
         def updated_requirements
@@ -267,7 +267,9 @@ module Dependabot
         # Updates the version in a "<" or "<=" constraint to allow the given
         # version
         def update_greatest_version(requirement, version_to_be_permitted)
-          version_to_be_permitted = Gem::Version.new(version_to_be_permitted) if version_to_be_permitted.is_a?(String)
+          if version_to_be_permitted.is_a?(String)
+            version_to_be_permitted = Dependabot::Bundler::Version.new(version_to_be_permitted)
+          end
           op, version = requirement.requirements.first
           version = version.release if version.prerelease?
 

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -118,7 +118,7 @@ module Dependabot
                 # mismatch
                 return nil if ruby_version_incompatible?(details)
 
-                details[:version] = Gem::Version.new(details[:version])
+                details[:version] = Dependabot::Bundler::Version.new(details[:version])
               end
               details
             end

data/lib/dependabot/bundler/update_checker.rb

@@ -130,10 +130,10 @@ module Dependabot
 
         updated_dependencies.none? do |dep|
           old_version = dep.previous_version
-          next unless Gem::Version.correct?(old_version)
-          next if Gem::Version.new(old_version).prerelease?
+          next unless Dependabot::Bundler::Version.correct?(old_version)
+          next if Dependabot::Bundler::Version.new(old_version).prerelease?
 
-          Gem::Version.new(dep.version).prerelease?
+          Dependabot::Bundler::Version.new(dep.version).prerelease?
         end
       rescue Dependabot::DependencyFileNotResolvable
         false

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.308.0
+  version: 0.309.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-12 00:00:00.000000000 Z
+date: 2025-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.309.0
 rdoc_options: []
 require_paths:
 - lib