dependabot-bundler 0.332.0 → 0.334.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0373cdfce669d8fb9d4fb6081a0b2660c58217e1c309cbc49e772971ba5f9f1a
-  data.tar.gz: f0a48edc13f2826d1177be53e368fb9bb9957d50f53bfb1ecdf62b7dc3a13b34
+  metadata.gz: 37ba3de8a1d1b67ae172bb66d32d9b3fb93780d98441e41fced9bea77d40027a
+  data.tar.gz: 48b422ee5ebcb1e925f0cb0b84fab0aa164fd85efb94ab54e5b9152d6304c82e
 SHA512:
-  metadata.gz: f259e4c088e2e8ccbf1a343e216b606681c4e40538a5aa6306fb508b176904467bbaaeeb9f73a8050e16c14d249204be42444640f1f0485f0da45c4127fdf468
-  data.tar.gz: e0a5c41f18681d4db017a5c6e28646739af2315d89a59e937ad2fee2a6078fb6d48b00c8da8652324616640c95ef740b683442b3bbd2059a77178aa0c9475632
+  metadata.gz: 2a702a441d11d257536810283d217a25149aaaab772c6eab11fd7caf958660af245b8b5836c2b92062b1384ac6ca0fadd7f5801c954b5b24e4eec971d41a5d1a
+  data.tar.gz: e2929aa03f76bb71700970e4b2cfea6f90f374a00e4f2ddcbf61ccdd2f1a7fd6fff84c0173f531a294b77552775316dba3965671036f91d78412068d8c194072

data/lib/dependabot/bundler/file_fetcher.rb

@@ -4,6 +4,7 @@
 require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/file_filtering"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/cached_lockfile_parser"
 require "dependabot/errors"
@@ -52,7 +53,13 @@ module Dependabot
         fetched_files += path_gemspecs
         fetched_files += find_included_files(fetched_files)
 
-        uniq_files(fetched_files)
+        # Filter excluded files from final collection
+        unique_files = uniq_files(fetched_files)
+        filtered_files = unique_files.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files
       end
 
       private
@@ -174,8 +181,12 @@ module Dependabot
         end
 
         @find_included_files ||= T.let(
-          paths.map { |path| fetch_file_from_host(path) }
-               .tap { |req_files| req_files.each { |f| f.support_file = true } },
+          paths.filter_map do |path|
+            # Skip excluded included files
+            next nil if Dependabot::FileFiltering.should_exclude_path?(path, "included file", @exclude_paths)
+
+            fetch_file_from_host(path)
+          end.tap { |req_files| req_files.each { |f| f.support_file = true } }, # rubocop:disable Style/MultilineBlockChain
           T.nilable(T::Array[DependencyFile])
         )
       end
@@ -238,6 +249,15 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
+          # Skip excluded child Gemfiles
+          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
+             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+            raise Dependabot::DependencyFileNotEvaluatable,
+                  "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
+                  "Please either remove the reference from '#{file.name}' " \
+                  "or update your exclude_paths configuration."
+          end
+
           fetched_file = fetch_file_from_host(path)
           grandchild_gemfiles = fetch_child_gemfiles(
             file: fetched_file,

data/lib/dependabot/bundler/file_parser.rb

@@ -20,6 +20,7 @@ module Dependabot
   module Bundler
     class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
+
       require "dependabot/file_parsers/base/dependency_set"
       require "dependabot/bundler/file_parser/file_preparer"
       require "dependabot/bundler/file_parser/gemfile_declaration_finder"

data/lib/dependabot/bundler/file_updater/git_pin_replacer.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "parser/current"
 require "dependabot/bundler/file_updater"
 
@@ -8,14 +9,21 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GitPinReplacer
+        extend T::Sig
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(String) }
         attr_reader :new_pin
 
+        sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
         def initialize(dependency:, new_pin:)
-          @dependency = dependency
-          @new_pin = new_pin
+          @dependency = T.let(dependency, Dependabot::Dependency)
+          @new_pin = T.let(new_pin, String)
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemfile_content)")
           buffer.source = content
@@ -27,15 +35,24 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
-          PIN_KEYS = %i(ref tag).freeze
+          extend T::Sig
+
+          PIN_KEYS = T.let(%i(ref tag).freeze, T::Array[Symbol])
+
+          sig { returns(Dependabot::Dependency) }
           attr_reader :dependency
+
+          sig { returns(String) }
           attr_reader :new_pin
 
+          sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
           def initialize(dependency:, new_pin:)
-            @dependency = dependency
-            @new_pin = new_pin
+            super()
+            @dependency = T.let(dependency, Dependabot::Dependency)
+            @new_pin = T.let(new_pin, String)
           end
 
+          sig { params(node: Parser::AST::Node).returns(T.untyped) }
           def on_send(node)
             return unless declares_targeted_gem?(node)
             return unless node.children.last.type == :hash
@@ -50,16 +67,19 @@ module Dependabot
 
           private
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def declares_targeted_gem?(node)
             return false unless node.children[1] == :gem
 
             node.children[2].children.first == dependency.name
           end
 
+          sig { params(node: Parser::AST::Node).returns(Symbol) }
           def key_from_hash_pair(node)
             node.children.first.children.first.to_sym
           end
 
+          sig { params(hash_pair: Parser::AST::Node).void }
           def update_value(hash_pair)
             value_node = hash_pair.children.last
             open_quote_character, close_quote_character =
@@ -71,6 +91,7 @@ module Dependabot
             )
           end
 
+          sig { params(value_node: Parser::AST::Node).returns([String, String]) }
           def extract_quote_characters_from(value_node)
             [value_node.loc.begin.source, value_node.loc.end.source]
           end

data/lib/dependabot/bundler/file_updater/git_source_remover.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -12,12 +12,15 @@ module Dependabot
       class GitSourceRemover
         extend T::Sig
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
+        sig { params(dependency: Dependabot::Dependency).void }
         def initialize(dependency:)
           @dependency = dependency
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemfile_content)")
           buffer.source = content
@@ -27,18 +30,23 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
+          extend T::Sig
+
           # TODO: Hack until Bundler 1.16.0 is available on Heroku
           GOOD_KEYS = %i(
             group groups path glob name require platform platforms type
             source install_if
           ).freeze
 
+          sig { returns(Dependabot::Dependency) }
           attr_reader :dependency
 
+          sig { params(dependency: Dependabot::Dependency).void }
           def initialize(dependency:)
-            @dependency = dependency
+            @dependency = T.let(dependency, Dependabot::Dependency)
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def on_send(node)
             return unless declares_targeted_gem?(node)
             return unless node.children.last.type == :hash
@@ -57,16 +65,19 @@ module Dependabot
 
           private
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def declares_targeted_gem?(node)
             return false unless node.children[1] == :gem
 
             node.children[2].children.first == dependency.name
           end
 
+          sig { params(node: Parser::AST::Node).returns(Symbol) }
           def key_from_hash_pair(node)
             node.children.first.children.first.to_sym
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def remove_all_kwargs(node)
             kwargs_node = node.children.last
 
@@ -76,6 +87,7 @@ module Dependabot
             remove(range_to_remove)
           end
 
+          sig { params(kwargs_node: Parser::AST::Node).void }
           def remove_git_related_kwargs(kwargs_node)
             good_key_index = T.let(nil, T.nilable(Integer))
             hash_pairs = kwargs_node.children

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "bundler"
+require "sorbet-runtime"
 
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -14,6 +15,8 @@ module Dependabot
   module Bundler
     class FileUpdater
       class LockfileUpdater
+        extend T::Sig
+
         require_relative "gemfile_updater"
         require_relative "gemspec_updater"
         require_relative "gemspec_sanitizer"
@@ -24,8 +27,32 @@ module Dependabot
         GIT_DEPENDENCIES_SECTION = /GIT\n.*?\n\n(?!GIT)/m
         GIT_DEPENDENCY_DETAILS = /GIT\n.*?\n\n/m
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            options: T::Hash[Symbol, T.untyped],
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
+        def initialize(dependencies:, dependency_files:, credentials:, options:,
+                       repo_contents_path: nil)
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @repo_contents_path = T.let(repo_contents_path, T.nilable(String))
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @options = T.let(options, T::Hash[Symbol, T.untyped])
+          @updated_lockfile_content = T.let(nil, T.nilable(String))
+          @gemfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @evaled_gemfiles = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @bundler_version = T.let(nil, T.nilable(String))
+        end
+
         # Can't be a constant because some of these don't exist in bundler
         # 1.15, which Heroku uses, which causes an exception on boot.
+        sig { returns(T::Array[T.class_of(::Bundler::Source::Path)]) }
         def gemspec_sources
           [
             ::Bundler::Source::Path,
@@ -33,21 +60,13 @@ module Dependabot
           ]
         end
 
-        def initialize(dependencies:, dependency_files:,
-                       repo_contents_path: nil, credentials:, options:)
-          @dependencies = dependencies
-          @dependency_files = dependency_files
-          @repo_contents_path = repo_contents_path
-          @credentials = credentials
-          @options = options
-        end
-
+        sig { returns(String) }
         def updated_lockfile_content
           @updated_lockfile_content ||=
             begin
               updated_content = build_updated_lockfile
 
-              raise "Expected content to change!" if lockfile.content == updated_content
+              raise "Expected content to change!" if T.must(lockfile).content == updated_content
 
               updated_content
             end
@@ -55,14 +74,24 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Hash[Symbol, T.untyped]) }
         attr_reader :options
 
+        sig { returns(String) }
         def build_updated_lockfile
-          base_dir = dependency_files.first.directory
+          base_dir = T.must(dependency_files.first).directory
           lockfile_body =
             SharedHelpers.in_a_temporary_repo_directory(
               base_dir,
@@ -75,8 +104,8 @@ module Dependabot
                 function: "update_lockfile",
                 options: options,
                 args: {
-                  gemfile_name: gemfile.name,
-                  lockfile_name: lockfile.name,
+                  gemfile_name: T.must(gemfile).name,
+                  lockfile_name: T.must(lockfile).name,
                   dir: tmp_dir,
                   credentials: credentials,
                   dependencies: dependencies.map(&:to_h)
@@ -90,9 +119,10 @@ module Dependabot
           raise
         end
 
+        sig { void }
         def write_temporary_dependency_files
-          File.write(gemfile.name, prepared_gemfile_content(gemfile))
-          File.write(lockfile.name, sanitized_lockfile_body)
+          File.write(T.must(gemfile).name, prepared_gemfile_content(T.must(gemfile)))
+          File.write(T.must(lockfile).name, sanitized_lockfile_body)
 
           write_gemspecs(top_level_gemspecs)
           write_ruby_version_file
@@ -108,22 +138,25 @@ module Dependabot
           end
         end
 
+        sig { void }
         def write_ruby_version_file
           return unless ruby_version_file
 
-          path = ruby_version_file.name
+          path = T.must(ruby_version_file).name
           FileUtils.mkdir_p(Pathname.new(path).dirname)
-          File.write(path, ruby_version_file.content)
+          File.write(path, T.must(ruby_version_file).content)
         end
 
+        sig { void }
         def write_tool_versions_file
           return unless tool_versions_file
 
-          path = tool_versions_file.name
+          path = T.must(tool_versions_file).name
           FileUtils.mkdir_p(Pathname.new(path).dirname)
-          File.write(path, tool_versions_file.content)
+          File.write(path, T.must(tool_versions_file).content)
         end
 
+        sig { params(files: T::Array[Dependabot::DependencyFile]).void }
         def write_gemspecs(files)
           files.each do |file|
             path = file.name
@@ -133,6 +166,7 @@ module Dependabot
           end
         end
 
+        sig { void }
         def write_specification_files
           specification_files.each do |file|
             path = file.name
@@ -141,6 +175,7 @@ module Dependabot
           end
         end
 
+        sig { void }
         def write_imported_ruby_files
           imported_ruby_files.each do |file|
             path = file.name
@@ -149,38 +184,46 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def path_gemspecs
           all = dependency_files.select { |f| f.name.end_with?(".gemspec") }
           all - top_level_gemspecs
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def imported_ruby_files
           dependency_files
             .select { |f| f.name.end_with?(".rb") }
             .reject { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def top_level_gemspecs
           dependency_files
             .select { |file| file.name.end_with?(".gemspec") && Pathname.new(file.name).dirname.to_s == "." }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def ruby_version_file
           dependency_files.find { |f| f.name == ".ruby-version" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def tool_versions_file
           dependency_files.find { |f| f.name == ".tool-versions" }
         end
 
+        sig { params(lockfile_body: String).returns(String) }
         def post_process_lockfile(lockfile_body)
           lockfile_body = reorder_git_dependencies(lockfile_body)
           replace_lockfile_ending(lockfile_body)
         end
 
+        sig { params(lockfile_body: String).returns(String) }
         def reorder_git_dependencies(lockfile_body)
           new_section = lockfile_body.match(GIT_DEPENDENCIES_SECTION)&.to_s
-          old_section = lockfile.content.match(GIT_DEPENDENCIES_SECTION)&.to_s
+          lockfile_content = T.must(lockfile).content
+          old_section = lockfile_content&.match(GIT_DEPENDENCIES_SECTION)&.to_s
 
           return lockfile_body unless new_section && old_section
 
@@ -190,8 +233,10 @@ module Dependabot
           return lockfile_body unless new_deps.count == old_deps.count
 
           reordered_new_section = new_deps.sort_by do |new_dep_details|
-            remote = new_dep_details.match(/remote: (?<remote>.*\n)/)[:remote]
-            i = old_deps.index { |details| details.include?(remote) }
+            dep_string = T.cast(new_dep_details, String)
+            match_result = dep_string.match(/remote: (?<remote>.*\n)/)
+            remote = match_result ? match_result[:remote] : ""
+            i = old_deps.index { |details| details.include?(T.must(remote)) }
 
             # If this dependency isn't in the old lockfile then we can't rely
             # on that (presumably outdated) lockfile to do reordering.
@@ -205,15 +250,18 @@ module Dependabot
           lockfile_body.gsub(new_section, reordered_new_section)
         end
 
+        sig { params(lockfile_body: String).returns(String) }
         def replace_lockfile_ending(lockfile_body)
           # Re-add the old `BUNDLED WITH` version (and remove the RUBY VERSION
           # if it wasn't previously present in the lockfile)
+          lockfile_content = T.must(lockfile).content
           lockfile_body.gsub(
             LOCKFILE_ENDING,
-            lockfile.content.match(LOCKFILE_ENDING)&.[](:ending) || "\n"
+            lockfile_content&.match(LOCKFILE_ENDING)&.[](:ending) || "\n"
           )
         end
 
+        sig { params(path: String, gemspec_content: String).returns(String) }
         def sanitized_gemspec_content(path, gemspec_content)
           new_version = replacement_version_for_gemspec(path, gemspec_content)
 
@@ -222,6 +270,7 @@ module Dependabot
             .rewrite(gemspec_content)
         end
 
+        sig { params(path: String, gemspec_content: String).returns(String) }
         def replacement_version_for_gemspec(path, gemspec_content)
           return "0.0.1" unless lockfile
 
@@ -233,9 +282,10 @@ module Dependabot
             CachedLockfileParser.parse(sanitized_lockfile_body).specs
                                 .select { |s| s.name == gem_name && gemspec_sources.include?(s.source.class) }
 
-          gemspec_specs.first&.version || "0.0.1"
+          gemspec_specs.first&.version&.to_s || "0.0.1"
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def prepared_gemfile_content(file)
           content = updated_gemfile_content(file)
 
@@ -246,6 +296,7 @@ module Dependabot
           content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def updated_gemfile_content(file)
           GemfileUpdater.new(
             dependencies: dependencies,
@@ -253,6 +304,7 @@ module Dependabot
           ).updated_gemfile_content
         end
 
+        sig { params(gemspec: Dependabot::DependencyFile).returns(String) }
         def updated_gemspec_content(gemspec)
           GemspecUpdater.new(
             dependencies: dependencies,
@@ -260,11 +312,13 @@ module Dependabot
           ).updated_gemspec_content
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           @gemfile ||= dependency_files.find { |f| f.name == "Gemfile" } ||
                        dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           @lockfile ||=
             dependency_files.find { |f| f.name == "Gemfile.lock" } ||
@@ -272,10 +326,13 @@ module Dependabot
         end
 
         # TODO: Stop sanitizing the lockfile once we have bundler 2 installed
+        sig { returns(String) }
         def sanitized_lockfile_body
-          lockfile.content.gsub(LOCKFILE_ENDING, "")
+          content = T.must(lockfile).content
+          T.must(content).gsub(LOCKFILE_ENDING, "")
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def evaled_gemfiles
           @evaled_gemfiles ||=
             dependency_files
@@ -288,10 +345,12 @@ module Dependabot
             .reject(&:support_file?)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def specification_files
           dependency_files.select { |f| f.name.end_with?(".specification") }
         end
 
+        sig { returns(String) }
         def bundler_version
           @bundler_version ||= Helpers.bundler_version(lockfile)
         end