dependabot-core 0.93.17 → 0.94.0

data/lib/dependabot/update_checkers/ruby/bundler/file_preparer.rb

@@ -1,281 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/dependency_file"
-require "dependabot/update_checkers/ruby/bundler"
-require "dependabot/file_updaters/ruby/bundler/gemspec_sanitizer"
-require "dependabot/file_updaters/ruby/bundler/git_pin_replacer"
-require "dependabot/file_updaters/ruby/bundler/git_source_remover"
-require "dependabot/file_updaters/ruby/bundler/requirement_replacer"
-require "dependabot/file_updaters/ruby/bundler/gemspec_dependency_name_finder"
-require "dependabot/file_updaters/ruby/bundler/lockfile_updater"
-require "dependabot/update_checkers/ruby/bundler/ruby_requirement_setter"
-
-module Dependabot
-  module UpdateCheckers
-    module Ruby
-      class Bundler
-        # This class takes a set of dependency files and sanitizes them for use
-        # in UpdateCheckers::Ruby::Bundler. In particular, it:
-        # - Removes any version requirement on the dependency being updated
-        #   (in the Gemfile)
-        # - Sanitizes any provided gemspecs to remove file imports etc. (since
-        #   Dependabot doesn't pull down the entire repo). This process is
-        #   imperfect - an alternative would be to clone the repo
-        # - Sets the ruby version in the Gemfile to be the lowest possible
-        #   version allowed by the gemspec, if the gemspec has a required ruby
-        #   version range
-        class FilePreparer
-          VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
-
-          # Can't be a constant because some of these don't exist in bundler
-          # 1.15, which Heroku uses, which causes an exception on boot.
-          def gemspec_sources
-            [
-              ::Bundler::Source::Path,
-              ::Bundler::Source::Gemspec
-            ]
-          end
-
-          def initialize(dependency_files:, dependency:,
-                         remove_git_source: false,
-                         unlock_requirement: true,
-                         replacement_git_pin: nil,
-                         latest_allowable_version: nil,
-                         lock_ruby_version: true)
-            @dependency_files         = dependency_files
-            @dependency               = dependency
-            @remove_git_source        = remove_git_source
-            @unlock_requirement       = unlock_requirement
-            @replacement_git_pin      = replacement_git_pin
-            @latest_allowable_version = latest_allowable_version
-            @lock_ruby_version        = lock_ruby_version
-          end
-
-          # rubocop:disable Metrics/AbcSize
-          # rubocop:disable Metrics/MethodLength
-          def prepared_dependency_files
-            files = []
-
-            if gemfile
-              files << DependencyFile.new(
-                name: gemfile.name,
-                content: gemfile_content_for_update_check(gemfile),
-                directory: gemfile.directory
-              )
-            end
-
-            top_level_gemspecs.each do |gemspec|
-              files << DependencyFile.new(
-                name: gemspec.name,
-                content: gemspec_content_for_update_check(gemspec),
-                directory: gemspec.directory
-              )
-            end
-
-            path_gemspecs.each do |file|
-              files << DependencyFile.new(
-                name: file.name,
-                content: sanitize_gemspec_content(file.content),
-                directory: file.directory,
-                support_file: file.support_file?
-              )
-            end
-
-            evaled_gemfiles.each do |file|
-              files << DependencyFile.new(
-                name: file.name,
-                content: gemfile_content_for_update_check(file),
-                directory: file.directory
-              )
-            end
-
-            # No editing required for lockfile or Ruby version file
-            files += [lockfile, ruby_version_file, *imported_ruby_files].compact
-          end
-          # rubocop:enable Metrics/AbcSize
-          # rubocop:enable Metrics/MethodLength
-
-          private
-
-          attr_reader :dependency_files, :dependency, :replacement_git_pin,
-                      :latest_allowable_version
-
-          def remove_git_source?
-            @remove_git_source
-          end
-
-          def unlock_requirement?
-            @unlock_requirement
-          end
-
-          def replace_git_pin?
-            !replacement_git_pin.nil?
-          end
-
-          def gemfile
-            dependency_files.find { |f| f.name == "Gemfile" } ||
-              dependency_files.find { |f| f.name == "gems.rb" }
-          end
-
-          def evaled_gemfiles
-            dependency_files.
-              reject { |f| f.name.end_with?(".gemspec") }.
-              reject { |f| f.name.end_with?(".lock") }.
-              reject { |f| f.name.end_with?(".ruby-version") }.
-              reject { |f| f.name == "Gemfile" }.
-              reject { |f| f.name == "gems.rb" }.
-              reject { |f| f.name == "gems.locked" }
-          end
-
-          def lockfile
-            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
-              dependency_files.find { |f| f.name == "gems.locked" }
-          end
-
-          def top_level_gemspecs
-            dependency_files.
-              select { |f| f.name.end_with?(".gemspec") }.
-              reject(&:support_file?)
-          end
-
-          def ruby_version_file
-            dependency_files.find { |f| f.name == ".ruby-version" }
-          end
-
-          def path_gemspecs
-            all = dependency_files.select { |f| f.name.end_with?(".gemspec") }
-            all - top_level_gemspecs
-          end
-
-          def imported_ruby_files
-            dependency_files.
-              select { |f| f.name.end_with?(".rb") }.
-              reject { |f| f.name == "gems.rb" }
-          end
-
-          def gemfile_content_for_update_check(file)
-            content = file.content
-            content = replace_gemfile_constraint(content, file.name)
-            content = remove_git_source(content) if remove_git_source?
-            content = replace_git_pin(content) if replace_git_pin?
-            content = lock_ruby_version(content) if lock_ruby_version?(file)
-            content
-          end
-
-          def gemspec_content_for_update_check(gemspec)
-            content = gemspec.content
-            content = replace_gemspec_constraint(content, gemspec.name)
-            sanitize_gemspec_content(content)
-          end
-
-          def replace_gemfile_constraint(content, filename)
-            FileUpdaters::Ruby::Bundler::RequirementReplacer.new(
-              dependency: dependency,
-              file_type: :gemfile,
-              updated_requirement: updated_version_requirement_string(filename),
-              insert_if_bare: true
-            ).rewrite(content)
-          end
-
-          def replace_gemspec_constraint(content, filename)
-            FileUpdaters::Ruby::Bundler::RequirementReplacer.new(
-              dependency: dependency,
-              file_type: :gemspec,
-              updated_requirement: updated_version_requirement_string(filename),
-              insert_if_bare: true
-            ).rewrite(content)
-          end
-
-          def sanitize_gemspec_content(gemspec_content)
-            new_version = replacement_version_for_gemspec(gemspec_content)
-
-            FileUpdaters::Ruby::Bundler::GemspecSanitizer.
-              new(replacement_version: new_version).
-              rewrite(gemspec_content)
-          end
-
-          def updated_version_requirement_string(filename)
-            lower_bound_req = updated_version_req_lower_bound(filename)
-
-            return lower_bound_req if latest_allowable_version.nil?
-            unless Gem::Version.correct?(latest_allowable_version)
-              return lower_bound_req
-            end
-
-            lower_bound_req + ", <= #{latest_allowable_version}"
-          end
-
-          def updated_version_req_lower_bound(filename)
-            original_req = dependency.requirements.
-                           find { |r| r.fetch(:file) == filename }&.
-                           fetch(:requirement)
-
-            if original_req && !unlock_requirement? then original_req
-            elsif dependency.version&.match?(/^[0-9a-f]{40}$/) then ">= 0"
-            elsif dependency.version then ">= #{dependency.version}"
-            else
-              version_for_requirement =
-                dependency.requirements.map { |r| r[:requirement] }.
-                reject { |req_string| req_string.start_with?("<") }.
-                select { |req_string| req_string.match?(VERSION_REGEX) }.
-                map { |req_string| req_string.match(VERSION_REGEX) }.
-                select { |version| Gem::Version.correct?(version) }.
-                max_by { |version| Gem::Version.new(version) }
-
-              ">= #{version_for_requirement || 0}"
-            end
-          end
-
-          def remove_git_source(content)
-            FileUpdaters::Ruby::Bundler::GitSourceRemover.new(
-              dependency: dependency
-            ).rewrite(content)
-          end
-
-          def replace_git_pin(content)
-            FileUpdaters::Ruby::Bundler::GitPinReplacer.new(
-              dependency: dependency,
-              new_pin: replacement_git_pin
-            ).rewrite(content)
-          end
-
-          def lock_ruby_version(gemfile_content)
-            top_level_gemspecs.each do |gs|
-              gemfile_content =
-                RubyRequirementSetter.new(gemspec: gs).rewrite(gemfile_content)
-            end
-
-            gemfile_content
-          end
-
-          def lock_ruby_version?(file)
-            @lock_ruby_version && file == gemfile
-          end
-
-          def replacement_version_for_gemspec(gemspec_content)
-            return "0.0.1" unless lockfile
-
-            gemspec_specs =
-              ::Bundler::LockfileParser.new(sanitized_lockfile_content).specs.
-              select { |s| gemspec_sources.include?(s.source.class) }
-
-            gem_name =
-              FileUpdaters::Ruby::Bundler::GemspecDependencyNameFinder.
-              new(gemspec_content: gemspec_content).
-              dependency_name
-
-            return gemspec_specs.first&.version || "0.0.1" unless gem_name
-
-            spec = gemspec_specs.find { |s| s.name == gem_name }
-            spec&.version || gemspec_specs.first&.version || "0.0.1"
-          end
-
-          def sanitized_lockfile_content
-            re = FileUpdaters::Ruby::Bundler::LockfileUpdater::LOCKFILE_ENDING
-            lockfile.content.gsub(re, "")
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/update_checkers/ruby/bundler/force_updater.rb

@@ -1,261 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler_definition_ruby_version_patch"
-require "bundler_definition_bundler_version_patch"
-require "bundler_git_source_patch"
-
-require "dependabot/update_checkers/ruby/bundler"
-require "dependabot/update_checkers/ruby/bundler/requirements_updater"
-require "dependabot/file_updaters/ruby/bundler/lockfile_updater"
-require "dependabot/file_parsers/ruby/bundler"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
-
-module Dependabot
-  module UpdateCheckers
-    module Ruby
-      class Bundler
-        class ForceUpdater
-          def initialize(dependency:, dependency_files:, credentials:,
-                         target_version:, requirements_update_strategy:)
-            @dependency                   = dependency
-            @dependency_files             = dependency_files
-            @credentials                  = credentials
-            @target_version               = target_version
-            @requirements_update_strategy = requirements_update_strategy
-          end
-
-          def updated_dependencies
-            @updated_dependencies ||= force_update
-          end
-
-          private
-
-          attr_reader :dependency, :dependency_files, :credentials,
-                      :target_version, :requirements_update_strategy
-
-          def force_update
-            in_a_temporary_bundler_context do
-              other_updates = []
-
-              begin
-                definition = build_definition(other_updates: other_updates)
-                definition.resolve_remotely!
-                specs = definition.resolve
-                dependencies_from([dependency] + other_updates, specs)
-              rescue ::Bundler::VersionConflict => error
-                # TODO: Not sure this won't unlock way too many things...
-                new_dependencies_to_unlock =
-                  new_dependencies_to_unlock_from(
-                    error: error,
-                    already_unlocked: other_updates
-                  )
-
-                raise if new_dependencies_to_unlock.none?
-
-                other_updates += new_dependencies_to_unlock
-                retry
-              end
-            end
-          rescue SharedHelpers::ChildProcessFailed => error
-            raise_unresolvable_error(error)
-          end
-
-          #########################
-          # Bundler context setup #
-          #########################
-
-          def in_a_temporary_bundler_context
-            SharedHelpers.in_a_temporary_directory do
-              write_temporary_dependency_files
-
-              SharedHelpers.in_a_forked_process do
-                # Remove installed gems from the default Rubygems index
-                ::Gem::Specification.all = []
-
-                # Set auth details
-                relevant_credentials.each do |cred|
-                  token = cred["token"] ||
-                          "#{cred['username']}:#{cred['password']}"
-
-                  ::Bundler.settings.set_command_option(
-                    cred.fetch("host"),
-                    token.gsub("@", "%40F").gsub("?", "%3F")
-                  )
-                end
-
-                # Only allow upgrades. Othewise it's unlikely that this
-                # resolution will be found by the FileUpdater
-                ::Bundler.settings.set_command_option(
-                  "only_update_to_newer_versions",
-                  true
-                )
-
-                yield
-              end
-            end
-          end
-
-          def new_dependencies_to_unlock_from(error:, already_unlocked:)
-            potentials_deps =
-              error.cause.conflicts.values.
-              flat_map(&:requirement_trees).
-              reject do |tree|
-                next true unless tree.last.requirement.specific?
-                next false unless tree.last.name == dependency.name
-
-                tree.last.requirement.satisfied_by?(
-                  Gem::Version.new(target_version)
-                )
-              end.map(&:first)
-
-            potentials_deps.
-              reject { |dep| already_unlocked.map(&:name).include?(dep.name) }.
-              reject { |dep| [dependency.name, "ruby\0"].include?(dep.name) }.
-              uniq
-          end
-
-          def raise_unresolvable_error(error)
-            msg = error.error_class + " with message: " + error.error_message
-            raise Dependabot::DependencyFileNotResolvable, msg
-          end
-
-          def build_definition(other_updates:)
-            gems_to_unlock = other_updates.map(&:name) + [dependency.name]
-            definition = ::Bundler::Definition.build(
-              gemfile.name,
-              lockfile&.name,
-              gems: gems_to_unlock + subdependencies,
-              lock_shared_dependencies: true
-            )
-
-            # Remove the Gemfile / gemspec requirements on the gems we're
-            # unlocking (i.e., completely unlock them)
-            gems_to_unlock.each do |gem_name|
-              unlock_gem(definition: definition, gem_name: gem_name)
-            end
-
-            # Set the requirement for the gem we're forcing an update of
-            new_req = Gem::Requirement.create("= #{target_version}")
-            definition.dependencies.
-              find { |d| d.name == dependency.name }.
-              instance_variable_set(:@requirement, new_req)
-
-            definition
-          end
-
-          def subdependencies
-            # If there's no lockfile we don't need to worry about
-            # subdependencies
-            return [] unless lockfile
-
-            all_deps =  ::Bundler::LockfileParser.new(sanitized_lockfile_body).
-                        specs.map(&:name).map(&:to_s)
-            top_level = ::Bundler::Definition.
-                        build(gemfile.name, lockfile.name, {}).
-                        dependencies.map(&:name).map(&:to_s)
-
-            all_deps - top_level
-          end
-
-          def unlock_gem(definition:, gem_name:)
-            dep = definition.dependencies.find { |d| d.name == gem_name }
-            version = definition.locked_gems.specs.
-                      find { |d| d.name == gem_name }.version
-
-            dep&.instance_variable_set(
-              :@requirement,
-              Gem::Requirement.create(">= #{version}")
-            )
-          end
-
-          def original_dependencies
-            @original_dependencies ||=
-              FileParsers::Ruby::Bundler.new(
-                dependency_files: dependency_files,
-                credentials: credentials,
-                source: nil
-              ).parse
-          end
-
-          def dependencies_from(updated_deps, specs)
-            # You might think we'd want to remove dependencies whose version
-            # hadn't changed from this array. We don't. We still need to unlock
-            # them to get Bundler to resolve, because unlocking them is what
-            # updates their subdependencies.
-            #
-            # This is kind of a bug in Bundler, and we should try to fix it,
-            # but resolving it won't necessarily be easy.
-            updated_deps.map do |dep|
-              original_dep =
-                original_dependencies.find { |d| d.name == dep.name }
-              spec = specs.find { |d| d.name == dep.name }
-
-              next if spec.version.to_s == original_dep.version
-
-              build_dependency(original_dep, spec)
-            end.compact
-          end
-
-          def build_dependency(original_dep, updated_spec)
-            Dependency.new(
-              name: updated_spec.name,
-              version: updated_spec.version.to_s,
-              requirements:
-                RequirementsUpdater.new(
-                  requirements: original_dep.requirements,
-                  update_strategy: requirements_update_strategy,
-                  updated_source: source_for(original_dep),
-                  latest_version: updated_spec.version.to_s,
-                  latest_resolvable_version: updated_spec.version.to_s
-                ).updated_requirements,
-              previous_version: original_dep.version,
-              previous_requirements: original_dep.requirements,
-              package_manager: original_dep.package_manager
-            )
-          end
-
-          def source_for(dependency)
-            dependency.requirements.
-              find { |r| r.fetch(:source) }&.
-              fetch(:source)
-          end
-
-          def gemfile
-            dependency_files.find { |f| f.name == "Gemfile" } ||
-              dependency_files.find { |f| f.name == "gems.rb" }
-          end
-
-          def lockfile
-            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
-              dependency_files.find { |f| f.name == "gems.locked" }
-          end
-
-          def sanitized_lockfile_body
-            re = FileUpdaters::Ruby::Bundler::LockfileUpdater::LOCKFILE_ENDING
-            lockfile.content.gsub(re, "")
-          end
-
-          def write_temporary_dependency_files
-            dependency_files.each do |file|
-              path = file.name
-              FileUtils.mkdir_p(Pathname.new(path).dirname)
-              File.write(path, file.content)
-            end
-
-            File.write(lockfile.name, sanitized_lockfile_body) if lockfile
-          end
-
-          def relevant_credentials
-            credentials.select do |cred|
-              next true if cred["type"] == "git_source"
-              next true if cred["type"] == "rubygems_server"
-
-              false
-            end
-          end
-        end
-      end
-    end
-  end
-end