dependabot-bundler 0.95.5 → 0.95.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f9e1ea4bdd44c85509a4528e5e7c9505f878d160417b19318289dba7ff3e265
-  data.tar.gz: 629019a0bb4caa43cebea73416c3c3b18100900b85a594a913d13f230a582223
+  metadata.gz: 6f9e379564416aff2841e1bccf1b420dd167eb77fb5647b3a1741d49a8d53a67
+  data.tar.gz: 3dbbaae582caf3e6380842c6b4f893002eb5062819cd249c3a24e22dc5749b51
 SHA512:
-  metadata.gz: c50492df52a2afed07fcf87b58ea08f7ff19ffe040192cd7d64c4fc9406f8215088205ee63b872c59cf90b7206374442e5e9e362d2190633b94e98223ed84534
-  data.tar.gz: 7407105ceb6974f50db64029f81bcc5769fdc50651599db73ee667c2edd789e4ef730909ee629d8b49908226e6c972b9516450ff506ba7671345ee9a9e426a16
+  metadata.gz: d5881f87654a931b002b2db3a1a128f43fd2f378acbaff69e77710cb81ed9133b5711bc98ee2bc27c2e56feb3eb71b3dc16e2b4fdd269c41c977734239522e95
+  data.tar.gz: eb4c477200b043f59e4de9c6e468d71be947468ac7cf980d62c3828c1a528e1f25f4559c1f6fdf153fdf04208fe0c855c0cad5ed664d388b7eef3dcdaba3a9b0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.95.5
+  version: 0.95.6
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.5
+        version: 0.95.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.95.5
+        version: 0.95.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -142,41 +142,7 @@ email: support@dependabot.com
 executables: []
 extensions: []
 extra_rdoc_files: []
-files:
-- helpers/Makefile
-- helpers/build
-- lib/dependabot/bundler.rb
-- lib/dependabot/bundler/file_fetcher.rb
-- lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb
-- lib/dependabot/bundler/file_fetcher/gemspec_finder.rb
-- lib/dependabot/bundler/file_fetcher/path_gemspec_finder.rb
-- lib/dependabot/bundler/file_fetcher/require_relative_finder.rb
-- lib/dependabot/bundler/file_parser.rb
-- lib/dependabot/bundler/file_parser/file_preparer.rb
-- lib/dependabot/bundler/file_parser/gemfile_checker.rb
-- lib/dependabot/bundler/file_updater.rb
-- lib/dependabot/bundler/file_updater/gemfile_updater.rb
-- lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb
-- lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb
-- lib/dependabot/bundler/file_updater/gemspec_updater.rb
-- lib/dependabot/bundler/file_updater/git_pin_replacer.rb
-- lib/dependabot/bundler/file_updater/git_source_remover.rb
-- lib/dependabot/bundler/file_updater/lockfile_updater.rb
-- lib/dependabot/bundler/file_updater/requirement_replacer.rb
-- lib/dependabot/bundler/metadata_finder.rb
-- lib/dependabot/bundler/requirement.rb
-- lib/dependabot/bundler/update_checker.rb
-- lib/dependabot/bundler/update_checker/file_preparer.rb
-- lib/dependabot/bundler/update_checker/force_updater.rb
-- lib/dependabot/bundler/update_checker/latest_version_finder.rb
-- lib/dependabot/bundler/update_checker/requirements_updater.rb
-- lib/dependabot/bundler/update_checker/ruby_requirement_setter.rb
-- lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb
-- lib/dependabot/bundler/update_checker/version_resolver.rb
-- lib/dependabot/bundler/version.rb
-- lib/dependabot/monkey_patches/bundler/definition_bundler_version_patch.rb
-- lib/dependabot/monkey_patches/bundler/definition_ruby_version_patch.rb
-- lib/dependabot/monkey_patches/bundler/git_source_patch.rb
+files: []
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard

data/helpers/Makefile

@@ -1,9 +0,0 @@
-.PHONY = all
-
-all: darwin linux
-
-darwin:
-	GO111MODULE=on GOOS=darwin GOARCH=amd64 go build -o go-helpers.darwin64 .
-
-linux:
-	GO111MODULE=on GOOS=linux GOARCH=amd64  go build -o go-helpers.linux64 .

data/helpers/build

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-set -e
-
-install_dir=$1
-if [ -z "$install_dir" ]; then
-  echo "usage: $0 INSTALL_DIR"
-  exit 1
-fi
-
-if ! [[ "$install_dir" =~ ^/ ]]; then
-  echo "$install_dir must be an absolute path"
-  exit 1
-fi
-
-if [ ! -d "$install_dir/bin" ]; then
-  mkdir -p "$install_dir/bin"
-fi
-
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cd $helpers_dir
-
-os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-echo "building $install_dir/bin/helper"
-
-GO111MODULE=on GOOS="$os" GOARCH=amd64 go build -o "$install_dir/bin/helper" .

data/lib/dependabot/bundler.rb

@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-# These all need to be required so the various classes can be registered in a
-# lookup table of package manager names to concrete classes.
-require "dependabot/bundler/file_fetcher"
-require "dependabot/bundler/file_parser"
-require "dependabot/bundler/update_checker"
-require "dependabot/bundler/file_updater"
-require "dependabot/bundler/metadata_finder"
-require "dependabot/bundler/requirement"
-require "dependabot/bundler/version"
-
-require "dependabot/pull_request_creator/labeler"
-Dependabot::PullRequestCreator::Labeler.
-  register_label_details("bundler", name: "ruby", colour: "ce2d2d")
-
-require "dependabot/dependency"
-Dependabot::Dependency.register_production_check(
-  "bundler",
-  lambda do |groups|
-    return true if groups.empty?
-    return true if groups.include?("runtime")
-    return true if groups.include?("default")
-
-    groups.any? { |g| g.include?("prod") }
-  end
-)

data/lib/dependabot/bundler/file_fetcher.rb

@@ -1,216 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/file_fetchers"
-require "dependabot/file_fetchers/base"
-require "dependabot/bundler/file_updater/lockfile_updater"
-require "dependabot/errors"
-
-module Dependabot
-  module Bundler
-    class FileFetcher < Dependabot::FileFetchers::Base
-      require "dependabot/bundler/file_fetcher/gemspec_finder"
-      require "dependabot/bundler/file_fetcher/path_gemspec_finder"
-      require "dependabot/bundler/file_fetcher/child_gemfile_finder"
-      require "dependabot/bundler/file_fetcher/require_relative_finder"
-
-      def self.required_files_in?(filenames)
-        if filenames.any? { |name| name.match?(%r{^[^/]*\.gemspec$}) }
-          return true
-        end
-
-        filenames.include?("Gemfile") || filenames.include?("gems.rb")
-      end
-
-      def self.required_files_message
-        "Repo must contain either a Gemfile, a gemspec, or a gems.rb."
-      end
-
-      private
-
-      def fetch_files
-        fetched_files = []
-        fetched_files << gemfile if gemfile
-        fetched_files << lockfile if gemfile && lockfile
-        fetched_files += child_gemfiles
-        fetched_files += gemspecs
-        fetched_files << ruby_version_file if ruby_version_file
-        fetched_files += path_gemspecs
-        fetched_files += require_relative_files(fetched_files)
-
-        fetched_files = uniq_files(fetched_files)
-
-        check_required_files_present
-
-        unless self.class.required_files_in?(fetched_files.map(&:name))
-          raise "Invalid set of files: #{fetched_files.map(&:name)}"
-        end
-
-        fetched_files
-      end
-
-      def uniq_files(fetched_files)
-        uniq_files = fetched_files.reject(&:support_file?).uniq
-        uniq_files += fetched_files.
-                      reject { |f| uniq_files.map(&:name).include?(f.name) }
-      end
-
-      def check_required_files_present
-        return if gemfile || gemspecs.any?
-
-        path = Pathname.new(File.join(directory, "Gemfile")).
-               cleanpath.to_path
-        raise Dependabot::DependencyFileNotFound, path
-      end
-
-      def gemfile
-        @gemfile ||= fetch_file_if_present("gems.rb") ||
-                     fetch_file_if_present("Gemfile")
-      end
-
-      def lockfile
-        @lockfile ||= fetch_file_if_present("gems.locked") ||
-                      fetch_file_if_present("Gemfile.lock")
-      end
-
-      def gemspecs
-        return @gemspecs if defined?(@gemspecs)
-
-        gemspecs_paths =
-          gemspec_directories.
-          flat_map do |d|
-            repo_contents(dir: d).
-              select { |f| f.name.end_with?(".gemspec") }.
-              map { |f| File.join(d, f.name) }
-          end
-
-        @gemspecs = gemspecs_paths.map { |n| fetch_file_from_host(n) }
-      rescue Octokit::NotFound
-        []
-      end
-
-      def gemspec_directories
-        gemfiles = ([gemfile] + child_gemfiles).compact
-        directories =
-          gemfiles.flat_map do |file|
-            GemspecFinder.new(gemfile: file).gemspec_directories
-          end.uniq
-
-        directories.empty? ? ["."] : directories
-      end
-
-      def ruby_version_file
-        return unless gemfile
-        return unless gemfile.content.include?(".ruby-version")
-
-        @ruby_version_file ||=
-          fetch_file_if_present(".ruby-version")&.
-          tap { |f| f.support_file = true }
-      end
-
-      def path_gemspecs
-        gemspec_files = []
-        unfetchable_gems = []
-
-        path_gemspec_paths.each do |path|
-          # Get any gemspecs at the path itself
-          gemspecs_at_path = fetch_gemspecs_from_directory(path)
-
-          # Get any gemspecs nested one level deeper
-          nested_directories =
-            repo_contents(dir: path).
-            select { |f| f.type == "dir" }
-
-          nested_directories.each do |dir|
-            dir_path = File.join(path, dir.name)
-            gemspecs_at_path += fetch_gemspecs_from_directory(dir_path)
-          end
-
-          # Add the fetched gemspecs to the main array, and note an error if
-          # none were found for this path
-          gemspec_files += gemspecs_at_path
-          unfetchable_gems << path.basename.to_s if gemspecs_at_path.empty?
-        rescue Octokit::NotFound, Gitlab::Error::NotFound
-          unfetchable_gems << path.basename.to_s
-        end
-
-        if unfetchable_gems.any?
-          raise Dependabot::PathDependenciesNotReachable, unfetchable_gems
-        end
-
-        gemspec_files.tap { |ar| ar.each { |f| f.support_file = true } }
-      end
-
-      def path_gemspec_paths
-        fetch_path_gemspec_paths.map { |path| Pathname.new(path) }
-      end
-
-      def require_relative_files(files)
-        ruby_files =
-          files.select { |f| f.name.end_with?(".rb", "Gemfile", ".gemspec") }
-
-        paths = ruby_files.flat_map do |file|
-          RequireRelativeFinder.new(file: file).require_relative_paths
-        end
-
-        @require_relative_files ||=
-          paths.map { |path| fetch_file_from_host(path) }.
-          tap { |req_files| req_files.each { |f| f.support_file = true } }
-      end
-
-      def fetch_gemspecs_from_directory(dir_path)
-        repo_contents(dir: dir_path, fetch_submodules: true).
-          select { |f| f.name.end_with?(".gemspec") }.
-          map { |f| File.join(dir_path, f.name) }.
-          map { |fp| fetch_file_from_host(fp, fetch_submodules: true) }
-      end
-
-      def fetch_path_gemspec_paths
-        if lockfile
-          parsed_lockfile = ::Bundler::LockfileParser.new(
-            sanitized_lockfile_content
-          )
-          parsed_lockfile.specs.
-            select { |s| s.source.instance_of?(::Bundler::Source::Path) }.
-            map { |s| s.source.path }.uniq
-        else
-          gemfiles = ([gemfile] + child_gemfiles).compact
-          gemfiles.flat_map do |file|
-            PathGemspecFinder.new(gemfile: file).path_gemspec_paths
-          end.uniq
-        end
-      rescue ::Bundler::LockfileError
-        raise Dependabot::DependencyFileNotParseable, lockfile.path
-      end
-
-      def child_gemfiles
-        return [] unless gemfile
-
-        @child_gemfiles ||=
-          fetch_child_gemfiles(file: gemfile, previously_fetched_files: [])
-      end
-
-      def sanitized_lockfile_content
-        regex = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
-        lockfile.content.gsub(regex, "")
-      end
-
-      def fetch_child_gemfiles(file:, previously_fetched_files:)
-        paths = ChildGemfileFinder.new(gemfile: file).child_gemfile_paths
-
-        paths.flat_map do |path|
-          next if previously_fetched_files.map(&:name).include?(path)
-          next if file.name == path
-
-          fetched_file = fetch_file_from_host(path)
-          grandchild_gemfiles = fetch_child_gemfiles(
-            file: fetched_file,
-            previously_fetched_files: previously_fetched_files + [file]
-          )
-          [fetched_file, *grandchild_gemfiles]
-        end.compact
-      end
-    end
-  end
-end
-
-Dependabot::FileFetchers.register("bundler", Dependabot::Bundler::FileFetcher)

data/lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-require "pathname"
-require "parser/current"
-require "dependabot/bundler/file_fetcher"
-require "dependabot/errors"
-
-module Dependabot
-  module Bundler
-    class FileFetcher
-      # Finds the paths of any Gemfiles declared using `eval_gemfile` in the
-      # passed Gemfile.
-      class ChildGemfileFinder
-        def initialize(gemfile:)
-          @gemfile = gemfile
-        end
-
-        def child_gemfile_paths
-          ast = Parser::CurrentRuby.parse(gemfile.content)
-          find_child_gemfile_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, gemfile.path
-        end
-
-        private
-
-        attr_reader :gemfile
-
-        # rubocop:disable Security/Eval
-        def find_child_gemfile_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
-
-          if declares_eval_gemfile?(node)
-            # We use eval here, but we know what we're doing. The FileFetchers
-            # helper method should only ever be run in an isolated environment
-            source = node.children[2].loc.expression.source
-            begin
-              path = eval(source)
-            rescue StandardError
-              return []
-            end
-            if Pathname.new(path).absolute?
-              base_path = Pathname.new(File.expand_path(Dir.pwd))
-              path = Pathname.new(path).relative_path_from(base_path).to_s
-            end
-            path = File.join(current_dir, path) unless current_dir.nil?
-            return [Pathname.new(path).cleanpath.to_path]
-          end
-
-          node.children.flat_map do |child_node|
-            find_child_gemfile_paths(child_node)
-          end
-        end
-        # rubocop:enable Security/Eval
-
-        def current_dir
-          @current_dir ||= gemfile.name.split("/")[0..-2].last
-        end
-
-        def declares_eval_gemfile?(node)
-          return false unless node.is_a?(Parser::AST::Node)
-
-          node.children[1] == :eval_gemfile
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/bundler/file_fetcher/gemspec_finder.rb

@@ -1,96 +0,0 @@
-# frozen_string_literal: true
-
-require "pathname"
-require "parser/current"
-require "dependabot/bundler/file_fetcher"
-require "dependabot/errors"
-
-module Dependabot
-  module Bundler
-    class FileFetcher
-      # Finds the directories of any gemspecs declared using `gemspec` in the
-      # passed Gemfile.
-      class GemspecFinder
-        def initialize(gemfile:)
-          @gemfile = gemfile
-        end
-
-        def gemspec_directories
-          ast = Parser::CurrentRuby.parse(gemfile.content)
-          find_gemspec_paths(ast)
-        rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, gemfile.path
-        end
-
-        private
-
-        attr_reader :gemfile
-
-        # rubocop:disable Security/Eval
-        def find_gemspec_paths(node)
-          return [] unless node.is_a?(Parser::AST::Node)
-
-          if declares_gemspec_dependency?(node)
-            path_node = path_node_for_gem_declaration(node)
-            return [clean_path(".")] unless path_node
-
-            begin
-              # We use eval here, but we know what we're doing. The
-              # FileFetchers helper method should only ever be run in an
-              # isolated environment
-              path = eval(path_node.loc.expression.source)
-            rescue StandardError
-              return []
-            end
-            return [clean_path(path)]
-          end
-
-          node.children.flat_map do |child_node|
-            find_gemspec_paths(child_node)
-          end
-        end
-        # rubocop:enable Security/Eval
-
-        def current_dir
-          @current_dir ||= gemfile.name.rpartition("/").first
-          @current_dir = nil if @current_dir == ""
-          @current_dir
-        end
-
-        def declares_gemspec_dependency?(node)
-          return false unless node.is_a?(Parser::AST::Node)
-
-          node.children[1] == :gemspec
-        end
-
-        def clean_path(path)
-          if Pathname.new(path).absolute?
-            base_path = Pathname.new(File.expand_path(Dir.pwd))
-            path = Pathname.new(path).relative_path_from(base_path).to_s
-          end
-          path = File.join(current_dir, path) unless current_dir.nil?
-          Pathname.new(path).cleanpath
-        end
-
-        def path_node_for_gem_declaration(node)
-          return unless node.children.last.is_a?(Parser::AST::Node)
-          return unless node.children.last.type == :hash
-
-          kwargs_node = node.children.last
-
-          path_hash_pair =
-            kwargs_node.children.
-            find { |hash_pair| key_from_hash_pair(hash_pair) == :path }
-
-          return unless path_hash_pair
-
-          path_hash_pair.children.last
-        end
-
-        def key_from_hash_pair(node)
-          node.children.first.children.first.to_sym
-        end
-      end
-    end
-  end
-end