dependabot-bundler 0.384.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3daa49f0b7badcac1b05d18da5a85120669028a0e05217e9f25909841c90593c
-  data.tar.gz: 86a858104d17f0050cbede5e5d9d815a47b2c0ee36ba844d4777f71a70840549
+  metadata.gz: 0f0e20b61f6f25f9cab555ba872e5f1e087435c8262e077340dbd54ffc4d06b6
+  data.tar.gz: f25535c60a1fbb733644a2e0429cc9cac5a63150b757ac0b4f14788884f62f31
 SHA512:
-  metadata.gz: 57636ebdc4fa11bebb74e6839df1d363dcb6db1e381b2070c5e81f76301ada8d747c36965c85c269cc25cd6a4ecc5b2d7312d3d9f3eeadc7c9b48e2d61fdedb1
-  data.tar.gz: 7907b9f4b766c2e080a0d2842c5cf3b10fc8c02dbfdfdf2f545366ecdf4c6566e8dcffa89783e83d6b65c4884da627624f98a469a8b93a24d20f9ac28752427f
+  metadata.gz: 0c80cce29ae7d8641213f9f6189627f3ef2e4d005b5039286638e7b7de35693744161b9c8668983ce46bc814c912c6264665060649f33c2ee43ad951f2faf399
+  data.tar.gz: 32a6267dd3b4e3682a726dafdcfc043e0259b3fee6881f8fbee7b35ab85ad9393a3d21a54ea39024f8ca70796a725d85fe05e76e479a9925e391e8ee0d049198

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -72,6 +72,15 @@ module Functions
         lockfile_specs.include?(spec)
       end.map(&:name).uniq
 
+      cache_path = Bundler.app_cache
+
+      # Snapshot the gems already vendored in the repo before we re-cache.
+      # `cache_all_platforms` re-fetches every platform variant of every gem,
+      # which adds gem files for platforms the repo may never have vendored.
+      # We only want to add platform variants for gems this update actually
+      # changed, so anything else newly added is reverted below.
+      pre_existing_gems = Dir["#{cache_path}/*.gem"]
+
       bundler_opts = {
         cache_all: true,
         cache_all_platforms: true,
@@ -84,10 +93,30 @@ module Functions
 
         # Only prune updated gems (the original implementation is in
         # Bundler::Runtime)
-        cache_path = Bundler.app_cache
         prune_gem_cache(resolve, cache_path, updated_gems)
         prune_git_and_path_cache(resolve, cache_path)
       end
+
+      # Revert gem files newly added by the all-platforms re-cache that belong
+      # to dependencies this update didn't touch. Without this a single-gem
+      # update re-vendors missing platform variants for *every* gem, producing
+      # large diffs unrelated to the update on repos that don't vendor every
+      # platform.
+      prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+    end
+
+    # Removes gem files added by the all-platforms re-cache that were not
+    # present before and don't belong to an updated dependency (including
+    # sub-dependencies). Pre-existing vendored gems are always left untouched.
+    def prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+      Dir["#{cache_path}/*.gem"].each do |path|
+        next if pre_existing_gems.include?(path)
+
+        spec = Bundler.rubygems.spec_from_gem(path)
+        next if updated_gems.include?(spec.name)
+
+        File.delete(path)
+      end
     end
 
     # Copied from Bundler::Runtime: Modified to only prune gems that have

data/helpers/v2/monkey_patches/endpoint_specification_metadata_patch.rb

@@ -0,0 +1,33 @@
+# typed: false
+# frozen_string_literal: true
+
+require "bundler/endpoint_specification"
+
+# Bundler parses the metadata a registry's compact index (`/info/<gem>`)
+# returns per gem version. Its guard is `next unless v`, but an empty array
+# `[]` is truthy, so for an empty `checksum` it calls `Checksum.from_api(nil)`
+# -> `nil.match?(...)` and raises `Bundler::GemspecError` ("There was an error
+# parsing the metadata for the gem ..."), aborting the whole resolution.
+#
+# GitHub Packages serves this empty-checksum shape for some old gems (e.g.
+# failbot 2.0.1), so one such gem blocks every update for the repo. Compact-
+# index checksum verification landed in Bundler 2.5, so both the Bundler 2 and
+# Bundler 4 helpers parse checksums and need this patch (the Bundler 2 helper
+# activates ">= 2.4, < 3", i.e. a checksum-parsing 2.5+).
+#
+# Drop nil/empty metadata values before Bundler parses them. An empty checksum
+# carries nothing to verify, so skipping it is safe; well-formed values (and
+# genuinely malformed ones, which still raise) are untouched.
+module BundlerEndpointSpecificationMetadataPatch
+  def parse_metadata(data)
+    if data.respond_to?(:reject)
+      data = data.reject do |_key, value|
+        value.nil? || (value.respond_to?(:empty?) && value.empty?)
+      end
+    end
+
+    super
+  end
+end
+
+Bundler::EndpointSpecification.prepend(BundlerEndpointSpecificationMetadataPatch)

data/helpers/v2/run.rb

@@ -25,6 +25,7 @@ end
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
 require "git_source_patch"
+require "endpoint_specification_metadata_patch"
 
 require "functions"
 

data/helpers/v2/spec/bundler_endpoint_specification_metadata_patch_spec.rb

@@ -0,0 +1,49 @@
+# typed: false
+# frozen_string_literal: true
+
+require "native_spec_helper"
+
+RSpec.describe BundlerEndpointSpecificationMetadataPatch do
+  let(:spec_fetcher) { instance_double(Bundler::Fetcher, uri: URI("https://example.com")) }
+
+  def build_spec(metadata)
+    Bundler::EndpointSpecification.new("failbot", "2.0.1", "ruby", spec_fetcher, [], metadata)
+  end
+
+  it "does not raise when the registry serves an empty checksum array" do
+    expect { build_spec([["checksum", []]]) }.not_to raise_error
+  end
+
+  it "leaves the checksum unset for an empty checksum array" do
+    spec = build_spec([["checksum", []]])
+    expect(spec.checksum).to be_nil
+  end
+
+  # The compact-index parser can emit a value-less entry (`["checksum"]`) rather
+  # than an empty array, depending on the RubyGems GemParser version. Both shapes
+  # reach this code, so both must be tolerated.
+  it "does not raise when the checksum entry has no value at all" do
+    expect { build_spec([["checksum"]]) }.not_to raise_error
+  end
+
+  it "ignores nil and blank metadata values" do
+    expect { build_spec([["checksum", nil], ["ruby", []]]) }.not_to raise_error
+  end
+
+  it "still parses a well-formed checksum" do
+    digest = "f" * 64
+    spec = build_spec([["checksum", [digest]]])
+    expect(spec.checksum).not_to be_nil
+  end
+
+  it "still parses ruby and rubygems requirements" do
+    spec = build_spec([["ruby", [">= 3.1"]], ["rubygems", [">= 3.0"]], ["checksum", []]])
+    expect(spec.required_ruby_version.to_s).to eq(">= 3.1")
+    expect(spec.required_rubygems_version.to_s).to eq(">= 3.0")
+  end
+
+  it "still raises on a genuinely malformed (non-empty) checksum" do
+    expect { build_spec([["checksum", ["not-a-valid-digest"]]]) }
+      .to raise_error(Bundler::GemspecError)
+  end
+end

data/helpers/v2/spec/native_spec_helper.rb

@@ -21,6 +21,7 @@ $LOAD_PATH.unshift(File.expand_path("../../spec_helpers", __dir__))
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
 require "git_source_patch"
+require "endpoint_specification_metadata_patch"
 
 require "functions"
 

data/helpers/v4/lib/functions/lockfile_updater.rb

@@ -72,6 +72,15 @@ module Functions
         lockfile_specs.include?(spec)
       end.map(&:name).uniq
 
+      cache_path = Bundler.app_cache
+
+      # Snapshot the gems already vendored in the repo before we re-cache.
+      # `cache_all_platforms` re-fetches every platform variant of every gem,
+      # which adds gem files for platforms the repo may never have vendored.
+      # We only want to add platform variants for gems this update actually
+      # changed, so anything else newly added is reverted below.
+      pre_existing_gems = Dir["#{cache_path}/*.gem"]
+
       bundler_opts = {
         cache_all: true,
         cache_all_platforms: true,
@@ -84,10 +93,30 @@ module Functions
 
         # Only prune updated gems (the original implementation is in
         # Bundler::Runtime)
-        cache_path = Bundler.app_cache
         prune_gem_cache(resolve, cache_path, updated_gems)
         prune_git_and_path_cache(resolve, cache_path)
       end
+
+      # Revert gem files newly added by the all-platforms re-cache that belong
+      # to dependencies this update didn't touch. Without this a single-gem
+      # update re-vendors missing platform variants for *every* gem, producing
+      # large diffs unrelated to the update on repos that don't vendor every
+      # platform.
+      prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+    end
+
+    # Removes gem files added by the all-platforms re-cache that were not
+    # present before and don't belong to an updated dependency (including
+    # sub-dependencies). Pre-existing vendored gems are always left untouched.
+    def prune_unrequested_gem_additions(cache_path, pre_existing_gems, updated_gems)
+      Dir["#{cache_path}/*.gem"].each do |path|
+        next if pre_existing_gems.include?(path)
+
+        spec = Bundler.rubygems.spec_from_gem(path)
+        next if updated_gems.include?(spec.name)
+
+        File.delete(path)
+      end
     end
 
     # Copied from Bundler::Runtime: Modified to only prune gems that have

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -8,6 +8,7 @@ require "uri"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
 require "dependabot/bundler/helpers"
+require "dependabot/logger"
 require "dependabot/registry_client"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -41,9 +42,11 @@ module Dependabot
         # Raised by Bundler when a registry's compact index (`/info/<gem>`) returns
         # gem metadata it can't parse (e.g. an illformed `ruby:`/`rubygems:`
         # requirement). This means the *registry* served bad data, not that the
-        # user's dependency files are broken.
+        # user's dependency files are broken. The trailing `detail` capture keeps
+        # Bundler's own explanation (e.g. `Illformed requirement [...]`) so the
+        # exact parse failure is preserved rather than discarded.
         REGISTRY_METADATA_ERROR_REGEX =
-          /error parsing the metadata for the gem (?<gem>\S+) \((?<version>[^)]+)\)/
+          /error parsing the metadata for the gem (?<gem>\S+) \((?<version>[^)]+)\):?\s*(?<detail>.*)/m
 
         module BundlerErrorPatterns
           MISSING_AUTH_REGEX = /bundle config set --global (?<source>.*) username:password/
@@ -217,8 +220,22 @@ module Dependabot
           source = private_registry_source
           return nil unless source
 
+          # Bundler's original message identifies which gem/version the registry
+          # served unparseable metadata for, and why (e.g. the illformed
+          # requirement string). The structured job error only records the source
+          # host, so log the full message here to keep the offending gem
+          # diagnosable from the updater logs.
+          Dependabot.logger.error(
+            "Registry #{source} returned unparseable compact-index metadata for " \
+            "#{match[:gem]} (#{match[:version]}); raising PrivateSourceBadResponse. " \
+            "Original Bundler error: #{error.message.strip}"
+          )
+
+          parse_detail = match[:detail].to_s.strip.gsub(/\s*\n\s*/, "; ")
           detail = "Invalid gem metadata returned for #{match[:gem]} (#{match[:version]}) " \
                    "by the source: #{source}"
+          detail += " (#{parse_detail})" unless parse_detail.empty?
+
           Dependabot::PrivateSourceBadResponse.new(source, detail)
         end
 

data/lib/dependabot/bundler/update_checker.rb

@@ -255,10 +255,8 @@ module Dependabot
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
-        if git_commit_checker.pinned_ref_looks_like_version?
-          latest_tag = git_commit_checker.local_tag_for_latest_version
-          return latest_tag&.fetch(:tag_sha) || dependency.version
-        end
+        latest_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
+        return latest_tag.fetch(:tag_sha) || dependency.version if latest_tag
 
         # If the dependency is pinned to a tag that doesn't look like a
         # version then there's nothing we can do.
@@ -280,9 +278,8 @@ module Dependabot
         # If the dependency is pinned to a tag that looks like a version then
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
-        if git_commit_checker.pinned_ref_looks_like_version? &&
-           latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+        if latest_git_tag_is_resolvable?
+          new_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
           return new_tag&.fetch(:tag_sha)
         end
 
@@ -317,7 +314,7 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def latest_git_tag_is_resolvable?
-        latest_tag_details = git_commit_checker.local_tag_for_latest_version
+        latest_tag_details = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
         return false unless latest_tag_details
 
         git_tag_resolvable?(latest_tag_details.fetch(:tag))
@@ -336,9 +333,8 @@ module Dependabot
         return dependency_source_details unless git_dependency?
 
         # Update the git tag if updating a pinned version
-        if git_commit_checker.pinned_ref_looks_like_version? &&
-           latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+        if latest_git_tag_is_resolvable?
+          new_tag = git_commit_checker.local_tag_for_pinned_version_ref(update_cooldown)
           return T.must(dependency_source_details).merge(ref: T.must(new_tag).fetch(:tag))
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -269,8 +269,10 @@ files:
 - helpers/v2/lib/functions/version_resolver.rb
 - helpers/v2/monkey_patches/definition_bundler_version_patch.rb
 - helpers/v2/monkey_patches/definition_ruby_version_patch.rb
+- helpers/v2/monkey_patches/endpoint_specification_metadata_patch.rb
 - helpers/v2/monkey_patches/git_source_patch.rb
 - helpers/v2/run.rb
+- helpers/v2/spec/bundler_endpoint_specification_metadata_patch_spec.rb
 - helpers/v2/spec/bundler_version_constraint_spec.rb
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
 - helpers/v2/spec/functions/dependency_source_spec.rb
@@ -351,7 +353,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib