dependabot-bundler 0.389.0 → 0.390.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b27c0ca95e53100edd2104766511302c6559cc4ebb099e304f2198337d940ab7
-  data.tar.gz: bada129a0da00144bdd4f600ce5dee62a90ef73943cfb7b75e4f55f0c94d28f7
+  metadata.gz: 0dac96c40d771c86c54ade253e41f44c096a49953f97a3a2732e365a7742e699
+  data.tar.gz: 3b300480b45f379249135aeaf77338678da10e128abf76c09c6d5ee3030f454f
 SHA512:
-  metadata.gz: 88f3032fe0d5aa2a747208d0dfcbeac1a57cdfa9eec18d193d17ac50a586cafdcb64dd15d42e24a8350c833747094561381f4dfb7c540a5a77a5ded124829334
-  data.tar.gz: 232bd45a635a8ad61404d957776977d25a1cf342fbe42025eeb14b629f0ff694ffd3a08bf47c059cb4a6e2ac60588d3261271c5af888076b92a9a22ba7229d3d
+  metadata.gz: 3d4953d692f99de6007cb8f64722d13a963d09cd20c01e3b3b1907907562fcd2d0551876b8ad40054c7ed77dcea490355c01dde2856845d1510eafc02689cb58
+  data.tar.gz: 73e2ed787f41f55aed80da27d17d443801536f7894b1fdfd4ec0711e70eef7a3dc82a3675ab8ae4740dce3b2f549b5b58ad8ae490b3a402636bfda7a8ec3aff0

data/lib/dependabot/bundler/file_parser.rb

@@ -104,7 +104,7 @@ module Dependabot
       sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(T::Boolean) }
       def git_source?(dependencies)
         dependencies.any? do |dep|
-          dep.requirements.any? { |req| req.fetch(:source)&.fetch(:type) == "git" }
+          dep.requirements.any? { |req| req.source_string("type") == "git" }
         end
       end
 
@@ -380,7 +380,7 @@ module Dependabot
       sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
       def production?(dependency)
         groups = dependency.requirements
-                           .flat_map { |r| r.fetch(:groups) }
+                           .flat_map { |r| r.groups || [] }
                            .map(&:to_s)
 
         return true if groups.empty?

data/lib/dependabot/bundler/file_updater/gemfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -56,18 +56,18 @@ module Dependabot
 
           updated_requirement =
             dependency.requirements
-                      .find { |r| r[:file] == file.name }
-                      &.fetch(:requirement)
+                      .find { |r| r.file == file.name }
+                      &.requirement_string
 
           previous_requirement =
             dependency.previous_requirements
-                      &.find { |r| r[:file] == file.name }
-                      &.fetch(:requirement)
+                      &.find { |r| r.file == file.name }
+                      &.requirement_string
 
           RequirementReplacer.new(
             dependency: dependency,
             file_type: :gemfile,
-            updated_requirement: updated_requirement,
+            updated_requirement: T.must(updated_requirement),
             previous_requirement: previous_requirement
           ).rewrite(content)
         end
@@ -77,34 +77,34 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def remove_git_source?(dependency)
           old_gemfile_req =
             dependency.previous_requirements
-                      &.find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      &.find { |f| GEMFILE_FILENAMES.include?(f.file) }
 
-          return false unless old_gemfile_req&.dig(:source, :type) == "git"
+          return false unless old_gemfile_req&.source_string("type") == "git"
 
           new_gemfile_req =
             dependency.requirements
-                      .find { |f| GEMFILE_FILENAMES.include?(f[:file]) }
+                      .find { |f| GEMFILE_FILENAMES.include?(f.file) }
 
-          T.must(new_gemfile_req)[:source].nil?
+          T.must(new_gemfile_req).source.nil?
         end
 
         sig { params(dependency: Dependabot::Dependency, file: Dependabot::DependencyFile).returns(T::Boolean) }
         def update_git_pin?(dependency, file)
           new_gemfile_req =
             dependency.requirements
-                      .find { |f| f[:file] == file.name }
-          return false unless new_gemfile_req&.dig(:source, :type) == "git"
+                      .find { |f| f.file == file.name }
+          return false unless new_gemfile_req&.source_string("type") == "git"
 
           # If the new requirement is a git dependency with a ref then there's
           # no harm in doing an update
-          !T.must(new_gemfile_req).dig(:source, :ref).nil?
+          !T.must(new_gemfile_req).source_string("ref").nil?
         end
 
         sig { params(dependency: Dependabot::Dependency, content: String).returns(String) }
@@ -118,12 +118,11 @@ module Dependabot
         def update_gemfile_git_pin(dependency, file, content)
           new_pin =
             dependency.requirements
-                      .find { |f| f[:file] == file.name }
-                      &.fetch(:source)
-                      &.fetch(:ref)
+                      .find { |f| f.file == file.name }
+                      &.source_string("ref")
 
           GitPinReplacer
-            .new(dependency: dependency, new_pin: new_pin)
+            .new(dependency: dependency, new_pin: T.must(new_pin))
             .rewrite(content)
         end
       end

data/lib/dependabot/bundler/file_updater/gemspec_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater"
@@ -51,21 +51,21 @@ module Dependabot
           updated_requirement =
             T.must(
               dependency.requirements
-                                    .find { |r| r[:file] == gemspec.name }
+                                    .find { |r| r.file == gemspec.name }
             )
-             .fetch(:requirement)
+             .requirement_string
 
           previous_requirement =
             T.must(
               T.must(dependency.previous_requirements)
-                                    .find { |r| r[:file] == gemspec.name }
+                                    .find { |r| r.file == gemspec.name }
             )
-             .fetch(:requirement)
+             .requirement_string
 
           RequirementReplacer.new(
             dependency: dependency,
             file_type: :gemspec,
-            updated_requirement: updated_requirement,
+            updated_requirement: T.must(updated_requirement),
             previous_requirement: previous_requirement
           ).rewrite(content)
         end
@@ -75,7 +75,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |f| f.file == file.name }
         end
       end
     end

data/lib/dependabot/bundler/file_updater/lockfile_updater.rb

@@ -29,9 +29,7 @@ module Dependabot
         # No `/m`: it would let the greedy `.*` in `entries` match newlines and
         # swallow the trailing `BUNDLED WITH` section. `^` is line-anchored anyway.
         CHECKSUMS_SECTION = /(^CHECKSUMS\n)(?<entries>(?:^  .*\n)+)/
-        BUNDLED_WITH_VERSION_REGEX = /BUNDLED WITH\s+(?<version>\d+\.\d+\.\d+)/m
         BUNDLER_CHECKSUM_ENTRY_REGEX = /^  bundler \([^)]+\).*\n?$/
-        MIN_BUNDLER_CHECKSUM_VERSION = Gem::Version.new("4.0.11")
 
         sig do
           params(
@@ -250,14 +248,17 @@ module Dependabot
           lockfile_content = T.must(lockfile).content
           return false unless lockfile_content&.include?("CHECKSUMS\n")
 
+          # Strip a bundler self-checksum only when the original CHECKSUMS
+          # section did not contain one. If the original pins one,
+          # restore_bundler_checksum separately swaps a generated entry back to
+          # the original when present. Dependabot must not introduce a missing
+          # entry: the runner's regular-gem install can calculate a checksum that
+          # a default-gem install cannot (ruby/rubygems#9512), and its runtime
+          # bundler version need not match BUNDLED WITH because Dependabot does
+          # not manage that version. This can add unrelated or mismatched
+          # metadata and cause lockfile churn.
           checksums_section = lockfile_content.match(CHECKSUMS_SECTION)
-          return false if checksums_section && T.must(checksums_section[:entries]).match?(BUNDLER_CHECKSUM_ENTRY_REGEX)
-
-          bundled_with = lockfile_content.match(BUNDLED_WITH_VERSION_REGEX)&.[](:version)
-          return false unless bundled_with
-
-          bundled_with_version = Gem::Version.new(bundled_with)
-          bundled_with_version >= Gem::Version.new("4.0.0") && bundled_with_version < MIN_BUNDLER_CHECKSUM_VERSION
+          !(checksums_section && T.must(checksums_section[:entries]).match?(BUNDLER_CHECKSUM_ENTRY_REGEX))
         end
 
         sig { params(lockfile_body: String).returns(String) }

data/lib/dependabot/bundler/metadata_finder.rb

@@ -95,9 +95,9 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
+        info = T.must(dependency.requirements.filter_map(&:source_hash).first)
 
-        url = info[:url] || info.fetch("url")
+        url = T.cast(info[:url] || info.fetch("url"), T.nilable(String))
         Source.from_url(url)
       end
 
@@ -222,8 +222,8 @@ module Dependabot
       def registry_url
         return base_url if new_source_type == "default"
 
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-        info[:url] || info.fetch("url")
+        info = T.must(dependency.requirements.filter_map(&:source_hash).first)
+        T.cast(info[:url] || info.fetch("url"), String)
       end
 
       sig { returns(String) }

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -214,9 +214,9 @@ module Dependabot
           return nil unless dependency&.requirements&.any?
 
           first_requirement = dependency.requirements.first
-          return nil unless first_requirement && first_requirement[:source]
+          return nil unless first_requirement
 
-          url = T.let(first_requirement[:source][:url], T.nilable(String))
+          url = first_requirement.source_string("url")
           return nil unless url
 
           url.end_with?("/") ? url.chop : url
@@ -242,9 +242,9 @@ module Dependabot
           return nil unless dependency.requirements.any?
 
           first_requirement = dependency.requirements.first
-          return nil unless first_requirement && first_requirement[:source]
+          return nil unless first_requirement
 
-          first_requirement[:source][:type]
+          first_requirement.source_string("type")
         end
 
         sig { override.returns(String) }

data/lib/dependabot/bundler/requirement.rb

@@ -13,9 +13,9 @@ module Dependabot
 
       GEM_DEP_SPLIT = T.let(/\A(?<name>[a-zA-Z0-9_\-]+):(?<version>.+)\z/, Regexp)
 
-      sig { params(req: T::Hash[Symbol, String], version: Gem::Version).returns(T::Boolean) }
+      sig { params(req: Dependabot::DependencyRequirement, version: Gem::Version).returns(T::Boolean) }
       def self.satisfied_by?(req, version)
-        new(req[:requirement]).satisfied_by?(version)
+        new(req.requirement_string).satisfied_by?(version)
       end
 
       # For consistency with other languages, we define a requirements array.

data/lib/dependabot/bundler/update_checker/file_preparer.rb

@@ -273,20 +273,20 @@ module Dependabot
         sig { params(filename: String).returns(String) }
         def updated_version_req_lower_bound(filename) # rubocop:disable Metrics/CyclomaticComplexity
           original_req = dependency.requirements
-                                   .find { |r| r.fetch(:file) == filename }
-                                   &.fetch(:requirement)
+                                   .find { |r| r.file == filename }
+                                   &.requirement_string
 
           if original_req && !unlock_requirement? then original_req
           elsif dependency.version&.match?(/^[0-9a-f]{40}$/) then ">= 0"
           elsif dependency.version then ">= #{dependency.version}"
           else
             version_for_requirement =
-              dependency.requirements.map { |r| r[:requirement] }
-                                     .reject { |req_string| req_string.start_with?("<") }
-                                     .select { |req_string| req_string.match?(VERSION_REGEX) }
-                                     .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
-                                     .select { |version| Bundler::Version.correct?(version) }
-                                     .max_by { |version| Bundler::Version.new(version) }
+              dependency.requirements.filter_map(&:requirement_string)
+                        .reject { |req_string| req_string.start_with?("<") }
+                        .select { |req_string| req_string.match?(VERSION_REGEX) }
+                        .map { |req_string| req_string.match(VERSION_REGEX)&.to_s }
+                        .select { |version| Bundler::Version.correct?(version) }
+                        .max_by { |version| Bundler::Version.new(version) }
 
             ">= #{version_for_requirement || 0}"
           end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -94,7 +94,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         sig { returns(T::Array[Dependabot::Dependency]) }
         def force_update
-          requirement = dependency.requirements.find { |req| req[:file] == T.must(gemfile).name }
+          requirement = dependency.requirements.find { |req| req.file == T.must(gemfile).name }
 
           valid_gem_version?(target_version)
 
@@ -192,11 +192,11 @@ module Dependabot
           )
         end
 
-        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
         def source_for(dependency)
           dependency.requirements
-                    .find { |r| r.fetch(:source) }
-                    &.fetch(:source)
+                    .find(&:source)
+                    &.source_hash
         end
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }

data/lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb

@@ -85,8 +85,10 @@ module Dependabot
             return unless git?
 
             source_details =
-              dependency.requirements.map { |r| r.fetch(:source) }
-                                     .uniq.compact.first
+              T.must(
+                dependency.requirements.map(&:source_hash)
+                                                     .uniq.compact.first
+              )
 
             SharedHelpers.with_git_configured(credentials: credentials) do
               in_a_native_bundler_context do |tmp_dir|

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -128,7 +128,7 @@ module Dependabot
             begin
               current_version = dependency.numeric_version
               current_version&.prerelease? || dependency.requirements.any? do |req|
-                req[:requirement].match?(/[a-z]/i)
+                T.must(req.requirement_string).match?(/[a-z]/i)
               end
             end,
             T.nilable(T::Boolean)

data/lib/dependabot/bundler/update_checker/requirements_updater.rb

@@ -28,7 +28,7 @@ module Dependabot
           params(
             requirements: T::Array[Dependabot::DependencyRequirement],
             update_strategy: Dependabot::RequirementsUpdateStrategy,
-            updated_source: T.nilable(T::Hash[Symbol, T.untyped]),
+            updated_source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
             latest_version: T.nilable(String),
             latest_resolvable_version: T.nilable(String)
           ).void
@@ -66,7 +66,7 @@ module Dependabot
           return requirements if update_strategy.lockfile_only?
 
           requirements.map do |req|
-            if req[:file].include?(".gemspec")
+            if T.must(req.file).include?(".gemspec")
               update_gemspec_requirement(req)
             else
               # If a requirement doesn't come from a gemspec, it must be from
@@ -81,7 +81,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
         attr_reader :updated_source
 
         sig { returns(T.nilable(Dependabot::Bundler::Version)) }
@@ -124,13 +124,13 @@ module Dependabot
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement(req)
           requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
+            T.must(req.requirement_string).split(",").map { |r| Gem::Requirement.new(r) }
 
           new_requirement =
             if requirements.any?(&:exact?) then latest_resolvable_version.to_s
             elsif requirements.any? { |r| r.to_s.start_with?("~>") }
               tw_req = requirements.find { |r| r.to_s.start_with?("~>") }
-              update_twiddle_version(tw_req, T.must(latest_resolvable_version)).to_s
+              update_twiddle_version(T.must(tw_req), T.must(latest_resolvable_version)).to_s
             else
               update_gemfile_range(requirements).join(", ")
             end
@@ -185,21 +185,22 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_gemspec_requirement(req)
-          req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source)) if req.fetch(:source)
+          req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source)) if req.source
           return req unless latest_version && latest_resolvable_version
 
           requirements =
-            req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
+            T.must(req.requirement_string).split(",").map { |r| Gem::Requirement.new(r) }
+          groups = T.must(req.groups).map(&:to_s)
 
           return req if requirements.all? do |r|
-            requirement_satisfied?(r, req[:groups])
+            requirement_satisfied?(r, groups)
           end
 
           updated_requirements =
             requirements.flat_map do |r|
-              next r if requirement_satisfied?(r, req[:groups])
+              next r if requirement_satisfied?(r, groups)
 
-              if req[:groups] == ["development"] then bumped_requirements(r)
+              if groups == ["development"] then bumped_requirements(r)
               else
                 widened_requirements(r)
               end

data/lib/dependabot/bundler/update_checker.rb

@@ -102,7 +102,7 @@ module Dependabot
 
         dependency.specific_requirements
                   .all? do |req|
-          file = T.must(dependency_files.find { |f| f.name == req.fetch(:file) })
+          file = T.must(dependency_files.find { |f| f.name == req.file })
           updated = FileUpdater::RequirementReplacer.new(
             dependency: dependency,
             file_type: file.name.end_with?("gemspec") ? :gemspec : :gemfile,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.390.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
 rdoc_options: []
 require_paths:
 - lib