dependabot-bundler 0.384.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3daa49f0b7badcac1b05d18da5a85120669028a0e05217e9f25909841c90593c
-  data.tar.gz: 86a858104d17f0050cbede5e5d9d815a47b2c0ee36ba844d4777f71a70840549
+  metadata.gz: 497069e0c24769d144719c23a99658721135d964311c543b79e8e79118b57ff4
+  data.tar.gz: 3fb99af5f766180db6928c1f7d22ccc835feb0829eba150ed4d7a56b8fc3ebf7
 SHA512:
-  metadata.gz: 57636ebdc4fa11bebb74e6839df1d363dcb6db1e381b2070c5e81f76301ada8d747c36965c85c269cc25cd6a4ecc5b2d7312d3d9f3eeadc7c9b48e2d61fdedb1
-  data.tar.gz: 7907b9f4b766c2e080a0d2842c5cf3b10fc8c02dbfdfdf2f545366ecdf4c6566e8dcffa89783e83d6b65c4884da627624f98a469a8b93a24d20f9ac28752427f
+  metadata.gz: 336c256aeae0398b830cb8fe398f98d8e4bbba385cfa94f11ea6e415985bc567700f34c92b89f7e5ecd0521ed3e90eaa024e4c2a6049ab3a533ebfff25e971fd
+  data.tar.gz: 682c35977db40d6fce2b12792ca1b310a5b0db198e6a784cb27c55d11c63f2c712a68cda48d7e73b53db5447bcb62ff083c5b7fec824493c424e1cbac9ad5b01

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -72,6 +72,15 @@ module Functions
         lockfile_specs.include?(spec)
       end.map(&:name).uniq
 
+      cache_path = Bundler.app_cache
+
+      # Snapshot the gems already vendored in the repo before we re-cache.
+      # `cache_all_platforms` re-fetches every platform variant of every gem,
+      # which adds gem files for platforms the repo may never have vendored.
+      # We only want to add platform variants for gems this update actually
+      # changed, so anything else newly added is reverted below.
+      pre_existing_gems = Dir["#{cache_path}/*.gem"]
+
       bundler_opts = {
         cache_all: true,
         cache_all_platforms: true,
@@ -84,10 +93,30 @@ module Functions
 
         # Only prune updated gems (the original implementation is in
         # Bundler::Runtime)
-        cache_path = Bundler.app_cache
         prune_gem_cache(resolve, cache_path, updated_gems)
         prune_git_and_path_cache(resolve, cache_path)
       end
+
+      # Revert gem files newly added by the all-platforms re-cache that belong
+      # to dependencies this update didn't touch. Without this a single-gem
+      # update re-vendors missing platform variants for *every* gem, producing
+      # large diffs unrelated to the update on repos that don't vendor every
+      # platform.
+      prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+    end
+
+    # Removes gem files added by the all-platforms re-cache that were not
+    # present before and don't belong to an updated dependency (including
+    # sub-dependencies). Pre-existing vendored gems are always left untouched.
+    def prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+      Dir["#{cache_path}/*.gem"].each do |path|
+        next if pre_existing_gems.include?(path)
+
+        spec = Bundler.rubygems.spec_from_gem(path)
+        next if updated_gems.include?(spec.name)
+
+        File.delete(path)
+      end
     end
 
     # Copied from Bundler::Runtime: Modified to only prune gems that have

data/helpers/v4/lib/functions/lockfile_updater.rb

@@ -72,6 +72,15 @@ module Functions
         lockfile_specs.include?(spec)
       end.map(&:name).uniq
 
+      cache_path = Bundler.app_cache
+
+      # Snapshot the gems already vendored in the repo before we re-cache.
+      # `cache_all_platforms` re-fetches every platform variant of every gem,
+      # which adds gem files for platforms the repo may never have vendored.
+      # We only want to add platform variants for gems this update actually
+      # changed, so anything else newly added is reverted below.
+      pre_existing_gems = Dir["#{cache_path}/*.gem"]
+
       bundler_opts = {
         cache_all: true,
         cache_all_platforms: true,
@@ -84,10 +93,30 @@ module Functions
 
         # Only prune updated gems (the original implementation is in
         # Bundler::Runtime)
-        cache_path = Bundler.app_cache
         prune_gem_cache(resolve, cache_path, updated_gems)
         prune_git_and_path_cache(resolve, cache_path)
       end
+
+      # Revert gem files newly added by the all-platforms re-cache that belong
+      # to dependencies this update didn't touch. Without this a single-gem
+      # update re-vendors missing platform variants for *every* gem, producing
+      # large diffs unrelated to the update on repos that don't vendor every
+      # platform.
+      prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+    end
+
+    # Removes gem files added by the all-platforms re-cache that were not
+    # present before and don't belong to an updated dependency (including
+    # sub-dependencies). Pre-existing vendored gems are always left untouched.
+    def prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+      Dir["#{cache_path}/*.gem"].each do |path|
+        next if pre_existing_gems.include?(path)
+
+        spec = Bundler.rubygems.spec_from_gem(path)
+        next if updated_gems.include?(spec.name)
+
+        File.delete(path)
+      end
     end
 
     # Copied from Bundler::Runtime: Modified to only prune gems that have

data/lib/dependabot/bundler/update_checker.rb

@@ -255,10 +255,8 @@ module Dependabot
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
-        if git_commit_checker.pinned_ref_looks_like_version?
-          latest_tag = git_commit_checker.local_tag_for_latest_version
-          return latest_tag&.fetch(:tag_sha) || dependency.version
-        end
+        latest_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
+        return latest_tag.fetch(:tag_sha) || dependency.version if latest_tag
 
         # If the dependency is pinned to a tag that doesn't look like a
         # version then there's nothing we can do.
@@ -280,9 +278,8 @@ module Dependabot
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
-        if git_commit_checker.pinned_ref_looks_like_version? &&
-           latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+        if latest_git_tag_is_resolvable?
+          new_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
           return new_tag&.fetch(:tag_sha)
         end
 
@@ -317,7 +314,7 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def latest_git_tag_is_resolvable?
-        latest_tag_details = git_commit_checker.local_tag_for_latest_version
+        latest_tag_details = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
         return false unless latest_tag_details
 
         git_tag_resolvable?(latest_tag_details.fetch(:tag))
@@ -336,9 +333,8 @@ module Dependabot
         return dependency_source_details unless git_dependency?
 
         # Update the git tag if updating a pinned version
-        if git_commit_checker.pinned_ref_looks_like_version? &&
-           latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+        if latest_git_tag_is_resolvable?
+          new_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
           return T.must(dependency_source_details).merge(ref: T.must(new_tag).fetch(:tag))
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -351,7 +351,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib