[rubygems/rubygems] Let compact index response parser consistently return a mutable dependencies array

That restores support for compact index dummy implementations that only lists
versions, without checksums or dependencies.

This format is undocumented, so we may want to get rid of it in the
future. However, some of our tests rely on it, and some implementations
did use it (gems.mutant.dev at least). And the way the code was written
suggest that support was intentional.

So for now, we should restore it.

https://github.com/rubygems/rubygems/commit/0427d8c983

lib/bundler/rubygems_ext.rb

@@ -447,6 +447,17 @@ module Gem
     end
   end
 
+  unless Gem.rubygems_version >= Gem::Version.new("3.6.7")
+    module UnfreezeCompactIndexParsedResponse
+      def parse(line)
+        version, platform, dependencies, requirements = super
+        [version, platform, dependencies.frozen? ? dependencies.dup : dependencies, requirements.frozen? ? requirements.dup : requirements]
+      end
+    end
+
+    Resolver::APISet::GemParser.prepend(UnfreezeCompactIndexParsedResponse)
+  end
+
   if Gem.rubygems_version < Gem::Version.new("3.6.0")
     class Package; end
     require "rubygems/package/tar_reader"

lib/rubygems/resolver/api_set/gem_parser.rb

@@ -1,15 +1,12 @@
 # frozen_string_literal: true
 
 class Gem::Resolver::APISet::GemParser
-  EMPTY_ARRAY = [].freeze
-  private_constant :EMPTY_ARRAY
-
   def parse(line)
     version_and_platform, rest = line.split(" ", 2)
     version, platform = version_and_platform.split("-", 2)
     dependencies, requirements = rest.split("|", 2).map! {|s| s.split(",") } if rest
-    dependencies = dependencies ? dependencies.map! {|d| parse_dependency(d) } : EMPTY_ARRAY
-    requirements = requirements ? requirements.map! {|d| parse_dependency(d) } : EMPTY_ARRAY
+    dependencies = dependencies ? dependencies.map! {|d| parse_dependency(d) } : []
+    requirements = requirements ? requirements.map! {|d| parse_dependency(d) } : []
     [version, platform, dependencies, requirements]
   end
 

spec/bundler/install/gems/compact_index_spec.rb

@@ -1089,4 +1089,11 @@ Running `bundle update rails` should fix the problem.
     count = lockfile.match?("CHECKSUMS") ? 2 : 1 # Once in the specs, and once in CHECKSUMS
     expect(lockfile.scan(/activemerchant \(/).size).to eq(count)
   end
+
+  it "handles an API that does not provide checksums info (undocumented, support may get removed)" do
+    install_gemfile <<-G, artifice: "compact_index_no_checksums"
+      source "https://gem.repo1"
+      gem "rake"
+    G
+  end
 end

spec/bundler/support/artifice/compact_index_no_checksums.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require_relative "helpers/compact_index"
+
+class CompactIndexNoChecksums < CompactIndexAPI
+  get "/info/:name" do
+    etag_response do
+      gem = gems.find {|g| g.name == params[:name] }
+      gem.versions.map(&:number).join("\n")
+    end
+  end
+end
+
+require_relative "helpers/artifice"
+
+Artifice.activate_with(CompactIndexNoChecksums)