dependabot-bundler 0.112.19 → 0.112.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3dd9b6a0ce64844325ff6e43f837b1a6ce4ccc9f843bf64bbcc06efeb333da8b
-  data.tar.gz: 3efdf872c7e7e27ae8c23c47413de6fd81292225ce8aa3369b2bd40381aaa6b9
+  metadata.gz: f606162773138c8e9eb453a392a6c7b50805a4934fff477434489e8c9d6f4ffc
+  data.tar.gz: 03cf1dd48d07b30da272e3abadbb08e3a043fc2e924751d157c342baf3e5aca6
 SHA512:
-  metadata.gz: 36a11f9a29b86f9deb25df425e87a6d81d43d6586530be2938d3d7bcfefbcb42ea9401a7b61a738c051c79488c8b85352217ce1304c5841ca7cdb6b312ec2100
-  data.tar.gz: fdb938a5974f2c0d9533e8ca0742924165c18096bca9f79e21c73e40d166df7f5d54b14bc696cabcccd0d1df98a14510da850bf2c68d51a030109afa9a7b2eec
+  metadata.gz: daae91565ef2d5fdfb92b98e632d56dd3628514456181dedc9cce0385d096a02732e19c645173140cb9a8187f52526da67a676d6397f7d7abd43f94b466aac52
+  data.tar.gz: 3b68a388ab4686a17cd399936e5cf03159678ee3177a8d9bd7374b38a6965d82f48acc8742ba20855ca9a37bdffefd961ee44001509c3f74159db0f3d325d5f2

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -80,16 +80,8 @@ module Dependabot
                 ::Gem::Specification.all =
                   ::Gem::Specification.send(:default_stubs, "*.gemspec")
 
-                # Set auth details
-                relevant_credentials.each do |cred|
-                  token = cred["token"] ||
-                          "#{cred['username']}:#{cred['password']}"
-
-                  ::Bundler.settings.set_command_option(
-                    cred.fetch("host"),
-                    token.gsub("@", "%40F").gsub("?", "%3F")
-                  )
-                end
+                # Set flags and credentials
+                set_bundler_flags_and_credentials
 
                 generate_lockfile
               end
@@ -422,12 +414,39 @@ module Dependabot
           dependency_files.select { |f| f.name.end_with?(".specification") }
         end
 
+        def set_bundler_flags_and_credentials
+          # Set auth details
+          relevant_credentials.each do |cred|
+            token = cred["token"] ||
+                    "#{cred['username']}:#{cred['password']}"
+
+            ::Bundler.settings.set_command_option(
+              cred.fetch("host"),
+              token.gsub("@", "%40F").gsub("?", "%3F")
+            )
+          end
+
+          # Use HTTPS for GitHub if lockfile was generated by Bundler 2
+          set_bundler_2_flags if using_bundler_2?
+        end
+
+        def set_bundler_2_flags
+          ::Bundler.settings.set_command_option("forget_cli_options", "true")
+          ::Bundler.settings.set_command_option("github.https", "true")
+        end
+
         def git_dependency?(dep)
           GitCommitChecker.new(
             dependency: dep,
             credentials: credentials
           ).git_dependency?
         end
+
+        def using_bundler_2?
+          return unless lockfile
+
+          lockfile.content.match?(/BUNDLED WITH\s+2/m)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -82,23 +82,8 @@ module Dependabot
               ::Gem::Specification.all =
                 ::Gem::Specification.send(:default_stubs, "*.gemspec")
 
-              # Set auth details
-              relevant_credentials.each do |cred|
-                token = cred["token"] ||
-                        "#{cred['username']}:#{cred['password']}"
-
-                ::Bundler.settings.set_command_option(
-                  cred.fetch("host"),
-                  token.gsub("@", "%40F").gsub("?", "%3F")
-                )
-              end
-
-              # Only allow upgrades. Othewise it's unlikely that this
-              # resolution will be found by the FileUpdater
-              ::Bundler.settings.set_command_option(
-                "only_update_to_newer_versions",
-                true
-              )
+              # Set flags and credentials
+              set_bundler_flags_and_credentials
 
               yield
             end
@@ -279,6 +264,34 @@ module Dependabot
           File.write(lockfile.name, sanitized_lockfile_body) if lockfile
         end
 
+        def set_bundler_flags_and_credentials
+          # Set auth details
+          relevant_credentials.each do |cred|
+            token = cred["token"] ||
+                    "#{cred['username']}:#{cred['password']}"
+
+            ::Bundler.settings.set_command_option(
+              cred.fetch("host"),
+              token.gsub("@", "%40F").gsub("?", "%3F")
+            )
+          end
+
+          # Only allow upgrades. Othewise it's unlikely that this
+          # resolution will be found by the FileUpdater
+          ::Bundler.settings.set_command_option(
+            "only_update_to_newer_versions",
+            true
+          )
+
+          # Use HTTPS for GitHub if lockfile was generated by Bundler 2
+          set_bundler_2_flags if using_bundler_2?
+        end
+
+        def set_bundler_2_flags
+          ::Bundler.settings.set_command_option("forget_cli_options", "true")
+          ::Bundler.settings.set_command_option("github.https", "true")
+        end
+
         def relevant_credentials
           credentials.
             select { |cred| cred["password"] || cred["token"] }.
@@ -289,6 +302,12 @@ module Dependabot
               false
             end
         end
+
+        def using_bundler_2?
+          return unless lockfile
+
+          lockfile.content.match?(/BUNDLED WITH\s+2/m)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -47,16 +47,8 @@ module Dependabot
               ::Gem::Specification.all =
                 ::Gem::Specification.send(:default_stubs, "*.gemspec")
 
-              # Set auth details
-              relevant_credentials.each do |cred|
-                token = cred["token"] ||
-                        "#{cred['username']}:#{cred['password']}"
-
-                ::Bundler.settings.set_command_option(
-                  cred.fetch("host"),
-                  token.gsub("@", "%40F").gsub("?", "%3F")
-                )
-              end
+              # Set flags and credentials
+              set_bundler_flags_and_credentials
 
               yield
             end
@@ -221,6 +213,27 @@ module Dependabot
           File.write(lockfile.name, sanitized_lockfile_body) if lockfile
         end
 
+        def set_bundler_flags_and_credentials
+          # Set auth details
+          relevant_credentials.each do |cred|
+            token = cred["token"] ||
+                    "#{cred['username']}:#{cred['password']}"
+
+            ::Bundler.settings.set_command_option(
+              cred.fetch("host"),
+              token.gsub("@", "%40F").gsub("?", "%3F")
+            )
+          end
+
+          # Use HTTPS for GitHub if lockfile was generated by Bundler 2
+          set_bundler_2_flags if using_bundler_2?
+        end
+
+        def set_bundler_2_flags
+          ::Bundler.settings.set_command_option("forget_cli_options", "true")
+          ::Bundler.settings.set_command_option("github.https", "true")
+        end
+
         def relevant_credentials
           [
             *git_source_credentials,
@@ -253,6 +266,12 @@ module Dependabot
           re = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
           lockfile.content.gsub(re, "")
         end
+
+        def using_bundler_2?
+          return unless lockfile
+
+          lockfile.content.match?(/BUNDLED WITH\s+2/m)
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.112.19
+  version: 0.112.20
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.19
+        version: 0.112.20
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.19
+        version: 0.112.20
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement