feat(bundler): enable Bundler 4 runtime support in helper flow (#14988)

* feat(bundler): enable Bundler 4 runtime support in helper flow

* fix(bundler): address review feedback on version resolution

- add upper bound (< 5) to prevent unintended Bundler 5+ activation
- resolve Bundler version from GEM_HOME only, not all gem paths
- add test specs for version resolution and override behavior

* test(bundler): skip bundler<3 constraint specs under bundler 4 helper runtime

* style(bundler): fix RuboCop RSpec offenses in v4 specs

* fix(bundler): print resolved Bundler version in helper build script

Without 'print', the Ruby one-liner produced an empty default_version,
causing 'bundle __ install' to raise Illformed requirement [""].

* fix(common): allow Bundler 4 in dependabot-common gemspec

* chore: update Gemfile.lock for bundler dependency bump

* chore(updater): update Gemfile.lock for bundler dependency bump

* fix(bundler): don't load run.rb in helper version spec

run.rb has top-level code that reads from $stdin, which crashed the
spec process and cascaded into all other helper specs. Replace the
require with a direct check of Bundler::VERSION.

* fix(bundler): support Bundler 4 in helper specs and APIs

- Eagerly require RSpec built-in matchers in native_spec_helper to work
  around Bundler 4's stricter $LOAD_PATH that breaks lazy autoload.
- Use safe matchers (include, be_positive) in bundler_version_spec.
- Replace removed Bundler::SourceList#rubygems_remotes with
  rubygems_sources.flat_map(&:remotes), keeping a respond_to? fallback.
- Replace removed Bundler::Index#search_all with #search, with fallback.
- Split specified_source fixture lockfile into separate GEM sections per
  remote (Bundler 4 hard-removed multi-remote single source).

* Address PR review feedback for Bundler 4 runtime support

- run.rb now honours DEPENDABOT_BUNDLER_VERSION_CONSTRAINT and the
  BUNDLER_VERSION_CONSTRAINT fallback, so the activation constraint
  matches the version installed by build (and rollback works).
- Extract BundlerVersionConstraint module and unit-test it in
  bundler_version_constraint_spec.rb (replacing the env-fetch round
  trip tests). Drop the dead 'not_to eq(3)' assertion.
- Replace hard-coded /opt/bundler/v2/.../bundler-4.0.11.gemspec
  skip checks with PackageManagerHelper.helper_running_bundler_v4?,
  which inspects the helper's GEM_HOME so it works across patch bumps.
- Restore bad-git-reference assertion in update_checker_spec by
  expecting GitDependencyReferenceNotFound on Bundler 2 and
  GitDependenciesNotReachable on Bundler 4.
- Note in package_manager.rb that Bundler 3 was intentionally
  skipped upstream.
- Document DEPENDABOT_BUNDLER_VERSION_CONSTRAINT and
  BUNDLER_VERSION_CONSTRAINT in bundler/README.md.

* Tighten dependabot-common bundler lower bound to >= 2.4

Match the helper runtime, which already requires >= 2.4. Lockfiles are
updated in lockstep.

Author: thavaahariharangit

Gemfile.lock

@@ -29,7 +29,7 @@ PATH
     dependabot-common (0.375.0)
       aws-sdk-codecommit (~> 1.28)
       aws-sdk-ecr (~> 1.5)
-      bundler (>= 1.16, < 3.0.0)
+      bundler (>= 2.4, < 5.0.0)
       commonmarker (~> 2.3)
       docker_registry2 (~> 1.18)
       excon (~> 1.2)
@@ -539,6 +539,7 @@ CHECKSUMS
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
   bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+  bundler (4.0.11) sha256=5bcec0fb78302e48d02ee46f10ee6e6942be647ba5b44a6d1ddfda9a240ce785
   citrus (3.0.2) sha256=4ec2412fc389ad186735f4baee1460f7900a8e130ffe3f216b30d4f9c684f650
   commonmarker (2.8.2-arm64-darwin) sha256=cd7364f1fb9735d60218e4af0a4afbbeedbc465eb81cccca56f29a4efe2b5013
   commonmarker (2.8.2-x86_64-linux) sha256=42cfb6532b15dd5821ce99e47397923255f32dcfc81024ef4c17e01e66ac7d75
@@ -674,4 +675,4 @@ CHECKSUMS
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd
 
 BUNDLED WITH
-   2.7.2
+  4.0.11

bundler/README.md

@@ -15,4 +15,18 @@ Ruby (bundler) support for [`dependabot-core`][core-repo].
    [dependabot-core-dev] ~ $ cd bundler && rspec
    ```
 
+### Native helper Bundler runtime
+
+The native helper at `helpers/v2` runs under Bundler 4 by default. Two
+environment variables can override the Bundler version installed by `build`
+and activated by `run.rb`, which is intended for staged rollouts and
+emergency rollback to Bundler 2:
+
+- `DEPENDABOT_BUNDLER_VERSION_CONSTRAINT` (preferred)
+- `BUNDLER_VERSION_CONSTRAINT` (fallback)
+
+Both accept any RubyGems requirement string, e.g. `~> 4.0`, `~> 2.7`, or a
+comma-separated list like `>= 2.4, < 5`. When neither is set the helper uses
+`~> 4.0` for installation and `>= 2.4, < 5` for activation.
+
 [core-repo]: https://github.com/dependabot/dependabot-core

bundler/helpers/v2/build

@@ -19,12 +19,27 @@ fi
 
 cd "$install_dir"
 
-default_version=$(ruby -rbundler -e'print Bundler::VERSION')
+# Default to Bundler 4, with an override for controlled testing/rollouts.
+bundler_constraint="${DEPENDABOT_BUNDLER_VERSION_CONSTRAINT:-${BUNDLER_VERSION_CONSTRAINT:-~> 4.0}}"
 
 export GEM_HOME=$install_dir/.bundle
 
-gem install bundler -v "$default_version" --no-document
+gem install bundler -v "$bundler_constraint" --no-document
+
+# Resolve the Bundler version that was actually installed in GEM_HOME to ensure
+# consistency with what was requested and to avoid picking up system gems.
+default_version=$(ruby -e '
+  gemspecs = Dir.glob("#{ENV["GEM_HOME"]}/specifications/bundler-*.gemspec")
+  latest = gemspecs.max_by { |f| Gem::Version.new(File.basename(f).match(/bundler-(.*)\.gemspec/)[1]) }
+  abort("No bundler gemspec found in #{ENV["GEM_HOME"]}/specifications") unless latest
+  print File.basename(latest).match(/bundler-(.*)\.gemspec/)[1]
+')
+
+if [ -z "$default_version" ]; then
+  echo "error: failed to resolve installed Bundler version in $GEM_HOME" >&2
+  exit 1
+fi
 
 if [ -z "$DEPENDABOT_NATIVE_HELPERS_PATH" ]; then
-  bundle install
+  bundle _"$default_version"_ install
 fi

bundler/helpers/v2/lib/bundler_version_constraint.rb

@@ -0,0 +1,25 @@
+# typed: true
+# frozen_string_literal: true
+
+# Resolves the Bundler version constraint that the native helper should use
+# at activation time. Honors DEPENDABOT_BUNDLER_VERSION_CONSTRAINT, falling
+# back to BUNDLER_VERSION_CONSTRAINT, and finally to the supplied default.
+#
+# Used by both `run.rb` (for activation via `gem`) and the helper specs so
+# the rollback/staged-rollout behavior is exercised by real code.
+module BundlerVersionConstraint
+  DEFAULT_ACTIVATION_CONSTRAINT = ">= 2.4, < 5"
+
+  def self.resolve(env: ENV, default: DEFAULT_ACTIVATION_CONSTRAINT)
+    env.fetch(
+      "DEPENDABOT_BUNDLER_VERSION_CONSTRAINT",
+      env.fetch("BUNDLER_VERSION_CONSTRAINT", default)
+    )
+  end
+
+  # Splits a comma-separated requirement string into the individual clauses
+  # accepted by Kernel#gem (e.g. ">= 2.4, < 5" -> [">= 2.4", "< 5"]).
+  def self.activation_clauses(constraint)
+    constraint.split(",").map(&:strip)
+  end
+end

bundler/helpers/v2/lib/functions.rb

@@ -91,11 +91,14 @@ def self.jfrog_source(**args)
     # Set flags and credentials
     set_bundler_flags_and_credentials(dir: args.fetch(:dir), credentials: args.fetch(:credentials))
 
-    Bundler::Definition.build(args.fetch(:gemfile_name), nil, {})
-                       .send(:sources)
-                       .rubygems_remotes
-                       .find { |uri| uri.host.include?("jfrog") }
-                       &.host
+    sources = Bundler::Definition.build(args.fetch(:gemfile_name), nil, {}).send(:sources)
+    # Bundler 4 removed SourceList#rubygems_remotes; use rubygems_sources + flat_map(&:remotes)
+    remotes = if sources.respond_to?(:rubygems_remotes)
+                sources.rubygems_remotes
+              else
+                sources.rubygems_sources.flat_map(&:remotes)
+              end
+    remotes.find { |uri| uri.host&.include?("jfrog") }&.host
   end
 
   def self.git_specs(**args)

bundler/helpers/v2/lib/functions/dependency_source.rb

@@ -41,9 +41,10 @@ def private_registry_versions
 
       bundler_source
         .fetchers.flat_map do |fetcher|
-          fetcher
-            .specs([dependency_name], bundler_source)
-            .search_all(dependency_name).map(&:version)
+          index = fetcher.specs([dependency_name], bundler_source)
+          # Bundler 4 removed Index#search_all; use #search which returns all matches
+          specs = index.respond_to?(:search_all) ? index.search_all(dependency_name) : index.search(dependency_name)
+          specs.map(&:version)
         end
     end
 

bundler/helpers/v2/run.rb

@@ -1,7 +1,14 @@
 # typed: true
 # frozen_string_literal: true
 
-gem "bundler", "~> 2.4"
+require_relative "lib/bundler_version_constraint"
+
+# Allow Bundler 4 by default with an upper bound to prevent unintended future
+# major versions. Honor DEPENDABOT_BUNDLER_VERSION_CONSTRAINT (or its
+# BUNDLER_VERSION_CONSTRAINT fallback) so staged rollouts and emergency
+# rollbacks performed by the build script are respected at activation time.
+bundler_constraint = BundlerVersionConstraint.resolve
+gem "bundler", *BundlerVersionConstraint.activation_clauses(bundler_constraint)
 require "bundler"
 require "json"
 

bundler/helpers/v2/spec/bundler_version_constraint_spec.rb

@@ -0,0 +1,65 @@
+# typed: false
+# frozen_string_literal: true
+
+require "native_spec_helper"
+require_relative "../lib/bundler_version_constraint"
+
+RSpec.describe BundlerVersionConstraint do
+  describe "helper runtime activation" do
+    it "is running a supported Bundler major version" do
+      # Bundler 3 was intentionally skipped upstream (Bundler jumped from 2.7
+      # straight to 4.0 to align with RubyGems) so the supported window is
+      # 2.x or 4.x.
+      bundler_major = Bundler::VERSION.split(".").first.to_i
+      expect(bundler_major).to be_between(2, 4)
+    end
+  end
+
+  describe ".resolve" do
+    it "returns the DEPENDABOT_BUNDLER_VERSION_CONSTRAINT override when set" do
+      env = { "DEPENDABOT_BUNDLER_VERSION_CONSTRAINT" => "~> 2.7" }
+      expect(described_class.resolve(env: env)).to eq("~> 2.7")
+    end
+
+    it "prefers DEPENDABOT_BUNDLER_VERSION_CONSTRAINT over BUNDLER_VERSION_CONSTRAINT" do
+      env = {
+        "DEPENDABOT_BUNDLER_VERSION_CONSTRAINT" => "~> 2.7",
+        "BUNDLER_VERSION_CONSTRAINT" => "~> 4.0"
+      }
+      expect(described_class.resolve(env: env)).to eq("~> 2.7")
+    end
+
+    it "falls back to BUNDLER_VERSION_CONSTRAINT when only that is set" do
+      env = { "BUNDLER_VERSION_CONSTRAINT" => "~> 4.0" }
+      expect(described_class.resolve(env: env)).to eq("~> 4.0")
+    end
+
+    it "uses the default activation constraint when no env var is set" do
+      expect(described_class.resolve(env: {})).to eq(">= 2.4, < 5")
+    end
+
+    it "honours an explicit default override" do
+      expect(described_class.resolve(env: {}, default: "~> 4.0")).to eq("~> 4.0")
+    end
+  end
+
+  describe ".activation_clauses" do
+    it "splits comma-separated requirement strings into trimmed clauses" do
+      expect(described_class.activation_clauses(">= 2.4, < 5")).to eq([">= 2.4", "< 5"])
+    end
+
+    it "returns a single clause for a single requirement" do
+      expect(described_class.activation_clauses("~> 4.0")).to eq(["~> 4.0"])
+    end
+  end
+
+  describe "build script GEM_HOME isolation" do
+    it "resolves Bundler version from GEM_HOME only" do
+      gem_home = ENV.fetch("GEM_HOME", nil)
+      skip "GEM_HOME not set in test environment" unless gem_home
+
+      bundler_specs = Dir.glob("#{gem_home}/specifications/bundler-*.gemspec")
+      expect(bundler_specs.length).to be_positive
+    end
+  end
+end

bundler/helpers/v2/spec/native_spec_helper.rb

@@ -6,6 +6,13 @@
 require "webmock/http_lib_adapters/excon_adapter"
 require "debug"
 
+# Bundler 4's stricter $LOAD_PATH handling breaks RSpec's lazy autoload of
+# built-in matchers (e.g. `satisfy`, `raise_error`, `contain_exactly`, `has`).
+# Eagerly load all of them so tests don't hit LoadError mid-run.
+Gem.loaded_specs["rspec-expectations"]&.then do |spec|
+  Dir[File.join(spec.full_gem_path, "lib/rspec/matchers/built_in/*.rb")].each { |f| require f }
+end
+
 $LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
 $LOAD_PATH.unshift(File.expand_path("../monkey_patches", __dir__))
 $LOAD_PATH.unshift(File.expand_path("../../spec_helpers", __dir__))

bundler/lib/dependabot/bundler/package_manager.rb

@@ -11,8 +11,14 @@ module Bundler
     ECOSYSTEM = "bundler"
     PACKAGE_MANAGER = "bundler"
 
-    # Keep versions in ascending order
-    SUPPORTED_BUNDLER_VERSIONS = T.let([Version.new("2")].freeze, T::Array[Dependabot::Version])
+    # Keep versions in ascending order.
+    # Note: Bundler 3 was intentionally skipped upstream — Bundler jumped from
+    # 2.7 directly to 4.0 to align its major version with RubyGems, so there
+    # is no Bundler 3.x release to support.
+    SUPPORTED_BUNDLER_VERSIONS = T.let(
+      [Version.new("2"), Version.new("4")].freeze,
+      T::Array[Dependabot::Version]
+    )
 
     # Currently, we don't support any deprecated versions of Bundler
     # When a version is going to be unsupported, it will be added here for a while to give users time to upgrade