dependabot-core 0.93.17 → 0.94.0

data/lib/dependabot/update_checkers/ruby/bundler/latest_version_finder.rb

@@ -1,169 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler_definition_ruby_version_patch"
-require "bundler_definition_bundler_version_patch"
-require "bundler_git_source_patch"
-
-require "excon"
-
-require "dependabot/update_checkers/ruby/bundler"
-require "dependabot/utils/ruby/requirement"
-require "dependabot/shared_helpers"
-require "dependabot/errors"
-
-module Dependabot
-  module UpdateCheckers
-    module Ruby
-      class Bundler
-        class LatestVersionFinder
-          require_relative "shared_bundler_helpers"
-          include SharedBundlerHelpers
-
-          def initialize(dependency:, dependency_files:, credentials:,
-                         ignored_versions:)
-            @dependency       = dependency
-            @dependency_files = dependency_files
-            @credentials      = credentials
-            @ignored_versions = ignored_versions
-          end
-
-          def latest_version_details
-            @latest_version_details ||= fetch_latest_version_details
-          end
-
-          private
-
-          attr_reader :dependency, :dependency_files, :credentials,
-                      :ignored_versions
-
-          def fetch_latest_version_details
-            if dependency.name == "bundler"
-              return latest_rubygems_version_details
-            end
-
-            case dependency_source
-            when NilClass then latest_rubygems_version_details
-            when ::Bundler::Source::Rubygems
-              if dependency_source.remotes.none? ||
-                 dependency_source.remotes.first.to_s == "https://rubygems.org/"
-                latest_rubygems_version_details
-              else
-                latest_private_version_details
-              end
-            when ::Bundler::Source::Git then latest_git_version_details
-            end
-          end
-
-          def latest_rubygems_version_details
-            response = Excon.get(
-              "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
-              idempotent: true,
-              **SharedHelpers.excon_defaults
-            )
-
-            relevant_versions =
-              JSON.parse(response.body).
-              reject do |d|
-                version = Gem::Version.new(d["number"])
-                next true if version.prerelease? && !wants_prerelease?
-                next true if ignore_reqs.any? { |r| r.satisfied_by?(version) }
-
-                false
-              end
-
-            dep = relevant_versions.max_by { |d| Gem::Version.new(d["number"]) }
-            return unless dep
-
-            {
-              version: Gem::Version.new(dep["number"]),
-              sha: dep["sha"]
-            }
-          rescue JSON::ParserError, Excon::Error::Timeout
-            nil
-          end
-
-          def latest_private_version_details
-            in_a_temporary_bundler_context do
-              spec =
-                dependency_source.
-                fetchers.flat_map do |fetcher|
-                  fetcher.
-                    specs_with_retry([dependency.name], dependency_source).
-                    search_all(dependency.name).
-                    reject { |s| s.version.prerelease? && !wants_prerelease? }.
-                    reject do |s|
-                      ignore_reqs.any? { |r| r.satisfied_by?(s.version) }
-                    end
-                end.
-                max_by(&:version)
-              spec.nil? ? nil : { version: spec.version }
-            end
-          end
-
-          def latest_git_version_details
-            dependency_source_details =
-              dependency.requirements.map { |r| r.fetch(:source) }.
-              uniq.compact.first
-
-            in_a_temporary_bundler_context do
-              SharedHelpers.with_git_configured(credentials: credentials) do
-                # Note: we don't set `ref`, as we want to unpin the dependency
-                source = ::Bundler::Source::Git.new(
-                  "uri" => dependency_source_details[:url],
-                  "branch" => dependency_source_details[:branch],
-                  "name" => dependency.name,
-                  "submodules" => true
-                )
-
-                # Tell Bundler we're fine with fetching the source remotely
-                source.instance_variable_set(:@allow_remote, true)
-
-                spec = source.specs.first
-                { version: spec.version, commit_sha: spec.source.revision }
-              end
-            end
-          end
-
-          def wants_prerelease?
-            @wants_prerelease ||=
-              begin
-                current_version = dependency.version
-                if current_version && Gem::Version.correct?(current_version) &&
-                   Gem::Version.new(current_version).prerelease?
-                  return true
-                end
-
-                dependency.requirements.any? do |req|
-                  req[:requirement].match?(/[a-z]/i)
-                end
-              end
-          end
-
-          def dependency_source
-            return nil unless gemfile
-
-            @dependency_source ||=
-              in_a_temporary_bundler_context do
-                definition = ::Bundler::Definition.build(gemfile.name, nil, {})
-
-                specified_source =
-                  definition.dependencies.
-                  find { |dep| dep.name == dependency.name }&.source
-
-                specified_source || definition.send(:sources).default_source
-              end
-          end
-
-          def ignore_reqs
-            ignored_versions.map { |req| Gem::Requirement.new(req.split(",")) }
-          end
-
-          def gemfile
-            dependency_files.find { |f| f.name == "Gemfile" } ||
-              dependency_files.find { |f| f.name == "gems.rb" }
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/update_checkers/ruby/bundler/requirements_updater.rb

@@ -1,283 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/update_checkers/ruby/bundler"
-
-module Dependabot
-  module UpdateCheckers
-    module Ruby
-      class Bundler
-        class RequirementsUpdater
-          class UnfixableRequirement < StandardError; end
-
-          ALLOWED_UPDATE_STRATEGIES =
-            %i(bump_versions bump_versions_if_necessary).freeze
-
-          def initialize(requirements:, update_strategy:, updated_source:,
-                         latest_version:, latest_resolvable_version:)
-            @requirements = requirements
-            @latest_version = Gem::Version.new(latest_version) if latest_version
-            @updated_source = updated_source
-            @update_strategy = update_strategy
-
-            check_update_strategy
-
-            return unless latest_resolvable_version
-
-            @latest_resolvable_version =
-              Gem::Version.new(latest_resolvable_version)
-          end
-
-          def updated_requirements
-            requirements.map do |req|
-              if req[:file].match?(/\.gemspec/)
-                update_gemspec_requirement(req)
-              else
-                # If a requirement doesn't come from a gemspec, it must be from
-                # a Gemfile.
-                update_gemfile_requirement(req)
-              end
-            end
-          end
-
-          private
-
-          attr_reader :requirements, :updated_source,
-                      :latest_version, :latest_resolvable_version,
-                      :update_strategy
-
-          def check_update_strategy
-            return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
-
-            raise "Unknown update strategy: #{update_strategy}"
-          end
-
-          def update_gemfile_requirement(req)
-            req = req.merge(source: updated_source)
-            return req unless latest_resolvable_version
-
-            case update_strategy
-            when :bump_versions
-              update_version_requirement(req)
-            when :bump_versions_if_necessary
-              update_version_requirement_if_needed(req)
-            else raise "Unexpected update strategy: #{update_strategy}"
-            end
-          end
-
-          def update_version_requirement_if_needed(req)
-            return req if new_version_satisfies?(req)
-
-            update_version_requirement(req)
-          end
-
-          def update_version_requirement(req)
-            requirements =
-              req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
-
-            new_requirement =
-              if requirements.any?(&:exact?) then latest_resolvable_version.to_s
-              elsif requirements.any? { |r| r.to_s.start_with?("~>") }
-                tw_req = requirements.find { |r| r.to_s.start_with?("~>") }
-                update_twiddle_version(tw_req, latest_resolvable_version).to_s
-              else
-                update_gemfile_range(requirements).map(&:to_s).join(", ")
-              end
-
-            req.merge(requirement: new_requirement)
-          end
-
-          def new_version_satisfies?(req)
-            original_req = Gem::Requirement.new(req[:requirement].split(","))
-            original_req.satisfied_by?(latest_resolvable_version)
-          end
-
-          def update_gemfile_range(requirements)
-            updated_requirements =
-              requirements.flat_map do |r|
-                next r if r.satisfied_by?(latest_resolvable_version)
-
-                case op = r.requirements.first.first
-                when "<", "<="
-                  [update_greatest_version(r, latest_resolvable_version)]
-                when "!="
-                  []
-                else
-                  raise "Unexpected operation for unsatisfied Gemfile "\
-                        "requirement: #{op}"
-                end
-              end
-
-            binding_requirements(updated_requirements)
-          end
-
-          def at_same_precision(new_version, old_version)
-            release_precision =
-              old_version.to_s.split(".").select { |i| i.match?(/^\d+$/) }.count
-            prerelease_precision =
-              old_version.to_s.split(".").count - release_precision
-
-            new_release =
-              new_version.to_s.split(".").first(release_precision)
-            new_prerelease =
-              new_version.to_s.split(".").
-              drop_while { |i| i.match?(/^\d+$/) }.
-              first([prerelease_precision, 1].max)
-
-            [*new_release, *new_prerelease].join(".")
-          end
-
-          # rubocop:disable Metrics/PerceivedComplexity
-          def update_gemspec_requirement(req)
-            return req unless latest_version && latest_resolvable_version
-
-            requirements =
-              req[:requirement].split(",").map { |r| Gem::Requirement.new(r) }
-
-            return req if requirements.all? do |r|
-              requirement_satisfied?(r, req[:groups])
-            end
-
-            updated_requirements =
-              requirements.flat_map do |r|
-                next r if requirement_satisfied?(r, req[:groups])
-
-                if req[:groups] == ["development"] then bumped_requirements(r)
-                else widened_requirements(r)
-                end
-              end
-
-            updated_requirements = binding_requirements(updated_requirements)
-            req.merge(requirement: updated_requirements.map(&:to_s).join(", "))
-          rescue UnfixableRequirement
-            req.merge(requirement: :unfixable)
-          end
-          # rubocop:enable Metrics/PerceivedComplexity
-
-          def requirement_satisfied?(req, groups)
-            if groups == ["development"]
-              req.satisfied_by?(latest_resolvable_version)
-            else
-              req.satisfied_by?(latest_version)
-            end
-          end
-
-          def binding_requirements(requirements)
-            grouped_by_operator =
-              requirements.group_by { |r| r.requirements.first.first }
-
-            binding_reqs = grouped_by_operator.flat_map do |operator, reqs|
-              case operator
-              when "<", "<=" then reqs.min_by { |r| r.requirements.first.last }
-              when ">", ">=" then reqs.max_by { |r| r.requirements.first.last }
-              else requirements
-              end
-            end.uniq
-
-            binding_reqs << Gem::Requirement.new if binding_reqs.empty?
-            binding_reqs.sort_by { |r| r.requirements.first.last }
-          end
-
-          def widened_requirements(req)
-            op, version = req.requirements.first
-
-            case op
-            when "=", nil
-              if version < latest_resolvable_version
-                [Gem::Requirement.new("#{op} #{latest_resolvable_version}")]
-              else
-                req
-              end
-            when "<", "<=" then [update_greatest_version(req, latest_version)]
-            when "~>" then convert_twidle_to_range(req, latest_version)
-            when "!=" then []
-            when ">", ">=" then raise UnfixableRequirement
-            else raise "Unexpected operation for requirement: #{op}"
-            end
-          end
-
-          def bumped_requirements(req)
-            op, version = req.requirements.first
-
-            case op
-            when "=", nil
-              if version < latest_resolvable_version
-                [Gem::Requirement.new("#{op} #{latest_resolvable_version}")]
-              else
-                req
-              end
-            when "~>"
-              [update_twiddle_version(req, latest_resolvable_version)]
-            when "<", "<=" then [update_greatest_version(req, latest_version)]
-            when "!=" then []
-            when ">", ">=" then raise UnfixableRequirement
-            else raise "Unexpected operation for requirement: #{op}"
-            end
-          end
-
-          # rubocop:disable Metrics/AbcSize
-          def convert_twidle_to_range(requirement, version_to_be_permitted)
-            version = requirement.requirements.first.last
-            version = version.release if version.prerelease?
-
-            index_to_update = [version.segments.count - 2, 0].max
-
-            ub_segments = version_to_be_permitted.segments
-            ub_segments << 0 while ub_segments.count <= index_to_update
-            ub_segments = ub_segments[0..index_to_update]
-            ub_segments[index_to_update] += 1
-
-            lb_segments = version.segments
-            lb_segments.pop while lb_segments.any? && lb_segments.last.zero?
-
-            if lb_segments.none?
-              return [Gem::Requirement.new("< #{ub_segments.join('.')}")]
-            end
-
-            # Ensure versions have the same length as each other (cosmetic)
-            length = [lb_segments.count, ub_segments.count].max
-            lb_segments.fill(0, lb_segments.count...length)
-            ub_segments.fill(0, ub_segments.count...length)
-
-            [
-              Gem::Requirement.new(">= #{lb_segments.join('.')}"),
-              Gem::Requirement.new("< #{ub_segments.join('.')}")
-            ]
-          end
-          # rubocop:enable Metrics/AbcSize
-
-          # Updates the version in a "~>" constraint to allow the given version
-          def update_twiddle_version(requirement, version_to_be_permitted)
-            old_version = requirement.requirements.first.last
-            updated_v = at_same_precision(version_to_be_permitted, old_version)
-            Gem::Requirement.new("~> #{updated_v}")
-          end
-
-          # Updates the version in a "<" or "<=" constraint to allow the given
-          # version
-          def update_greatest_version(requirement, version_to_be_permitted)
-            if version_to_be_permitted.is_a?(String)
-              version_to_be_permitted =
-                Gem::Version.new(version_to_be_permitted)
-            end
-            op, version = requirement.requirements.first
-            version = version.release if version.prerelease?
-
-            index_to_update =
-              version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
-
-            new_segments = version.segments.map.with_index do |_, index|
-              if index < index_to_update
-                version_to_be_permitted.segments[index]
-              elsif index == index_to_update
-                version_to_be_permitted.segments[index] + 1
-              else 0
-              end
-            end
-
-            Gem::Requirement.new("#{op} #{new_segments.join('.')}")
-          end
-        end
-      end
-    end
-  end
-end