dependabot-bundler 0.385.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 497069e0c24769d144719c23a99658721135d964311c543b79e8e79118b57ff4
-  data.tar.gz: 3fb99af5f766180db6928c1f7d22ccc835feb0829eba150ed4d7a56b8fc3ebf7
+  metadata.gz: 0f0e20b61f6f25f9cab555ba872e5f1e087435c8262e077340dbd54ffc4d06b6
+  data.tar.gz: f25535c60a1fbb733644a2e0429cc9cac5a63150b757ac0b4f14788884f62f31
 SHA512:
-  metadata.gz: 336c256aeae0398b830cb8fe398f98d8e4bbba385cfa94f11ea6e415985bc567700f34c92b89f7e5ecd0521ed3e90eaa024e4c2a6049ab3a533ebfff25e971fd
-  data.tar.gz: 682c35977db40d6fce2b12792ca1b310a5b0db198e6a784cb27c55d11c63f2c712a68cda48d7e73b53db5447bcb62ff083c5b7fec824493c424e1cbac9ad5b01
+  metadata.gz: 0c80cce29ae7d8641213f9f6189627f3ef2e4d005b5039286638e7b7de35693744161b9c8668983ce46bc814c912c6264665060649f33c2ee43ad951f2faf399
+  data.tar.gz: 32a6267dd3b4e3682a726dafdcfc043e0259b3fee6881f8fbee7b35ab85ad9393a3d21a54ea39024f8ca70796a725d85fe05e76e479a9925e391e8ee0d049198

data/helpers/v2/monkey_patches/endpoint_specification_metadata_patch.rb

@@ -0,0 +1,33 @@
+# typed: false
+# frozen_string_literal: true
+
+require "bundler/endpoint_specification"
+
+# Bundler parses the metadata a registry's compact index (`/info/<gem>`)
+# returns per gem version. Its guard is `next unless v`, but an empty array
+# `[]` is truthy, so for an empty `checksum` it calls `Checksum.from_api(nil)`
+# -> `nil.match?(...)` and raises `Bundler::GemspecError` ("There was an error
+# parsing the metadata for the gem ..."), aborting the whole resolution.
+#
+# GitHub Packages serves this empty-checksum shape for some old gems (e.g.
+# failbot 2.0.1), so one such gem blocks every update for the repo. Compact-
+# index checksum verification landed in Bundler 2.5, so both the Bundler 2 and
+# Bundler 4 helpers parse checksums and need this patch (the Bundler 2 helper
+# activates ">= 2.4, < 3", i.e. a checksum-parsing 2.5+).
+#
+# Drop nil/empty metadata values before Bundler parses them. An empty checksum
+# carries nothing to verify, so skipping it is safe; well-formed values (and
+# genuinely malformed ones, which still raise) are untouched.
+module BundlerEndpointSpecificationMetadataPatch
+  def parse_metadata(data)
+    if data.respond_to?(:reject)
+      data = data.reject do |_key, value|
+        value.nil? || (value.respond_to?(:empty?) && value.empty?)
+      end
+    end
+
+    super
+  end
+end
+
+Bundler::EndpointSpecification.prepend(BundlerEndpointSpecificationMetadataPatch)

data/helpers/v2/run.rb

@@ -25,6 +25,7 @@ end
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
 require "git_source_patch"
+require "endpoint_specification_metadata_patch"
 
 require "functions"
 

data/helpers/v2/spec/bundler_endpoint_specification_metadata_patch_spec.rb

@@ -0,0 +1,49 @@
+# typed: false
+# frozen_string_literal: true
+
+require "native_spec_helper"
+
+RSpec.describe BundlerEndpointSpecificationMetadataPatch do
+  let(:spec_fetcher) { instance_double(Bundler::Fetcher, uri: URI("https://example.com")) }
+
+  def build_spec(metadata)
+    Bundler::EndpointSpecification.new("failbot", "2.0.1", "ruby", spec_fetcher, [], metadata)
+  end
+
+  it "does not raise when the registry serves an empty checksum array" do
+    expect { build_spec([["checksum", []]]) }.not_to raise_error
+  end
+
+  it "leaves the checksum unset for an empty checksum array" do
+    spec = build_spec([["checksum", []]])
+    expect(spec.checksum).to be_nil
+  end
+
+  # The compact-index parser can emit a value-less entry (`["checksum"]`) rather
+  # than an empty array, depending on the RubyGems GemParser version. Both shapes
+  # reach this code, so both must be tolerated.
+  it "does not raise when the checksum entry has no value at all" do
+    expect { build_spec([["checksum"]]) }.not_to raise_error
+  end
+
+  it "ignores nil and blank metadata values" do
+    expect { build_spec([["checksum", nil], ["ruby", []]]) }.not_to raise_error
+  end
+
+  it "still parses a well-formed checksum" do
+    digest = "f" * 64
+    spec = build_spec([["checksum", [digest]]])
+    expect(spec.checksum).not_to be_nil
+  end
+
+  it "still parses ruby and rubygems requirements" do
+    spec = build_spec([["ruby", [">= 3.1"]], ["rubygems", [">= 3.0"]], ["checksum", []]])
+    expect(spec.required_ruby_version.to_s).to eq(">= 3.1")
+    expect(spec.required_rubygems_version.to_s).to eq(">= 3.0")
+  end
+
+  it "still raises on a genuinely malformed (non-empty) checksum" do
+    expect { build_spec([["checksum", ["not-a-valid-digest"]]]) }
+      .to raise_error(Bundler::GemspecError)
+  end
+end

data/helpers/v2/spec/native_spec_helper.rb

@@ -21,6 +21,7 @@ $LOAD_PATH.unshift(File.expand_path("../../spec_helpers", __dir__))
 require "definition_ruby_version_patch"
 require "definition_bundler_version_patch"
 require "git_source_patch"
+require "endpoint_specification_metadata_patch"
 
 require "functions"
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -8,6 +8,7 @@ require "uri"
 require "dependabot/bundler/update_checker"
 require "dependabot/bundler/native_helpers"
 require "dependabot/bundler/helpers"
+require "dependabot/logger"
 require "dependabot/registry_client"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
@@ -41,9 +42,11 @@ module Dependabot
         # Raised by Bundler when a registry's compact index (`/info/<gem>`) returns
         # gem metadata it can't parse (e.g. an illformed `ruby:`/`rubygems:`
         # requirement). This means the *registry* served bad data, not that the
-        # user's dependency files are broken.
+        # user's dependency files are broken. The trailing `detail` capture keeps
+        # Bundler's own explanation (e.g. `Illformed requirement [...]`) so the
+        # exact parse failure is preserved rather than discarded.
         REGISTRY_METADATA_ERROR_REGEX =
-          /error parsing the metadata for the gem (?<gem>\S+) \((?<version>[^)]+)\)/
+          /error parsing the metadata for the gem (?<gem>\S+) \((?<version>[^)]+)\):?\s*(?<detail>.*)/m
 
         module BundlerErrorPatterns
           MISSING_AUTH_REGEX = /bundle config set --global (?<source>.*) username:password/
@@ -217,8 +220,22 @@ module Dependabot
           source = private_registry_source
           return nil unless source
 
+          # Bundler's original message identifies which gem/version the registry
+          # served unparseable metadata for, and why (e.g. the illformed
+          # requirement string). The structured job error only records the source
+          # host, so log the full message here to keep the offending gem
+          # diagnosable from the updater logs.
+          Dependabot.logger.error(
+            "Registry #{source} returned unparseable compact-index metadata for " \
+            "#{match[:gem]} (#{match[:version]}); raising PrivateSourceBadResponse. " \
+            "Original Bundler error: #{error.message.strip}"
+          )
+
+          parse_detail = match[:detail].to_s.strip.gsub(/\s*\n\s*/, "; ")
           detail = "Invalid gem metadata returned for #{match[:gem]} (#{match[:version]}) " \
                    "by the source: #{source}"
+          detail += " (#{parse_detail})" unless parse_detail.empty?
+
           Dependabot::PrivateSourceBadResponse.new(source, detail)
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -269,8 +269,10 @@ files:
 - helpers/v2/lib/functions/version_resolver.rb
 - helpers/v2/monkey_patches/definition_bundler_version_patch.rb
 - helpers/v2/monkey_patches/definition_ruby_version_patch.rb
+- helpers/v2/monkey_patches/endpoint_specification_metadata_patch.rb
 - helpers/v2/monkey_patches/git_source_patch.rb
 - helpers/v2/run.rb
+- helpers/v2/spec/bundler_endpoint_specification_metadata_patch_spec.rb
 - helpers/v2/spec/bundler_version_constraint_spec.rb
 - helpers/v2/spec/functions/conflicting_dependency_resolver_spec.rb
 - helpers/v2/spec/functions/dependency_source_spec.rb
@@ -351,7 +353,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib