Dependabot-core: Dependabot removing platform specific gems from Gemfile.lock

[ashkulz]

Package manager/ecosystem
ruby:bundler 2.2.3

Manifest contents prior to update
Gemfile

gem 'sorbet'
gem 'sorbet-runtime'

Gemfile.lock (snippet)

    sorbet (0.5.6034)
      sorbet-static (= 0.5.6034)
    sorbet-runtime (0.5.6034)
    sorbet-static (0.5.6034-universal-darwin-14)
    sorbet-static (0.5.6034-universal-darwin-15)
    sorbet-static (0.5.6034-universal-darwin-16)
    sorbet-static (0.5.6034-universal-darwin-17)
    sorbet-static (0.5.6034-universal-darwin-18)
    sorbet-static (0.5.6034-universal-darwin-19)
    sorbet-static (0.5.6034-universal-darwin-20)
    sorbet-static (0.5.6034-x86_64-linux)

Updated dependency
n/a

What you expected to see, versus what you actually saw

Dependabot is removing the dependencies, which were added as part of Bundler 2.2.3 (see rubygems/rubygems#4180). It should be left untouched, as the PR is for a different dependency and it works fine when using bundler 2.2.3 via the CLI.

Images of the diff or a link to the PR, issue or logs

[connorshea]

I'm running into the same thing.

[connorshea]

You can see this with nokogiri 1.11.0.rc4 as well, since it's now shipping as a pre-compiled gem.

[tas50]

It would be really great if you could specify platforms in the Ruby dependabot config. In our project we bundle ruby, x64-mingw32, and x86-mingw32 into a single Gemfile.lock we use to build our project on Linux/Mac/Windows. Dependabot just can't handle that kind of non-ruby platform situation.

[ashkulz]

@connorshea it didn't make a difference for us, as nokogiri doesn't ship with gems for each version of macOS.

[jurre]

Hey, yeah I think this happens because we don't fully support bundler v2 yet :( We're currently planning this work though, and hope to add support relatively soon.

[ashkulz]

In the meantime, we downgraded back to bundler 2.2.1 and added the platforms we use via bundle lock --add-platform -- Dependabot is too useful :slightly_smiling_face: