dependabot-bundler 0.275.0 → 0.276.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32a209d032e7f6caf7f9f41b846d7e6897607b8952b1035a385f41594a849700
-  data.tar.gz: f3559e260e9cf8b437b363151b9a0001789a7fe0f360c95d9f5cb5aedf83f998
+  metadata.gz: 79a19d7a225becc8cf4c031542f0243f76aafbc06e7bddc5f07c18e81b0fa72f
+  data.tar.gz: 3ad916573eab9a1b62ec84183a1a1d8189a091bed5fe4c458c0154e238b1a3b0
 SHA512:
-  metadata.gz: 4b6016702987249bb6bc68e91360464c54765b2f6fd553eabcb157c04a26bb71ce85f2e48ed742979cb7d73a58d84bc74d82855c1616dc9928a364f9557d4e3f
-  data.tar.gz: 07aad64b7613b1efa409a73b405af03d9b1927ed0f6b67887a9e15ea1802f4059d17dce61664d74fa96b56353902d75c7ce491f499c46b7dee79a92257131b64
+  metadata.gz: d9e71142cd9048c31cf4ab29084b78f6e5612b0672b4afe0c23dd814b8d0f2470a0684b7c6675d03d14c698a40f569f8e7ac752879c0e65da204e5ef956b8c95
+  data.tar.gz: 443ba8a0babf33f236c6430087a5a3166abbf3d79cb915c388e4862301a3cf5bc6e566de3115ae2b1060636a5ca62a1b801220993bd9f83f461e58ca85f482bd

data/lib/dependabot/bundler/helpers.rb

@@ -1,35 +1,47 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 module Dependabot
   module Bundler
     module Helpers
+      extend T::Sig
+      extend T::Helpers
+
       V1 = "1"
       V2 = "2"
       # If we are updating a project with no Gemfile.lock, we default to the
       # newest version we support
       DEFAULT = V2
-      # If we are updating a project with a Gemfile.lock that does not specify
-      # the version it was bundled with, we failover to V1 on the assumption
-      # it was created with an old version that didn't add this information
-      FAILOVER = V1
-
       BUNDLER_MAJOR_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+)\./m
 
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.bundler_version(lockfile)
         return DEFAULT unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i >= 2 ? V2 : V1
+        elsif Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+          DEFAULT
         else
-          FAILOVER
+          failover_version
         end
       end
 
+      # If we are updating a project with a Gemfile.lock that does not specify
+      # the version it was bundled with, we failover to V1 on the assumption
+      # it was created with an old version that didn't add this information
+      sig { returns(String) }
+      def self.failover_version
+        return V2 if Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        V1
+      end
+
+      sig { params(lockfile: T.nilable(Dependabot::DependencyFile)).returns(String) }
       def self.detected_bundler_version(lockfile)
         return "unknown" unless lockfile
 
-        if (matches = lockfile.content.match(BUNDLER_MAJOR_VERSION_REGEX))
+        if (matches = lockfile.content&.match(BUNDLER_MAJOR_VERSION_REGEX))
           matches[:version].to_i.to_s
         else
           "unspecified"

data/lib/dependabot/bundler/package_manager.rb

@@ -9,9 +9,8 @@ module Dependabot
   module Bundler
     PACKAGE_MANAGER = "bundler"
 
-    SUPPORTED_BUNDLER_VERSIONS = T.let([
-      Version.new("2")
-    ].freeze, T::Array[Dependabot::Version])
+    # Keep versions in ascending order
+    SUPPORTED_BUNDLER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
 
     DEPRECATED_BUNDLER_VERSIONS = T.let([
       Version.new("1")
@@ -40,13 +39,12 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::Version]) }
       attr_reader :supported_versions
 
-      sig { override.returns(T::Boolean) }
-      def deprecated?
-        deprecated_versions.include?(version)
-      end
       sig { override.returns(T::Boolean) }
       def unsupported?
-        !deprecated? && version < supported_versions.first
+        # Check if the feature flag for Bundler v1 unsupported error is enabled.
+        return false unless Dependabot::Experiments.enabled?(:bundler_v1_unsupported_error)
+
+        supported_versions.all? { |supported| supported > version }
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.275.0
+  version: 0.276.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-12 00:00:00.000000000 Z
+date: 2024-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.276.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.275.0
+        version: 0.276.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -346,7 +346,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.275.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.276.0
 post_install_message: 
 rdoc_options: []
 require_paths: