dependabot-bundler 0.389.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b27c0ca95e53100edd2104766511302c6559cc4ebb099e304f2198337d940ab7
-  data.tar.gz: bada129a0da00144bdd4f600ce5dee62a90ef73943cfb7b75e4f55f0c94d28f7
+  metadata.gz: 672d87cda96727e07addcdfc985c06c305ba63f344405f55ff4b10dd36562096
+  data.tar.gz: 6a19d0836c030bc9aaa9b27a4b1761fe11bb27e0afc8ecc6b1d1ae001872a892
 SHA512:
-  metadata.gz: 88f3032fe0d5aa2a747208d0dfcbeac1a57cdfa9eec18d193d17ac50a586cafdcb64dd15d42e24a8350c833747094561381f4dfb7c540a5a77a5ded124829334
-  data.tar.gz: 232bd45a635a8ad61404d957776977d25a1cf342fbe42025eeb14b629f0ff694ffd3a08bf47c059cb4a6e2ac60588d3261271c5af888076b92a9a22ba7229d3d
+  metadata.gz: 3ba582280818476c7829d113c8ce8d6658240d9295f497736621418c9d8d0e85b1aefa555ea4dbd2f6296149fe8f7e2b4527f176edf6d3bfeb3393f0bd94e90c
+  data.tar.gz: '08fc1b1c9f73c5649a53758f60a41a8139211f48fa81b371cce24666fd79ae6000e998c802808664ee8d54675047693c11bc15d544cbcd6598b43c75cd962d23'

data/lib/dependabot/bundler/file_parser.rb

@@ -104,7 +104,7 @@ module Dependabot
       sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(T::Boolean) }
       def git_source?(dependencies)
         dependencies.any? do |dep|
-          dep.requirements.any? { |req| req.fetch(:source)&.fetch(:type) == "git" }
+          dep.requirements.any? { |req| req.source_string("type") == "git" }
         end
       end
 
@@ -380,7 +380,7 @@ module Dependabot
       sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
       def production?(dependency)
         groups = dependency.requirements
-                           .flat_map { |r| r.fetch(:groups) }
+                           .flat_map { |r| r.groups || [] }
                            .map(&:to_s)
 
         return true if groups.empty?

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -56,18 +56,18 @@ module Dependabot
 
           updated_requirement =
             dependency.requirements
-                      .find { |r| r[:file] == file.name }
-                      &.fetch(:requirement)
+                      .find { |r| r.file == file.name }
+                      &.requirement_string
 
           previous_requirement =
             dependency.previous_requirements
-                      &.find { |r| r[:file] == file.name }
-                      &.fetch(:requirement)
+                      &.find { |r| r.file == file.name }
+                      &.requirement_string
 
           RequirementReplacer.new(
             dependency: dependency,
             file_type: :gemfile,
-            updated_requirement: updated_requirement,
+            updated_requirement: T.must(updated_requirement),
             previous_requirement: previous_requirement
           ).rewrite(content)
         end
@@ -77,34 +77,34 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def remove_git_source?(dependency)
           old_gemfile_req =
             dependency.previous_requirements
-                      &.find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      &.find { |f| GEMFILE_FILENAMES.include?(f.file) }
 
-          return false unless old_gemfile_req&.dig(:source, :type) == "git"
+          return false unless old_gemfile_req&.source_string("type") == "git"
 
           new_gemfile_req =
             dependency.requirements
-                      .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      .find { |f| GEMFILE_FILENAMES.include?(f.file) }
 
-          T.must(new_gemfile_req)[:source].nil?
+          T.must(new_gemfile_req).source.nil?
         end
 
         sig { params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile).returns(T::Boolean) }
         def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements
-                      .find { |f| f[:file] == file.name }
-          return false unless new_gemfile_req&.dig(:source, :type) == "git"
+                      .find { |f| f.file == file.name }
+          return false unless new_gemfile_req&.source_string("type") == "git"
 
           # If the new requirement is a git dependency with a ref then there's
           # no harm in doing an update
-          !T.must(new_gemfile_req).dig(:source, :ref).nil?
+          !T.must(new_gemfile_req).source_string("ref").nil?
         end
 
         sig { params(dependency: Dependabot::Dependency, content: String).returns(String) }
@@ -118,12 +118,11 @@ module Dependabot
         def update_gemfile_git_pin(dependency, file, content)
           new_pin =
             dependency.requirements
-                      .find { |f| f[:file] == file.name }
-                      &.fetch(:source)
-                      &.fetch(:ref)
+                      .find { |f| f.file == file.name }
+                      &.source_string("ref")
 
           GitPinReplacer
-            .new(dependency: dependency, new_pin: new_pin)
+            .new(dependency: dependency, new_pin: T.must(new_pin))
             .rewrite(content)
         end
       end

data/lib/dependabot/bundler/file_updater/gemspec_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -13,8 +13,8 @@ module Dependabot
 
         sig { params(dependencies: T::Array[Dependabot::Dependency], gemspec: Dependabot::DependencyFile).void }
         def initialize(dependencies:, gemspec:)
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @gemspec = T.let(gemspec, Dependabot::DependencyFile)
+          @dependencies = dependencies
+          @gemspec = gemspec
         end
 
         sig { returns(String) }
@@ -51,21 +51,21 @@ module Dependabot
           updated_requirement =
             T.must(
               dependency.requirements
-                                    .find { |r| r[:file] == gemspec.name }
+                                    .find { |r| r.file == gemspec.name }
             )
-             .fetch(:requirement)
+             .requirement_string
 
           previous_requirement =
             T.must(
               T.must(dependency.previous_requirements)
-                                    .find { |r| r[:file] == gemspec.name }
+                                    .find { |r| r.file == gemspec.name }
             )
-             .fetch(:requirement)
+             .requirement_string
 
           RequirementReplacer.new(
             dependency: dependency,
             file_type: :gemspec,
-            updated_requirement: updated_requirement,
+            updated_requirement: T.must(updated_requirement),
             previous_requirement: previous_requirement
           ).rewrite(content)
         end
@@ -75,7 +75,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
       end
     end

data/lib/dependabot/bundler/file_updater/git_pin_replacer.rb

@@ -20,8 +20,8 @@ module Dependabot
 
         sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
         def initialize(dependency:, new_pin:)
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @new_pin = T.let(new_pin, String)
+          @dependency = dependency
+          @new_pin = new_pin
         end
 
         sig { params(content: String).returns(String) }
@@ -38,7 +38,7 @@ module Dependabot
         class Rewriter < Parser::TreeRewriter
           extend T::Sig
 
-          PIN_KEYS = T.let(%i(ref tag).freeze, T::Array[Symbol])
+          PIN_KEYS = %i(ref tag).freeze
 
           sig { returns(Dependabot::Dependency) }
           attr_reader :dependency
@@ -49,8 +49,8 @@ module Dependabot
           sig { params(dependency: Dependabot::Dependency, new_pin: String).void }
           def initialize(dependency:, new_pin:)
             super()
-            @dependency = T.let(dependency, Dependabot::Dependency)
-            @new_pin = T.let(new_pin, String)
+            @dependency = dependency
+            @new_pin = new_pin
           end
 
           sig { params(node: Parser::AST::Node).void }

data/lib/dependabot/bundler/file_updater/git_source_remover.rb

@@ -44,7 +44,7 @@ module Dependabot
 
           sig { params(dependency: Dependabot::Dependency).void }
           def initialize(dependency:)
-            @dependency = T.let(dependency, Dependabot::Dependency)
+            @dependency = dependency
           end
 
           sig { params(node: Parser::AST::Node).void }
@@ -57,10 +57,10 @@ module Dependabot
               key_from_hash_pair(hash_pair)
             end
 
-            if keys.none? { |key| GOOD_KEYS.include?(key) }
-              remove_all_kwargs(node)
-            else
+            if keys.intersect?(GOOD_KEYS)
               remove_git_related_kwargs(kwargs_node)
+            else
+              remove_all_kwargs(node)
             end
           end
 

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -29,9 +29,7 @@ module Dependabot
         # No `/m`: it would let the greedy `.*` in `entries` match newlines and
         # swallow the trailing `BUNDLED WITH` section. `^` is line-anchored anyway.
         CHECKSUMS_SECTION = /(^CHECKSUMS\n)(?<entries>(?:^  .*\n)+)/
-        BUNDLED_WITH_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+\.\d+\.\d+)/m
         BUNDLER_CHECKSUM_ENTRY_REGEX = /^  bundler \([^)]+\).*\n?$/
-        MIN_BUNDLER_CHECKSUM_VERSION = Gem::Version.new("4.0.11")
 
         sig do
           params(
@@ -49,11 +47,11 @@ module Dependabot
           options:,
           repo_contents_path: nil
         )
-          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @repo_contents_path = T.let(repo_contents_path, T.nilable(String))
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @options = T.let(options, T::Hash[Symbol, T.untyped])
+          @dependencies = dependencies
+          @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
+          @credentials = credentials
+          @options = options
           @updated_lockfile_content = T.let(nil, T.nilable(String))
           @gemfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
           @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
@@ -250,14 +248,17 @@ module Dependabot
           lockfile_content = T.must(lockfile).content
           return false unless lockfile_content&.include?("CHECKSUMS\n")
 
+          # Strip a bundler self-checksum only when the original CHECKSUMS
+          # section did not contain one. If the original pins one,
+          # restore_bundler_checksum separately swaps a generated entry back to
+          # the original when present. Dependabot must not introduce a missing
+          # entry: the runner's regular-gem install can calculate a checksum that
+          # a default-gem install cannot (ruby/rubygems#9512), and its runtime
+          # bundler version need not match BUNDLED WITH because Dependabot does
+          # not manage that version. This can add unrelated or mismatched
+          # metadata and cause lockfile churn.
           checksums_section = lockfile_content.match(CHECKSUMS_SECTION)
-          return false if checksums_section && T.must(checksums_section[:entries]).match?(BUNDLER_CHECKSUM_ENTRY_REGEX)
-
-          bundled_with = lockfile_content.match(BUNDLED_WITH_VERSION_REGEX)&.[](:version)
-          return false unless bundled_with
-
-          bundled_with_version = Gem::Version.new(bundled_with)
-          bundled_with_version >= Gem::Version.new("4.0.0") && bundled_with_version < MIN_BUNDLER_CHECKSUM_VERSION
+          !(checksums_section && T.must(checksums_section[:entries]).match?(BUNDLER_CHECKSUM_ENTRY_REGEX))
         end
 
         sig { params(lockfile_body: String).returns(String) }

data/lib/dependabot/bundler/file_updater/requirement_replacer.rb

@@ -117,7 +117,7 @@ module Dependabot
 
           # TODO: Ideally we wouldn't have to ignore all of these, but
           # implementing each one will be tricky.
-          SKIPPED_TYPES = T.let(%i(send lvar dstr begin if case splat const or).freeze, T::Array[Symbol])
+          SKIPPED_TYPES = %i(send lvar dstr begin if case splat const or).freeze
 
           sig do
             params(
@@ -133,10 +133,10 @@ module Dependabot
             updated_requirement:,
             insert_if_bare:
           )
-            @dependency = T.let(dependency, Dependabot::Dependency)
-            @file_type = T.let(file_type, Symbol)
-            @updated_requirement = T.let(updated_requirement, String)
-            @insert_if_bare = T.let(insert_if_bare, T::Boolean)
+            @dependency = dependency
+            @file_type = file_type
+            @updated_requirement = updated_requirement
+            @insert_if_bare = insert_if_bare
 
             return if %i(gemfile gemspec).include?(file_type)
 
@@ -231,7 +231,7 @@ module Dependabot
               end
 
             ops = Gem::Requirement::OPS.keys
-            return true if ops.none? { |op| req_string.include?(op) }
+            return true if ops.none? { |op| req_string.index(op) }
 
             req_string.include?(" ")
           end

data/lib/dependabot/bundler/metadata_finder.rb

@@ -11,19 +11,16 @@ module Dependabot
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
 
-      SOURCE_KEYS = T.let(
-        %w(
-          source_code_uri
-          homepage_uri
-          wiki_uri
-          bug_tracker_uri
-          documentation_uri
-          changelog_uri
-          mailing_list_uri
-          download_uri
-        ).freeze,
-        T::Array[String]
-      )
+      SOURCE_KEYS = %w(
+        source_code_uri
+        homepage_uri
+        wiki_uri
+        bug_tracker_uri
+        documentation_uri
+        changelog_uri
+        mailing_list_uri
+        download_uri
+      ).freeze
 
       sig do
         params(
@@ -95,9 +92,9 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
+        info = T.must(dependency.requirements.filter_map(&:source_hash).first)
 
-        url = info[:url] || info.fetch("url")
+        url = T.cast(info[:url] || info.fetch("url"), T.nilable(String))
         Source.from_url(url)
       end
 
@@ -222,8 +219,8 @@ module Dependabot
       def registry_url
         return base_url if new_source_type == "default"
 
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-        info[:url] || info.fetch("url")
+        info = T.must(dependency.requirements.filter_map(&:source_hash).first)
+        T.cast(info[:url] || info.fetch("url"), String)
       end
 
       sig { returns(String) }

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -214,9 +214,9 @@ module Dependabot
           return nil unless dependency&.requirements&.any?
 
           first_requirement = dependency.requirements.first
-          return nil unless first_requirement && first_requirement[:source]
+          return nil unless first_requirement
 
-          url = T.let(first_requirement[:source][:url], T.nilable(String))
+          url = first_requirement.source_string("url")
           return nil unless url
 
           url.end_with?("/") ? url.chop : url
@@ -242,9 +242,9 @@ module Dependabot
           return nil unless dependency.requirements.any?
 
           first_requirement = dependency.requirements.first
-          return nil unless first_requirement && first_requirement[:source]
+          return nil unless first_requirement
 
-          first_requirement[:source][:type]
+          first_requirement.source_string("type")
         end
 
         sig { override.returns(String) }

data/lib/dependabot/bundler/requirement.rb

@@ -11,11 +11,11 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      GEM_DEP_SPLIT = T.let(/\A(?<name>[a-zA-Z0-9_\-]+):(?<version>.+)\z/, Regexp)
+      GEM_DEP_SPLIT = /\A(?<name>[a-zA-Z0-9_\-]+):(?<version>.+)\z/
 
-      sig { params(req: T::Hash[Symbol, String], version: Gem::Version).returns(T::Boolean) }
+      sig { params(req: Dependabot::DependencyRequirement, version: Gem::Version).returns(T::Boolean) }
       def self.satisfied_by?(req, version)
-        new(req[:requirement]).satisfied_by?(version)
+        new(req.requirement_string).satisfied_by?(version)
       end
 
       # For consistency with other languages, we define a requirements array.

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -62,16 +62,16 @@ module Dependabot
           latest_allowable_version: nil,
           lock_ruby_version: true
         )
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @remove_git_source = T.let(remove_git_source, T::Boolean)
-          @unlock_requirement = T.let(unlock_requirement, T::Boolean)
-          @replacement_git_pin = T.let(replacement_git_pin, T.nilable(String))
+          @dependency_files = dependency_files
+          @dependency = dependency
+          @remove_git_source = remove_git_source
+          @unlock_requirement = unlock_requirement
+          @replacement_git_pin = replacement_git_pin
           @latest_allowable_version = T.let(
             latest_allowable_version&.to_s,
             T.nilable(String)
           )
-          @lock_ruby_version = T.let(lock_ruby_version, T::Boolean)
+          @lock_ruby_version = lock_ruby_version
         end
 
         # rubocop:disable Metrics/AbcSize
@@ -273,20 +273,20 @@ module Dependabot
         sig { params(filename: String).returns(String) }
         def updated_version_req_lower_bound(filename) # rubocop:disable Metrics/CyclomaticComplexity
           original_req = dependency.requirements
-                                   .find { |r| r.fetch(:file) == filename }
-                                   &.fetch(:requirement)
+                                   .find { |r| r.file == filename }
+                                   &.requirement_string
 
           if original_req && !unlock_requirement? then original_req
           elsif dependency.version&.match?(/^[0-9a-f]{40}$/) then ">= 0"
           elsif dependency.version then ">= #{dependency.version}"
           else
             version_for_requirement =
-              dependency.requirements.map { |r| r[:requirement] }
-                                     .reject { |req_string| req_string.start_with?("<") }
-                                     .select { |req_string| req_string.match?(VERSION_REGEX) }
-                                     .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
-                                     .select { |version| Bundler::Version.correct?(version) }
-                                     .max_by { |version| Bundler::Version.new(version) }
+              dependency.requirements.filter_map(&:requirement_string)
+                        .reject { |req_string| req_string.start_with?("<") }
+                        .select { |req_string| req_string.match?(VERSION_REGEX) }
+                        .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
+                        .select { |version| Bundler::Version.correct?(version) }
+                        .max_by { |version| Bundler::Version.new(version) }
 
             ">= #{version_for_requirement || 0}"
           end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -94,7 +94,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         sig { returns(T::Array[Dependabot::Dependency]) }
         def force_update
-          requirement = dependency.requirements.find { |req| req[:file] == T.must(gemfile).name }
+          requirement = dependency.requirements.find { |req| req.file == T.must(gemfile).name }
 
           valid_gem_version?(target_version)
 
@@ -192,11 +192,11 @@ module Dependabot
           )
         end
 
-        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
         def source_for(dependency)
           dependency.requirements
-                    .find { |r| r.fetch(:source) }
-                    &.fetch(:source)
+                    .find(&:source)
+                    &.source_hash
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -85,8 +85,10 @@ module Dependabot
             return unless git?
 
             source_details =
-              dependency.requirements.map { |r| r.fetch(:source) }
-                                     .uniq.compact.first
+              T.must(
+                dependency.requirements.map(&:source_hash)
+                                                     .uniq.compact.first
+              )
 
             SharedHelpers.with_git_configured(credentials: credentials) do
               in_a_native_bundler_context do |tmp_dir|

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -128,7 +128,7 @@ module Dependabot
             begin
               current_version = dependency.numeric_version
               current_version&.prerelease? || dependency.requirements.any? do |req|
-                req[:requirement].match?(/[a-z]/i)
+                T.must(req.requirement_string).match?(/[a-z]/i)
               end
             end,
             T.nilable(T::Boolean)

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -28,7 +28,7 @@ module Dependabot
           params(
             requirements: T::Array[Dependabot::DependencyRequirement],
             update_strategy: Dependabot::RequirementsUpdateStrategy,
-            updated_source: T.nilable(T::Hash[Symbol, T.untyped]),
+            updated_source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
             latest_version: T.nilable(String),
             latest_resolvable_version: T.nilable(String)
           ).void
@@ -66,7 +66,7 @@ module Dependabot
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            if req[:file].include?(".gemspec")
+            if T.must(req.file).include?(".gemspec")
               update_gemspec_requirement(req)
             else
               # If a requirement doesn't come from a gemspec, it must be from
@@ -81,7 +81,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
         attr_reader :updated_source
 
         sig { returns(T.nilable(Dependabot::Bundler::Version)) }
@@ -124,13 +124,14 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement(req)
           requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
+            T.must(req.requirement_string).split(",").map { |r| Gem::Requirement.new(r) }
 
           new_requirement =
-            if requirements.any?(&:exact?) then latest_resolvable_version.to_s
+            if requirements.any?(&:exact?)
+              latest_resolvable_version.to_s
             elsif requirements.any? { |r| r.to_s.start_with?("~>") }
               tw_req = requirements.find { |r| r.to_s.start_with?("~>") }
-              update_twiddle_version(tw_req, T.must(latest_resolvable_version)).to_s
+              update_twiddle_version(T.must(tw_req), T.must(latest_resolvable_version)).to_s
             else
               update_gemfile_range(requirements).join(", ")
             end
@@ -185,21 +186,22 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_gemspec_requirement(req)
-          req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source)) if req.fetch(:source)
+          req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source)) if req.source
           return req unless latest_version && latest_resolvable_version
 
           requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
+            T.must(req.requirement_string).split(",").map { |r| Gem::Requirement.new(r) }
+          groups = T.must(req.groups).map(&:to_s)
 
           return req if requirements.all? do |r|
-            requirement_satisfied?(r, req[:groups])
+            requirement_satisfied?(r, groups)
           end
 
           updated_requirements =
             requirements.flat_map do |r|
-              next r if requirement_satisfied?(r, req[:groups])
+              next r if requirement_satisfied?(r, groups)
 
-              if req[:groups] == ["development"] then bumped_requirements(r)
+              if groups == ["development"] then bumped_requirements(r)
               else
                 widened_requirements(r)
               end

data/lib/dependabot/bundler/update_checker.rb

@@ -102,7 +102,7 @@ module Dependabot
 
         dependency.specific_requirements
                   .all? do |req|
-          file = T.must(dependency_files.find { |f| f.name == req.fetch(:file) })
+          file = T.must(dependency_files.find { |f| f.name == req.file })
           updated = FileUpdater::RequirementReplacer.new(
             dependency: dependency,
             file_type: file.name.end_with?("gemspec") ? :gemspec : :gemfile,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib