dependabot-bundler 0.333.0 → 0.335.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed2db4c89c832c17cf73a1183c1ca6645f8f8c141a357526eb997691227dade6
-  data.tar.gz: 41f43a96a647a712ba845860aaecd0bcca8a5aa316c93e578c271f5f7aabd50d
+  metadata.gz: e7f69a64ba15ebbad9f9a6b231aafd823c1dfd209eaf6256bcadcec2cf2b4146
+  data.tar.gz: e99f4c6991029f7f44fc0a82c79298e7b57ca5e52e723abcf7e0a29f23635d2e
 SHA512:
-  metadata.gz: 8e1ed157de7a72eb7d78ca0cafce120e2517e1142a1f38a2fb676edd787db470da46f782f091123028c9a45c647d77f15740e4ee12fa189be9dbd1176f77aae8
-  data.tar.gz: 99d4ccb5ccb39ed52adca7aaaeb84e34356b7efa263541fbdd7a00cbca100b818d52311c3145f2abc73da100fb8e318b05c2fa9fbc5d501c5a7a0d06ff936bad
+  metadata.gz: f016dcae6e50e038e723c4edd8181f0f69f8d784b6fb1811362a044dfe878d9addf22b5647869b6d3073275774d915ffb3963a6aea04979378b6119e4ebaf3fb
+  data.tar.gz: 20c66bb7c4d1293f0fb19f3f5ebec61de873f3a21066b6d4ee9935d0bb858151d381c91e2f5979bd727b226fd787de6f1f8fd71b1f9979dfc54a5d9aad124f04

data/helpers/v2/lib/functions/force_updater.rb

@@ -5,8 +5,13 @@ module Functions
   class ForceUpdater
     class TopLevelDependencyDowngradedError < StandardError; end
 
-    def initialize(dependency_name:, target_version:, gemfile_name:,
-                   lockfile_name:, update_multiple_dependencies:)
+    def initialize(
+      dependency_name:,
+      target_version:,
+      gemfile_name:,
+      lockfile_name:,
+      update_multiple_dependencies:
+    )
       @dependency_name = dependency_name
       @target_version = target_version
       @gemfile_name = gemfile_name

data/helpers/v2/lib/functions/version_resolver.rb

@@ -10,8 +10,12 @@ module Functions
     attr_reader :gemfile_name
     attr_reader :lockfile_name
 
-    def initialize(dependency_name:, dependency_requirements:,
-                   gemfile_name:, lockfile_name:)
+    def initialize(
+      dependency_name:,
+      dependency_requirements:,
+      gemfile_name:,
+      lockfile_name:
+    )
       @dependency_name = dependency_name
       @dependency_requirements = dependency_requirements
       @gemfile_name = gemfile_name

data/helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb

@@ -42,42 +42,50 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:target_version) { "6.0.0" }
 
       it "returns a list of dependencies that block the update" do
-        expect(conflicting_dependencies).to contain_exactly({
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
-          "name" => "rails",
-          "requirement" => "= 5.2.0",
-          "version" => "5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
-          "name" => "actionpack",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
-          "name" => "actionview",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
-          "name" => "activejob",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
-          "name" => "activemodel",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
-          "name" => "activerecord",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        }, {
-          "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
-          "name" => "railties",
-          "version" => "5.2.0",
-          "requirement" => "= 5.2.0"
-        })
+        expect(conflicting_dependencies).to contain_exactly(
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0)",
+            "name" => "rails",
+            "requirement" => "= 5.2.0",
+            "version" => "5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionpack (5.2.0)",
+            "name" => "actionpack",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via actionview (5.2.0)",
+            "name" => "actionview",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activejob (5.2.0)",
+            "name" => "activejob",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activemodel (5.2.0)",
+            "name" => "activemodel",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via activerecord (5.2.0)",
+            "name" => "activerecord",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          },
+          {
+            "explanation" => "rails (5.2.0) requires activesupport (= 5.2.0) via railties (5.2.0)",
+            "name" => "railties",
+            "version" => "5.2.0",
+            "requirement" => "= 5.2.0"
+          }
+        )
       end
     end
 
@@ -88,22 +96,26 @@ RSpec.describe Functions::ConflictingDependencyResolver do
       let(:project_name) { "multiple_blocking" }
 
       it "returns all of the blocking dependencies" do
-        expect(conflicting_dependencies).to contain_exactly({
-          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
-          "name" => "actionpack",
-          "version" => "5.0.0",
-          "requirement" => "= 5.0.0"
-        }, {
-          "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
-          "name" => "actionview",
-          "version" => "5.0.0",
-          "requirement" => "= 5.0.0"
-        }, {
-          "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
-          "name" => "activejob",
-          "version" => "5.0.0",
-          "requirement" => "= 5.0.0"
-        })
+        expect(conflicting_dependencies).to contain_exactly(
+          {
+            "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via actionpack (5.0.0)",
+            "name" => "actionpack",
+            "version" => "5.0.0",
+            "requirement" => "= 5.0.0"
+          },
+          {
+            "explanation" => "actionview (5.0.0) requires activesupport (= 5.0.0)",
+            "name" => "actionview",
+            "version" => "5.0.0",
+            "requirement" => "= 5.0.0"
+          },
+          {
+            "explanation" => "actionmailer (5.0.0) requires activesupport (= 5.0.0) via activejob (5.0.0)",
+            "name" => "activejob",
+            "version" => "5.0.0",
+            "requirement" => "= 5.0.0"
+          }
+        )
       end
     end
 

data/helpers/v2/spec/functions/dependency_source_spec.rb

@@ -40,22 +40,26 @@ RSpec.describe Functions::DependencySource do
     end
 
     it "returns all versions from the private source" do
-      expect(private_registry_versions).to eq([
-        Gem::Version.new("1.5.0"),
-        Gem::Version.new("1.9.0"),
-        Gem::Version.new("1.10.0.beta")
-      ])
+      expect(private_registry_versions).to eq(
+        [
+          Gem::Version.new("1.5.0"),
+          Gem::Version.new("1.9.0"),
+          Gem::Version.new("1.10.0.beta")
+        ]
+      )
     end
 
     context "when specified as the default source" do
       let(:project_name) { "specified_default_source_no_lockfile" }
 
       it "returns all versions from the private source" do
-        expect(private_registry_versions).to eq([
-          Gem::Version.new("1.5.0"),
-          Gem::Version.new("1.9.0"),
-          Gem::Version.new("1.10.0.beta")
-        ])
+        expect(private_registry_versions).to eq(
+          [
+            Gem::Version.new("1.5.0"),
+            Gem::Version.new("1.9.0"),
+            Gem::Version.new("1.10.0.beta")
+          ]
+        )
       end
     end
 

data/helpers/v2/spec/functions/version_resolver_spec.rb

@@ -96,8 +96,10 @@ RSpec.describe Functions::VersionResolver do
         stub_request(:get, old_index_url + "?gems=business,statesman")
           .to_return(
             status: 200,
-            body: fixture("rubygems_responses",
-                          "dependencies-default-gemfile")
+            body: fixture(
+              "rubygems_responses",
+              "dependencies-default-gemfile"
+            )
           )
       end
 

data/lib/dependabot/bundler/file_fetcher.rb

@@ -75,16 +75,20 @@ module Dependabot
       def gemfile
         return @gemfile if defined?(@gemfile)
 
-        @gemfile = T.let(fetch_file_if_present("gems.rb") || fetch_file_if_present("Gemfile"),
-                         T.nilable(Dependabot::DependencyFile))
+        @gemfile = T.let(
+          fetch_file_if_present("gems.rb") || fetch_file_if_present("Gemfile"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
       sig { returns(T.nilable(DependencyFile)) }
       def lockfile
         return @lockfile if defined?(@lockfile)
 
-        @lockfile = T.let(fetch_file_if_present("gems.locked") || fetch_file_if_present("Gemfile.lock"),
-                          T.nilable(Dependabot::DependencyFile))
+        @lockfile = T.let(
+          fetch_file_if_present("gems.locked") || fetch_file_if_present("Gemfile.lock"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -239,8 +243,10 @@ module Dependabot
       end
 
       sig do
-        params(file: DependencyFile,
-               previously_fetched_files: T::Array[DependencyFile]).returns(T::Array[DependencyFile])
+        params(
+          file: DependencyFile,
+          previously_fetched_files: T::Array[DependencyFile]
+        ).returns(T::Array[DependencyFile])
       end
       def fetch_child_gemfiles(file:, previously_fetched_files:)
         paths = ChildGemfileFinder.new(gemfile: file).child_gemfile_paths

data/lib/dependabot/bundler/file_parser.rb

@@ -209,8 +209,10 @@ module Dependabot
       sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def parsed_gemfile
         @parsed_gemfile ||= T.let(
-          SharedHelpers.in_a_temporary_repo_directory(T.must(base_directory),
-                                                      repo_contents_path) do
+          SharedHelpers.in_a_temporary_repo_directory(
+            T.must(base_directory),
+            repo_contents_path
+          ) do
             write_temporary_dependency_files
 
             NativeHelpers.run_bundler_subprocess(

data/lib/dependabot/bundler/file_updater/gemspec_updater.rb

@@ -39,20 +39,27 @@ module Dependabot
         attr_reader :gemspec
 
         sig do
-          params(gemspec: Dependabot::DependencyFile, dependency: Dependabot::Dependency,
-                 content: String).returns(String)
+          params(
+            gemspec: Dependabot::DependencyFile,
+            dependency: Dependabot::Dependency,
+            content: String
+          ).returns(String)
         end
         def replace_gemspec_version_requirement(gemspec, dependency, content)
           return content unless requirement_changed?(gemspec, dependency)
 
           updated_requirement =
-            T.must(dependency.requirements
-                      .find { |r| r[:file] == gemspec.name })
+            T.must(
+              dependency.requirements
+                                    .find { |r| r[:file] == gemspec.name }
+            )
              .fetch(:requirement)
 
           previous_requirement =
-            T.must(T.must(dependency.previous_requirements)
-                      .find { |r| r[:file] == gemspec.name })
+            T.must(
+              T.must(dependency.previous_requirements)
+                                    .find { |r| r[:file] == gemspec.name }
+            )
              .fetch(:requirement)
 
           RequirementReplacer.new(

data/lib/dependabot/bundler/file_updater/git_pin_replacer.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "parser/current"
 require "dependabot/bundler/file_updater"
 
@@ -8,14 +9,21 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GitPinReplacer
+        extend T::Sig
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(String) }
         attr_reader :new_pin
 
+        sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
         def initialize(dependency:, new_pin:)
-          @dependency = dependency
-          @new_pin = new_pin
+          @dependency = T.let(dependency, Dependabot::Dependency)
+          @new_pin = T.let(new_pin, String)
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemfile_content)")
           buffer.source = content
@@ -27,15 +35,24 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
-          PIN_KEYS = %i(ref tag).freeze
+          extend T::Sig
+
+          PIN_KEYS = T.let(%i(ref tag).freeze, T::Array[Symbol])
+
+          sig { returns(Dependabot::Dependency) }
           attr_reader :dependency
+
+          sig { returns(String) }
           attr_reader :new_pin
 
+          sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
           def initialize(dependency:, new_pin:)
-            @dependency = dependency
-            @new_pin = new_pin
+            super()
+            @dependency = T.let(dependency, Dependabot::Dependency)
+            @new_pin = T.let(new_pin, String)
           end
 
+          sig { params(node: Parser::AST::Node).returns(T.untyped) }
           def on_send(node)
             return unless declares_targeted_gem?(node)
             return unless node.children.last.type == :hash
@@ -50,16 +67,19 @@ module Dependabot
 
           private
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def declares_targeted_gem?(node)
             return false unless node.children[1] == :gem
 
             node.children[2].children.first == dependency.name
           end
 
+          sig { params(node: Parser::AST::Node).returns(Symbol) }
           def key_from_hash_pair(node)
             node.children.first.children.first.to_sym
           end
 
+          sig { params(hash_pair: Parser::AST::Node).void }
           def update_value(hash_pair)
             value_node = hash_pair.children.last
             open_quote_character, close_quote_character =
@@ -71,6 +91,7 @@ module Dependabot
             )
           end
 
+          sig { params(value_node: Parser::AST::Node).returns([String, String]) }
           def extract_quote_characters_from(value_node)
             [value_node.loc.begin.source, value_node.loc.end.source]
           end

data/lib/dependabot/bundler/file_updater/git_source_remover.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -12,12 +12,15 @@ module Dependabot
       class GitSourceRemover
         extend T::Sig
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
+        sig { params(dependency: Dependabot::Dependency).void }
         def initialize(dependency:)
           @dependency = dependency
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemfile_content)")
           buffer.source = content
@@ -27,18 +30,23 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
+          extend T::Sig
+
           # TODO: Hack until Bundler 1.16.0 is available on Heroku
           GOOD_KEYS = %i(
             group groups path glob name require platform platforms type
             source install_if
           ).freeze
 
+          sig { returns(Dependabot::Dependency) }
           attr_reader :dependency
 
+          sig { params(dependency: Dependabot::Dependency).void }
           def initialize(dependency:)
-            @dependency = dependency
+            @dependency = T.let(dependency, Dependabot::Dependency)
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def on_send(node)
             return unless declares_targeted_gem?(node)
             return unless node.children.last.type == :hash
@@ -57,16 +65,19 @@ module Dependabot
 
           private
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def declares_targeted_gem?(node)
             return false unless node.children[1] == :gem
 
             node.children[2].children.first == dependency.name
           end
 
+          sig { params(node: Parser::AST::Node).returns(Symbol) }
           def key_from_hash_pair(node)
             node.children.first.children.first.to_sym
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def remove_all_kwargs(node)
             kwargs_node = node.children.last
 
@@ -76,6 +87,7 @@ module Dependabot
             remove(range_to_remove)
           end
 
+          sig { params(kwargs_node: Parser::AST::Node).void }
           def remove_git_related_kwargs(kwargs_node)
             good_key_index = T.let(nil, T.nilable(Integer))
             hash_pairs = kwargs_node.children