dependabot-core
dependabot-core copied to clipboard
Stop sanitizing the lockfile in Bundler now that we have Bundler 2
I noticed this TODO in our code: https://github.com/dependabot/dependabot-core/blob/252cb9a123e82391995797fdac45cb8b6f49cbe7/bundler/lib/dependabot/bundler/file_updater/lockfile_updater.rb#L261
I also extracted some additional notes from our internal issue tracker:
- Remove
sanitized_lockfile_bodyfromDependabot::Bundler::FileUpdater::LockfileUpdater- We anticipate the
BUNDLED WITHline being added or modified during the update and reset it to the original line here, so leaving the existing line in place should not impact this: https://github.com/dependabot/dependabot-core/blob/252cb9a123e82391995797fdac45cb8b6f49cbe7/bundler/lib/dependabot/bundler/file_updater/lockfile_updater.rb#L190-L197 - By removing this line we are encouraging the native bundler version to treat the file as a/ malformed or b/ created by an early version of v1.x
- This may work as intended now, but it could introduce subtle bugs in future
- Finally, if we leave this line in place we can add a sanity check on the v1 native helper being passed a v2 file, or vice versa.
- We anticipate the