Faraday dependency breaks Danger in ruby 2.x containers

[MajorFlamingo]

Report

Danger is unable to run due to the updated transitive faraday dependency release v 2.9.0. The faraday release 2.9.0 drops support for ruby v. 2.x.

The faraday dependency is included through the unversioned faraday-http-cache, that in turn also unversioned includes faraday.

What did you do?

Executed Danger in Gitlab CI. The Gitlab CI will by default use the Gitlab-supported container file. However, testing with the latest Danger v9.4.2 container image does yield the same result.

What did you expect to happen?

Danger is able to execute.

What happened instead?

Danger is unable to start with the following error message:

Bundler will use `/tmp/bundler20240112-46-r72zs146' as your home directory temporarily.
faraday-net_http-3.1.0 requires ruby version >= 3.0.0, which is incompatible
with the current version, ruby 2.7.5p203

Your Environment

• Which CI are you running on?
  Gitlab CI

• Are you running the latest version of Danger?

Yes, v. 9.4.2

• What is your Dangerfile?

The simplest Dangerfile will do, e.g. https://github.com/danger/danger/blob/master/Dangerfile

[manicmaniac]

Hmm, I'm wondering if this issue is due to Danger or not.

Yes, Faraday 2.9.0 drops support for Ruby 2.x but it should work because its gemspec says it supports Ruby 3.0 or above. Bundler recognizes Ruby version and installs older Faraday if you use Ruby 2.7.

The faraday dependency is included through the unversioned faraday-http-cache, that in turn also unversioned includes faraday.

No, it's versioned.
Dependencies in Gemfile are not installed when you just install Danger.
Current gemspec restricts faraday-http-cache to ~> 2.0.

However, testing with the latest Danger v9.4.2 container image does yield the same result.

It sounds weird. I think Bundler version mismatch occurs before installing Danger as reported in #1472 🤔

[manicmaniac]

@MajorFlamingo

A possible scenario is that

1. Install dependencies in Ruby 3.x
2. Copy Gemfile.lock to Docker container
3. Run Docker container that uses Ruby 2.x

Please double-check if your environment satisfies the above conditions.

If it does, this is not a bug in Danger. You need to install dependencies in Ruby as the same version of the Docker container or just not copy Gemfile.lock to the container.