dependabot-bundler 0.103.3 → 0.104.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 214bad1306bd5538779ee55ebeeb76af02b308953e71fe653d7a63b673c2dd3c
-  data.tar.gz: 47e3c1131ef1081a2ef05c7cd999c03520a2379864e387d459a875fff67bef46
+  metadata.gz: b3955c8a3cb5756607028ee4f13ca8ffd2f8578f9b4c5b247fc56ccc7f4865d2
+  data.tar.gz: 5b18aa92559e79eab68c4f70e39213ed32aee3e6324ce0f7acf38693d7f0c4b3
 SHA512:
-  metadata.gz: 52b483b4826f43a8c7df4f3cd063078928549ec89c412cea2767287a66ff11ae571657fecf1b1dc3f2603e8db184bb3a6895cf9ddfaa205d64611a04595172e6
-  data.tar.gz: f30c7a957cfc0e0dd1104a6c0b29f46c63b1adf0b1d1957dce8a5eaac826f8df0493adadf90e0a63d564d22e46cf5b477d815d83c7a2e5a16df1eea5035626fa
+  metadata.gz: dadadec7982214f33fadacc7708b0a238b62ef1fc64d07cf2de1600194c0a28fc179d45909f98ae96e37012f26f5a5d151f310560e2b20bccb36b0a60e634c07
+  data.tar.gz: d8ad86d4c6899e16442f021fe69d9aaf4bfc15703ae5bc8609c4e032603cb243e35af7518e4d48d0cd21236ef23a42fc9adb80d9ff55d721fe87d1d29e983b3f

data/lib/dependabot/bundler/update_checker.rb

@@ -6,6 +6,7 @@ require "dependabot/bundler/file_updater/requirement_replacer"
 require "dependabot/bundler/version"
 require "dependabot/git_commit_checker"
 
+# rubocop:disable Metrics/ClassLength
 module Dependabot
   module Bundler
     class UpdateChecker < Dependabot::UpdateCheckers::Base
@@ -27,6 +28,18 @@ module Dependabot
         latest_resolvable_version_details&.fetch(:version)
       end
 
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+        return latest_resolvable_version if git_dependency?
+
+        lowest_fix =
+          latest_version_finder(remove_git_source: false).
+          lowest_security_fix_version
+        return unless lowest_fix
+
+        resolvable?(lowest_fix) ? lowest_fix : latest_resolvable_version
+      end
+
       def latest_resolvable_version_with_no_unlock
         current_ver = dependency.version
         return current_ver if git_dependency? && git_commit_checker.pinned?
@@ -63,18 +76,15 @@ module Dependabot
             updated_source: updated_source,
             latest_version: latest_version_details&.fetch(:version)&.to_s,
             latest_resolvable_version:
-              latest_resolvable_version_details&.fetch(:version)&.to_s
+              preferred_resolvable_version_details&.fetch(:version)&.to_s
           ).updated_requirements
         end
       end
 
       def requirements_unlocked_or_can_be?
         dependency.requirements.
-          reject { |r| r[:requirement].nil? }.
+          select { |r| requirement_class.new(r[:requirement]).specific? }.
           all? do |req|
-            requirement = requirement_class.new(req[:requirement])
-            next true if requirement.satisfied_by?(Gem::Version.new("100000"))
-
             file = dependency_files.find { |f| f.name == req.fetch(:file) }
             updated = FileUpdater::RequirementReplacer.new(
               dependency: dependency,
@@ -118,10 +128,36 @@ module Dependabot
         force_updater.updated_dependencies
       end
 
+      def preferred_resolvable_version_details
+        if vulnerable?
+          return { version: lowest_resolvable_security_fix_version }
+        end
+
+        latest_resolvable_version_details
+      end
+
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      def resolvable?(version)
+        @resolvable ||= {}
+        @resolvable[version] ||=
+          begin
+            ForceUpdater.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              target_version: version,
+              requirements_update_strategy: requirements_update_strategy,
+              update_multiple_dependencies: false
+            ).updated_dependencies
+            true
+          rescue Dependabot::DependencyFileNotResolvable
+            false
+          end
+      end
+
       def latest_version_details(remove_git_source: false)
         @latest_version_details ||= {}
         @latest_version_details[remove_git_source] ||=
@@ -331,7 +367,8 @@ module Dependabot
               dependency: dependency,
               dependency_files: prepared_dependency_files,
               credentials: credentials,
-              ignored_versions: ignored_versions
+              ignored_versions: ignored_versions,
+              security_advisories: security_advisories
             )
           end
       end
@@ -349,6 +386,7 @@ module Dependabot
     end
   end
 end
+# rubocop:enable Metrics/ClassLength
 
 Dependabot::UpdateCheckers.
   register("bundler", Dependabot::Bundler::UpdateChecker)

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -16,12 +16,14 @@ module Dependabot
     class UpdateChecker
       class ForceUpdater
         def initialize(dependency:, dependency_files:, credentials:,
-                       target_version:, requirements_update_strategy:)
+                       target_version:, requirements_update_strategy:,
+                       update_multiple_dependencies: true)
           @dependency                   = dependency
           @dependency_files             = dependency_files
           @credentials                  = credentials
           @target_version               = target_version
           @requirements_update_strategy = requirements_update_strategy
+          @update_multiple_dependencies = update_multiple_dependencies
         end
 
         def updated_dependencies
@@ -33,6 +35,10 @@ module Dependabot
         attr_reader :dependency, :dependency_files, :credentials,
                     :target_version, :requirements_update_strategy
 
+        def update_multiple_dependencies?
+          @update_multiple_dependencies
+        end
+
         def force_update
           in_a_temporary_bundler_context do
             other_updates = []
@@ -43,6 +49,8 @@ module Dependabot
               specs = definition.resolve
               dependencies_from([dependency] + other_updates, specs)
             rescue ::Bundler::VersionConflict => e
+              raise unless update_multiple_dependencies?
+
               # TODO: Not sure this won't unlock way too many things...
               new_dependencies_to_unlock =
                 new_dependencies_to_unlock_from(

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -19,82 +19,116 @@ module Dependabot
         include SharedBundlerHelpers
 
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:)
-          @dependency       = dependency
-          @dependency_files = dependency_files
-          @credentials      = credentials
-          @ignored_versions = ignored_versions
+                       ignored_versions:, security_advisories:)
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
         end
 
         def latest_version_details
           @latest_version_details ||= fetch_latest_version_details
         end
 
+        def lowest_security_fix_version
+          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        end
+
         private
 
         attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions
+                    :ignored_versions, :security_advisories
 
         def fetch_latest_version_details
-          return latest_rubygems_version_details if dependency.name == "bundler"
-
-          case dependency_source
-          when NilClass then latest_rubygems_version_details
-          when ::Bundler::Source::Rubygems
-            if dependency_source.remotes.none? ||
-               dependency_source.remotes.first.to_s == "https://rubygems.org/"
-              latest_rubygems_version_details
-            else
-              latest_private_version_details
-            end
-          when ::Bundler::Source::Git then latest_git_version_details
+          if dependency_source.is_a?(::Bundler::Source::Git) &&
+             dependency.name != "bundler"
+            return latest_git_version_details
           end
+
+          relevant_versions = registry_versions
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+
+          relevant_versions.empty? ? nil : { version: relevant_versions.max }
         end
 
-        def latest_rubygems_version_details
-          response = Excon.get(
-            "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
-            idempotent: true,
-            **SharedHelpers.excon_defaults
-          )
+        def fetch_lowest_security_fix_version
+          return if dependency_source.is_a?(::Bundler::Source::Git)
 
-          relevant_versions =
-            JSON.parse(response.body).
-            reject do |d|
-              version = Gem::Version.new(d["number"])
-              next true if version.prerelease? && !wants_prerelease?
-              next true if ignore_reqs.any? { |r| r.satisfied_by?(version) }
+          relevant_versions = registry_versions
+          relevant_versions = filter_prerelease_versions(relevant_versions)
+          relevant_versions = filter_ignored_versions(relevant_versions)
+          relevant_versions = filter_vulnerable_versions(relevant_versions)
+          relevant_versions = filter_lower_versions(relevant_versions)
 
-              false
-            end
+          relevant_versions.min
+        end
 
-          dep = relevant_versions.max_by { |d| Gem::Version.new(d["number"]) }
-          return unless dep
+        def filter_prerelease_versions(versions_array)
+          versions_array.
+            reject { |v| v.prerelease? && !wants_prerelease? }
+        end
+
+        def filter_ignored_versions(versions_array)
+          versions_array.
+            reject { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+        end
+
+        def filter_vulnerable_versions(versions_array)
+          arr = versions_array
+
+          security_advisories.each do |advisory|
+            arr = arr.reject { |v| advisory.vulnerable?(v) }
+          end
+
+          arr
+        end
 
-          {
-            version: Gem::Version.new(dep["number"]),
-            sha: dep["sha"]
-          }
+        def filter_lower_versions(versions_array)
+          versions_array.
+            select { |version| version > Gem::Version.new(dependency.version) }
+        end
+
+        def registry_versions
+          return rubygems_versions if dependency.name == "bundler"
+          return rubygems_versions unless dependency_source
+          return [] unless dependency_source.is_a?(::Bundler::Source::Rubygems)
+
+          remote = dependency_source.remotes.first
+          return rubygems_versions if remote.nil?
+          return rubygems_versions if remote.to_s == "https://rubygems.org/"
+
+          private_registry_versions
+        end
+
+        def rubygems_versions
+          @rubygems_versions ||=
+            begin
+              response = Excon.get(
+                "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
+                idempotent: true,
+                **SharedHelpers.excon_defaults
+              )
+
+              JSON.parse(response.body).
+                map { |d| Gem::Version.new(d["number"]) }
+            end
         rescue JSON::ParserError, Excon::Error::Timeout
-          nil
+          @rubygems_versions = []
         end
 
-        def latest_private_version_details
-          in_a_temporary_bundler_context do
-            spec =
+        def private_registry_versions
+          @private_registry_versions ||=
+            in_a_temporary_bundler_context do
               dependency_source.
-              fetchers.flat_map do |fetcher|
-                fetcher.
-                  specs_with_retry([dependency.name], dependency_source).
-                  search_all(dependency.name).
-                  reject { |s| s.version.prerelease? && !wants_prerelease? }.
-                  reject do |s|
-                    ignore_reqs.any? { |r| r.satisfied_by?(s.version) }
-                  end
-              end.
-              max_by(&:version)
-            spec.nil? ? nil : { version: spec.version }
-          end
+                fetchers.flat_map do |fetcher|
+                  fetcher.
+                    specs_with_retry([dependency.name], dependency_source).
+                    search_all(dependency.name)
+                end.
+                map(&:version)
+            end
         end
 
         def latest_git_version_details

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -270,7 +270,8 @@ module Dependabot
               dependency: dependency,
               dependency_files: dependency_files,
               credentials: credentials,
-              ignored_versions: ignored_versions
+              ignored_versions: ignored_versions,
+              security_advisories: []
             ).latest_version_details
         end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.103.3
+  version: 0.104.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-14 00:00:00.000000000 Z
+date: 2019-04-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.103.3
+        version: 0.104.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.103.3
+        version: 0.104.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement