RubyGems - dependabot-bundler - Versions diffs - 0.303.0 → 0.304.0 - Mend

dependabot-bundler 0.303.0 → 0.304.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fea7b824346608c85aa153277a3d95c1490b32601fd390390bad519a76264b69
-  data.tar.gz: 50530f2584e007afa21e905f9ef29cb7e9fe894b7bc5127fa6001ad19be805a3
+  metadata.gz: afac5aac6bfb6ee45bfa6a928dcd47663352670e32334a78859f6062cdf5e38e
+  data.tar.gz: 9a5c98bda93d938912881fdc6d4407304d485795e6e170c2256b462f8a967546
 SHA512:
-  metadata.gz: cc9b5a20c3812ca94c287432710e021c925c75e6bfd044a6d084e97d0c1f00f4ab51f46ef9015202c9de75b8627445c3c0a31b3c2d198462fde57ab7e8b0976a
-  data.tar.gz: a91e3098508822b8afb01ec20feb86d1e3dba8631be244629869560635e414256e8f0c4628c1cb00fcbe1a019460fe7fb5a14292d6a973f92ad6269538ab24dc
+  metadata.gz: 19e479a5ea88a9a770c780172b9a1e07cd8a694a3b22825adb348257126871490fe044d56da48a81ca02973cbd0835e5d681a752e4405c3fe0cda3f7c2cda57e
+  data.tar.gz: 45aa64aef52bfca8cb704e1eab1af719ac4a59d3f806e5a4cd412f7ebf234a336fcab74f8e0b56ee749f1ceb92a0b578e0aecf715886a4f1d1960249c7badf11

data/lib/dependabot/bundler/package/package_details_fetcher.rb CHANGED Viewed

@@ -18,12 +18,20 @@ module Dependabot
       class PackageDetailsFetcher
         extend T::Sig
+        require_relative "../update_checker/shared_bundler_helpers"
+        include Dependabot::Bundler::UpdateChecker::SharedBundlerHelpers
         RELEASES_URL = "https://rubygems.org/api/v1/versions/%s.json"
         GEM_URL = "https://rubygems.org/gems/%s.gem"
         PACKAGE_TYPE = "gem"
         PACKAGE_LANGUAGE = "ruby"
         APPLICATION_JSON = "application/json"
+        RUBYGEMS = "rubygems"
+        PRIVATE_REGISTRY = "private"
+        GIT = "git"
+        OTHER = "other"
         sig do
           params(
             dependency: Dependabot::Dependency,
@@ -35,6 +43,8 @@ module Dependabot
           @dependency = dependency
           @dependency_files = dependency_files
           @credentials = credentials
+          @source_type = T.let(nil, T.nilable(String))
         end
         sig { returns(Dependabot::Dependency) }
@@ -46,6 +56,21 @@ module Dependabot
         sig { returns(T::Array[T.untyped]) }
         attr_reader :credentials
+        sig { returns(Dependabot::Package::PackageDetails) }
+        def fetch
+          return rubygems_versions if dependency.name == "bundler"
+          return rubygems_versions unless gemfile
+          case source_type
+          when OTHER, GIT, PRIVATE_REGISTRY
+            package_details([])
+          else
+            rubygems_versions
+          end
+        end
+        private
         # Example JSON Response Format:
         # eg https://rubygems.org/api/v1/versions/dependabot-common.json
         # response:
@@ -101,35 +126,23 @@ module Dependabot
         # ...
         # ]
         sig { returns(Dependabot::Package::PackageDetails) }
-        def fetch
+        def rubygems_versions
           response = registry_json_response_for_dependency
           raise unless response.status == 200
           package_releases = JSON.parse(response.body).map do |release|
-            Dependabot::Package::PackageRelease.new(
-              version: Dependabot::Bundler::Version.new(release["number"]),
+            package_release(
+              version: release["number"],
               released_at: Time.parse(release["created_at"]),
-              yanked: false,
-              yanked_reason: nil,
               downloads: release["downloads_count"],
               url: GEM_URL % "#{@dependency.name}-#{release['number']}",
-              package_type: PACKAGE_TYPE,
-              language: Dependabot::Package::PackageLanguage.new(
-                name: PACKAGE_LANGUAGE,
-                version: nil,
-                requirement: language_requirement(release["ruby_version"])
-              )
+              ruby_version: release["ruby_version"]
             )
           end
-          Dependabot::Package::PackageDetails.new(
-            dependency: dependency,
-            releases: package_releases.reverse.uniq(&:version)
-          )
+          package_details(package_releases)
         end
-        private
         sig { returns(Excon::Response) }
         def registry_json_response_for_dependency
           url = RELEASES_URL % dependency.name
@@ -143,6 +156,72 @@ module Dependabot
         def language_requirement(req_string)
           Requirement.new(req_string)
         end
+        sig { returns(String) }
+        def source_type
+          @source_type ||= begin
+            return @source_type = RUBYGEMS unless gemfile
+            @source_type = in_a_native_bundler_context do |tmp_dir|
+              NativeHelpers.run_bundler_subprocess(
+                bundler_version: bundler_version,
+                function: "dependency_source_type",
+                options: {}, # options,
+                args: {
+                  dir: tmp_dir,
+                  gemfile_name: gemfile.name,
+                  dependency_name: dependency.name,
+                  credentials: credentials
+                }
+              )
+            end
+          end
+        end
+        sig { override.returns(String) }
+        def bundler_version
+          @bundler_version ||= T.let(Helpers.bundler_version(lockfile), T.nilable(String))
+        end
+        sig do
+          params(releases: T::Array[Dependabot::Package::PackageRelease])
+            .returns(Dependabot::Package::PackageDetails)
+        end
+        def package_details(releases)
+          @package_details ||= T.let(
+            Dependabot::Package::PackageDetails.new(
+              dependency: dependency,
+              releases: releases.reverse.uniq(&:version)
+            ), T.nilable(Dependabot::Package::PackageDetails)
+          )
+        end
+        sig do
+          params(
+            version: String,
+            released_at: Time,
+            downloads: Integer,
+            url: String,
+            ruby_version: String,
+            yanked: T::Boolean
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def package_release(version:, released_at:, downloads:, url:, ruby_version:, yanked: false)
+          Dependabot::Package::PackageRelease.new(
+            version: Dependabot::Bundler::Version.new(version),
+            released_at: released_at,
+            yanked: yanked,
+            yanked_reason: nil,
+            downloads: downloads,
+            url: url,
+            package_type: PACKAGE_TYPE,
+            language: Dependabot::Package::PackageLanguage.new(
+              name: PACKAGE_LANGUAGE,
+              version: nil,
+              requirement: language_requirement(ruby_version)
+            )
+          )
+        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb CHANGED Viewed

@@ -4,12 +4,13 @@
 require "dependabot/registry_client"
 require "dependabot/bundler/native_helpers"
 require "dependabot/bundler/helpers"
+require "dependabot/bundler/update_checker/latest_version_finder"
 require "sorbet-runtime"
 module Dependabot
   module Bundler
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         class DependencySource
           extend T::Sig

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb CHANGED Viewed

@@ -8,46 +8,54 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/bundler/requirement"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/package/package_latest_version_finder"
 require "dependabot/bundler/update_checker/latest_version_finder/" \
         "dependency_source"
+require "dependabot/bundler/package/package_details_fetcher"
 require "sorbet-runtime"
 module Dependabot
   module Bundler
     class UpdateChecker
-      class LatestVersionFinder
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
         extend T::Sig
-        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
-                       credentials:, ignored_versions:, raise_on_ignored: false,
-                       security_advisories:, options:)
-          @dependency          = dependency
-          @dependency_files    = dependency_files
-          @repo_contents_path  = repo_contents_path
-          @credentials         = credentials
-          @ignored_versions    = ignored_versions
-          @raise_on_ignored    = raise_on_ignored
-          @security_advisories = security_advisories
-          @options             = options
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details
+          @package_details ||= Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).fetch
         end
         def latest_version_details
-          @latest_version_details ||= fetch_latest_version_details
+          @latest_version_details ||= if cooldown_enabled?
+                                        latest_version = fetch_latest_version(language_version: nil)
+                                        latest_version ? { version: latest_version } : nil
+                                      else
+                                        fetch_latest_version_details
+                                      end
         end
-        def lowest_security_fix_version
-          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_bundler)
         end
-        private
+        sig { override.returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def available_versions
+          return nil if package_details&.releases.nil?
+          source_versions = dependency_source.versions
+          return [] if source_versions.empty?
-        attr_reader :dependency
-        attr_reader :dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
-        attr_reader :ignored_versions
-        attr_reader :security_advisories
-        attr_reader :options
+          T.must(package_details).releases.select do |release|
+            source_versions.any? { |v| v.to_s == release.version.to_s }
+          end
+        end
+        private
         def fetch_latest_version_details
           return dependency_source.latest_git_version_details if dependency_source.git?
@@ -59,7 +67,7 @@ module Dependabot
           relevant_versions.empty? ? nil : { version: relevant_versions.max }
         end
-        def fetch_lowest_security_fix_version
+        def fetch_lowest_security_fix_version(*)
           return if dependency_source.git?
           relevant_versions = dependency_source.versions
@@ -72,41 +80,9 @@ module Dependabot
           relevant_versions.min
         end
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-        def filter_prerelease_versions(versions_array)
-          return versions_array if wants_prerelease?
-          filtered = versions_array.reject(&:prerelease?)
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
-          end
-          filtered
-        end
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-        def filter_ignored_versions(versions_array)
-          filtered = versions_array
-                     .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
-          if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions_array).any?
-            raise AllVersionsIgnored
-          end
-          if versions_array.count > filtered.count
-            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
-          end
-          filtered
-        end
-        def filter_lower_versions(versions_array)
-          return versions_array unless dependency.numeric_version
-          versions_array
-            .select { |version| version > dependency.numeric_version }
-        end
+        sig { returns(T::Boolean) }
         def wants_prerelease?
-          @wants_prerelease ||=
+          @wants_prerelease ||= T.let(
             begin
               current_version = dependency.numeric_version
               if current_version&.prerelease?
@@ -116,30 +92,21 @@ module Dependabot
                   req[:requirement].match?(/[a-z]/i)
                 end
               end
-            end
+            end, T.nilable(T::Boolean)
+          )
         end
+        # sig { returns(DependencySource) }
         def dependency_source
-          @dependency_source ||= DependencySource.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            options: options
+          @dependency_source ||= T.let(
+            DependencySource.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              options: options
+            ), T.nilable(DependencySource)
           )
         end
-        def ignore_requirements
-          ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
-        end
-        def requirement_class
-          dependency.requirement_class
-        end
-        def gemfile
-          dependency_files.find { |f| f.name == "Gemfile" } ||
-            dependency_files.find { |f| f.name == "gems.rb" }
-        end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/version_resolver.rb CHANGED Viewed

@@ -26,6 +26,7 @@ module Dependabot
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
                        latest_allowable_version: nil,
+                       cooldown_options: {},
                        options:)
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
@@ -37,6 +38,7 @@ module Dependabot
           @remove_git_source           = remove_git_source
           @unlock_requirement          = unlock_requirement
           @latest_allowable_version    = latest_allowable_version
+          @cooldown_options            = cooldown_options
           @options                     = options
           @latest_allowable_version_incompatible_with_ruby = false
@@ -183,7 +185,6 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: dependency_files,
-              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: @raise_on_ignored,

data/lib/dependabot/bundler/update_checker.rb CHANGED Viewed

@@ -367,7 +367,6 @@ module Dependabot
             LatestVersionFinder.new(
               dependency: dependency,
               dependency_files: prepared_dependency_files,
-              repo_contents_path: repo_contents_path,
               credentials: credentials,
               ignored_versions: ignored_versions,
               raise_on_ignored: raise_on_ignored,

metadata CHANGED Viewed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.303.0
+  version: 0.304.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-27 00:00:00.000000000 Z
+date: 2025-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -323,7 +323,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.304.0
 post_install_message:
 rdoc_options: []
 require_paths: