Fix security updates in Bundler subdependencies

[deivid-rodriguez]

What are you trying to accomplish?

I noticed that #9923 seems to have caused an issue where security updates in Bundler subdependencies no longer succeed.

The new issue seems much worse than the original enhancement (a better error message in an edge case).

So I'm trying to fix it.

Closes #10251.

Anything you want to highlight for special attention from reviewers?

I think ideally we'd add support in upstream Bundler for things like bundle lock --update foo=<version>, since right now Bundler only has the capability of updating dependencies to their latest version.

But that's a big feature, so for now I used an approach that creates a Bundler::Definition from the Gemfile but adds an extra top level dependency to force the update.

How will you know you've accomplished your goal?

Hopefully the new smoke test I added to cover this passes.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[thavaahariharangit]

LGTM

[deivid-rodriguez]

Sorry, I should've mentioned that in order to proof that the smoke test passes, I pointed it to my smoke-tests repository fork. The associated smoke tests PR needs to be merged, and then the workflows updated back to point to the main repo and branch.

[deivid-rodriguez]

For what it's worth, I retried the security update and it now succeeded 🎉

[jeffwidman]

Thanks @deivid-rodriguez for handling this in #10253. You shouldn't need to mention this, the PR reviewer should have caught it and coordinated with you on this.

[deivid-rodriguez]

It's ok. I also wanted to mention that I only fixed this for Bundler v2. I did not mess with Bundler v1 since given there's an ongoing discussion about what to do with it, I did not want to implement anything that may be immediately removed.