dependabot-bundler 0.225.0 → 0.226.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ba17ad283a50a7c06199c0dd9eb7546616bbc18161b2d475587f67535c4f527
-  data.tar.gz: e0ec3920c84e0a1df752bebd6f3f9545c50782e34a22f0933f94e3c27932c506
+  metadata.gz: 62e7833c9a64fc684512d74fa39ce224e18754731dddb5208d7984f920c54467
+  data.tar.gz: c598beadef625a3c4789a34cc52066bd96cc2b9b5a17e4c47b38ae3e2d96641c
 SHA512:
-  metadata.gz: f7c2375065f8ce381f6b2c1293f24ba0b279416c14adba367ef6623a915a56b5e2c93ba5e382eef5cfb06487630b3291d5f5af368469db2ade9a139751d35dde
-  data.tar.gz: 1028997b2e4d5bf9deb4b07eac0532af63aa7e4cc9fa9e59007fb61da7a44adefd6ef2ef4de7720ac6ce5cf3f8d7217c521f99baf4239641fd0197dd63497dc8
+  metadata.gz: 0d86274e3b7f9e971b6add631c155b67843fe5adbbf719b73934517b73824feca2eeb41ca37ab9557c9bb5737b67208f039cc7e852e73d97f3d1b40d4e77a0af
+  data.tar.gz: 105562225882a8b562ff3afdd2851a2fc05d7a0ee0ff61993b9688e4e5df0f6dffcb1f077e6b43a75150758d5ea1960eda2dbb30963a08bded17980d65b339c1

data/helpers/v1/run.rb

@@ -21,25 +21,11 @@ require "resolver_spec_group_sane_eql"
 
 require "functions"
 
-MAX_BUNDLER_VERSION = "2.0.0"
-
-def validate_bundler_version!
-  return true if correct_bundler_version?
-
-  raise StandardError, "Called with Bundler '#{Bundler::VERSION}', expected < '#{MAX_BUNDLER_VERSION}'"
-end
-
-def correct_bundler_version?
-  Gem::Version.new(Bundler::VERSION) < Gem::Version.new(MAX_BUNDLER_VERSION)
-end
-
 def output(obj)
   print JSON.dump(obj)
 end
 
 begin
-  validate_bundler_version!
-
   request = JSON.parse($stdin.read)
 
   function = request["function"]

data/helpers/v2/lib/functions/lockfile_updater.rb

@@ -62,10 +62,13 @@ module Functions
     end
 
     def cache_vendored_gems(definition)
-      # Dependencies that have been unlocked for the update (including
-      # sub-dependencies)
-      unlocked_gems = definition.instance_variable_get(:@unlock).
-                      fetch(:gems)
+      resolve = definition.resolve
+
+      # Dependencies that have been updated (including sub-dependencies)
+      updated_gems = resolve.reject do |spec|
+        lockfile_specs.include?(spec)
+      end.map(&:name).uniq
+
       bundler_opts = {
         cache_all: true,
         cache_all_platforms: true,
@@ -76,27 +79,30 @@ module Functions
         # Fetch and cache gems on all platforms without pruning
         Bundler::Runtime.new(nil, definition).cache
 
-        # Only prune unlocked gems (the original implementation is in
+        # Only prune updated gems (the original implementation is in
         # Bundler::Runtime)
         cache_path = Bundler.app_cache
-        resolve = definition.resolve
-        prune_gem_cache(resolve, cache_path, unlocked_gems)
+        prune_gem_cache(resolve, cache_path, updated_gems)
         prune_git_and_path_cache(resolve, cache_path)
       end
     end
 
     # Copied from Bundler::Runtime: Modified to only prune gems that have
-    # been unlocked
-    def prune_gem_cache(resolve, cache_path, unlocked_gems)
+    # been updated
+    def prune_gem_cache(resolve, cache_path, updated_gems)
       cached_gems = Dir["#{cache_path}/*.gem"]
 
-      outdated_gems = cached_gems.reject do |path|
+      outdated_gems = cached_gems.select do |path|
         spec = Bundler.rubygems.spec_from_gem path
 
-        !unlocked_gems.include?(spec.name) || resolve.any? do |s|
+        caused_by_update = updated_gems.include?(spec.name) && resolve.none? do |s|
           s.name == spec.name && s.version == spec.version &&
             !s.source.is_a?(Bundler::Source::Git)
         end
+
+        caused_by_removal = resolve.none? { |s| s.name == spec.name }
+
+        caused_by_update || caused_by_removal
       end
 
       return unless outdated_gems.any?
@@ -138,8 +144,7 @@ module Functions
     end
 
     def unlock_blocking_subdeps(dependencies_to_unlock, error)
-      all_deps =  Bundler::LockfileParser.new(lockfile).
-                  specs.map(&:name).map(&:to_s)
+      all_deps = lockfile_specs.map(&:name).map(&:to_s)
       top_level = build_definition([]).dependencies.
                   map(&:name).map(&:to_s)
       allowed_new_unlocks = all_deps - top_level - dependencies_to_unlock
@@ -215,6 +220,10 @@ module Functions
       sources.all? { |s| s&.fetch("type", nil) == "git" }
     end
 
+    def lockfile_specs
+      @lockfile_specs ||= Bundler::LockfileParser.new(lockfile).specs
+    end
+
     def lockfile
       @lockfile ||= File.read(lockfile_name)
     end

data/helpers/v2/run.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-gem "bundler", "~> 2.3"
+gem "bundler", "~> 2.4"
 require "bundler"
 require "json"
 
@@ -19,25 +19,11 @@ require "git_source_patch"
 
 require "functions"
 
-MIN_BUNDLER_VERSION = "2.1.0"
-
-def validate_bundler_version!
-  return true if correct_bundler_version?
-
-  raise StandardError, "Called with Bundler '#{Bundler::VERSION}', expected >= '#{MIN_BUNDLER_VERSION}'"
-end
-
-def correct_bundler_version?
-  Gem::Version.new(Bundler::VERSION) >= Gem::Version.new(MIN_BUNDLER_VERSION)
-end
-
 def output(obj)
   print JSON.dump(obj)
 end
 
 begin
-  validate_bundler_version!
-
   request = JSON.parse($stdin.read)
 
   function = request["function"]

data/lib/dependabot/bundler/file_fetcher.rb

@@ -69,13 +69,15 @@ module Dependabot
       end
 
       def gemfile
-        @gemfile ||= fetch_file_if_present("gems.rb") ||
-                     fetch_file_if_present("Gemfile")
+        return @gemfile if defined?(@gemfile)
+
+        @gemfile = fetch_file_if_present("gems.rb") || fetch_file_if_present("Gemfile")
       end
 
       def lockfile
-        @lockfile ||= fetch_file_if_present("gems.locked") ||
-                      fetch_file_if_present("Gemfile.lock")
+        return @lockfile if defined?(@lockfile)
+
+        @lockfile = fetch_file_if_present("gems.locked") || fetch_file_if_present("Gemfile.lock")
       end
 
       def gemspecs

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -19,7 +19,9 @@ module Dependabot
         PATH_REGEX = /The path `(?<path>.*)` does not exist/
 
         module BundlerErrorPatterns
-          MISSING_AUTH_REGEX = /bundle config (?<source>.*) username:password/
+          # The `set --global` optional part can be made required when Bundler 1 support is dropped
+          MISSING_AUTH_REGEX = /bundle config (?:set --global )?(?<source>.*) username:password/
+
           BAD_AUTH_REGEX = /Bad username or password for (?<source>.*)\.$/
           BAD_CERT_REGEX = /verify the SSL certificate for (?<source>.*)\.$/
           HTTP_ERR_REGEX = /Could not fetch specs from (?<source>.*)$/

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.225.0
+  version: 0.226.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-31 00:00:00.000000000 Z
+date: 2023-08-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.225.0
+        version: 0.226.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.225.0
+        version: 0.226.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.17.1
+        version: 1.18.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.17.1
+        version: 1.18.0
 - !ruby/object:Gem::Dependency
   name: stackprof
   requirement: !ruby/object:Gem::Requirement
@@ -268,7 +268,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.226.0
 post_install_message: 
 rdoc_options: []
 require_paths: