dependabot-bundler 0.135.0 → 0.136.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 967d2da1e215388ce5d73185bf92ab738f1f769a4d221c8ece0d6166f070ee80
-  data.tar.gz: 8b3b76b611be774e676da7c7a46b5216cae7b54ce95d6816dd41a64a0a9623cc
+  metadata.gz: 393bf9b8a90811c0809226907cbff66998c3fb481f16d23115cbf4e22444ed8e
+  data.tar.gz: 7e334d28a93224445785f7f23215d782bc3b2c70b177faf9f35276604ff1adae
 SHA512:
-  metadata.gz: b208788a96fcf1eb801073e2ae69e7132329facd9f0acded7a51a466515c5ff07baa255efccd5f5db2c29d7a37f075e098c9670a36908254db092fabf3b196dc
-  data.tar.gz: 577e39faa093464f653d2f728e900ab06f3c4049bc90b2a2e7c7e9f6f0139914d041ef2f0a31df08cc1a7a7f33882986368eb9d6a85483cb04bc063a897aa024
+  metadata.gz: efbd895bfb249b021160b2806b74449741d4d7dfb1e955436d3ef6919683b8465f8574708be01b9a3fca992dc5df06e055647d4236aea66b219fe3c5f48ade2f
+  data.tar.gz: 21d703a2ad5dfe9eeba687172f558ec0cf7abddd5e6b4f9dbf72d05dead39b6a5764857903982d2fa3809fa19b5acf75c2d3b006c5c5ce6e9fc80453f3f7460b

data/helpers/v1/.bundle/config

@@ -0,0 +1,2 @@
+---
+BUNDLE_PATH: ".bundle"

data/helpers/v1/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/*
+!/.bundle/config
+/.env
+/tmp
+/dependabot-*.gem
+Gemfile.lock
+spec/fixtures/projects/*/.bundle/
+!spec/fixtures/projects/**/Gemfile.lock
+!spec/fixtures/projects/**/vendor

data/helpers/v1/Gemfile

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# NOTE: This is intentionally left blank as it's currently only used to force
+# bundler to use v1 when executing native helpers by pointing the BUNDLE_GEMFILE
+# env to this Gemfile in Dependabot::Bundler::NativeHelpers

data/helpers/{build → v1/build}

@@ -10,9 +10,15 @@ fi
 
 helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
 cp -r \
+  "$helpers_dir/.bundle" \
   "$helpers_dir/lib" \
   "$helpers_dir/monkey_patches" \
   "$helpers_dir/run.rb" \
+  "$helpers_dir/Gemfile" \
   "$install_dir"
 
 cd "$install_dir"
+
+# NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
+# forcing specs and native helpers to run with the same version
+BUNDLER_VERSION=1 bundle install

data/lib/dependabot/bundler/file_parser.rb

@@ -5,6 +5,7 @@ require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/version"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -129,8 +130,8 @@ module Dependabot
                                                       repo_contents_path) do
             write_temporary_dependency_files
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "parsed_gemfile",
               args: {
                 gemfile_name: gemfile.name,
@@ -159,8 +160,8 @@ module Dependabot
                                                       repo_contents_path) do
             write_temporary_dependency_files
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "parsed_gemspec",
               args: {
                 gemspec_name: file.name,
@@ -298,6 +299,10 @@ module Dependabot
           select { |f| f.name.end_with?(".rb") }.
           reject { |f| f.name == "gems.rb" }
       end
+
+      def bundler_version
+        @bundler_version ||= Helpers.bundler_version(lockfile)
+      end
     end
   end
 end

data/lib/dependabot/bundler/file_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/file_updaters/vendor_updater"
 
 module Dependabot
@@ -75,8 +76,8 @@ module Dependabot
         return @vendor_cache_dir if defined?(@vendor_cache_dir)
 
         @vendor_cache_dir =
-          SharedHelpers.run_helper_subprocess(
-            command: NativeHelpers.helper_path,
+          NativeHelpers.run_bundler_subprocess(
+            bundler_version: bundler_version,
             function: "vendor_cache_dir",
             args: {
               dir: repo_contents_path
@@ -159,6 +160,10 @@ module Dependabot
           select { |file| file.name.end_with?(".gemspec") }.
           reject(&:support_file?)
       end
+
+      def bundler_version
+        @bundler_version ||= Helpers.bundler_version(lockfile)
+      end
     end
   end
 end

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -234,11 +234,8 @@ module Dependabot
           def remove_unnecessary_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
-            if unnecessary_assignment?(node) &&
-               node.children.last&.location.respond_to?(:heredoc_end)
-              range_to_remove = node.loc.expression.join(
-                node.children.last.location.heredoc_end
-              )
+            if unnecessary_assignment?(node) && node_includes_heredoc?(node)
+              range_to_remove = node.loc.expression.join(find_heredoc_end_range(node))
               return replace(range_to_remove, '"sanitized"')
             elsif unnecessary_assignment?(node)
               return replace(node.loc.expression, '"sanitized"')
@@ -249,6 +246,30 @@ module Dependabot
             end
           end
 
+          def node_includes_heredoc?(node)
+            find_heredoc_end_range(node)
+          end
+
+          # Performs a depth-first search for the first heredoc in the given
+          # Parser::AST::Node.
+          #
+          # Returns a Parser::Source::Range identifying the location of the end
+          #   of the heredoc, or nil if no heredoc was found.
+          def find_heredoc_end_range(node)
+            return unless node.is_a?(Parser::AST::Node)
+
+            node.children.each do |child|
+              next unless child.is_a?(Parser::AST::Node)
+
+              return child.location.heredoc_end if child.location.respond_to?(:heredoc_end)
+
+              range = find_heredoc_end_range(child)
+              return range if range
+            end
+
+            nil
+          end
+
           def unnecessary_assignment?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -6,6 +6,7 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/bundler/file_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 
 module Dependabot
   module Bundler
@@ -64,8 +65,8 @@ module Dependabot
             ) do |tmp_dir|
               write_temporary_dependency_files
 
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "update_lockfile",
                 args: {
                   gemfile_name: gemfile.name,
@@ -301,6 +302,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/helpers.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Bundler
+    module Helpers
+      V1 = "1"
+      V2 = "2"
+
+      # TODO: Add support for bundler v2
+      # return "v2" if lockfile.content.match?(/BUNDLED WITH\s+2/m)
+      def self.bundler_version(_lockfile)
+        V1
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/native_helpers.rb

@@ -1,10 +1,35 @@
 # frozen_string_literal: true
 
+require "bundler"
+require "dependabot/shared_helpers"
+
 module Dependabot
   module Bundler
     module NativeHelpers
-      def self.helper_path
-        "bundle exec ruby #{File.join(native_helpers_root, 'run.rb')}"
+      def self.run_bundler_subprocess(function:, args:, bundler_version:)
+        # Run helper suprocess with all bundler-related ENV variables removed
+        ::Bundler.with_original_env do
+          SharedHelpers.run_helper_subprocess(
+            command: helper_path(bundler_version: bundler_version),
+            function: function,
+            args: args,
+            env: {
+              # Bundler will pick the matching installed major version
+              "BUNDLER_VERSION" => bundler_version,
+              "BUNDLE_GEMFILE" => File.join(versioned_helper_path(bundler_version: bundler_version), "Gemfile"),
+              "BUNDLE_PATH" => File.join(versioned_helper_path(bundler_version: bundler_version), ".bundle")
+            }
+          )
+        end
+      end
+
+      def self.versioned_helper_path(bundler_version:)
+        native_helper_version = "v#{bundler_version}"
+        File.join(native_helpers_root, native_helper_version)
+      end
+
+      def self.helper_path(bundler_version:)
+        "ruby #{File.join(versioned_helper_path(bundler_version: bundler_version), 'run.rb')}"
       end
 
       def self.native_helpers_root

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -28,8 +29,8 @@ module Dependabot
         #   * requirement [String] the requirement on the target_dependency
         def conflicting_dependencies(dependency:, target_version:)
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "conflicting_dependencies",
               args: {
                 dir: tmp_dir,
@@ -42,6 +43,12 @@ module Dependabot
             )
           end
         end
+
+        private
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -3,6 +3,7 @@
 require "dependabot/bundler/file_parser"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/update_checker/requirements_updater"
 require "dependabot/errors"
@@ -43,8 +44,8 @@ module Dependabot
 
         def force_update
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            updated_deps, specs = SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            updated_deps, specs = NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "force_update",
               args: {
                 dir: tmp_dir,
@@ -146,6 +147,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
+
 module Dependabot
   module Bundler
     class UpdateChecker
@@ -53,8 +56,8 @@ module Dependabot
 
             SharedHelpers.with_git_configured(credentials: credentials) do
               in_a_native_bundler_context do |tmp_dir|
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
+                NativeHelpers.run_bundler_subprocess(
+                  bundler_version: bundler_version,
                   function: "depencency_source_latest_git_version",
                   args: {
                     dir: tmp_dir,
@@ -98,8 +101,8 @@ module Dependabot
           def private_registry_versions
             @private_registry_versions ||=
               in_a_native_bundler_context do |tmp_dir|
-                SharedHelpers.run_helper_subprocess(
-                  command: NativeHelpers.helper_path,
+                NativeHelpers.run_bundler_subprocess(
+                  bundler_version: bundler_version,
                   function: "private_registry_versions",
                   args: {
                     dir: tmp_dir,
@@ -118,8 +121,8 @@ module Dependabot
             return @source_type = RUBYGEMS unless gemfile
 
             @source_type = in_a_native_bundler_context do |tmp_dir|
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "dependency_source_type",
                 args: {
                   dir: tmp_dir,
@@ -135,6 +138,15 @@ module Dependabot
             dependency_files.find { |f| f.name == "Gemfile" } ||
               dependency_files.find { |f| f.name == "gems.rb" }
           end
+
+          def lockfile
+            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
+              dependency_files.find { |f| f.name == "gems.locked" }
+          end
+
+          def bundler_version
+            @bundler_version ||= Helpers.bundler_version(lockfile)
+          end
         end
       end
     end

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -4,6 +4,7 @@ require "excon"
 
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
+require "dependabot/bundler/helpers"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 
@@ -163,8 +164,8 @@ module Dependabot
 
         def inaccessible_git_dependencies
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-            git_specs = SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            git_specs = NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "git_specs",
               args: {
                 dir: tmp_dir,
@@ -187,8 +188,8 @@ module Dependabot
 
         def jfrog_source
           in_a_native_bundler_context(error_handling: false) do |dir|
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
+            NativeHelpers.run_bundler_subprocess(
+              bundler_version: bundler_version,
               function: "jfrog_source",
               args: {
                 dir: dir,
@@ -236,6 +237,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -2,6 +2,7 @@
 
 require "excon"
 
+require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/requirement"
@@ -75,8 +76,8 @@ module Dependabot
             # some errors we want to handle specifically ourselves, including
             # potentially retrying in the case of the Ruby version being locked
             in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-              details =  SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
+              details = NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
                 function: "resolve_version",
                 args: {
                   dependency_name: dependency.name,
@@ -218,6 +219,10 @@ module Dependabot
 
           lockfile.content.match?(/BUNDLED WITH\s+2/m)
         end
+
+        def bundler_version
+          @bundler_version ||= Helpers.bundler_version(lockfile)
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.135.0
+  version: 0.136.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-05 00:00:00.000000000 Z
+date: 2021-03-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.135.0
+        version: 0.136.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.135.0
+        version: 0.136.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -185,18 +185,21 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- helpers/build
-- helpers/lib/functions.rb
-- helpers/lib/functions/conflicting_dependency_resolver.rb
-- helpers/lib/functions/dependency_source.rb
-- helpers/lib/functions/file_parser.rb
-- helpers/lib/functions/force_updater.rb
-- helpers/lib/functions/lockfile_updater.rb
-- helpers/lib/functions/version_resolver.rb
-- helpers/monkey_patches/definition_bundler_version_patch.rb
-- helpers/monkey_patches/definition_ruby_version_patch.rb
-- helpers/monkey_patches/git_source_patch.rb
-- helpers/run.rb
+- helpers/v1/.bundle/config
+- helpers/v1/.gitignore
+- helpers/v1/Gemfile
+- helpers/v1/build
+- helpers/v1/lib/functions.rb
+- helpers/v1/lib/functions/conflicting_dependency_resolver.rb
+- helpers/v1/lib/functions/dependency_source.rb
+- helpers/v1/lib/functions/file_parser.rb
+- helpers/v1/lib/functions/force_updater.rb
+- helpers/v1/lib/functions/lockfile_updater.rb
+- helpers/v1/lib/functions/version_resolver.rb
+- helpers/v1/monkey_patches/definition_bundler_version_patch.rb
+- helpers/v1/monkey_patches/definition_ruby_version_patch.rb
+- helpers/v1/monkey_patches/git_source_patch.rb
+- helpers/v1/run.rb
 - lib/dependabot/bundler.rb
 - lib/dependabot/bundler/file_fetcher.rb
 - lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb
@@ -216,6 +219,7 @@ files:
 - lib/dependabot/bundler/file_updater/lockfile_updater.rb
 - lib/dependabot/bundler/file_updater/requirement_replacer.rb
 - lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb
+- lib/dependabot/bundler/helpers.rb
 - lib/dependabot/bundler/metadata_finder.rb
 - lib/dependabot/bundler/native_helpers.rb
 - lib/dependabot/bundler/requirement.rb