dependabot-bundler 0.293.0 → 0.294.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c55f6a2180b66147c8e9a848447d253edbc94e067e93664e2bf299adee37d1c7
-  data.tar.gz: 2836e8a29140eba59fdb5e6a16e3e460c236007c9d2c1f9c2b7444f0500510f9
+  metadata.gz: ea55f401ee91f93504d7b0c6ef45f14b1d6b3a729830c5090ce31fe309425add
+  data.tar.gz: 89e1acee2cba3451d660f5cfe54ba52b43ebce4aa8e79399a7ff9ece241c4b93
 SHA512:
-  metadata.gz: 77ebfa910168259f5ce8228794e090aee255720ce2f1b9ba39b734909d1fdc148b6536d83cc405930e2df4eb6aeb8d48f86837d7aa5a5d73ab001fbb4413788c
-  data.tar.gz: 6daa5c21ed5d6fb37e1c9dc3f41385bf43e90e66934bd346f2262641202681727b6915539deef5f60e423bdef0a932a5efbc9922b9473533183fbba559ba61a4
+  metadata.gz: ed004691bff5b07c9f3b3e910cc4b2b9d36b067bc012bb1acb76ce2698b0642bdace106c0f91c30891d40faeb61910162b0cc3501c835caec69f06b434f82e23
+  data.tar.gz: 8aa29af8206e1ec201e040ab59f8580fcd898f970a54bc60babd21179ba15f1d77415a20f3d147423508f5ed331d2daa6fe01f4512dc9deae7378b7642fd719b

data/helpers/v2/monkey_patches/git_source_patch.rb

@@ -55,7 +55,7 @@ module Bundler
           spec = Bundler.load_gemspec(spec_path)
           next unless spec
 
-          Bundler.rubygems.set_installed_by_version(spec)
+          spec.installed_by_version = Gem::VERSION
           Bundler.rubygems.validate(spec)
           File.binwrite(spec_path, spec.to_ruby)
         end

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -7,19 +7,23 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemfileUpdater
+        extend T::Sig
+
         GEMFILE_FILENAMES = %w(Gemfile gems.rb).freeze
 
         require_relative "git_pin_replacer"
         require_relative "git_source_remover"
         require_relative "requirement_replacer"
 
+        sig { params(dependencies: T::Array[Dependabot::Dependency], gemfile: Dependabot::DependencyFile).void }
         def initialize(dependencies:, gemfile:)
           @dependencies = dependencies
           @gemfile = gemfile
         end
 
+        sig { returns(String) }
         def updated_gemfile_content
-          content = gemfile.content
+          content = T.must(gemfile.content)
 
           dependencies.each do |dependency|
             content = replace_gemfile_version_requirement(
@@ -38,21 +42,27 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemfile
 
+        sig do
+          params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile, content: String).returns(String)
+        end
         def replace_gemfile_version_requirement(dependency, file, content)
           return content unless requirement_changed?(file, dependency)
 
           updated_requirement =
             dependency.requirements
                       .find { |r| r[:file] == file.name }
-                      .fetch(:requirement)
+                      &.fetch(:requirement)
 
           previous_requirement =
             dependency.previous_requirements
-                      .find { |r| r[:file] == file.name }
-                      .fetch(:requirement)
+                      &.find { |r| r[:file] == file.name }
+                      &.fetch(:requirement)
 
           RequirementReplacer.new(
             dependency: dependency,
@@ -62,17 +72,19 @@ module Dependabot
           ).rewrite(content)
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def remove_git_source?(dependency)
           old_gemfile_req =
             dependency.previous_requirements
-                      .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      &.find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
 
           return false unless old_gemfile_req&.dig(:source, :type) == "git"
 
@@ -80,9 +92,10 @@ module Dependabot
             dependency.requirements
                       .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
 
-          new_gemfile_req[:source].nil?
+          T.must(new_gemfile_req)[:source].nil?
         end
 
+        sig { params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile).returns(T::Boolean) }
         def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements
@@ -91,18 +104,23 @@ module Dependabot
 
           # If the new requirement is a git dependency with a ref then there's
           # no harm in doing an update
-          new_gemfile_req.dig(:source, :ref)
+          !T.must(new_gemfile_req).dig(:source, :ref).nil?
         end
 
+        sig { params(dependency: Dependabot::Dependency, content: String).returns(String) }
         def remove_gemfile_git_source(dependency, content)
           GitSourceRemover.new(dependency: dependency).rewrite(content)
         end
 
+        sig do
+          params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile, content: String).returns(String)
+        end
         def update_gemfile_git_pin(dependency, file, content)
           new_pin =
             dependency.requirements
                       .find { |f| f[:file] == file.name }
-                      .fetch(:source).fetch(:ref)
+                      &.fetch(:source)
+                      &.fetch(:ref)
 
           GitPinReplacer
             .new(dependency: dependency, new_pin: new_pin)

data/lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -8,13 +8,20 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemspecDependencyNameFinder
+        extend T::Sig
+
+        ChildNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, String)) }
+
+        sig { returns(String) }
         attr_reader :gemspec_content
 
+        sig { params(gemspec_content: String).void }
         def initialize(gemspec_content:)
           @gemspec_content = gemspec_content
         end
 
         # rubocop:disable Security/Eval
+        sig { returns(T.nilable(String)) }
         def dependency_name
           ast = Parser::CurrentRuby.parse(gemspec_content)
           dependency_name_node = find_dependency_name_node(ast)
@@ -30,6 +37,7 @@ module Dependabot
 
         private
 
+        sig { params(node: ChildNode).returns(T.nilable(Parser::AST::Node)) }
         def find_dependency_name_node(node)
           return unless node.is_a?(Parser::AST::Node)
           return node if declares_dependency_name?(node)
@@ -40,6 +48,7 @@ module Dependabot
           end
         end
 
+        sig { params(node: ChildNode).returns(T::Boolean) }
         def declares_dependency_name?(node)
           return false unless node.is_a?(Parser::AST::Node)
 

data/lib/dependabot/bundler/file_updater/gemspec_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -9,13 +9,17 @@ module Dependabot
       class GemspecUpdater
         require_relative "requirement_replacer"
 
+        extend T::Sig
+
+        sig { params(dependencies: T::Array[Dependabot::Dependency], gemspec: Dependabot::DependencyFile).void }
         def initialize(dependencies:, gemspec:)
-          @dependencies = dependencies
-          @gemspec = gemspec
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @gemspec = T.let(gemspec, Dependabot::DependencyFile)
         end
 
+        sig { returns(String) }
         def updated_gemspec_content
-          content = gemspec.content
+          content = T.let(T.must(gemspec.content), String)
 
           dependencies.each do |dependency|
             content = replace_gemspec_version_requirement(
@@ -28,21 +32,28 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :gemspec
 
+        sig do
+          params(gemspec: Dependabot::DependencyFile, dependency: Dependabot::Dependency,
+                 content: String).returns(String)
+        end
         def replace_gemspec_version_requirement(gemspec, dependency, content)
           return content unless requirement_changed?(gemspec, dependency)
 
           updated_requirement =
-            dependency.requirements
-                      .find { |r| r[:file] == gemspec.name }
-                      .fetch(:requirement)
+            T.must(dependency.requirements
+                      .find { |r| r[:file] == gemspec.name })
+             .fetch(:requirement)
 
           previous_requirement =
-            dependency.previous_requirements
-                      .find { |r| r[:file] == gemspec.name }
-                      .fetch(:requirement)
+            T.must(T.must(dependency.previous_requirements)
+                      .find { |r| r[:file] == gemspec.name })
+             .fetch(:requirement)
 
           RequirementReplacer.new(
             dependency: dependency,
@@ -52,9 +63,10 @@ module Dependabot
           ).rewrite(content)
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end

data/lib/dependabot/bundler/file_updater/ruby_requirement_setter.rb

@@ -9,12 +9,12 @@ module Dependabot
   module Bundler
     class FileUpdater
       class RubyRequirementSetter
-        class RubyVersionNotFound < StandardError; end
-
         RUBY_VERSIONS = %w(
           1.8.7 1.9.3 2.0.0 2.1.10 2.2.10 2.3.8 2.4.10 2.5.9 2.6.9 2.7.6 3.0.6 3.1.6 3.2.4 3.3.6
         ).freeze
 
+        LANGUAGE = "ruby"
+
         attr_reader :gemspec
 
         def initialize(gemspec:)
@@ -62,7 +62,13 @@ module Dependabot
             .map { |v| Gem::Version.new(v) }.sort
             .find { |v| requirement.satisfied_by?(v) }
 
-          raise RubyVersionNotFound unless ruby_version
+          unless ruby_version
+            raise ToolVersionNotSupported.new(
+              LANGUAGE,
+              requirement.to_s,
+              RUBY_VERSIONS.join(", ")
+            )
+          end
 
           ruby_version
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.293.0
+  version: 0.294.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-16 00:00:00.000000000 Z
+date: 2025-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.293.0
+        version: 0.294.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.293.0
+        version: 0.294.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.293.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.294.0
 post_install_message:
 rdoc_options: []
 require_paths: