dependabot-bundler 0.318.0 → 0.319.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2893c2182ca7aad9c1ab46333536daf31a7253a08c01b3a84f422622118aeebd
-  data.tar.gz: ddffd70d6df0a1f77370bc93fe36bb92604f44353b8ed1ddcc317aabc5986de0
+  metadata.gz: c84a4ce3cf3c25f4653b83ec740ff4eab8e340e6f581b54927b3b538a555fbba
+  data.tar.gz: da79266f90324197c44ca612b834a8ff45cefdfba9c706e53634e343f09f1c07
 SHA512:
-  metadata.gz: 97aa8b394311211a8ce25b920e8c230d8f4b75489f1f3ee90180796a9ccf6ab2b146d501bebeb44194f83737b0af620647ab52e789ea84f0ba4509667ce5aac0
-  data.tar.gz: 54a4b721000eba54bee7d8608d0269858f1477ab67f4b8f560c96c37c6e1f1f884995c0705531e44d48051fe534518f31d5d675c105fb3c0cb73c58f3a779e65
+  metadata.gz: 1db9886067f3b48773a6f9e64def493290e161643cf4641c4e5b6b63287925494b360ee3f84e3052c05b699ed2b8f8a8f8f52cd42518b696621560376ab13a1d
+  data.tar.gz: 422cde4c40c7a03197589c5ad06afcd51816023c6afc31bd5727bb38974b834e943b108e30702b832bfd579d999d77c939fc885320c5449343e0d58fdbade790

data/lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "parser/current"
+require "prism"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
 require "sorbet-runtime"
@@ -22,10 +22,10 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def child_gemfile_paths
-          ast = Parser::CurrentRuby.parse(gemfile&.content)
-          find_child_gemfile_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, T.must(gemfile&.path)
+          result = Prism.parse(gemfile&.content)
+          raise Dependabot::DependencyFileNotParseable, T.must(gemfile&.path) if result.failure?
+
+          find_child_gemfile_paths(result.value)
         end
 
         private
@@ -35,24 +35,24 @@ module Dependabot
 
         sig { params(node: T.untyped).returns(T::Array[String]) }
         def find_child_gemfile_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
+          return [] if node.nil?
 
           if declares_eval_gemfile?(node)
-            path_node = node.children[2]
-            unless path_node.type == :str
+            path_node = node.arguments&.arguments&.first
+            unless path_node.is_a?(Prism::StringNode)
               path = gemfile&.path
               msg = "Dependabot only supports uninterpolated string arguments " \
                     "to eval_gemfile. Got " \
-                    "`#{path_node.loc.expression.source}`"
+                    "`#{path_node.slice}`"
               raise Dependabot::DependencyFileNotParseable.new(T.must(path), msg)
             end
 
-            path = path_node.loc.expression.source.gsub(/['"]/, "")
+            path = path_node.unescaped
             path = File.join(current_dir, path) unless current_dir.nil?
             return [Pathname.new(path).cleanpath.to_path]
           end
 
-          node.children.flat_map do |child_node|
+          node.child_nodes.flat_map do |child_node|
             find_child_gemfile_paths(child_node)
           end
         end
@@ -64,11 +64,11 @@ module Dependabot
           @current_dir
         end
 
-        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_eval_gemfile?(node)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          node.children[1] == :eval_gemfile
+          node.name == :eval_gemfile
         end
       end
     end

data/lib/dependabot/bundler/file_fetcher/gemspec_finder.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "parser/current"
+require "prism"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
 require "sorbet-runtime"
@@ -22,10 +22,10 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def gemspec_directories
-          ast = Parser::CurrentRuby.parse(T.must(gemfile).content)
-          find_gemspec_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, T.must(gemfile).path
+          result = Prism.parse(T.must(gemfile).content)
+          raise Dependabot::DependencyFileNotParseable, T.must(gemfile).path if result.failure?
+
+          find_gemspec_paths(result.value)
         end
 
         private
@@ -33,27 +33,27 @@ module Dependabot
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :gemfile
 
-        sig { params(node: T.untyped).returns(T::Array[T.untyped]) }
+        sig { params(node: T.nilable(Prism::Node)).returns(T::Array[T.untyped]) }
         def find_gemspec_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
+          return [] if node.nil?
 
           if declares_gemspec_dependency?(node)
             path_node = path_node_for_gem_declaration(node)
             return [clean_path(".")] unless path_node
 
-            unless path_node.type == :str
+            unless path_node.is_a?(Prism::StringNode)
               path = T.must(gemfile).path
               msg = "Dependabot only supports uninterpolated string arguments " \
                     "to gemspec. Got " \
-                    "`#{path_node.loc.expression.source}`"
+                    "`#{path_node.slice}`"
               raise Dependabot::DependencyFileNotParseable.new(path, msg)
             end
 
-            path = path_node.loc.expression.source.gsub(/['"]/, "")
+            path = path_node.unescaped
             return [clean_path(path)]
           end
 
-          node.children.flat_map do |child_node|
+          node.child_nodes.flat_map do |child_node|
             find_gemspec_paths(child_node)
           end
         end
@@ -65,11 +65,11 @@ module Dependabot
           @current_dir
         end
 
-        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_gemspec_dependency?(node)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          node.children[1] == :gemspec
+          node.name == :gemspec
         end
 
         sig { params(path: String).returns(Pathname) }
@@ -82,25 +82,31 @@ module Dependabot
           Pathname.new(path).cleanpath
         end
 
-        sig { params(node: Parser::AST::Node).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(node: Prism::Node).returns(T.nilable(Prism::Node)) }
         def path_node_for_gem_declaration(node)
-          return unless node.children.last.is_a?(Parser::AST::Node)
-          return unless node.children.last.type == :hash
+          return unless node.is_a?(Prism::CallNode)
+
+          kwargs_node = node.arguments&.arguments&.last
 
-          kwargs_node = node.children.last
+          return unless kwargs_node.is_a?(Prism::Node)
 
           path_hash_pair =
-            kwargs_node.children
+            kwargs_node.child_nodes
                        .find { |hash_pair| key_from_hash_pair(hash_pair) == :path }
 
           return unless path_hash_pair
 
-          path_hash_pair.children.last
+          T.cast(path_hash_pair, Prism::AssocNode).value
         end
 
-        sig { params(node: Parser::AST::Node).returns(Symbol) }
+        sig { params(node: T.nilable(Prism::Node)).returns(T.nilable(Symbol)) }
         def key_from_hash_pair(node)
-          node.children.first.children.first.to_sym
+          return unless node.is_a?(Prism::AssocNode)
+
+          key_node = node.key
+          return unless key_node.is_a?(Prism::StringNode) || key_node.is_a?(Prism::SymbolNode)
+
+          key_node.unescaped.to_sym
         end
       end
     end

data/lib/dependabot/bundler/file_fetcher/included_path_finder.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "parser/current"
+require "prism"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
 require "sorbet-runtime"
@@ -22,10 +22,10 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def find_included_paths
-          ast = Parser::CurrentRuby.parse(file.content)
-          find_require_relative_paths(ast) + find_eval_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, file.path
+          result = Prism.parse(file.content)
+          raise Dependabot::DependencyFileNotParseable, file.path if result.failure?
+
+          find_require_relative_paths(result.value) + find_eval_paths(result.value)
         end
 
         private
@@ -35,59 +35,50 @@ module Dependabot
 
         sig { params(node: T.untyped).returns(T::Array[String]) }
         def find_require_relative_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
+          return [] if node.nil?
 
           if declares_require_relative?(node)
-            return [] unless node.children[2].type == :str
+            relative_arg = node.arguments&.arguments&.first
+            return [] unless relative_arg.is_a?(Prism::StringNode)
 
-            path = node.children[2].loc.expression.source.gsub(/['"]/, "")
+            path = relative_arg.unescaped
             path = File.join(current_dir, path) unless current_dir.nil?
             path += ".rb" unless path.end_with?(".rb")
             return [Pathname.new(path).cleanpath.to_path]
           end
 
-          node.children.flat_map do |child_node|
+          node.child_nodes.flat_map do |child_node|
             find_require_relative_paths(child_node)
           end
         end
 
         sig { params(node: T.untyped).returns(T::Array[String]) }
         def find_eval_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
+          return [] if node.nil?
 
           if declares_eval?(node)
-            eval_arg = node.children[2]
-            if eval_arg.is_a?(Parser::AST::Node)
+            eval_arg = node.arguments&.arguments&.first
+
+            if eval_arg.is_a?(Prism::Node)
               file_read_node = find_file_read_node(eval_arg)
               path = extract_path_from_file_read(file_read_node) if file_read_node
               return [path] if path
             end
           end
 
-          node.children.flat_map do |child_node|
+          node.child_nodes.flat_map do |child_node|
             find_eval_paths(child_node)
           end
         end
 
-        sig { params(node: Parser::AST::Node).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(node: T.nilable(Prism::Node)).returns(T.nilable(Prism::Node)) }
         def find_file_read_node(node)
-          return nil unless node.is_a?(Parser::AST::Node)
-
-          # Check if the node represents a method call (:send)
-          # and if the method name is :read
-          method_name = node.children[1]
-          receiver_node = node.children[0]
+          return nil unless node.is_a?(Prism::Node)
 
-          if node.type == :send && method_name == :read && receiver_node.is_a?(Parser::AST::Node)
-            # Check if the receiver of the :read method call is :File
-            receiver_const = receiver_node.children[1]
-            return node if receiver_const == :File
-          end
+          return node if contains_receiver_node?(node)
 
           # Recursively search for a file read node in the children
-          node.children.each do |child|
-            next unless child.is_a?(Parser::AST::Node)
-
+          node.child_nodes.each do |child|
             result = find_file_read_node(child)
             return result if result
           end
@@ -95,14 +86,29 @@ module Dependabot
           nil
         end
 
-        sig { params(node: Parser::AST::Node).returns(T.nilable(String)) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
+        def contains_receiver_node?(node)
+          return false unless node.is_a?(Prism::CallNode) && node.name == :read
+
+          # Check if the node represents a method call (CallNode))
+          # and if the method name is :read
+          receiver_node = node.arguments&.arguments&.first
+
+          # Check if the receiver of the :read method call is :File
+          return false unless receiver_node.is_a?(Prism::CallNode)
+
+          constant_node = T.cast(receiver_node.receiver, T.nilable(Prism::ConstantReadNode))
+          constant_node&.name == :File
+        end
+
+        sig { params(node: Prism::Node).returns(T.nilable(String)) }
         def extract_path_from_file_read(node)
-          return nil unless node.is_a?(Parser::AST::Node)
+          return nil unless node.is_a?(Prism::CallNode)
 
-          expand_path_node = node.children[2]
-          if expand_path_node.type == :send && expand_path_node.children[1] == :expand_path
-            path_node = expand_path_node.children[2]
-            return path_node.loc.expression.source.gsub(/['"]/, "") if path_node.type == :str
+          expand_path_node = node.arguments&.arguments&.first
+          if expand_path_node.is_a?(Prism::CallNode) && expand_path_node.name == :expand_path
+            path_node = expand_path_node.arguments&.arguments&.first
+            return path_node.unescaped if path_node.is_a?(Prism::StringNode)
           end
           nil
         end
@@ -114,18 +120,18 @@ module Dependabot
           @current_dir
         end
 
-        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_require_relative?(node)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          node.children[1] == :require_relative
+          node.name == :require_relative
         end
 
-        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_eval?(node)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          node.children[1] == :eval
+          node.name == :eval
         end
       end
     end

data/lib/dependabot/bundler/file_fetcher/path_gemspec_finder.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "parser/current"
+require "prism"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
 require "sorbet-runtime"
@@ -22,10 +22,10 @@ module Dependabot
 
         sig { returns(T::Array[String]) }
         def path_gemspec_paths
-          ast = Parser::CurrentRuby.parse(gemfile&.content)
-          find_path_gemspec_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, T.must(gemfile).path
+          result = Prism.parse(gemfile&.content)
+          raise Dependabot::DependencyFileNotParseable, T.must(gemfile).path if result.failure?
+
+          find_path_gemspec_paths(result.value)
         end
 
         private
@@ -35,24 +35,24 @@ module Dependabot
 
         sig { params(node: T.untyped).returns(T::Array[T.untyped]) }
         def find_path_gemspec_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
+          return [] unless node.is_a?(Prism::Node)
 
           if declares_path_dependency?(node)
             path_node = path_node_for_gem_declaration(node)
 
-            unless path_node&.type == :str
+            unless path_node.is_a?(Prism::StringNode)
               path = gemfile&.path
               msg = "Dependabot only supports uninterpolated string arguments " \
                     "for path dependencies. Got " \
-                    "`#{path_node&.loc&.expression&.source}`"
+                    "`#{path_node&.slice}`"
               raise Dependabot::DependencyFileNotParseable.new(T.must(path), msg)
             end
 
-            path = T.must(path_node).loc.expression.source.gsub(/['"]/, "")
+            path = path_node.unescaped
             return [clean_path(path)]
           end
 
-          node.children.flat_map do |child_node|
+          node.child_nodes.flat_map do |child_node|
             find_path_gemspec_paths(child_node)
           end
         end
@@ -64,10 +64,10 @@ module Dependabot
           @current_dir
         end
 
-        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_path_dependency?(node)
-          return false unless node.is_a?(Parser::AST::Node)
-          return false unless node.children[1] == :gem
+          return false unless node.is_a?(Prism::CallNode)
+          return false unless node.name == :gem
 
           !path_node_for_gem_declaration(node).nil?
         end
@@ -82,24 +82,31 @@ module Dependabot
           Pathname.new(path).cleanpath
         end
 
-        sig { params(node: Parser::AST::Node).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(node: Prism::Node).returns(T.nilable(Prism::Node)) }
         def path_node_for_gem_declaration(node)
-          return unless node.children.last.type == :hash
+          return unless node.is_a?(Prism::CallNode)
+
+          kwargs_node = node.arguments&.arguments&.last
 
-          kwargs_node = node.children.last
+          return unless kwargs_node.is_a?(Prism::Node)
 
           path_hash_pair =
-            kwargs_node.children
+            kwargs_node.child_nodes
                        .find { |hash_pair| key_from_hash_pair(hash_pair) == :path }
 
           return unless path_hash_pair
 
-          path_hash_pair.children.last
+          T.cast(path_hash_pair, Prism::AssocNode).value
         end
 
-        sig { params(node: Parser::AST::Node).returns(Symbol) }
+        sig { params(node: T.nilable(Prism::Node)).returns(T.nilable(Symbol)) }
         def key_from_hash_pair(node)
-          node.children.first.children.first.to_sym
+          return unless node.is_a?(Prism::AssocNode)
+
+          key_node = node.key
+          return unless key_node.is_a?(Prism::StringNode) || key_node.is_a?(Prism::SymbolNode)
+
+          key_node.unescaped.to_sym
         end
       end
     end

data/lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb

@@ -1,7 +1,7 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "parser/current"
+require "prism"
 require "sorbet-runtime"
 
 require "dependabot/file_parsers/base"
@@ -16,7 +16,7 @@ module Dependabot
         sig { params(gemfile: Dependabot::DependencyFile).void }
         def initialize(gemfile:)
           @gemfile = gemfile
-          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Parser::AST::Node)])
+          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Prism::Node)])
         end
 
         sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
@@ -30,13 +30,16 @@ module Dependabot
           return unless gemfile_includes_dependency?(dependency)
 
           fallback_string = dependency.fetch("requirement")
-          req_nodes = declaration_node(dependency)&.children&.[](3..-1)
-          req_nodes = req_nodes.reject { |child| child.type == :hash }
+          call_node = declaration_node(dependency)
+          return fallback_string unless call_node.is_a?(Prism::CallNode)
+
+          req_nodes = call_node.arguments&.arguments&.[](1..-1) || []
+          req_nodes = req_nodes.reject { |child| child.is_a?(Prism::HashNode) || child.is_a?(Prism::KeywordHashNode) }
 
           return fallback_string if req_nodes.none?
-          return fallback_string unless req_nodes.all? { |n| n.type == :str }
+          return fallback_string unless req_nodes.all?(Prism::StringNode)
 
-          original_req_string = req_nodes.map { |n| n.children.last }
+          original_req_string = T.cast(req_nodes, T::Array[Prism::StringNode]).map(&:unescaped)
           fallback_requirement =
             Gem::Requirement.new(fallback_string.split(", "))
           if fallback_requirement == Gem::Requirement.new(original_req_string)
@@ -52,21 +55,21 @@ module Dependabot
         sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemfile
 
-        sig { returns(T.nilable(Parser::AST::Node)) }
+        sig { returns(T.nilable(Prism::Node)) }
         def parsed_gemfile
           @parsed_gemfile ||= T.let(
-            Parser::CurrentRuby.parse(gemfile.content),
-            T.nilable(Parser::AST::Node)
+            Prism.parse(gemfile.content).value,
+            T.nilable(Prism::Node)
           )
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
         def declaration_node(dependency)
           return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
           return unless parsed_gemfile
 
           @declaration_nodes[dependency] = nil
-          T.must(parsed_gemfile).children.any? do |node|
+          T.must(parsed_gemfile).child_nodes.any? do |node|
             @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
           @declaration_nodes[dependency]
@@ -77,14 +80,14 @@ module Dependabot
             node: T.untyped,
             dependency: T::Hash[String, String]
           )
-            .returns(T.nilable(Parser::AST::Node))
+            .returns(T.nilable(Prism::Node))
         end
         def deep_search_for_gem(node, dependency)
-          return T.cast(node, Parser::AST::Node) if declares_targeted_gem?(node, dependency)
-          return unless node.is_a?(Parser::AST::Node)
+          return unless node.is_a?(Prism::Node)
+          return node if declares_targeted_gem?(node, dependency)
 
-          declaration_node = T.let(nil, T.nilable(Parser::AST::Node))
-          node.children.find do |child_node|
+          declaration_node = T.let(nil, T.nilable(Prism::Node))
+          node.child_nodes.find do |child_node|
             declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
@@ -98,10 +101,13 @@ module Dependabot
             .returns(T::Boolean)
         end
         def declares_targeted_gem?(node, dependency)
-          return false unless node.is_a?(Parser::AST::Node)
-          return false unless node.children[1] == :gem
+          return false unless node.is_a?(Prism::CallNode)
+          return false unless node.name == :gem
+
+          gem_name_node = node.arguments&.arguments&.first
+          return false unless gem_name_node.is_a?(Prism::StringNode)
 
-          node.children[2].children.first == dependency.fetch("name")
+          gem_name_node.unescaped == dependency.fetch("name")
         end
       end
     end

data/lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb

@@ -1,7 +1,7 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "parser/current"
+require "prism"
 require "sorbet-runtime"
 
 require "dependabot/file_parsers/base"
@@ -16,7 +16,7 @@ module Dependabot
         sig { params(gemspec: Dependabot::DependencyFile).void }
         def initialize(gemspec:)
           @gemspec = gemspec
-          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Parser::AST::Node)])
+          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Prism::Node)])
         end
 
         sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
@@ -29,30 +29,30 @@ module Dependabot
         sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemspec
 
-        sig { returns(T.nilable(Parser::AST::Node)) }
+        sig { returns(T.nilable(Prism::Node)) }
         def parsed_gemspec
-          @parsed_gemspec ||= T.let(Parser::CurrentRuby.parse(gemspec.content), T.nilable(Parser::AST::Node))
+          @parsed_gemspec ||= T.let(Prism.parse(gemspec.content).value, T.nilable(Prism::Node))
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
         def declaration_node(dependency)
           return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
           return unless parsed_gemspec
 
           @declaration_nodes[dependency] = nil
-          T.must(parsed_gemspec).children.any? do |node|
+          T.must(parsed_gemspec).child_nodes.any? do |node|
             @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
           @declaration_nodes[dependency]
         end
 
-        sig { params(node: T.untyped, dependency: T::Hash[String, String]).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(node: T.untyped, dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
         def deep_search_for_gem(node, dependency)
-          return T.cast(node, Parser::AST::Node) if declares_targeted_gem?(node, dependency)
-          return unless node.is_a?(Parser::AST::Node)
+          return unless node.is_a?(Prism::Node)
+          return T.cast(node, Prism::CallNode) if declares_targeted_gem?(node, dependency)
 
-          declaration_node = T.let(nil, T.nilable(Parser::AST::Node))
-          node.children.find do |child_node|
+          declaration_node = T.let(nil, T.nilable(Prism::Node))
+          node.child_nodes.find do |child_node|
             declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
@@ -60,13 +60,16 @@ module Dependabot
 
         sig { params(node: T.untyped, dependency: T::Hash[String, String]).returns(T::Boolean) }
         def declares_targeted_gem?(node, dependency)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          second_child = node.children[1]
+          second_child = node.name
           allowed_declarations = %i(add_dependency add_runtime_dependency add_development_dependency)
           return false unless allowed_declarations.include?(second_child)
 
-          node.children[2].children.first == dependency.fetch("name")
+          gem_name_node = node.arguments&.child_nodes&.first
+          return false unless gem_name_node.is_a?(Prism::StringNode)
+
+          gem_name_node.unescaped == dependency.fetch("name")
         end
       end
     end

data/lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb

@@ -1,7 +1,7 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "parser/current"
+require "prism"
 require "dependabot/bundler/file_updater"
 
 module Dependabot
@@ -10,8 +10,6 @@ module Dependabot
       class GemspecDependencyNameFinder
         extend T::Sig
 
-        ChildNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, String, Integer, Float)) }
-
         sig { returns(String) }
         attr_reader :gemspec_content
 
@@ -23,12 +21,15 @@ module Dependabot
         # rubocop:disable Security/Eval
         sig { returns(T.nilable(String)) }
         def dependency_name
-          ast = Parser::CurrentRuby.parse(gemspec_content)
-          dependency_name_node = find_dependency_name_node(ast)
-          return unless dependency_name_node
+          result = Prism.parse(gemspec_content)
+          dependency_name_node = find_dependency_name_node(result.value)
+          return unless dependency_name_node.is_a?(Prism::CallNode)
+
+          arg_node = dependency_name_node.arguments&.arguments&.first
+          return if arg_node.nil?
 
           begin
-            eval(dependency_name_node.children[2].loc.expression.source)
+            eval(arg_node.slice)
           rescue StandardError
             nil # If we can't evaluate the expression just return nil
           end
@@ -37,22 +38,22 @@ module Dependabot
 
         private
 
-        sig { params(node: ChildNode).returns(T.nilable(Parser::AST::Node)) }
+        sig { params(node: T.nilable(Prism::Node)).returns(T.nilable(Prism::Node)) }
         def find_dependency_name_node(node)
-          return unless node.is_a?(Parser::AST::Node)
+          return unless node.is_a?(Prism::Node)
           return node if declares_dependency_name?(node)
 
-          node.children.find do |cn|
+          node.child_nodes.find do |cn|
             dependency_name_node = find_dependency_name_node(cn)
             break dependency_name_node if dependency_name_node
           end
         end
 
-        sig { params(node: ChildNode).returns(T::Boolean) }
+        sig { params(node: Prism::Node).returns(T::Boolean) }
         def declares_dependency_name?(node)
-          return false unless node.is_a?(Parser::AST::Node)
+          return false unless node.is_a?(Prism::CallNode)
 
-          node.children[1] == :name=
+          node.name == :name=
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.318.0
+  version: 0.319.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.318.0
+        version: 0.319.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.318.0
+        version: 0.319.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.318.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.319.0
 rdoc_options: []
 require_paths:
 - lib