Drop support for Bundler version 1? Let Renovate create update PR for Bundler v1?

[HonkingGoose]

Tell us more.

Bundler version 1 is end of life. Should we:

• Drop Renovate support for Bundler version 1?
• Create a update PR from Bundler v1 to the first safe version of Bundler?

References

Full quote from Github Blog, Deprecation notice: Dependabot dropping support for Bundler v1:

As of October 7, 2024, Dependabot will no longer support Bundler version 1, which has reached its end-of-life. If you continue to use Bundler version 1, there’s a risk that Dependabot will not create pull requests to update dependencies. If this affects you, we recommend updating to a supported release of Bundler. As of September 2024, the newest supported version of Bundler is 2.5. View Bundler’s official support policies for more information about supported releases.

[rarkins]

My questions:

1. Do we even support Bundler v1 today?
2. Is there a way to "upgrade" a Bundler v1 project to v2, and if so then can Renovate do that already?

[HonkingGoose]

I think we support Bundler v1 today

We have code mentioning Bundler versions below 2. So that implies Bundler version 1 support.

renovate/lib/modules/manager/bundler/artifacts.spec.ts

Line 491 in a95e869

it('injects bundler host configuration as command with bundler < 2', async () => {

renovate/lib/modules/manager/bundler/artifacts.ts

Lines 173 to 191 in a95e869

	// Bundler < 2 has a different config option syntax than >= 2
	if (
	bundlerHostRulesAuthCommands &&
	bundler &&
	isValid(bundler) &&
	lt(bundler, '2')
	) {
	preCommands.push(
	...bundlerHostRulesAuthCommands.map(
	(authCommand) => `bundler config --local ${authCommand}`,
	),
	);
	} else if (bundlerHostRulesAuthCommands) {
	preCommands.push(
	...bundlerHostRulesAuthCommands.map(
	(authCommand) => `bundler config set --local ${authCommand}`,
	),
	);
	}

Upgrading bundler from v1 to v2

If the prerequisites are met, I think you can run bundle update --bundler to update Bundler itself.

The Bundler docs say:

Before you upgrade to Bundler 2, make sure you have the right Ruby and RubyGems. You need to be using Ruby 2.3.0 or higher, and you need to have RubyGems 2.5.0 or higher.

And also:

Your existing applications will continue to use Bundler 1. Bundler will never change your application to a new major version until you choose to do so. If your application is ready, you can upgrade that application to the latest installed version of Bundler by running bundle update --bundler.

We recommend committing your Gemfile.lock before you upgrade. That way, if something goes wrong or doesn’t work, you can always revert to the previous lockfile and go back to using Bundler 1.

Source: Bundler: How to Upgrade to Bundler 2

[rarkins]

I would like to do this:

1. See if we can count how many repos/orgs have Bundler v1 in the hosted app, ideally also an ability to see if they're old/stale or still being updated, and
2. Make sure that Renovate can propose updating Bundler correctly in such cases (at least to propose the PR, even if some manual intervention is necessary)

[HonkingGoose]

1. See if we can count how many repos/orgs have Bundler v1 in the hosted app, ideally also an ability to see if they're old/stale or still being updated, and

I tried getting a GitHub code search going for you. I'm stuck on getting GitHub to accept my regex. It works on regex101, but GitHub complains about escaping the forward slashes... Here's what I found so far:

Finding bundler version hosted app

The bottom of the Gemfile.lock shows which version of Bundler was used to generate the lockfile. For example:

BUNDLED WITH
   2.5.10

The important bits here are:

• The string BUNDLED WITH
• The newline
• The 4 spaces
• Capturing versions in the 1.0.0 range

Regex

This regex matches the format above, but for versions starting with 1.

BUNDLED WITH\v\s\s\s[1]\.\d+\.\d+

I tried this regex on GitHub. But escaping the whole regex with / leads to no results on GitHub. 😕

/BUNDLED WITH\v\s\s\s[1]\.\d+\.\d+/

Limit search to Gemfile.lock

I found out we can use path:**/Gemfile.lock to limit the search to just the Gemfile.lock files.

Limit search to only repositories with renovate.json AND Gemfile.lock

The final step is to say to GitHub:

1. IF the repository has a renovate.json file AND a Gemfile.lock.
2. Then use the regex (properly escaped) to find versions in the range 1.0.0.
3. Show results that match IF statement AND the regex.

Documentation

GitHub Docs, understanding GitHub code search, using regular expressions