dependabot-bundler 0.317.0 → 0.318.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1aed7711aa4d28efbf7f689080aacfcea195e396452f0e4c3919b9fe3f3c9925
-  data.tar.gz: 3222607755992756baccfc661c9046d0d0f531394eec15b356e7267d32302aae
+  metadata.gz: 2893c2182ca7aad9c1ab46333536daf31a7253a08c01b3a84f422622118aeebd
+  data.tar.gz: ddffd70d6df0a1f77370bc93fe36bb92604f44353b8ed1ddcc317aabc5986de0
 SHA512:
-  metadata.gz: 6d9c9886c057eca2efa7f61ece94c1ad470477b6f72a9abd1b4412c69084a9c1b4d80008888d3ca8ef87b760f8c2afc335e4f806634d35cfc23336cb5f547e54
-  data.tar.gz: 9e1d96d3996858b3b2936a2239e3d22798c9a2af76671efe27c660c0e79199b1bb1a43cd79b27698229f425ab1c7dab959d8f0d6fea96b72d461a552bc1016e1
+  metadata.gz: 97aa8b394311211a8ce25b920e8c230d8f4b75489f1f3ee90180796a9ccf6ab2b146d501bebeb44194f83737b0af620647ab52e789ea84f0ba4509667ce5aac0
+  data.tar.gz: 54a4b721000eba54bee7d8608d0269858f1477ab67f4b8f560c96c37c6e1f1f884995c0705531e44d48051fe534518f31d5d675c105fb3c0cb73c58f3a779e65

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -21,16 +21,12 @@ module Dependabot
         require_relative "../update_checker/shared_bundler_helpers"
         include Dependabot::Bundler::UpdateChecker::SharedBundlerHelpers
 
-        RELEASES_URL = "https://rubygems.org/api/v1/versions/%s.json"
-        GEM_URL = "https://rubygems.org/gems/%s.gem"
+        RELEASES_URL = "%s/api/v1/versions/%s.json"
+        GEM_URL = "%s/gems/%s.gem"
         PACKAGE_TYPE = "gem"
         PACKAGE_LANGUAGE = "ruby"
         APPLICATION_JSON = "application/json"
-
         RUBYGEMS = "rubygems"
-        PRIVATE_REGISTRY = "private"
-        GIT = "git"
-        OTHER = "other"
 
         sig do
           params(
@@ -58,15 +54,7 @@ module Dependabot
 
         sig { returns(Dependabot::Package::PackageDetails) }
         def fetch
-          return rubygems_versions if dependency.name == "bundler"
-          return rubygems_versions unless gemfile
-
-          case source_type
-          when OTHER, GIT, PRIVATE_REGISTRY
-            package_details([])
-          else
-            rubygems_versions
-          end
+          rubygems_versions
         end
 
         private
@@ -127,15 +115,39 @@ module Dependabot
         # ]
         sig { returns(Dependabot::Package::PackageDetails) }
         def rubygems_versions
-          response = registry_json_response_for_dependency
-          raise unless response.status == 200
+          registry_url = get_url_from_dependency(dependency) || "https://rubygems.org"
+
+          # TODO: Github private registry support
+          # registry_url = "https://rubygems.pkg.github.com/#{OWNER_NAME}"
+          # Corresponding API URL:
+          # curl  -H "Accept: application/json" \
+          #       -H "Authorization: Bearer <<TOKEN>>" \
+          #       https://api.github.com/orgs/dsp-testing/packages/rubygems/json/version
+          parsed_url = begin
+            URI.parse(registry_url)
+          rescue URI::InvalidURIError
+            raise "Invalid registry URL: #{registry_url}"
+          end
+          return package_details([]) if parsed_url.host == "rubygems.pkg.github.com"
+
+          response = registry_json_response_for_dependency(registry_url)
+
+          unless response.status == 200
+            error_details = "Status: #{response.status}"
+            error_message = "Failed to fetch versions for '#{dependency.name}' from '#{registry_url}'. #{error_details}"
+            Dependabot.logger.info(error_message)
+            return package_details([])
+          end
+
+          registry_url = get_url_from_dependency(dependency) || "https://rubygems.org" # Get registry_url
 
           package_releases = JSON.parse(response.body).map do |release|
+            gem_name_with_version = "#{@dependency.name}-#{release['number']}"
             package_release(
               version: release["number"],
               released_at: Time.parse(release["created_at"]),
               downloads: release["downloads_count"],
-              url: GEM_URL % "#{@dependency.name}-#{release['number']}",
+              url: format(GEM_URL, registry_url, gem_name_with_version),
               ruby_version: release["ruby_version"]
             )
           end
@@ -143,9 +155,23 @@ module Dependabot
           package_details(package_releases)
         end
 
-        sig { returns(Excon::Response) }
-        def registry_json_response_for_dependency
-          url = RELEASES_URL % dependency.name
+        sig { params(dependency: T.untyped).returns(T.nilable(String)) }
+        def get_url_from_dependency(dependency)
+          return nil unless dependency&.requirements&.any?
+
+          first_requirement = dependency.requirements.first
+          return nil unless first_requirement && first_requirement[:source]
+
+          url = T.let(first_requirement[:source][:url], T.nilable(String))
+          return nil unless url
+
+          url.end_with?("/") ? url.chop : url
+        end
+
+        sig { params(registry_url: T.nilable(String)).returns(Excon::Response) }
+        def registry_json_response_for_dependency(registry_url = "https://rubygems.org")
+          url = format(RELEASES_URL, registry_url, dependency.name)
+
           Dependabot::RegistryClient.get(
             url: url,
             headers: { "Accept" => APPLICATION_JSON }
@@ -157,27 +183,6 @@ module Dependabot
           Requirement.new(req_string)
         end
 
-        sig { returns(String) }
-        def source_type
-          @source_type ||= begin
-            return @source_type = RUBYGEMS unless gemfile
-
-            @source_type = in_a_native_bundler_context do |tmp_dir|
-              NativeHelpers.run_bundler_subprocess(
-                bundler_version: bundler_version,
-                function: "dependency_source_type",
-                options: {}, # options,
-                args: {
-                  dir: tmp_dir,
-                  gemfile_name: gemfile.name,
-                  dependency_name: dependency.name,
-                  credentials: credentials
-                }
-              )
-            end
-          end
-        end
-
         sig { override.returns(String) }
         def bundler_version
           @bundler_version ||= T.let(Helpers.bundler_version(lockfile), T.nilable(String))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.317.0
+  version: 0.318.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.317.0
+        version: 0.318.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.317.0
+        version: 0.318.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.317.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.318.0
 rdoc_options: []
 require_paths:
 - lib