Fix NoMethodError during bundle update --group

The `bundler` gem does not participate in the lockfile, but it can still
be included in the list of dependencies that are being updated by
`bundle update` if `--group` is specified.

For example, if a Gemfile contains `bundler-audit` (which depends on
`bundler`) in the `:development` group, then updating with the option
`--group=development` will naturally include `bundler` in the list of
gems to evaluate for updating.

The trouble is that since `bundler` is excluded from the lockfile,
searching the locked gems for a gemspec for bundler will return `nil`.
This caused the following error during `bundle update`:

    NoMethodError: undefined method `version' for nil:NilClass

This commit solves this bug by skipping over gems (i.e `bundler`) that
are not in the lockfile when comparing gem versions at the conclusion of
the upgrade command.

Author: mattbrictson

CHANGELOG.md

@@ -11,6 +11,7 @@ Bugfixes:
   - prioritise explicitly requested gems in dependency resolution sort order (@segiddins)
   - reduce memory usage during dependency resolution ([#6114](https://github.com/bundler/bundler/issues/6114), @greysteil)
   - ensure that the default bundler gem is not accidentally activated on ruby 2.5 when using local git overrides (@segiddins)
+  - fix `NoMethodError` when using the `--group` option with `bundle update` ([#6156](https://github.com/bundler/bundler/issues/6156), @mattbrictson)
 
 ## 1.16.0.pre.3 (2017-10-04)
 

lib/bundler/cli/update.rb

@@ -68,7 +68,9 @@ def run
 
       if locked_gems = Bundler.definition.locked_gems
         gems.each do |name|
-          locked_version = locked_gems.specs.find {|s| s.name == name }.version
+          locked_version = locked_gems.specs.find {|s| s.name == name }
+          locked_version &&= locked_version.version
+          next unless locked_version
           new_version = Bundler.definition.specs[name].first
           new_version &&= new_version.version
           if !new_version

spec/commands/update_spec.rb

@@ -195,6 +195,23 @@
         expect(the_bundle).not_to include_gems "foo 2.0"
       end
     end
+
+    context "when bundler itself is a transitive dependency" do
+      it "executes without error" do
+        install_gemfile <<-G
+          source "file://#{gem_repo1}"
+          gem "activesupport", :group => :development
+          gem "rack"
+        G
+        update_repo2 do
+          build_gem "activesupport", "3.0"
+        end
+        bundle "update --group development"
+        expect(the_bundle).to include_gems "activesupport 2.3.5"
+        expect(the_bundle).to include_gems "bundler #{Bundler::VERSION}"
+        expect(the_bundle).not_to include_gems "rack 1.2"
+      end
+    end
   end
 
   describe "in a frozen bundle" do