dependabot-bundler 0.236.0 → 0.237.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4fd34dd5e86ac6b391a703c276d062a73f797c3f936658aebc25680ee886edc6
-  data.tar.gz: f06e52b4ddfaba21629b65ccc739eede69faccc75eb542cb2da726f3a1611cba
+  metadata.gz: be50dcf437b4b6c5a4570e0c34f106900f8f8ba0ffd7e270b8fdef2a503859e6
+  data.tar.gz: fbaf4ba7a14c4c709cb669ecbd48268e51ba9ee82710edf4fdf6304fb114224d
 SHA512:
-  metadata.gz: 6e6ec483cbd9483321846361ade36c24bf9fca1c355e43bbffcfc7a3d25c7c8ec08f3e88137913d3538928fdde6b00bb3f82edb912fccff856ade082a5b00ba6
-  data.tar.gz: 1581d435a66c7753929a5adece2b9b9387477fad411de498afb85f9972ba99a1f6df9482597acbab5bacaf0b8cbda2a6f42e6de080b41572da9ac2255e3a9694
+  metadata.gz: 26af90911a7dec4e6179c4b58d0504ce47f08e0e34583ed9d5c105e128c4b9c24608abb343f46c42ebc5204112968d394c8bd6b44d14cf02828bb4534270bd09
+  data.tar.gz: '0099faad52d13445a1c946ed9f66391278f062ae90bee7cfe6253d72b9a5dbce1c7f59972edaef4f8a99c1762b9447788146bafccb1f9537fdfec93684790ec3'

data/helpers/v1/lib/functions.rb

@@ -148,6 +148,9 @@ module Functions
 
     # Use HTTPS for GitHub if lockfile
     Bundler.settings.set_command_option("github.https", "true")
+
+    # Native helpers rely on dependency unlocking, so Bundler should never be frozen
+    Bundler.settings.set_command_option("frozen", "false")
   end
 
   def self.relevant_credentials(credentials)

data/helpers/v2/lib/functions/dependency_source.rb

@@ -42,9 +42,8 @@ module Functions
         .fetchers.flat_map do |fetcher|
           fetcher
             .specs([dependency_name], bundler_source)
-            .search_all(dependency_name)
+            .search_all(dependency_name).map(&:version)
         end
-        .map(&:version)
     end
 
     private

data/helpers/v2/lib/functions/version_resolver.rb

@@ -127,7 +127,7 @@ module Functions
     def fetcher_class(dep)
       return unless dep.source.is_a?(::Bundler::Source::Rubygems)
 
-      dep.source.fetchers.first.fetchers.first.class.to_s
+      dep.source.fetchers.first.send(:fetchers).first.class.to_s
     end
 
     def ruby_version

data/helpers/v2/lib/functions.rb

@@ -152,6 +152,9 @@ module Functions
     Bundler.ui = Bundler::UI::Silent.new
 
     Bundler.settings.set_command_option("forget_cli_options", "true")
+
+    # Native helpers rely on dependency unlocking, so Bundler should never be frozen
+    Bundler.settings.set_command_option("frozen", "false")
   end
 
   def self.relevant_credentials(credentials)

data/helpers/v2/spec/functions/dependency_source_spec.rb

@@ -96,11 +96,11 @@ RSpec.describe Functions::DependencySource do
       end
 
       it "blows up with a useful error" do
-        error_class = Bundler::Fetcher::BadAuthenticationError
+        error_class = Bundler::Fetcher::AuthenticationForbiddenError
         expect { private_registry_versions }
           .to raise_error do |error|
             expect(error).to be_a(error_class)
-            expect(error.message).to include("Bad username or password for")
+            expect(error.message).to include("Access token could not be authenticated for")
           end
       end
     end
@@ -126,7 +126,7 @@ RSpec.describe Functions::DependencySource do
           .to raise_error do |error|
             expect(error).to be_a(Bundler::HTTPError)
             expect(error.message)
-              .to include("Could not fetch specs from")
+              .to include("Could not fetch specs from #{registry_url} due to underlying error")
           end
       end
     end

data/lib/dependabot/bundler/file_fetcher.rb

@@ -1,6 +1,7 @@
 # typed: false
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 require "dependabot/bundler/file_updater/lockfile_updater"
@@ -9,6 +10,9 @@ require "dependabot/errors"
 module Dependabot
   module Bundler
     class FileFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+      extend T::Helpers
+
       require "dependabot/bundler/file_fetcher/gemspec_finder"
       require "dependabot/bundler/file_fetcher/path_gemspec_finder"
       require "dependabot/bundler/file_fetcher/child_gemfile_finder"
@@ -32,8 +36,7 @@ module Dependabot
         }
       end
 
-      private
-
+      sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files << gemfile if gemfile
@@ -55,6 +58,8 @@ module Dependabot
         fetched_files
       end
 
+      private
+
       def uniq_files(fetched_files)
         uniq_files = fetched_files.reject(&:support_file?).uniq
         uniq_files += fetched_files

data/lib/dependabot/bundler/native_helpers.rb

@@ -1,32 +1,43 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "bundler"
+require "sorbet-runtime"
 require "dependabot/shared_helpers"
 
 module Dependabot
   module Bundler
     module NativeHelpers
+      extend T::Sig
+      extend T::Generic
+
       class BundleCommand
+        extend T::Sig
+
         MAX_SECONDS = 1800
         MIN_SECONDS = 60
 
+        sig { params(timeout_seconds: T.nilable(Integer)).void }
         def initialize(timeout_seconds)
-          @timeout_seconds = clamp(timeout_seconds)
+          @timeout_seconds = T.let(clamp(timeout_seconds), Integer)
         end
 
+        sig { params(script: String).returns(String) }
         def build(script)
           [timeout_command, :ruby, script].compact.join(" ")
         end
 
         private
 
+        sig { returns(Integer) }
         attr_reader :timeout_seconds
 
+        sig { returns(T.nilable(String)) }
         def timeout_command
           "timeout -s HUP #{timeout_seconds}" unless timeout_seconds.zero?
         end
 
+        sig { params(seconds: T.nilable(Integer)).returns(Integer) }
         def clamp(seconds)
           return 0 unless seconds
 
@@ -34,6 +45,15 @@ module Dependabot
         end
       end
 
+      sig do
+        params(
+          function: String,
+          args: T::Hash[Symbol, String],
+          bundler_version: String,
+          options: T::Hash[Symbol, T.untyped]
+        )
+          .returns(T.untyped)
+      end
       def self.run_bundler_subprocess(function:, args:, bundler_version:, options: {})
         # Run helper suprocess with all bundler-related ENV variables removed
         helpers_path = versioned_helper_path(bundler_version)
@@ -60,10 +80,12 @@ module Dependabot
         end
       end
 
+      sig { params(bundler_major_version: String).returns(String) }
       def self.versioned_helper_path(bundler_major_version)
         File.join(native_helpers_root, "v#{bundler_major_version}")
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "bundler") unless helpers_root.nil?

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -24,8 +24,9 @@ module Dependabot
           MISSING_AUTH_REGEX = /bundle config (?:set --global )?(?<source>.*) username:password/
 
           BAD_AUTH_REGEX = /Bad username or password for (?<source>.*)\.$/
+          FORBIDDEN_AUTH_REGEX = /Access token could not be authenticated for (?<source>.*)\.$/
           BAD_CERT_REGEX = /verify the SSL certificate for (?<source>.*)\.$/
-          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>.*)$/
+          HTTP_ERR_REGEX = /Could not fetch specs from (?<source>\S+)/
         end
 
         RETRYABLE_ERRORS = %w(
@@ -133,6 +134,10 @@ module Dependabot
             regex = BundlerErrorPatterns::MISSING_AUTH_REGEX
             source = error.message.match(regex)[:source]
             raise Dependabot::PrivateSourceAuthenticationFailure, source
+          when "Bundler::Fetcher::AuthenticationForbiddenError"
+            regex = BundlerErrorPatterns::FORBIDDEN_AUTH_REGEX
+            source = error.message.match(regex)[:source]
+            raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::BadAuthenticationError"
             regex = BundlerErrorPatterns::BAD_AUTH_REGEX
             source = error.message.match(regex)[:source]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.236.0
+  version: 0.237.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-26 00:00:00.000000000 Z
+date: 2023-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.237.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.236.0
+        version: 0.237.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -94,20 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec-sorbet
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.56.0
+        version: 1.57.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -282,7 +296,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.236.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.237.0
 post_install_message: 
 rdoc_options: []
 require_paths: