dependabot-bundler 0.294.0 → 0.295.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea55f401ee91f93504d7b0c6ef45f14b1d6b3a729830c5090ce31fe309425add
-  data.tar.gz: 89e1acee2cba3451d660f5cfe54ba52b43ebce4aa8e79399a7ff9ece241c4b93
+  metadata.gz: 532e630972469774f8e29af1f314691ee4ed0ad880860c01675d54c1f10590d8
+  data.tar.gz: 2912cadecb1d9fec7fd793ec2ab7e17bf5e807fe0ab86d3cda574e6acbe569d8
 SHA512:
-  metadata.gz: ed004691bff5b07c9f3b3e910cc4b2b9d36b067bc012bb1acb76ce2698b0642bdace106c0f91c30891d40faeb61910162b0cc3501c835caec69f06b434f82e23
-  data.tar.gz: 8aa29af8206e1ec201e040ab59f8580fcd898f970a54bc60babd21179ba15f1d77415a20f3d147423508f5ed331d2daa6fe01f4512dc9deae7378b7642fd719b
+  metadata.gz: 335795149b582fdc7ed996ad5ed20e3ca5736facc4f557aaddb811198eb319ba8ae30dbbf31ae36bba9e06eb67e509c21a6543f8154a7827dea28f2992cc0474
+  data.tar.gz: 25e3ca306fecb0e2f4ca0f1c66682d6b43336bbfec71b73674dca2cfbc7d1ee15f03b7110d74639872496692729cad18a613a5ba00fa0050554e880550e13086

data/lib/dependabot/bundler/file_parser/file_preparer.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb

@@ -10,7 +10,7 @@ module Dependabot
       class GemspecDependencyNameFinder
         extend T::Sig
 
-        ChildNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, String)) }
+        ChildNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, String, Integer, Float)) }
 
         sig { returns(String) }
         attr_reader :gemspec_content

data/lib/dependabot/bundler/file_updater/gemspec_sanitizer.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "parser/current"
@@ -8,6 +8,8 @@ module Dependabot
   module Bundler
     class FileUpdater
       class GemspecSanitizer
+        extend T::Sig
+
         UNNECESSARY_ASSIGNMENTS = %i(
           bindir=
           cert_chain=
@@ -23,12 +25,15 @@ module Dependabot
           rdoc_options=
         ).freeze
 
+        sig { returns(String) }
         attr_reader :replacement_version
 
+        sig { params(replacement_version: T.any(String, Integer, Gem::Version)).void }
         def initialize(replacement_version:)
-          @replacement_version = replacement_version
+          @replacement_version = T.let(replacement_version.to_s, String)
         end
 
+        sig { params(content: String).returns(String) }
         def rewrite(content)
           buffer = Parser::Source::Buffer.new("(gemspec_content)")
           buffer.source = content
@@ -47,10 +52,16 @@ module Dependabot
         end
 
         class Rewriter < Parser::TreeRewriter
+          extend T::Sig
+
+          ParserNode = T.type_alias { T.nilable(T.any(Parser::AST::Node, Symbol, Integer, String, Float)) }
+
+          sig { params(replacement_version: String).void }
           def initialize(replacement_version:)
             @replacement_version = replacement_version
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def on_send(node)
             # Wrap any `require` or `require_relative` calls in a rescue
             # block, as we might not have the required files
@@ -82,12 +93,15 @@ module Dependabot
 
           private
 
+          sig { returns(String) }
           attr_reader :replacement_version
 
+          sig { params(node: Parser::AST::Node).returns(T::Boolean) }
           def requires_file?(node)
             %i(require require_relative).include?(node.children[1])
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def wrap_require(node)
             replace(
               node.loc.expression,
@@ -98,6 +112,7 @@ module Dependabot
             )
           end
 
+          sig { params(node: ParserNode).void }
           def replace_version_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -106,6 +121,7 @@ module Dependabot
             node.children.each { |child| replace_version_assignments(child) }
           end
 
+          sig { params(node: ParserNode).void }
           def replace_version_constant_references(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -116,6 +132,7 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).void }
           def replace_file_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -124,6 +141,7 @@ module Dependabot
             node.children.each { |child| replace_file_assignments(child) }
           end
 
+          sig { params(node: ParserNode).void }
           def replace_require_paths_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -134,6 +152,7 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_to_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -146,6 +165,7 @@ module Dependabot
             node_interpolates_version_constant?(node.children.last)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_files_to_var?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -155,6 +175,7 @@ module Dependabot
             node_dynamically_lists_files?(node.children[2])
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_dynamically_lists_files?(node)
             return false unless node.is_a?(Parser::AST::Node)
 
@@ -163,6 +184,7 @@ module Dependabot
             node.type == :block && node.children.first&.type == :send
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_assigns_require_paths?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -171,6 +193,7 @@ module Dependabot
             node.children[1] == :require_paths=
           end
 
+          sig { params(node: ParserNode).void }
           def replace_file_reads(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -180,6 +203,7 @@ module Dependabot
             node.children.each { |child| replace_file_reads(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_reads_a_file?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -189,6 +213,7 @@ module Dependabot
             node.children[1] == :read
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_uses_readlines?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -198,6 +223,7 @@ module Dependabot
             node.children[1] == :readlines
           end
 
+          sig { params(node: ParserNode).void }
           def replace_json_parses(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -206,6 +232,7 @@ module Dependabot
             node.children.each { |child| replace_json_parses(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_parses_json?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -215,6 +242,7 @@ module Dependabot
             node.children[1] == :parse
           end
 
+          sig { params(node: ParserNode).void }
           def remove_find_dot_find_args(node)
             return unless node.is_a?(Parser::AST::Node)
             return if node.children[1] == :version=
@@ -223,6 +251,7 @@ module Dependabot
             node.children.each { |child| remove_find_dot_find_args(child) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_calls_find_dot_find?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -232,6 +261,7 @@ module Dependabot
             node.children[1] == :find
           end
 
+          sig { params(node: ParserNode).void }
           def remove_unnecessary_assignments(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -247,8 +277,9 @@ module Dependabot
             end
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_includes_heredoc?(node)
-            find_heredoc_end_range(node)
+            !!find_heredoc_end_range(node)
           end
 
           # Performs a depth-first search for the first heredoc in the given
@@ -256,6 +287,7 @@ module Dependabot
           #
           # Returns a Parser::Source::Range identifying the location of the end
           #   of the heredoc, or nil if no heredoc was found.
+          sig { params(node: ParserNode).returns(T.nilable(Parser::Source::Range)) }
           def find_heredoc_end_range(node)
             return unless node.is_a?(Parser::AST::Node)
 
@@ -271,6 +303,7 @@ module Dependabot
             nil
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def unnecessary_assignment?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.children.first.is_a?(Parser::AST::Node)
@@ -278,9 +311,10 @@ module Dependabot
             return true if node.children.first.type == :lvar &&
                            UNNECESSARY_ASSIGNMENTS.include?(node.children[1])
 
-            node.children[1] == :[]= && node.children.first.children.last
+            !!(node.children[1] == :[]= && node.children.first.children.last)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_is_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :const
@@ -288,6 +322,7 @@ module Dependabot
             node.children.last.to_s.match?(/version/i)
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_calls_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :send
@@ -295,6 +330,7 @@ module Dependabot
             node.children.any? { |n| node_is_version_constant?(n) }
           end
 
+          sig { params(node: ParserNode).returns(T::Boolean) }
           def node_interpolates_version_constant?(node)
             return false unless node.is_a?(Parser::AST::Node)
             return false unless node.type == :dstr
@@ -305,6 +341,7 @@ module Dependabot
                 .any? { |n| node_is_version_constant?(n) }
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_constant(node)
             case node.children.last&.type
             when :str, :int then nil # no-op
@@ -318,18 +355,22 @@ module Dependabot
             end
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_assignment(node)
             replace(node.children.last.loc.expression, "[]")
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_require_paths_assignment(node)
             replace(node.children.last.loc.expression, "['lib']")
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_read(node)
             replace(node.loc.expression, %("#{replacement_version}"))
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_json_parse(node)
             replace(
               node.loc.expression,
@@ -337,10 +378,12 @@ module Dependabot
             )
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def replace_file_readlines(node)
             replace(node.loc.expression, %(["#{replacement_version}"]))
           end
 
+          sig { params(node: Parser::AST::Node).void }
           def remove_find_args(node)
             last_arg = node.children.last
 

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -52,6 +52,9 @@ module Dependabot
 
         def force_update
           requirement = dependency.requirements.find { |req| req[:file] == gemfile.name }
+
+          valid_gem_version?(target_version)
+
           manifest_requirement_not_satisfied = requirement && !Requirement.satisfied_by?(requirement, target_version)
 
           if manifest_requirement_not_satisfied && requirements_update_strategy.lockfile_only?
@@ -80,6 +83,15 @@ module Dependabot
           end
         end
 
+        def valid_gem_version?(target_version)
+          # to rule out empty, non gem info ending up in as target_version
+          return true if target_version.is_a?(Gem::Version)
+
+          Dependabot.logger.warn("Bundler force update called with a non-Gem::Version #{target_version}")
+
+          raise Dependabot::DependencyFileNotResolvable
+        end
+
         def original_dependencies
           @original_dependencies ||=
             FileParser.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.294.0
+  version: 0.295.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-23 00:00:00.000000000 Z
+date: 2025-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.294.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
 post_install_message:
 rdoc_options: []
 require_paths: