Dependabot-core: Support Bundler v2

[xtreme-jason-smith]

For the past month or so, Dependepot has been opening and closing issues on our repo with the following issue:

Bundler::VersionConflict with message: Bundler could not find compatible versions for gem "bundler":
  In Gemfile:
    license_finder was resolved to 0.0.1, which depends on
      bundler (~> 2.1.0)

  Current Bundler version:
    bundler (1.17.3)
This Gemfile requires a different version of Bundler.
Perhaps you need to update Bundler by running `gem install bundler`?

Could not find gem 'bundler (~> 2.1.0)', which is required by gem 'license_finder', in any of the sources.

Bundler could not find compatible versions for gem "rack":
  In Gemfile:
    rack (> 1.6, ~> 2.0.7)

    capybara (~> 3.15.0) was resolved to 3.15.1, which depends on
      rack (>= 1.6.0)

    rack-test (> 0.7, ~> 1.1.0) was resolved to 1.1.0, which depends on
      rack (>= 1.0, < 3)

This aligns with our recent changes to lock our bundler version to ~> 2.1.0 in our gemspec file. However, it appears that Dependebot Docker image only has Bundler 1.17.3 installed.

It should be updated to also support Bundler 2.x

[hadees]

I'm having the same issue, pretty frustrating since I don't think I can do anything about it. We have no way to specify a bundler version.

[feelepxyz]

Sorry about this, Dependabot currently doesn't support bundler v2. We have it on our backlog and will get to it but we're currently focusing on integrating Dependabot natively within GitHub so we've slowed down on package ecosystem support while we do this.

[GiriB]

@feelepxyz Bundler 1.x are prone to injection attack via gem name collisions. Shouldn't we prioritize moving to 2.x?

[jamesbebbington]

Hey @feelepxyz Dependabot is a wonderful tool, and when combined with GitHub Actions, truly is a match made in heaven! Any update on when support for bundler 2.x might be added? Thanks.

[feelepxyz]

@jamesbebbington thanks for the kind words! Soon! We're currently working on ecosystem upgrades (npm 7, bundler 2, pipenv) and hoping to get to bundler 2 in the next month or so. Dependabot currently has partial bundler 2 support but won't work for projects that depend on gems that require bundler 2 to be installed.

[jamesbebbington]

That's great news! Many thanks!