dependabot-bundler 0.396.0 → 0.397.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b148dc013501428e1d1805c3f8c44e833fff5dec4e42efd28048d2252fdfa4b
-  data.tar.gz: 416201519f49e7f757fb404743fa8cd700295d16122c5ca26d1cfe1e811da553
+  metadata.gz: 43d670382313df98efe56ca75538daf1ef494b65bdb4dfa87e79bcb2f5ae3fdc
+  data.tar.gz: 46faf363b2a8e37874cc5516425abf14bf31a50c12573fac6c837d78aba6a182
 SHA512:
-  metadata.gz: daef51089d338a57f43a6655fb955854654e37ecdd773f36066fe6840f9e4404893cd4e107c4b5fb80bf1faa2f3c67d77f410669a37b9847d90278d27b6b40d1
-  data.tar.gz: dd14dc06263439c9bf3e37d56c9b8c142043b0ca6eaa7cb6119c0e1049226473855057513e3011e309cb94b12f7a4b0cb150289097f60ebecebe21bea9b2aeb7
+  metadata.gz: 24a9688ad6a277c68a763f39a298e13b9c2a8a64fea6ecc57d2414ea55555d9cfb49ec5feeddc1ad99a99ce475625ef18a4f35ee83a1bb2e26666fecb166ae58
+  data.tar.gz: 9b8e28ec1cc08b2d841112f29d75e3d7545be0563dd69dd1f0a67cf693cf66759e175245cf88b658229ca90878aaaa53cc13ea40c5e400ae23a2738efdde0150

data/helpers/v2/spec/functions/file_parser_spec.rb

@@ -3,6 +3,7 @@
 
 require "native_spec_helper"
 require "shared_contexts"
+require "json"
 
 RSpec.describe Functions::FileParser do
   include_context "when in a temporary bundler directory"
@@ -23,87 +24,87 @@ RSpec.describe Functions::FileParser do
     let(:project_name) { "gemfile" }
 
     it "parses gemfile" do
-      parsed_gemfile = [
+      expected = [
         {
-          groups: [:default],
-          name: "business",
-          requirement: Gem::Requirement.new("~> 1.4.0"),
-          source: nil,
-          type: :runtime
+          "groups" => ["default"],
+          "name" => "business",
+          "requirement" => "~> 1.4.0",
+          "source" => nil,
+          "type" => "runtime"
         },
         {
-          groups: [:default],
-          name: "statesman",
-          requirement: Gem::Requirement.new("~> 1.2.0"),
-          source: nil,
-          type: :runtime
+          "groups" => ["default"],
+          "name" => "statesman",
+          "requirement" => "~> 1.2.0",
+          "source" => nil,
+          "type" => "runtime"
         }
       ]
-      expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+      expect(JSON.parse(JSON.dump(parsed_gemfile))).to eq(expected)
     end
 
     context "with a git source" do
       let(:project_name) { "git_source" }
 
       it "parses gemfile" do
-        parsed_gemfile = [
+        expected = [
           {
-            groups: [:default],
-            name: "business",
-            requirement: Gem::Requirement.new("~> 1.6.0"),
-            source: {
-              branch: nil,
-              ref: "a1b78a9",
-              type: "git",
-              url: "git@github.com:dependabot-fixtures/business"
+            "groups" => ["default"],
+            "name" => "business",
+            "requirement" => "~> 1.6.0",
+            "source" => {
+              "branch" => nil,
+              "ref" => "a1b78a9",
+              "type" => "git",
+              "url" => "git@github.com:dependabot-fixtures/business"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "statesman",
-            requirement: Gem::Requirement.new("~> 1.2.0"),
-            source: nil,
-            type: :runtime
+            "groups" => ["default"],
+            "name" => "statesman",
+            "requirement" => "~> 1.2.0",
+            "source" => nil,
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "prius",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: nil,
-              type: "git",
-              url: "https://github.com/dependabot-fixtures/prius"
+            "groups" => ["default"],
+            "name" => "prius",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => nil,
+              "type" => "git",
+              "url" => "https://github.com/dependabot-fixtures/prius"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "que",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: "v0.11.6",
-              type: "git",
-              url: "git@github.com:dependabot-fixtures/que"
+            "groups" => ["default"],
+            "name" => "que",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => "v0.11.6",
+              "type" => "git",
+              "url" => "git@github.com:dependabot-fixtures/que"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "uk_phone_numbers",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: nil,
-              type: "git",
-              url: "https://github.com/dependabot-fixtures/uk_phone_numbers"
+            "groups" => ["default"],
+            "name" => "uk_phone_numbers",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => nil,
+              "type" => "git",
+              "url" => "https://github.com/dependabot-fixtures/uk_phone_numbers"
             },
-            type: :runtime
+            "type" => "runtime"
           }
         ]
-        expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+        expect(JSON.parse(JSON.dump(parsed_gemfile))).to eq(expected)
       end
     end
   end
@@ -118,23 +119,23 @@ RSpec.describe Functions::FileParser do
     let(:project_name) { "gemfile_exact" }
 
     it "parses gemspec" do
-      parsed_gemspec = [
+      expected = [
         {
-          groups: nil,
-          name: "business",
-          requirement: Gem::Requirement.new("= 1.0.0"),
-          source: nil,
-          type: :runtime
+          "groups" => nil,
+          "name" => "business",
+          "requirement" => "= 1.0.0",
+          "source" => nil,
+          "type" => "runtime"
         },
         {
-          groups: nil,
-          name: "statesman",
-          requirement: Gem::Requirement.new("= 1.0.0"),
-          source: nil,
-          type: :runtime
+          "groups" => nil,
+          "name" => "statesman",
+          "requirement" => "= 1.0.0",
+          "source" => nil,
+          "type" => "runtime"
         }
       ]
-      expect(parsed_gemspec).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+      expect(JSON.parse(JSON.dump(parsed_gemspec))).to eq(expected)
     end
   end
 end

data/helpers/v4/spec/functions/file_parser_spec.rb

@@ -3,6 +3,7 @@
 
 require "native_spec_helper"
 require "shared_contexts"
+require "json"
 
 RSpec.describe Functions::FileParser do
   include_context "when in a temporary bundler directory"
@@ -23,87 +24,87 @@ RSpec.describe Functions::FileParser do
     let(:project_name) { "gemfile" }
 
     it "parses gemfile" do
-      parsed_gemfile = [
+      expected = [
         {
-          groups: [:default],
-          name: "business",
-          requirement: Gem::Requirement.new("~> 1.4.0"),
-          source: nil,
-          type: :runtime
+          "groups" => ["default"],
+          "name" => "business",
+          "requirement" => "~> 1.4.0",
+          "source" => nil,
+          "type" => "runtime"
         },
         {
-          groups: [:default],
-          name: "statesman",
-          requirement: Gem::Requirement.new("~> 1.2.0"),
-          source: nil,
-          type: :runtime
+          "groups" => ["default"],
+          "name" => "statesman",
+          "requirement" => "~> 1.2.0",
+          "source" => nil,
+          "type" => "runtime"
         }
       ]
-      expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+      expect(JSON.parse(JSON.dump(parsed_gemfile))).to eq(expected)
     end
 
     context "with a git source" do
       let(:project_name) { "git_source" }
 
       it "parses gemfile" do
-        parsed_gemfile = [
+        expected = [
           {
-            groups: [:default],
-            name: "business",
-            requirement: Gem::Requirement.new("~> 1.6.0"),
-            source: {
-              branch: nil,
-              ref: "a1b78a9",
-              type: "git",
-              url: "git@github.com:dependabot-fixtures/business"
+            "groups" => ["default"],
+            "name" => "business",
+            "requirement" => "~> 1.6.0",
+            "source" => {
+              "branch" => nil,
+              "ref" => "a1b78a9",
+              "type" => "git",
+              "url" => "git@github.com:dependabot-fixtures/business"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "statesman",
-            requirement: Gem::Requirement.new("~> 1.2.0"),
-            source: nil,
-            type: :runtime
+            "groups" => ["default"],
+            "name" => "statesman",
+            "requirement" => "~> 1.2.0",
+            "source" => nil,
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "prius",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: nil,
-              type: "git",
-              url: "https://github.com/dependabot-fixtures/prius"
+            "groups" => ["default"],
+            "name" => "prius",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => nil,
+              "type" => "git",
+              "url" => "https://github.com/dependabot-fixtures/prius"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "que",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: "v0.11.6",
-              type: "git",
-              url: "git@github.com:dependabot-fixtures/que"
+            "groups" => ["default"],
+            "name" => "que",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => "v0.11.6",
+              "type" => "git",
+              "url" => "git@github.com:dependabot-fixtures/que"
             },
-            type: :runtime
+            "type" => "runtime"
           },
           {
-            groups: [:default],
-            name: "uk_phone_numbers",
-            requirement: Gem::Requirement.new(">= 0"),
-            source: {
-              branch: nil,
-              ref: nil,
-              type: "git",
-              url: "https://github.com/dependabot-fixtures/uk_phone_numbers"
+            "groups" => ["default"],
+            "name" => "uk_phone_numbers",
+            "requirement" => ">= 0",
+            "source" => {
+              "branch" => nil,
+              "ref" => nil,
+              "type" => "git",
+              "url" => "https://github.com/dependabot-fixtures/uk_phone_numbers"
             },
-            type: :runtime
+            "type" => "runtime"
           }
         ]
-        expect(parsed_gemfile).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+        expect(JSON.parse(JSON.dump(parsed_gemfile))).to eq(expected)
       end
     end
   end
@@ -118,23 +119,23 @@ RSpec.describe Functions::FileParser do
     let(:project_name) { "gemfile_exact" }
 
     it "parses gemspec" do
-      parsed_gemspec = [
+      expected = [
         {
-          groups: nil,
-          name: "business",
-          requirement: Gem::Requirement.new("= 1.0.0"),
-          source: nil,
-          type: :runtime
+          "groups" => nil,
+          "name" => "business",
+          "requirement" => "= 1.0.0",
+          "source" => nil,
+          "type" => "runtime"
         },
         {
-          groups: nil,
-          name: "statesman",
-          requirement: Gem::Requirement.new("= 1.0.0"),
-          source: nil,
-          type: :runtime
+          "groups" => nil,
+          "name" => "statesman",
+          "requirement" => "= 1.0.0",
+          "source" => nil,
+          "type" => "runtime"
         }
       ]
-      expect(parsed_gemspec).not_to be_nil # to get past IdenticalEqualityAssertion and NamedSubject
+      expect(JSON.parse(JSON.dump(parsed_gemspec))).to eq(expected)
     end
   end
 end

data/lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb

@@ -4,7 +4,7 @@
 require "prism"
 require "sorbet-runtime"
 
-require "dependabot/file_parsers/base"
+require "dependabot/bundler/file_parser"
 
 module Dependabot
   module Bundler
@@ -16,21 +16,20 @@ module Dependabot
         sig { params(gemfile: Dependabot::DependencyFile).void }
         def initialize(gemfile:)
           @gemfile = gemfile
-          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Prism::Node)])
+          @declaration_nodes = T.let({}, T::Hash[String, T.nilable(Prism::Node)])
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
-        def gemfile_includes_dependency?(dependency)
-          !declaration_node(dependency).nil?
+        sig { params(dependency_name: String).returns(T::Boolean) }
+        def gemfile_includes_dependency?(dependency_name)
+          !declaration_node(dependency_name).nil?
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(String)) }
-        def enhanced_req_string(dependency)
-          return unless gemfile_includes_dependency?(dependency)
+        sig { params(dependency_name: String, fallback_string: String).returns(T.nilable(String)) }
+        def enhanced_req_string(dependency_name, fallback_string)
+          return unless gemfile_includes_dependency?(dependency_name)
 
-          fallback_string = dependency.fetch("requirement")
-          call_node = declaration_node(dependency)
+          call_node = declaration_node(dependency_name)
           return fallback_string unless call_node.is_a?(Prism::CallNode)
 
           req_nodes = call_node.arguments&.arguments&.[](1..-1) || []
@@ -63,32 +62,32 @@ module Dependabot
           )
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
-        def declaration_node(dependency)
-          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+        sig { params(dependency_name: String).returns(T.nilable(Prism::Node)) }
+        def declaration_node(dependency_name)
+          return @declaration_nodes[dependency_name] if @declaration_nodes.key?(dependency_name)
           return unless parsed_gemfile
 
-          @declaration_nodes[dependency] = nil
+          @declaration_nodes[dependency_name] = nil
           T.must(parsed_gemfile).child_nodes.any? do |node|
-            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
+            @declaration_nodes[dependency_name] = deep_search_for_gem(node, dependency_name)
           end
-          @declaration_nodes[dependency]
+          @declaration_nodes[dependency_name]
         end
 
         sig do
           params(
             node: T.nilable(Prism::Node),
-            dependency: T::Hash[String, String]
+            dependency_name: String
           )
             .returns(T.nilable(Prism::Node))
         end
-        def deep_search_for_gem(node, dependency)
+        def deep_search_for_gem(node, dependency_name)
           return unless node.is_a?(Prism::Node)
-          return node if declares_targeted_gem?(node, dependency)
+          return node if declares_targeted_gem?(node, dependency_name)
 
           declaration_node = T.let(nil, T.nilable(Prism::Node))
           node.child_nodes.find do |child_node|
-            declaration_node = deep_search_for_gem(child_node, dependency)
+            declaration_node = deep_search_for_gem(child_node, dependency_name)
           end
           declaration_node
         end
@@ -96,18 +95,18 @@ module Dependabot
         sig do
           params(
             node: T.nilable(Prism::Node),
-            dependency: T::Hash[String, String]
+            dependency_name: String
           )
             .returns(T::Boolean)
         end
-        def declares_targeted_gem?(node, dependency)
+        def declares_targeted_gem?(node, dependency_name)
           return false unless node.is_a?(Prism::CallNode)
           return false unless node.name == :gem
 
           gem_name_node = node.arguments&.arguments&.first
           return false unless gem_name_node.is_a?(Prism::StringNode)
 
-          gem_name_node.unescaped == dependency.fetch("name")
+          gem_name_node.unescaped == dependency_name
         end
       end
     end

data/lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb

@@ -4,7 +4,7 @@
 require "prism"
 require "sorbet-runtime"
 
-require "dependabot/file_parsers/base"
+require "dependabot/bundler/file_parser"
 
 module Dependabot
   module Bundler
@@ -16,12 +16,12 @@ module Dependabot
         sig { params(gemspec: Dependabot::DependencyFile).void }
         def initialize(gemspec:)
           @gemspec = gemspec
-          @declaration_nodes = T.let({}, T::Hash[T::Hash[String, String], T.nilable(Prism::Node)])
+          @declaration_nodes = T.let({}, T::Hash[String, T.nilable(Prism::Node)])
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T::Boolean) }
-        def gemspec_includes_dependency?(dependency)
-          !declaration_node(dependency).nil?
+        sig { params(dependency_name: String).returns(T::Boolean) }
+        def gemspec_includes_dependency?(dependency_name)
+          !declaration_node(dependency_name).nil?
         end
 
         private
@@ -34,32 +34,32 @@ module Dependabot
           @parsed_gemspec ||= T.let(Prism.parse(gemspec.content).value, T.nilable(Prism::Node))
         end
 
-        sig { params(dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
-        def declaration_node(dependency)
-          return @declaration_nodes[dependency] if @declaration_nodes.key?(dependency)
+        sig { params(dependency_name: String).returns(T.nilable(Prism::Node)) }
+        def declaration_node(dependency_name)
+          return @declaration_nodes[dependency_name] if @declaration_nodes.key?(dependency_name)
           return unless parsed_gemspec
 
-          @declaration_nodes[dependency] = nil
+          @declaration_nodes[dependency_name] = nil
           T.must(parsed_gemspec).child_nodes.any? do |node|
-            @declaration_nodes[dependency] = deep_search_for_gem(node, dependency)
+            @declaration_nodes[dependency_name] = deep_search_for_gem(node, dependency_name)
           end
-          @declaration_nodes[dependency]
+          @declaration_nodes[dependency_name]
         end
 
-        sig { params(node: T.nilable(Prism::Node), dependency: T::Hash[String, String]).returns(T.nilable(Prism::Node)) }
-        def deep_search_for_gem(node, dependency)
+        sig { params(node: T.nilable(Prism::Node), dependency_name: String).returns(T.nilable(Prism::Node)) }
+        def deep_search_for_gem(node, dependency_name)
           return unless node.is_a?(Prism::Node)
-          return T.cast(node, Prism::CallNode) if declares_targeted_gem?(node, dependency)
+          return T.cast(node, Prism::CallNode) if declares_targeted_gem?(node, dependency_name)
 
           declaration_node = T.let(nil, T.nilable(Prism::Node))
           node.child_nodes.find do |child_node|
-            declaration_node = deep_search_for_gem(child_node, dependency)
+            declaration_node = deep_search_for_gem(child_node, dependency_name)
           end
           declaration_node
         end
 
-        sig { params(node: T.nilable(Prism::Node), dependency: T::Hash[String, String]).returns(T::Boolean) }
-        def declares_targeted_gem?(node, dependency)
+        sig { params(node: T.nilable(Prism::Node), dependency_name: String).returns(T::Boolean) }
+        def declares_targeted_gem?(node, dependency_name)
           return false unless node.is_a?(Prism::CallNode)
 
           second_child = node.name
@@ -69,7 +69,7 @@ module Dependabot
           gem_name_node = node.arguments&.child_nodes&.first
           return false unless gem_name_node.is_a?(Prism::StringNode)
 
-          gem_name_node.unescaped == dependency.fetch("name")
+          gem_name_node.unescaped == dependency_name
         end
       end
     end

data/lib/dependabot/bundler/file_parser/helper_dependencies.rb

@@ -0,0 +1,116 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/errors"
+require "dependabot/bundler/file_parser"
+
+module Dependabot
+  module Bundler
+    class FileParser < Dependabot::FileParsers::Base
+      module HelperDependencies
+        extend T::Sig
+
+        Source = T.type_alias { T::Hash[Symbol, T.nilable(String)] }
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+        class GemfileDependency < T::ImmutableStruct
+          const :name, String
+          const :requirement, String
+          const :groups, T::Array[String]
+          const :source, T.nilable(Source)
+        end
+
+        class GemspecDependency < T::ImmutableStruct
+          const :name, String
+          const :requirement, String
+          const :type, String
+          const :source, T.nilable(Source)
+        end
+
+        # Both helper versions serialize these fields in Functions::FileParser#serialize_bundler_dependency.
+        sig { params(result: Object, file: Dependabot::DependencyFile).returns(T::Array[GemfileDependency]) }
+        def self.from_gemfile_result(result, file:)
+          context = "parsed_gemfile result for #{file.path}"
+          array(result, context).each_with_index.map do |value, index|
+            entry_context = "#{context}[#{index}]"
+            entry = object(value, entry_context)
+
+            GemfileDependency.new(
+              name: string(entry["name"], "#{entry_context}.name"),
+              requirement: string(entry["requirement"], "#{entry_context}.requirement"),
+              groups: strings(entry["groups"], "#{entry_context}.groups"),
+              source: source(entry, entry_context)
+            )
+          end
+        end
+
+        sig { params(result: Object, file: Dependabot::DependencyFile).returns(T::Array[GemspecDependency]) }
+        def self.from_gemspec_result(result, file:)
+          context = "parsed_gemspec result for #{file.path}"
+          array(result, context).each_with_index.map do |value, index|
+            entry_context = "#{context}[#{index}]"
+            entry = object(value, entry_context)
+
+            GemspecDependency.new(
+              name: string(entry["name"], "#{entry_context}.name"),
+              requirement: string(entry["requirement"], "#{entry_context}.requirement"),
+              type: string(entry["type"], "#{entry_context}.type"),
+              source: source(entry, entry_context)
+            )
+          end
+        end
+
+        sig { params(entry: ObjectHash, context: String).returns(T.nilable(Source)) }
+        def self.source(entry, context)
+          raise DependencyFileNotEvaluatable, "#{context}.source must be present" unless entry.key?("source")
+
+          value = entry["source"]
+          return if value.nil?
+
+          fields = object(value, "#{context}.source")
+          string(fields["type"], "#{context}.source.type")
+          fields.to_h do |key, field|
+            [key.to_sym, field.nil? ? nil : string(field, "#{context}.source.#{key}")]
+          end
+        end
+        private_class_method :source
+
+        sig { params(value: Object, context: String).returns(ObjectHash) }
+        def self.object(value, context)
+          raise DependencyFileNotEvaluatable, "#{context} must be an object" unless value.is_a?(Hash)
+
+          value.to_h do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise DependencyFileNotEvaluatable, "#{context} keys must be strings" unless key.is_a?(String)
+
+            [key, T.cast(raw_value, Object)]
+          end
+        end
+        private_class_method :object
+
+        sig { params(value: Object, context: String).returns(T::Array[Object]) }
+        def self.array(value, context)
+          raise DependencyFileNotEvaluatable, "#{context} must be an array" unless value.is_a?(Array)
+
+          value.map { |entry| T.cast(entry, Object) }
+        end
+        private_class_method :array
+
+        sig { params(value: Object, context: String).returns(String) }
+        def self.string(value, context)
+          return value if value.is_a?(String)
+
+          raise DependencyFileNotEvaluatable, "#{context} must be a string"
+        end
+        private_class_method :string
+
+        sig { params(value: Object, context: String).returns(T::Array[String]) }
+        def self.strings(value, context)
+          array(value, context).each_with_index.map { |entry, index| string(entry, "#{context}[#{index}]") }
+        end
+        private_class_method :strings
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/file_parser.rb

@@ -22,6 +22,7 @@ module Dependabot
       extend T::Sig
 
       require "dependabot/file_parsers/base/dependency_set"
+      require "dependabot/bundler/file_parser/helper_dependencies"
       require "dependabot/bundler/file_parser/file_preparer"
       require "dependabot/bundler/file_parser/gemfile_declaration_finder"
       require "dependabot/bundler/file_parser/gemspec_declaration_finder"
@@ -121,15 +122,15 @@ module Dependabot
           gemfile_declaration_finder = GemfileDeclarationFinder.new(gemfile: file)
 
           parsed_gemfile.each do |dep|
-            next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
+            next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep.name)
 
             dependencies << Dependency.new(
-              name: dep.fetch("name"),
-              version: dependency_version(dep.fetch("name"))&.to_s,
+              name: dep.name,
+              version: dependency_version(dep.name)&.to_s,
               requirements: [{
-                requirement: gemfile_declaration_finder.enhanced_req_string(dep),
-                groups: dep.fetch("groups").map(&:to_sym),
-                source: dep.fetch("source")&.transform_keys(&:to_sym),
+                requirement: gemfile_declaration_finder.enhanced_req_string(dep.name, dep.requirement),
+                groups: dep.groups.map(&:to_sym),
+                source: dep.source&.dup,
                 file: file.name
               }],
               package_manager: "bundler"
@@ -141,7 +142,7 @@ module Dependabot
       end
 
       sig { returns(DependencySet) }
-      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity
+      def gemspec_dependencies
         @gemspec_dependencies = T.let(@gemspec_dependencies, T.nilable(DependencySet))
         return @gemspec_dependencies if @gemspec_dependencies
 
@@ -154,19 +155,19 @@ module Dependabot
             gemspec_declaration_finder = GemspecDeclarationFinder.new(gemspec: gemspec)
 
             parsed_gemspec(gemspec).each do |dependency|
-              next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
+              next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency.name)
 
               queue << Dependency.new(
-                name: dependency.fetch("name"),
-                version: dependency_version(dependency.fetch("name"))&.to_s,
+                name: dependency.name,
+                version: dependency_version(dependency.name)&.to_s,
                 requirements: [{
-                  requirement: dependency.fetch("requirement").to_s,
-                  groups: if dependency.fetch("type") == "runtime"
+                  requirement: dependency.requirement,
+                  groups: if dependency.type == "runtime"
                             ["runtime"]
                           else
                             ["development"]
                           end,
-                  source: dependency.fetch("source")&.transform_keys(&:to_sym),
+                  source: dependency.source&.dup,
                   file: gemspec.name
                 }],
                 package_manager: "bundler"
@@ -206,7 +207,7 @@ module Dependabot
         dependencies
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[HelperDependencies::GemfileDependency]) }
       def parsed_gemfile
         @parsed_gemfile ||= T.let(
           SharedHelpers.in_a_temporary_repo_directory(
@@ -215,7 +216,7 @@ module Dependabot
           ) do
             write_temporary_dependency_files
 
-            NativeHelpers.run_bundler_subprocess(
+            result = NativeHelpers.run_bundler_subprocess(
               bundler_version: bundler_version,
               function: "parsed_gemfile",
               options: options,
@@ -225,8 +226,9 @@ module Dependabot
                 dir: Dir.pwd
               }
             )
+            HelperDependencies.from_gemfile_result(result, file: T.must(gemfile))
           end,
-          T.nilable(T::Array[T::Hash[String, T.untyped]])
+          T.nilable(T::Array[HelperDependencies::GemfileDependency])
         )
       rescue SharedHelpers::HelperSubprocessFailed => e
         handle_eval_error(e) if e.error_class == "JSON::ParserError"
@@ -242,9 +244,9 @@ module Dependabot
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[HelperDependencies::GemspecDependency]) }
       def parsed_gemspec(file)
-        NativeHelpers.run_bundler_subprocess(
+        result = NativeHelpers.run_bundler_subprocess(
           bundler_version: bundler_version,
           function: "parsed_gemspec",
           options: options,
@@ -254,6 +256,7 @@ module Dependabot
             dir: Dir.pwd
           }
         )
+        HelperDependencies.from_gemspec_result(result, file: file)
       rescue SharedHelpers::HelperSubprocessFailed => e
         msg = e.error_class + " with message: " + e.message
         raise Dependabot::DependencyFileNotEvaluatable, msg

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -21,6 +21,7 @@ module Dependabot
         include Dependabot::Bundler::UpdateChecker::SharedBundlerHelpers
 
         RELEASES_URL = "%s/api/v1/versions/%s.json"
+        COMPACT_INDEX_URL = "%s/info/%s"
         GEM_URL = "%s/gems/%s.gem"
         PACKAGE_TYPE = "gem"
         PACKAGE_LANGUAGE = "ruby"
@@ -142,7 +143,7 @@ module Dependabot
             error_msg = "Failed to fetch versions for '#{dependency.name}' from '#{registry_url}'. " \
                         "Status: #{response.status}"
             log_error(error_msg)
-            return package_details([])
+            return fetch_compact_index_response(registry_url)
           end
 
           return handle_empty_response(registry_url) if response.body.nil? || response.body.strip.empty?
@@ -150,6 +151,52 @@ module Dependabot
           parse_rubygems_response(response, registry_url)
         end
 
+        sig { params(registry_url: String).returns(Dependabot::Package::PackageDetails) }
+        def fetch_compact_index_response(registry_url)
+          response = Dependabot::RegistryClient.get(
+            url: format(COMPACT_INDEX_URL, registry_url, dependency.name),
+            headers: { "Accept" => "text/plain" }
+          )
+          return package_details([]) unless response.status == 200
+
+          lines = response.body.to_s.lines(chomp: true).drop_while { |line| line != "---" }.drop(1)
+          releases = lines.filter_map { |line| compact_index_release(line, registry_url) }
+          package_details(releases)
+        end
+
+        sig do
+          params(line: String, registry_url: String).returns(T.nilable(Dependabot::Package::PackageRelease))
+        end
+        def compact_index_release(line, registry_url)
+          version_and_platform = line.split(" ", 2).first
+          return nil unless version_and_platform && line.include?("|")
+
+          version = T.must(version_and_platform.split("-", 2).first)
+          return nil unless Dependabot::Bundler::Version.correct?(version)
+
+          metadata = line.partition("|").last.split(",").to_h do |field|
+            key, _, value = field.partition(":")
+            [key, value]
+          end
+
+          package_release(
+            version: version,
+            released_at: compact_index_release_date(metadata["created_at"]),
+            downloads: 0,
+            url: format(GEM_URL, registry_url, "#{dependency.name}-#{version_and_platform}"),
+            ruby_version: metadata["ruby"]&.tr("&", ",")
+          )
+        rescue Gem::Requirement::BadRequirementError
+          nil
+        end
+
+        sig { params(created_at: T.nilable(String)).returns(T.nilable(Time)) }
+        def compact_index_release_date(created_at)
+          Time.iso8601(created_at) if created_at
+        rescue ArgumentError
+          nil
+        end
+
         sig do
           params(response: Excon::Response, registry_url: String)
             .returns(Dependabot::Package::PackageDetails)
@@ -269,7 +316,7 @@ module Dependabot
         sig do
           params(
             version: String,
-            released_at: Time,
+            released_at: T.nilable(Time),
             downloads: Integer,
             url: String,
             ruby_version: T.nilable(String),

data/lib/dependabot/bundler/update_checker.rb

@@ -216,10 +216,10 @@ module Dependabot
         git_commit_checker.git_dependency?
       end
 
-      sig { params(version: Dependabot::Bundler::Version).returns(T.untyped) }
+      sig { params(version: Dependabot::Bundler::Version).returns(T::Boolean) }
       def resolvable?(version)
-        @resolvable ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
-        return @resolvable[version] if @resolvable.key?(version)
+        @resolvable ||= T.let({}, T.nilable(T::Hash[Dependabot::Bundler::Version, T::Boolean]))
+        return @resolvable.fetch(version) if @resolvable.key?(version)
 
         @resolvable[version] =
           begin
@@ -239,10 +239,10 @@ module Dependabot
           end
       end
 
-      sig { params(tag: T.nilable(String)).returns(T.untyped) }
+      sig { params(tag: T.nilable(String)).returns(T::Boolean) }
       def git_tag_resolvable?(tag)
-        @git_tag_resolvable ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
-        return @git_tag_resolvable[tag] if @git_tag_resolvable.key?(tag)
+        @git_tag_resolvable ||= T.let({}, T.nilable(T::Hash[T.nilable(String), T::Boolean]))
+        return @git_tag_resolvable.fetch(tag) if @git_tag_resolvable.key?(tag)
 
         @git_tag_resolvable[tag] =
           begin

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.396.0
+  version: 0.397.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.396.0
+        version: 0.397.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.396.0
+        version: 0.397.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -327,6 +327,7 @@ files:
 - lib/dependabot/bundler/file_parser/file_preparer.rb
 - lib/dependabot/bundler/file_parser/gemfile_declaration_finder.rb
 - lib/dependabot/bundler/file_parser/gemspec_declaration_finder.rb
+- lib/dependabot/bundler/file_parser/helper_dependencies.rb
 - lib/dependabot/bundler/file_updater.rb
 - lib/dependabot/bundler/file_updater/gemfile_updater.rb
 - lib/dependabot/bundler/file_updater/gemspec_dependency_name_finder.rb
@@ -360,7 +361,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.396.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
 rdoc_options: []
 require_paths:
 - lib