dependabot-core icon indicating copy to clipboard operation
dependabot-core copied to clipboard

Stop sanitizing the lockfile in Bundler now that we have Bundler 2

Open jeffwidman opened this issue 3 years ago • 0 comments

I noticed this TODO in our code: https://github.com/dependabot/dependabot-core/blob/252cb9a123e82391995797fdac45cb8b6f49cbe7/bundler/lib/dependabot/bundler/file_updater/lockfile_updater.rb#L261

I also extracted some additional notes from our internal issue tracker:

  • Remove sanitized_lockfile_body from Dependabot::Bundler::FileUpdater::LockfileUpdater
    • We anticipate the BUNDLED WITH line being added or modified during the update and reset it to the original line here, so leaving the existing line in place should not impact this: https://github.com/dependabot/dependabot-core/blob/252cb9a123e82391995797fdac45cb8b6f49cbe7/bundler/lib/dependabot/bundler/file_updater/lockfile_updater.rb#L190-L197
    • By removing this line we are encouraging the native bundler version to treat the file as a/ malformed or b/ created by an early version of v1.x
    • This may work as intended now, but it could introduce subtle bugs in future
    • Finally, if we leave this line in place we can add a sanity check on the v1 native helper being passed a v2 file, or vice versa.

jeffwidman avatar Sep 17 '22 23:09 jeffwidman