dependabot-bundler 0.212.0 → 0.213.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b08c43d9300e9e7fa9b6d5f0e3e0631638a6e9785385688079fdc91fa4ad5aaf
-  data.tar.gz: 4958a4a8e3a18c4b533891917c85b71f75fe94c002faac703240eef60e24cfad
+  metadata.gz: 55546e82f289d523c8f13d59a6c60863c9771ebfb0e2e3fd1df0ba7057a5c745
+  data.tar.gz: e3e912ae9743390b574d72c93867618838526335ae43f165db59686af1339139
 SHA512:
-  metadata.gz: c808f814bde969264d27a002a03839c07b7654f013154b3287b9b3259568c795bcd1b4a4fd346a3c9496aee2e8364243832baad5cdf02bfbeb2add6f844fc885
-  data.tar.gz: 5caf001d47e54cca9efac60192e772aafdc5038add498779d96e5f722568d260e0adbc3503c382600805d9c2ea012101bc346e1f9c62607dfc1506763e008de7
+  metadata.gz: b4097b5de54f37b1a1e237ead1dc4c9d62c30f5e49b86597715dd776e827a82358ffcfefaa23cefd0f1fa69a6c1170d547a8720efe6b5f27231c201660a53a27
+  data.tar.gz: 9ac94050be3a3d3a35deb72a24ae6884848a736b501cc5d4ae980ec9817d5d13e40cd37b2dd8be1264e03f583a77f38c681496e11622fd46a9e5c1aa0b68734c

data/helpers/v1/build

@@ -2,26 +2,34 @@
 
 set -e
 
+helpers_dir=$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
 if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  echo "Unable to build, DEPENDABOT_NATIVE_HELPERS_PATH is not set"
-  exit 1
+  install_dir="$helpers_dir"
+else
+  install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v1"
+  mkdir -p "$install_dir"
+
+  cp -r \
+    "$helpers_dir/lib" \
+    "$helpers_dir/monkey_patches" \
+    "$helpers_dir/run.rb" \
+    "$helpers_dir/Gemfile" \
+    "$install_dir"
 fi
 
-install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v1"
-mkdir -p "$install_dir"
+cd "$install_dir"
 
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cp -r \
-  "$helpers_dir/lib" \
-  "$helpers_dir/monkey_patches" \
-  "$helpers_dir/run.rb" \
-  "$helpers_dir/Gemfile" \
-  "$install_dir"
+export GEM_HOME=$install_dir/.bundle
 
-cd "$install_dir"
+gem install bundler -v 1.17.3 --no-document
+
+BUNDLER_VERSION=1.17.3 bundle config --local path.system true
+
+if [ -n "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
+  BUNDLER_VERSION=1.17.3 bundle config --local without "test"
+fi
 
 # NOTE: Sets `BUNDLED WITH` to match the installed v1 version in Gemfile.lock
 # forcing native helpers to run with the same version
-BUNDLER_VERSION=1.17.3 bundle config --local path ".bundle"
-BUNDLER_VERSION=1.17.3 bundle config --local without "test"
 BUNDLER_VERSION=1.17.3 bundle install

data/helpers/v1/lib/functions/lockfile_updater.rb

@@ -10,7 +10,7 @@ module Functions
         locked\sto\s(?<name>[^\s]+)\s\(|
         not\sfind\s(?<name>[^\s]+)-\d|
         has\s(?<name>[^\s]+)\slocked\sat
-      /x.freeze
+      /x
 
     def initialize(gemfile_name:, lockfile_name:, dependencies:)
       @gemfile_name = gemfile_name

data/helpers/v1/lib/functions/version_resolver.rb

@@ -2,7 +2,7 @@
 
 module Functions
   class VersionResolver
-    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
+    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/
 
     attr_reader :dependency_name, :dependency_requirements,
                 :gemfile_name, :lockfile_name

data/helpers/v1/spec/native_spec_helper.rb

@@ -25,7 +25,7 @@ end
 
 # Duplicated in lib/dependabot/bundler/file_updater/lockfile_updater.rb
 # TODO: Stop sanitizing the lockfile once we have bundler 2 installed
-LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
+LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m
 
 def project_dependency_files(project)
   project_path = File.expand_path(File.join("../../spec/fixtures/projects/bundler1", project))

data/helpers/v2/build

@@ -2,24 +2,34 @@
 
 set -e
 
+helpers_dir=$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
 if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  echo "Unable to build, DEPENDABOT_NATIVE_HELPERS_PATH is not set"
-  exit 1
+  install_dir="$helpers_dir"
+else
+  install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v2"
+  mkdir -p "$install_dir"
+
+  cp -r \
+    "$helpers_dir/lib" \
+    "$helpers_dir/monkey_patches" \
+    "$helpers_dir/run.rb" \
+    "$helpers_dir/Gemfile" \
+    "$install_dir"
 fi
 
-install_dir="$DEPENDABOT_NATIVE_HELPERS_PATH/bundler/v2"
-mkdir -p "$install_dir"
+cd "$install_dir"
 
-helpers_dir="$(dirname "${BASH_SOURCE[0]}")"
-cp -r \
-  "$helpers_dir/lib" \
-  "$helpers_dir/monkey_patches" \
-  "$helpers_dir/run.rb" \
-  "$helpers_dir/Gemfile" \
-  "$install_dir"
+default_version=$(ruby -rbundler -e'print Bundler::VERSION')
 
-cd "$install_dir"
+export GEM_HOME=$install_dir/.bundle
+
+gem install bundler -v "$default_version" --no-document
+
+bundle config --local path.system true
+
+if [ -n "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
+  bundle config --local without "test"
+fi
 
-bundle config --local path ".bundle"
-bundle config --local without "test"
 bundle install

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -10,7 +10,7 @@ module Functions
         locked\sto\s(?<name>[^\s]+)\s\(|
         not\sfind\s(?<name>[^\s]+)-\d|
         has\s(?<name>[^\s]+)\slocked\sat
-      /x.freeze
+      /x
     DEPENDENCY_DROPPED = "_dependency_dropped_"
 
     def initialize(gemfile_name:, lockfile_name:, dependencies:)

data/helpers/v2/lib/functions/version_resolver.rb

@@ -2,7 +2,7 @@
 
 module Functions
   class VersionResolver
-    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
+    GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/
 
     attr_reader :dependency_name, :dependency_requirements,
                 :gemfile_name, :lockfile_name
@@ -16,6 +16,11 @@ module Functions
     end
 
     def version_details
+      # If the dependency is Bundler itself then we can't trust the
+      # version that has been returned (it's the version Dependabot is
+      # running on, rather than the true latest resolvable version).
+      return nil if dependency_name == "bundler"
+
       dep = dependency_from_definition
 
       # If the dependency wasn't found in the definition, but *is*
@@ -28,11 +33,6 @@ module Functions
       # subdependency that was removed when attempting to update it.
       return nil if dep.nil?
 
-      # If the dependency is Bundler itself then we can't trust the
-      # version that has been returned (it's the version Dependabot is
-      # running on, rather than the true latest resolvable version).
-      return nil if dep.name == "bundler"
-
       details = {
         version: dep.version,
         ruby_version: ruby_version,

data/helpers/v2/run.rb

@@ -15,7 +15,6 @@ end
 # Bundler monkey patches
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
-require "endpoint_specification_patch"
 require "git_source_patch"
 
 require "functions"

data/lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb

@@ -8,20 +8,20 @@ module Dependabot
     class FileParser
       # Checks whether a dependency is declared in a Gemfile
       class GemfileDeclarationFinder
-        def initialize(dependency:, gemfile:)
-          @dependency = dependency
+        def initialize(gemfile:)
           @gemfile = gemfile
+          @declaration_nodes = {}
         end
 
-        def gemfile_includes_dependency?
-          !declaration_node.nil?
+        def gemfile_includes_dependency?(dependency)
+          !declaration_node(dependency).nil?
         end
 
-        def enhanced_req_string
-          return unless gemfile_includes_dependency?
+        def enhanced_req_string(dependency)
+          return unless gemfile_includes_dependency?(dependency)
 
           fallback_string = dependency.fetch("requirement")
-          req_nodes = declaration_node.children[3..-1]
+          req_nodes = declaration_node(dependency).children[3..-1]
           req_nodes = req_nodes.reject { |child| child.type == :hash }
 
           return fallback_string if req_nodes.none?
@@ -39,31 +39,35 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :gemfile
+        attr_reader :gemfile
 
-        def declaration_node
-          return @declaration_node if defined?(@declaration_node)
-          return unless Parser::CurrentRuby.parse(gemfile.content)
+        def parsed_gemfile
+          @parsed_gemfile ||= Parser::CurrentRuby.parse(gemfile.content)
+        end
+
+        def declaration_node(dependency)
+          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+          return unless parsed_gemfile
 
-          @declaration_node = nil
-          Parser::CurrentRuby.parse(gemfile.content).children.any? do |node|
-            @declaration_node = deep_search_for_gem(node)
+          @declaration_nodes[dependency] = nil
+          parsed_gemfile.children.any? do |node|
+            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
           end
-          @declaration_node
+          @declaration_nodes[dependency]
         end
 
-        def deep_search_for_gem(node)
-          return node if declares_targeted_gem?(node)
+        def deep_search_for_gem(node, dependency)
+          return node if declares_targeted_gem?(node, dependency)
           return unless node.is_a?(Parser::AST::Node)
 
           declaration_node = nil
           node.children.find do |child_node|
-            declaration_node = deep_search_for_gem(child_node)
+            declaration_node = deep_search_for_gem(child_node, dependency)
           end
           declaration_node
         end
 
-        def declares_targeted_gem?(node)
+        def declares_targeted_gem?(node, dependency)
           return false unless node.is_a?(Parser::AST::Node)
           return false unless node.children[1] == :gem
 

data/lib/dependabot/bundler/file_parser.rb

@@ -60,17 +60,17 @@ module Dependabot
         return dependencies unless gemfile
 
         [gemfile, *evaled_gemfiles].each do |file|
+          gemfile_declaration_finder = GemfileDeclarationFinder.new(gemfile: file)
+
           parsed_gemfile.each do |dep|
-            gemfile_declaration_finder =
-              GemfileDeclarationFinder.new(dependency: dep, gemfile: file)
-            next unless gemfile_declaration_finder.gemfile_includes_dependency?
+            next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
 
             dependencies <<
               Dependency.new(
                 name: dep.fetch("name"),
                 version: dependency_version(dep.fetch("name"))&.to_s,
                 requirements: [{
-                  requirement: gemfile_declaration_finder.enhanced_req_string,
+                  requirement: gemfile_declaration_finder.enhanced_req_string(dep),
                   groups: dep.fetch("groups").map(&:to_sym),
                   source: dep.fetch("source")&.transform_keys(&:to_sym),
                   file: file.name

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -29,7 +29,7 @@ module Dependabot
 
             content = remove_gemfile_git_source(dependency, content) if remove_git_source?(dependency)
 
-            content = update_gemfile_git_pin(dependency, gemfile, content) if update_git_pin?(dependency)
+            content = update_gemfile_git_pin(dependency, gemfile, content) if update_git_pin?(dependency, gemfile)
           end
 
           content
@@ -81,10 +81,10 @@ module Dependabot
           new_gemfile_req[:source].nil?
         end
 
-        def update_git_pin?(dependency)
+        def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements.
-            find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+            find { |f| f[:file] == file.name }
           return false unless new_gemfile_req&.dig(:source, :type) == "git"
 
           # If the new requirement is a git dependency with a ref then there's

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -18,10 +18,9 @@ module Dependabot
         require_relative "gemspec_dependency_name_finder"
         require_relative "ruby_requirement_setter"
 
-        LOCKFILE_ENDING =
-          /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m.freeze
-        GIT_DEPENDENCIES_SECTION = /GIT\n.*?\n\n(?!GIT)/m.freeze
-        GIT_DEPENDENCY_DETAILS = /GIT\n.*?\n\n/m.freeze
+        LOCKFILE_ENDING = /(?<ending>\s*(?:RUBY VERSION|BUNDLED WITH).*)/m
+        GIT_DEPENDENCIES_SECTION = /GIT\n.*?\n\n(?!GIT)/m
+        GIT_DEPENDENCY_DETAILS = /GIT\n.*?\n\n/m
 
         # Can't be a constant because some of these don't exist in bundler
         # 1.15, which Heroku uses, which causes an exception on boot.

data/lib/dependabot/bundler/file_updater/requirement_replacer.rb

@@ -167,7 +167,7 @@ module Dependabot
             req_string.include?(" ")
           end
 
-          EQUALITY_OPERATOR = /(?<![<>!])=/.freeze
+          EQUALITY_OPERATOR = /(?<![<>!])=/
 
           def use_equality_operator?(requirement_nodes)
             return true if requirement_nodes.none?

data/lib/dependabot/bundler/helpers.rb

@@ -13,7 +13,7 @@ module Dependabot
       # it was created with an old version that didn't add this information
       FAILOVER = V1
 
-      BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m.freeze
+      BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile

data/lib/dependabot/bundler/requirement.rb

@@ -5,7 +5,7 @@ require "dependabot/utils"
 module Dependabot
   module Bundler
     class Requirement < Gem::Requirement
-      # For consistency with other langauges, we define a requirements array.
+      # For consistency with other languages, we define a requirements array.
       # Ruby doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
       def self.requirements_array(requirement_string)

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -24,7 +24,7 @@ module Dependabot
       #   version allowed by the gemspec, if the gemspec has a required ruby
       #   version range
       class FilePreparer
-        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
+        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
 
         # Can't be a constant because some of these don't exist in bundler
         # 1.15, which Heroku uses, which causes an exception on boot.

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -14,19 +14,15 @@ module Dependabot
   module Bundler
     class UpdateChecker
       module SharedBundlerHelpers
-        GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/.freeze
-        GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./.freeze
-        PATH_REGEX = /The path `(?<path>.*)` does not exist/.freeze
+        GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/
+        GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./
+        PATH_REGEX = /The path `(?<path>.*)` does not exist/
 
         module BundlerErrorPatterns
-          MISSING_AUTH_REGEX =
-            /bundle config (?<source>.*) username:password/.freeze
-          BAD_AUTH_REGEX =
-            /Bad username or password for (?<source>.*)\.$/.freeze
-          BAD_CERT_REGEX =
-            /verify the SSL certificate for (?<source>.*)\.$/.freeze
-          HTTP_ERR_REGEX =
-            /Could not fetch specs from (?<source>.*)$/.freeze
+          MISSING_AUTH_REGEX = /bundle config (?<source>.*) username:password/
+          BAD_AUTH_REGEX = /Bad username or password for (?<source>.*)\.$/
+          BAD_CERT_REGEX = /verify the SSL certificate for (?<source>.*)\.$/
+          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>.*)$/
         end
 
         RETRYABLE_ERRORS = %w(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.212.0
+  version: 0.213.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-06 00:00:00.000000000 Z
+date: 2022-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
+        version: 0.213.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.212.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.213.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.12.0
+        version: 3.13.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,42 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.37.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.36.0
+        version: 1.37.1
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.14.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.14.2
-- !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +248,6 @@ files:
 - helpers/v2/lib/functions/version_resolver.rb
 - helpers/v2/monkey_patches/definition_bundler_version_patch.rb
 - helpers/v2/monkey_patches/definition_ruby_version_patch.rb
-- helpers/v2/monkey_patches/endpoint_specification_patch.rb
 - helpers/v2/monkey_patches/git_source_patch.rb
 - helpers/v2/run.rb
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
@@ -346,14 +303,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Ruby (bundler) support for dependabot

data/helpers/v2/monkey_patches/endpoint_specification_patch.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/endpoint_specification"
-
-module EndpointSpecificationPatch
-  def required_ruby_version
-    @required_ruby_version ||= Gem::Requirement.default
-  end
-
-  def required_rubygems_version
-    @required_rubygems_version ||= Gem::Requirement.default
-  end
-end
-
-Bundler::EndpointSpecification.prepend(EndpointSpecificationPatch)