dependabot-bundler 0.95.5 → 0.95.6

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -1,259 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/monkey_patches/bundler/definition_ruby_version_patch"
-require "dependabot/monkey_patches/bundler/definition_bundler_version_patch"
-require "dependabot/monkey_patches/bundler/git_source_patch"
-
-require "dependabot/bundler/update_checker"
-require "dependabot/bundler/update_checker/requirements_updater"
-require "dependabot/bundler/file_updater/lockfile_updater"
-require "dependabot/bundler/file_parser"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
-
-module Dependabot
-  module Bundler
-    class UpdateChecker
-      class ForceUpdater
-        def initialize(dependency:, dependency_files:, credentials:,
-                       target_version:, requirements_update_strategy:)
-          @dependency                   = dependency
-          @dependency_files             = dependency_files
-          @credentials                  = credentials
-          @target_version               = target_version
-          @requirements_update_strategy = requirements_update_strategy
-        end
-
-        def updated_dependencies
-          @updated_dependencies ||= force_update
-        end
-
-        private
-
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :target_version, :requirements_update_strategy
-
-        def force_update
-          in_a_temporary_bundler_context do
-            other_updates = []
-
-            begin
-              definition = build_definition(other_updates: other_updates)
-              definition.resolve_remotely!
-              specs = definition.resolve
-              dependencies_from([dependency] + other_updates, specs)
-            rescue ::Bundler::VersionConflict => error
-              # TODO: Not sure this won't unlock way too many things...
-              new_dependencies_to_unlock =
-                new_dependencies_to_unlock_from(
-                  error: error,
-                  already_unlocked: other_updates
-                )
-
-              raise if new_dependencies_to_unlock.none?
-
-              other_updates += new_dependencies_to_unlock
-              retry
-            end
-          end
-        rescue SharedHelpers::ChildProcessFailed => error
-          raise_unresolvable_error(error)
-        end
-
-        #########################
-        # Bundler context setup #
-        #########################
-
-        def in_a_temporary_bundler_context
-          SharedHelpers.in_a_temporary_directory do
-            write_temporary_dependency_files
-
-            SharedHelpers.in_a_forked_process do
-              # Remove installed gems from the default Rubygems index
-              ::Gem::Specification.all = []
-
-              # Set auth details
-              relevant_credentials.each do |cred|
-                token = cred["token"] ||
-                        "#{cred['username']}:#{cred['password']}"
-
-                ::Bundler.settings.set_command_option(
-                  cred.fetch("host"),
-                  token.gsub("@", "%40F").gsub("?", "%3F")
-                )
-              end
-
-              # Only allow upgrades. Othewise it's unlikely that this
-              # resolution will be found by the FileUpdater
-              ::Bundler.settings.set_command_option(
-                "only_update_to_newer_versions",
-                true
-              )
-
-              yield
-            end
-          end
-        end
-
-        def new_dependencies_to_unlock_from(error:, already_unlocked:)
-          potentials_deps =
-            error.cause.conflicts.values.
-            flat_map(&:requirement_trees).
-            reject do |tree|
-              next true unless tree.last.requirement.specific?
-              next false unless tree.last.name == dependency.name
-
-              tree.last.requirement.satisfied_by?(
-                Gem::Version.new(target_version)
-              )
-            end.map(&:first)
-
-          potentials_deps.
-            reject { |dep| already_unlocked.map(&:name).include?(dep.name) }.
-            reject { |dep| [dependency.name, "ruby\0"].include?(dep.name) }.
-            uniq
-        end
-
-        def raise_unresolvable_error(error)
-          msg = error.error_class + " with message: " + error.error_message
-          raise Dependabot::DependencyFileNotResolvable, msg
-        end
-
-        def build_definition(other_updates:)
-          gems_to_unlock = other_updates.map(&:name) + [dependency.name]
-          definition = ::Bundler::Definition.build(
-            gemfile.name,
-            lockfile&.name,
-            gems: gems_to_unlock + subdependencies,
-            lock_shared_dependencies: true
-          )
-
-          # Remove the Gemfile / gemspec requirements on the gems we're
-          # unlocking (i.e., completely unlock them)
-          gems_to_unlock.each do |gem_name|
-            unlock_gem(definition: definition, gem_name: gem_name)
-          end
-
-          # Set the requirement for the gem we're forcing an update of
-          new_req = Gem::Requirement.create("= #{target_version}")
-          definition.dependencies.
-            find { |d| d.name == dependency.name }.
-            instance_variable_set(:@requirement, new_req)
-
-          definition
-        end
-
-        def subdependencies
-          # If there's no lockfile we don't need to worry about
-          # subdependencies
-          return [] unless lockfile
-
-          all_deps =  ::Bundler::LockfileParser.new(sanitized_lockfile_body).
-                      specs.map(&:name).map(&:to_s)
-          top_level = ::Bundler::Definition.
-                      build(gemfile.name, lockfile.name, {}).
-                      dependencies.map(&:name).map(&:to_s)
-
-          all_deps - top_level
-        end
-
-        def unlock_gem(definition:, gem_name:)
-          dep = definition.dependencies.find { |d| d.name == gem_name }
-          version = definition.locked_gems.specs.
-                    find { |d| d.name == gem_name }.version
-
-          dep&.instance_variable_set(
-            :@requirement,
-            Gem::Requirement.create(">= #{version}")
-          )
-        end
-
-        def original_dependencies
-          @original_dependencies ||=
-            FileParser.new(
-              dependency_files: dependency_files,
-              credentials: credentials,
-              source: nil
-            ).parse
-        end
-
-        def dependencies_from(updated_deps, specs)
-          # You might think we'd want to remove dependencies whose version
-          # hadn't changed from this array. We don't. We still need to unlock
-          # them to get Bundler to resolve, because unlocking them is what
-          # updates their subdependencies.
-          #
-          # This is kind of a bug in Bundler, and we should try to fix it,
-          # but resolving it won't necessarily be easy.
-          updated_deps.map do |dep|
-            original_dep =
-              original_dependencies.find { |d| d.name == dep.name }
-            spec = specs.find { |d| d.name == dep.name }
-
-            next if spec.version.to_s == original_dep.version
-
-            build_dependency(original_dep, spec)
-          end.compact
-        end
-
-        def build_dependency(original_dep, updated_spec)
-          Dependency.new(
-            name: updated_spec.name,
-            version: updated_spec.version.to_s,
-            requirements:
-              RequirementsUpdater.new(
-                requirements: original_dep.requirements,
-                update_strategy: requirements_update_strategy,
-                updated_source: source_for(original_dep),
-                latest_version: updated_spec.version.to_s,
-                latest_resolvable_version: updated_spec.version.to_s
-              ).updated_requirements,
-            previous_version: original_dep.version,
-            previous_requirements: original_dep.requirements,
-            package_manager: original_dep.package_manager
-          )
-        end
-
-        def source_for(dependency)
-          dependency.requirements.
-            find { |r| r.fetch(:source) }&.
-            fetch(:source)
-        end
-
-        def gemfile
-          dependency_files.find { |f| f.name == "Gemfile" } ||
-            dependency_files.find { |f| f.name == "gems.rb" }
-        end
-
-        def lockfile
-          dependency_files.find { |f| f.name == "Gemfile.lock" } ||
-            dependency_files.find { |f| f.name == "gems.locked" }
-        end
-
-        def sanitized_lockfile_body
-          re = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
-          lockfile.content.gsub(re, "")
-        end
-
-        def write_temporary_dependency_files
-          dependency_files.each do |file|
-            path = file.name
-            FileUtils.mkdir_p(Pathname.new(path).dirname)
-            File.write(path, file.content)
-          end
-
-          File.write(lockfile.name, sanitized_lockfile_body) if lockfile
-        end
-
-        def relevant_credentials
-          credentials.select do |cred|
-            next true if cred["type"] == "git_source"
-            next true if cred["type"] == "rubygems_server"
-
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -1,165 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/monkey_patches/bundler/definition_ruby_version_patch"
-require "dependabot/monkey_patches/bundler/definition_bundler_version_patch"
-require "dependabot/monkey_patches/bundler/git_source_patch"
-
-require "excon"
-
-require "dependabot/bundler/update_checker"
-require "dependabot/bundler/requirement"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
-
-module Dependabot
-  module Bundler
-    class UpdateChecker
-      class LatestVersionFinder
-        require_relative "shared_bundler_helpers"
-        include SharedBundlerHelpers
-
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @dependency_files = dependency_files
-          @credentials      = credentials
-          @ignored_versions = ignored_versions
-        end
-
-        def latest_version_details
-          @latest_version_details ||= fetch_latest_version_details
-        end
-
-        private
-
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions
-
-        def fetch_latest_version_details
-          return latest_rubygems_version_details if dependency.name == "bundler"
-
-          case dependency_source
-          when NilClass then latest_rubygems_version_details
-          when ::Bundler::Source::Rubygems
-            if dependency_source.remotes.none? ||
-               dependency_source.remotes.first.to_s == "https://rubygems.org/"
-              latest_rubygems_version_details
-            else
-              latest_private_version_details
-            end
-          when ::Bundler::Source::Git then latest_git_version_details
-          end
-        end
-
-        def latest_rubygems_version_details
-          response = Excon.get(
-            "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
-            idempotent: true,
-            **SharedHelpers.excon_defaults
-          )
-
-          relevant_versions =
-            JSON.parse(response.body).
-            reject do |d|
-              version = Gem::Version.new(d["number"])
-              next true if version.prerelease? && !wants_prerelease?
-              next true if ignore_reqs.any? { |r| r.satisfied_by?(version) }
-
-              false
-            end
-
-          dep = relevant_versions.max_by { |d| Gem::Version.new(d["number"]) }
-          return unless dep
-
-          {
-            version: Gem::Version.new(dep["number"]),
-            sha: dep["sha"]
-          }
-        rescue JSON::ParserError, Excon::Error::Timeout
-          nil
-        end
-
-        def latest_private_version_details
-          in_a_temporary_bundler_context do
-            spec =
-              dependency_source.
-              fetchers.flat_map do |fetcher|
-                fetcher.
-                  specs_with_retry([dependency.name], dependency_source).
-                  search_all(dependency.name).
-                  reject { |s| s.version.prerelease? && !wants_prerelease? }.
-                  reject do |s|
-                    ignore_reqs.any? { |r| r.satisfied_by?(s.version) }
-                  end
-              end.
-              max_by(&:version)
-            spec.nil? ? nil : { version: spec.version }
-          end
-        end
-
-        def latest_git_version_details
-          dependency_source_details =
-            dependency.requirements.map { |r| r.fetch(:source) }.
-            uniq.compact.first
-
-          in_a_temporary_bundler_context do
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              # Note: we don't set `ref`, as we want to unpin the dependency
-              source = ::Bundler::Source::Git.new(
-                "uri" => dependency_source_details[:url],
-                "branch" => dependency_source_details[:branch],
-                "name" => dependency.name,
-                "submodules" => true
-              )
-
-              # Tell Bundler we're fine with fetching the source remotely
-              source.instance_variable_set(:@allow_remote, true)
-
-              spec = source.specs.first
-              { version: spec.version, commit_sha: spec.source.revision }
-            end
-          end
-        end
-
-        def wants_prerelease?
-          @wants_prerelease ||=
-            begin
-              current_version = dependency.version
-              if current_version && Gem::Version.correct?(current_version) &&
-                 Gem::Version.new(current_version).prerelease?
-                return true
-              end
-
-              dependency.requirements.any? do |req|
-                req[:requirement].match?(/[a-z]/i)
-              end
-            end
-        end
-
-        def dependency_source
-          return nil unless gemfile
-
-          @dependency_source ||=
-            in_a_temporary_bundler_context do
-              definition = ::Bundler::Definition.build(gemfile.name, nil, {})
-
-              specified_source =
-                definition.dependencies.
-                find { |dep| dep.name == dependency.name }&.source
-
-              specified_source || definition.send(:sources).default_source
-            end
-        end
-
-        def ignore_reqs
-          ignored_versions.map { |req| Gem::Requirement.new(req.split(",")) }
-        end
-
-        def gemfile
-          dependency_files.find { |f| f.name == "Gemfile" } ||
-            dependency_files.find { |f| f.name == "gems.rb" }
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -1,281 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/bundler/update_checker"
-
-module Dependabot
-  module Bundler
-    class UpdateChecker
-      class RequirementsUpdater
-        class UnfixableRequirement < StandardError; end
-
-        ALLOWED_UPDATE_STRATEGIES =
-          %i(bump_versions bump_versions_if_necessary).freeze
-
-        def initialize(requirements:, update_strategy:, updated_source:,
-                       latest_version:, latest_resolvable_version:)
-          @requirements = requirements
-          @latest_version = Gem::Version.new(latest_version) if latest_version
-          @updated_source = updated_source
-          @update_strategy = update_strategy
-
-          check_update_strategy
-
-          return unless latest_resolvable_version
-
-          @latest_resolvable_version =
-            Gem::Version.new(latest_resolvable_version)
-        end
-
-        def updated_requirements
-          requirements.map do |req|
-            if req[:file].match?(/\.gemspec/)
-              update_gemspec_requirement(req)
-            else
-              # If a requirement doesn't come from a gemspec, it must be from
-              # a Gemfile.
-              update_gemfile_requirement(req)
-            end
-          end
-        end
-
-        private
-
-        attr_reader :requirements, :updated_source,
-                    :latest_version, :latest_resolvable_version,
-                    :update_strategy
-
-        def check_update_strategy
-          return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
-
-          raise "Unknown update strategy: #{update_strategy}"
-        end
-
-        def update_gemfile_requirement(req)
-          req = req.merge(source: updated_source)
-          return req unless latest_resolvable_version
-
-          case update_strategy
-          when :bump_versions
-            update_version_requirement(req)
-          when :bump_versions_if_necessary
-            update_version_requirement_if_needed(req)
-          else raise "Unexpected update strategy: #{update_strategy}"
-          end
-        end
-
-        def update_version_requirement_if_needed(req)
-          return req if new_version_satisfies?(req)
-
-          update_version_requirement(req)
-        end
-
-        def update_version_requirement(req)
-          requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
-
-          new_requirement =
-            if requirements.any?(&:exact?) then latest_resolvable_version.to_s
-            elsif requirements.any? { |r| r.to_s.start_with?("~>") }
-              tw_req = requirements.find { |r| r.to_s.start_with?("~>") }
-              update_twiddle_version(tw_req, latest_resolvable_version).to_s
-            else
-              update_gemfile_range(requirements).map(&:to_s).join(", ")
-            end
-
-          req.merge(requirement: new_requirement)
-        end
-
-        def new_version_satisfies?(req)
-          original_req = Gem::Requirement.new(req[:requirement].split(","))
-          original_req.satisfied_by?(latest_resolvable_version)
-        end
-
-        def update_gemfile_range(requirements)
-          updated_requirements =
-            requirements.flat_map do |r|
-              next r if r.satisfied_by?(latest_resolvable_version)
-
-              case op = r.requirements.first.first
-              when "<", "<="
-                [update_greatest_version(r, latest_resolvable_version)]
-              when "!="
-                []
-              else
-                raise "Unexpected operation for unsatisfied Gemfile "\
-                      "requirement: #{op}"
-              end
-            end
-
-          binding_requirements(updated_requirements)
-        end
-
-        def at_same_precision(new_version, old_version)
-          release_precision =
-            old_version.to_s.split(".").select { |i| i.match?(/^\d+$/) }.count
-          prerelease_precision =
-            old_version.to_s.split(".").count - release_precision
-
-          new_release =
-            new_version.to_s.split(".").first(release_precision)
-          new_prerelease =
-            new_version.to_s.split(".").
-            drop_while { |i| i.match?(/^\d+$/) }.
-            first([prerelease_precision, 1].max)
-
-          [*new_release, *new_prerelease].join(".")
-        end
-
-        # rubocop:disable Metrics/PerceivedComplexity
-        def update_gemspec_requirement(req)
-          return req unless latest_version && latest_resolvable_version
-
-          requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
-
-          return req if requirements.all? do |r|
-            requirement_satisfied?(r, req[:groups])
-          end
-
-          updated_requirements =
-            requirements.flat_map do |r|
-              next r if requirement_satisfied?(r, req[:groups])
-
-              if req[:groups] == ["development"] then bumped_requirements(r)
-              else widened_requirements(r)
-              end
-            end
-
-          updated_requirements = binding_requirements(updated_requirements)
-          req.merge(requirement: updated_requirements.map(&:to_s).join(", "))
-        rescue UnfixableRequirement
-          req.merge(requirement: :unfixable)
-        end
-        # rubocop:enable Metrics/PerceivedComplexity
-
-        def requirement_satisfied?(req, groups)
-          if groups == ["development"]
-            req.satisfied_by?(latest_resolvable_version)
-          else
-            req.satisfied_by?(latest_version)
-          end
-        end
-
-        def binding_requirements(requirements)
-          grouped_by_operator =
-            requirements.group_by { |r| r.requirements.first.first }
-
-          binding_reqs = grouped_by_operator.flat_map do |operator, reqs|
-            case operator
-            when "<", "<=" then reqs.min_by { |r| r.requirements.first.last }
-            when ">", ">=" then reqs.max_by { |r| r.requirements.first.last }
-            else requirements
-            end
-          end.uniq
-
-          binding_reqs << Gem::Requirement.new if binding_reqs.empty?
-          binding_reqs.sort_by { |r| r.requirements.first.last }
-        end
-
-        def widened_requirements(req)
-          op, version = req.requirements.first
-
-          case op
-          when "=", nil
-            if version < latest_resolvable_version
-              [Gem::Requirement.new("#{op} #{latest_resolvable_version}")]
-            else
-              req
-            end
-          when "<", "<=" then [update_greatest_version(req, latest_version)]
-          when "~>" then convert_twidle_to_range(req, latest_version)
-          when "!=" then []
-          when ">", ">=" then raise UnfixableRequirement
-          else raise "Unexpected operation for requirement: #{op}"
-          end
-        end
-
-        def bumped_requirements(req)
-          op, version = req.requirements.first
-
-          case op
-          when "=", nil
-            if version < latest_resolvable_version
-              [Gem::Requirement.new("#{op} #{latest_resolvable_version}")]
-            else
-              req
-            end
-          when "~>"
-            [update_twiddle_version(req, latest_resolvable_version)]
-          when "<", "<=" then [update_greatest_version(req, latest_version)]
-          when "!=" then []
-          when ">", ">=" then raise UnfixableRequirement
-          else raise "Unexpected operation for requirement: #{op}"
-          end
-        end
-
-        # rubocop:disable Metrics/AbcSize
-        def convert_twidle_to_range(requirement, version_to_be_permitted)
-          version = requirement.requirements.first.last
-          version = version.release if version.prerelease?
-
-          index_to_update = [version.segments.count - 2, 0].max
-
-          ub_segments = version_to_be_permitted.segments
-          ub_segments << 0 while ub_segments.count <= index_to_update
-          ub_segments = ub_segments[0..index_to_update]
-          ub_segments[index_to_update] += 1
-
-          lb_segments = version.segments
-          lb_segments.pop while lb_segments.any? && lb_segments.last.zero?
-
-          if lb_segments.none?
-            return [Gem::Requirement.new("< #{ub_segments.join('.')}")]
-          end
-
-          # Ensure versions have the same length as each other (cosmetic)
-          length = [lb_segments.count, ub_segments.count].max
-          lb_segments.fill(0, lb_segments.count...length)
-          ub_segments.fill(0, ub_segments.count...length)
-
-          [
-            Gem::Requirement.new(">= #{lb_segments.join('.')}"),
-            Gem::Requirement.new("< #{ub_segments.join('.')}")
-          ]
-        end
-        # rubocop:enable Metrics/AbcSize
-
-        # Updates the version in a "~>" constraint to allow the given version
-        def update_twiddle_version(requirement, version_to_be_permitted)
-          old_version = requirement.requirements.first.last
-          updated_v = at_same_precision(version_to_be_permitted, old_version)
-          Gem::Requirement.new("~> #{updated_v}")
-        end
-
-        # Updates the version in a "<" or "<=" constraint to allow the given
-        # version
-        def update_greatest_version(requirement, version_to_be_permitted)
-          if version_to_be_permitted.is_a?(String)
-            version_to_be_permitted =
-              Gem::Version.new(version_to_be_permitted)
-          end
-          op, version = requirement.requirements.first
-          version = version.release if version.prerelease?
-
-          index_to_update =
-            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
-
-          new_segments = version.segments.map.with_index do |_, index|
-            if index < index_to_update
-              version_to_be_permitted.segments[index]
-            elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
-            else 0
-            end
-          end
-
-          Gem::Requirement.new("#{op} #{new_segments.join('.')}")
-        end
-      end
-    end
-  end
-end