dependabot-bun 0.305.0 → 0.306.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce7041993b9d64b4a4189d5ca9a4a03a77dff0a4976ba90320edc0ae5a38b9e3
-  data.tar.gz: 78474ef6d6bc726d9275a7817c3ff3d7666d4c5692319567060f045aee579440
+  metadata.gz: 5318c5bef5f7b65a8b0dfcd0ac25f3a2224c6535d73fce986ac77acdb2485c66
+  data.tar.gz: d1209df0024619b48d7e8cb34b4d2dcdf37bdd67593ce0910ed20519eaba6ea5
 SHA512:
-  metadata.gz: 952dc4d6c311dab15d48d7992ea857e2f18c0f2df16fb73804f8b2c3d8c3eb6334abf86d10ab455da85d6745d3c8ca7082433d9f8302374bb5d29d7b0f04e758
-  data.tar.gz: 786c6d9069871bf87518bfc1bdb464ad50fb7818f4ded374e6568c40cf7f31eeef01d692b8a41f07e57d2ca0783824d155cc44238a691a8aad49dd7649ec9cce
+  metadata.gz: 547fcd49277721954a07f796e265fc4d69759d2338ff5e3e513f93c66ea32cf4eb574fc330230ccf20e6c355591aeca11e19a138734cfdc2a1bdf638ec445787
+  data.tar.gz: 104aa91ef4222b1cf17e200ee9656c538afca3b14a84b338e8e63ad1796c101118514dec420d278b19355dccc4514f7117577fb60362deb22a7750d54f6378d9

data/lib/dependabot/bun/file_fetcher.rb

@@ -98,8 +98,6 @@ module Dependabot
 
       sig { returns(T.nilable(T.any(Integer, String))) }
       def bun_version
-        return @bun_version = nil unless allow_beta_ecosystems?
-
         @bun_version ||= T.let(
           package_manager_helper.setup(BunPackageManager::NAME),
           T.nilable(T.any(Integer, String))

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -27,9 +27,9 @@ module Dependabot
 
         require_relative "latest_version_finder"
 
-        TIGHTLY_COUPLED_MONOREPOS = {
+        TIGHTLY_COUPLED_MONOREPOS = T.let({
           "vue" => %w(vue vue-template-compiler)
-        }.freeze
+        }.freeze, T::Hash[String, T::Array[String]])
 
         # Error message returned by `npm install` (for NPM 6):
         # react-dom@15.2.0 requires a peer of react@^15.2.0 \
@@ -54,19 +54,55 @@ module Dependabot
             npm\s(?:WARN|ERR!)\speer\s(?<required_dep>\S+@\S+(\s\S+)?)\sfrom\s(?<requiring_dep>\S+@\S+)
           /x
 
-        def initialize(dependency:, credentials:, dependency_files:,
-                       latest_allowable_version:, latest_version_finder:, repo_contents_path:, dependency_group: nil)
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            latest_allowable_version: T.nilable(T.any(String, Gem::Version)),
+            latest_version_finder: T.any(LatestVersionFinder, PackageLatestVersionFinder),
+            repo_contents_path: T.nilable(String),
+            dependency_group: T.nilable(Dependabot::DependencyGroup),
+            raise_on_ignored: T::Boolean,
+            update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize( # rubocop:disable Metrics/AbcSize
+          dependency:, dependency_files:, credentials:,
+          latest_allowable_version:, latest_version_finder:,
+          repo_contents_path:, dependency_group: nil,
+          raise_on_ignored: false, update_cooldown: nil
+        )
           @dependency               = dependency
-          @credentials              = credentials
           @dependency_files         = dependency_files
+          @credentials              = credentials
           @latest_allowable_version = latest_allowable_version
           @dependency_group = dependency_group
 
-          @latest_version_finder = {}
+          @latest_version_finder = T.let(
+            {},
+            T::Hash[Dependabot::Dependency, T.any(LatestVersionFinder, PackageLatestVersionFinder)
+          ]
+          )
           @latest_version_finder[dependency] = latest_version_finder
           @repo_contents_path = repo_contents_path
-        end
-
+          @raise_on_ignored = raise_on_ignored
+          @update_cooldown = update_cooldown
+
+          @types_package = T.let(nil, T.nilable(Dependabot::Dependency))
+          @original_package = T.let(nil, T.nilable(Dependabot::Dependency))
+          @latest_types_package_version = T.let(nil, T.nilable(Dependabot::Version))
+          @dependency_files_builder = T.let(nil, T.nilable(DependencyFilesBuilder))
+          @resolve_latest_previous_version = T.let({}, T::Hash[Dependabot::Dependency, T.nilable(String)])
+          @paths_requiring_update_check = T.let(nil, T.nilable(T::Array[String]))
+          @top_level_dependencies = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+          @old_peer_dependency_errors = T.let(
+            nil, T.nilable(T::Array[T.any(T::Hash[String, T.nilable(String)], String)])
+          )
+          @peer_dependency_errors = T.let(nil, T.nilable(T::Array[T.any(T::Hash[String, T.nilable(String)], String)]))
+        end
+
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
         def latest_resolvable_version
           return latest_allowable_version if git_dependency?(dependency)
           return if part_of_tightly_locked_monorepo?
@@ -78,17 +114,24 @@ module Dependabot
           satisfying_versions.first
         end
 
+        sig { returns(T::Boolean) }
         def latest_version_resolvable_with_full_unlock?
           return false if dependency_updates_from_full_unlock.nil?
 
           true
         end
 
+        sig do
+          params(
+            updated_version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T.nilable(T.any(String, Gem::Version)))
+        end
         def latest_resolvable_previous_version(updated_version)
           resolve_latest_previous_version(dependency, updated_version)
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.nilable(T::Array[T::Hash[String, T.nilable(String)]])) }
         def dependency_updates_from_full_unlock
           return if git_dependency?(dependency)
           return updated_monorepo_dependencies if part_of_tightly_locked_monorepo?
@@ -131,28 +174,61 @@ module Dependabot
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
-        attr_reader :credentials
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
         attr_reader :latest_allowable_version
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
+        sig { returns(T.nilable(Dependabot::DependencyGroup)) }
         attr_reader :dependency_group
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :update_cooldown
+        sig { returns(T::Boolean) }
+        attr_reader :raise_on_ignored
 
+        sig { params(dep: Dependabot::Dependency) .returns(T.any(LatestVersionFinder, PackageLatestVersionFinder)) }
         def latest_version_finder(dep)
           @latest_version_finder[dep] ||=
-            LatestVersionFinder.new(
-              dependency: dep,
-              credentials: credentials,
-              dependency_files: dependency_files,
-              ignored_versions: [],
-              security_advisories: []
-            )
+            if enable_cooldown?
+              PackageLatestVersionFinder.new(
+                dependency: dep,
+                dependency_files: dependency_files,
+                credentials: credentials,
+                cooldown_options: update_cooldown,
+                ignored_versions: [],
+                security_advisories: [],
+                raise_on_ignored: raise_on_ignored
+              )
+            else
+              LatestVersionFinder.new(
+                dependency: dep,
+                credentials: credentials,
+                dependency_files: dependency_files,
+                ignored_versions: [],
+                security_advisories: [],
+                raise_on_ignored: raise_on_ignored
+              )
+            end
+        end
+
+        sig { returns(T::Boolean) }
+        def enable_cooldown?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_npm_and_yarn)
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig do
+          params(
+            dep: Dependabot::Dependency,
+            updated_version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T.nilable(String))
+        end
         def resolve_latest_previous_version(dep, updated_version)
           return dep.version if dep.version
 
-          @resolve_latest_previous_version ||= {}
           @resolve_latest_previous_version[dep] ||= begin
             relevant_versions = latest_version_finder(dependency)
                                 .possible_previous_versions_with_details
@@ -183,6 +259,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T::Boolean) }
         def part_of_tightly_locked_monorepo?
           monorepo_dep_names =
             TIGHTLY_COUPLED_MONOREPOS.values
@@ -196,6 +273,7 @@ module Dependabot
           deps_to_update.count > 1
         end
 
+        sig { returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def updated_monorepo_dependencies
           monorepo_dep_names =
             TIGHTLY_COUPLED_MONOREPOS.values
@@ -203,7 +281,7 @@ module Dependabot
 
           deps_to_update =
             top_level_dependencies
-            .select { |d| monorepo_dep_names.include?(d.name) }
+            .select { |d| monorepo_dep_names&.include?(d.name) }
 
           updates = []
           deps_to_update.each do |dep|
@@ -229,48 +307,71 @@ module Dependabot
           updates
         end
 
+        sig { returns(T.nilable(Dependabot::Dependency)) }
         def types_package
-          @types_package ||= begin
+          return @types_package if @types_package
+
+          @types_package = begin
             types_package_name = PackageName.new(dependency.name).types_package_name
             top_level_dependencies.find { |d| types_package_name.to_s == d.name } if types_package_name
           end
+          @types_package
         end
 
+        sig { returns(T.nilable(Dependabot::Dependency)) }
         def original_package
-          @original_package ||= begin
+          return @original_package if @original_package
+
+          @original_package = begin
             original_package_name = PackageName.new(dependency.name).library_name
             top_level_dependencies.find { |d| original_package_name.to_s == d.name } if original_package_name
           end
+          @original_package
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_types_package_version
-          @latest_types_package_version ||= latest_version_finder(types_package).latest_version_from_registry
+          types_pkg = types_package
+          return unless types_pkg
+
+          return @latest_types_package_version if @latest_types_package_version
+
+          @latest_types_package_version = latest_version_finder(types_pkg).latest_version_from_registry
+          @latest_types_package_version
         end
 
+        sig { returns(T::Boolean) }
         def types_update_available?
-          return false if types_package.nil?
+          types_pkg = types_package
+          return false unless types_pkg
 
-          return false if latest_types_package_version.nil?
+          latest_types_version = latest_types_package_version
+          return false unless latest_types_version
 
-          return false unless latest_allowable_version.backwards_compatible_with?(latest_types_package_version)
+          latest_allowable_ver = latest_allowable_version
+          return false unless latest_allowable_ver.is_a?(Version) && latest_allowable_ver.backwards_compatible_with?(
+            T.unsafe(latest_types_version)
+          )
 
-          return false unless version_class.correct?(types_package.version)
+          return false unless version_class.correct?(types_pkg.version)
 
-          current_types_package_version = version_class.new(types_package.version)
+          current_types_package_version = version_class.new(types_pkg.version)
 
-          return false unless current_types_package_version < latest_types_package_version
+          return false unless current_types_package_version < latest_types_version
 
           true
         end
 
+        sig { returns(T::Boolean) }
         def original_package_update_available?
-          return false if original_package.nil?
+          original_pack = original_package
+          return false unless original_pack
 
-          return false unless version_class.correct?(original_package.version)
+          return false unless version_class.correct?(original_pack.version)
 
-          original_package_version = version_class.new(original_package.version)
+          original_package_version = version_class.new(original_pack.version)
 
-          latest_version = latest_version_finder(original_package).latest_version_from_registry
+          latest_version = latest_version_finder(original_pack).latest_version_from_registry
 
           # If the latest version is within the scope of the current requirements,
           # latest_version will be nil. In such cases, there is no update available.
@@ -279,41 +380,45 @@ module Dependabot
           original_package_version < latest_version
         end
 
+        sig { returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def updated_types_dependencies
           [{
             dependency: types_package,
             version: latest_types_package_version,
             previous_version: resolve_latest_previous_version(
-              types_package, latest_types_package_version
+              T.must(types_package), T.cast(latest_types_package_version, Gem::Version)
             )
           }]
         end
 
+        sig { returns(T::Array[T.any(T::Hash[String, T.nilable(String)], String)]) }
         def peer_dependency_errors
-          return @peer_dependency_errors if @peer_dependency_errors_checked
-
-          @peer_dependency_errors_checked = true
+          return @peer_dependency_errors if @peer_dependency_errors
 
-          @peer_dependency_errors =
-            fetch_peer_dependency_errors(version: latest_allowable_version)
+          @peer_dependency_errors = fetch_peer_dependency_errors(version: latest_allowable_version)
+          @peer_dependency_errors
         end
 
+        sig { returns(T::Array[T.any(T::Hash[String, T.nilable(String)], String)]) }
         def old_peer_dependency_errors
-          return @old_peer_dependency_errors if @old_peer_dependency_errors_checked
-
-          @old_peer_dependency_errors_checked = true
+          return @old_peer_dependency_errors if @old_peer_dependency_errors
 
           version = version_for_dependency(dependency)
 
-          @old_peer_dependency_errors =
-            fetch_peer_dependency_errors(version: version)
+          @old_peer_dependency_errors = fetch_peer_dependency_errors(version: version)
+          @old_peer_dependency_errors
         end
 
+        sig do
+          params(
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T::Array[T.any(T::Hash[String, T.nilable(String)], String)])
+        end
         def fetch_peer_dependency_errors(version:)
           # TODO: Add all of the error handling that the FileUpdater does
           # here (since problematic repos will be resolved here before they're
           # seen by the FileUpdater)
-          base_dir = dependency_files.first.directory
+          base_dir = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             dependency_files_builder.write_temporary_dependency_files
 
@@ -345,16 +450,22 @@ module Dependabot
           errors
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def unmet_peer_dependencies
           peer_dependency_errors
             .map { |captures| error_details_from_captures(captures) }
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def old_unmet_peer_dependencies
           old_peer_dependency_errors
             .map { |captures| error_details_from_captures(captures) }
         end
 
+        sig do
+          params(captures: T.any(T::Hash[String, T.nilable(String)], String))
+            .returns(T::Hash[Symbol, T.nilable(String)])
+        end
         def error_details_from_captures(captures)
           return {} unless captures.is_a?(Hash)
 
@@ -364,12 +475,13 @@ module Dependabot
 
           {
             requirement_name: required_dep_captures.sub(/@[^@]+$/, ""),
-            requirement_version: required_dep_captures.split("@").last.delete('"'),
+            requirement_version: required_dep_captures.split("@").last&.delete('"'),
             requiring_dep_name: requiring_dep_captures.sub(/@[^@]+$/, "")
           }
         end
 
-        def relevant_unmet_peer_dependencies
+        sig { returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
+        def relevant_unmet_peer_dependencies # rubocop:disable Metrics/PerceivedComplexity
           relevant_unmet_peer_dependencies =
             unmet_peer_dependencies.select do |dep|
               dep[:requirement_name] == dependency.name ||
@@ -380,7 +492,7 @@ module Dependabot
             # Ignore unmet peer dependencies that are in the dependency group because
             # the update is also updating those dependencies.
             relevant_unmet_peer_dependencies.reject! do |dep|
-              dependency_group.dependencies.any? do |group_dep|
+              dependency_group&.dependencies&.any? do |group_dep|
                 dep[:requirement_name] == group_dep.name ||
                   dep[:requiring_dep_name] == group_dep.name
               end
@@ -399,11 +511,13 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T::Array[T.any(String, Gem::Version)]) }
         def satisfying_versions
           latest_version_finder(dependency)
             .possible_versions_with_details
-            .select do |version, details|
-              next false unless satisfies_peer_reqs_on_dep?(version)
+            .select do |versions_with_details|
+              version, details = versions_with_details
+              next false unless satisfies_peer_reqs_on_dep?(T.unsafe(version))
               next true unless details["peerDependencies"]
               next true if version == version_for_dependency(dependency)
 
@@ -419,18 +533,18 @@ module Dependabot
               rescue Gem::Requirement::BadRequirementError
                 false
               end
-            end
-            .map(&:first)
+            end.map(&:first)
         end
 
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(version: T.nilable(T.any(String, Gem::Version))).returns(T::Boolean) }
         def satisfies_peer_reqs_on_dep?(version)
           newly_broken_peer_reqs_on_dep.all? do |peer_req|
             req = peer_req.fetch(:requirement_version)
 
             # Git requirements can't be satisfied by a version
-            next false if req.include?("/")
+            next false if req&.include?("/")
 
             reqs = requirement_class.requirements_array(req)
             reqs.any? { |r| r.satisfied_by?(version) }
@@ -439,11 +553,16 @@ module Dependabot
           end
         end
 
-        def latest_version_of_dep_with_satisfied_peer_reqs(dep)
-          latest_version_finder(dep)
+        sig { params(dep: Dependabot::Dependency).returns(T.nilable(T.any(String, Gem::Version))) }
+        def latest_version_of_dep_with_satisfied_peer_reqs(dep) # rubocop:disable Metrics/PerceivedComplexity
+          dependency_version = version_for_dependency(dep)
+          version_with_detail =
+            latest_version_finder(dep)
             .possible_versions_with_details
-            .find do |version, details|
-              next false unless version > version_for_dependency(dep)
+            .find do |version_details|
+              version, details = version_details
+
+              next false unless !dependency_version || version > dependency_version
               next true unless details["peerDependencies"]
 
               details["peerDependencies"].all? do |peer_dep_name, req|
@@ -458,9 +577,10 @@ module Dependabot
                 false
               end
             end
-            &.first
+          version_with_detail.is_a?(Array) ? version_with_detail.first : version_with_detail
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
         def git_dependency?(dep)
           # ignored_version/raise_on_ignored are irrelevant.
           GitCommitChecker
@@ -468,22 +588,36 @@ module Dependabot
             .git_dependency?
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
         def newly_broken_peer_reqs_on_dep
           relevant_unmet_peer_dependencies
             .select { |dep| dep[:requirement_name] == dependency.name }
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.nilable(String)]]) }
         def newly_broken_peer_reqs_from_dep
           relevant_unmet_peer_dependencies
             .select { |dep| dep[:requiring_dep_name] == dependency.name }
         end
 
+        sig do
+          params(
+            lockfiles: T::Array[Dependabot::DependencyFile],
+            path: String
+          ).returns(T::Array[Dependabot::DependencyFile])
+        end
         def lockfiles_for_path(lockfiles:, path:)
           lockfiles.select do |lockfile|
             File.dirname(lockfile.name) == File.dirname(path)
           end
         end
 
+        sig do
+          params(
+            path: String,
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]])))
+        end
         def run_checker(path:, version:)
           bun_lockfiles = lockfiles_for_path(lockfiles: dependency_files_builder.bun_locks, path: path)
           return run_bun_checker(path: path, version: version) if bun_lockfiles.any?
@@ -494,6 +628,12 @@ module Dependabot
           handle_peer_dependency_errors(e.message)
         end
 
+        sig do
+          params(
+            path: String,
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(T.untyped)
+        end
         def run_bun_checker(path:, version:)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -505,6 +645,11 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            version: T.nilable(T.any(String, Gem::Version))
+          ).returns(String)
+        end
         def version_install_arg(version:)
           git_source = dependency.requirements.find { |req| req[:source] && req[:source][:type] == "git" }
 
@@ -515,6 +660,12 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            path: String
+          ).returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
         def requirements_for_path(requirements, path)
           return requirements if path.to_s == "."
 
@@ -528,31 +679,44 @@ module Dependabot
         # Top level dependencies are required in the peer dep checker
         # to fetch the manifests for all top level deps which may contain
         # "peerDependency" requirements
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def top_level_dependencies
-          @top_level_dependencies ||= Bun::FileParser.new(
+          return @top_level_dependencies if @top_level_dependencies
+
+          @top_level_dependencies = Bun::FileParser.new(
             dependency_files: dependency_files,
             source: nil,
             credentials: credentials
           ).parse.select(&:top_level?)
+          @top_level_dependencies
         end
 
+        sig { returns(T::Array[String]) }
         def paths_requiring_update_check
-          @paths_requiring_update_check ||=
+          return @paths_requiring_update_check if @paths_requiring_update_check
+
+          @paths_requiring_update_check =
             DependencyFilesFilterer.new(
               dependency_files: dependency_files,
               updated_dependencies: [dependency]
             ).paths_requiring_update_check
+          @paths_requiring_update_check
         end
 
+        sig { returns(DependencyFilesBuilder) }
         def dependency_files_builder
-          @dependency_files_builder ||=
+          return @dependency_files_builder if @dependency_files_builder
+
+          @dependency_files_builder =
             DependencyFilesBuilder.new(
               dependency: dependency,
               dependency_files: dependency_files,
               credentials: credentials
             )
+          @dependency_files_builder
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(T.nilable(T.any(String, Gem::Version))) }
         def version_for_dependency(dep)
           return version_class.new(dep.version) if dep.version && version_class.correct?(dep.version)
 
@@ -565,14 +729,17 @@ module Dependabot
              .max
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T.class_of(Dependabot::Requirement)) }
         def requirement_class
           dependency.requirement_class
         end
 
+        sig { returns(String) }
         def version_regex
           Dependabot::Bun::Version::VERSION_PATTERN
         end

data/lib/dependabot/bun/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "set"
@@ -11,7 +11,8 @@ require "dependabot/update_checkers/base"
 
 module Dependabot
   module Bun
-    class UpdateChecker < Dependabot::UpdateCheckers::Base
+    class UpdateChecker < Dependabot::UpdateCheckers::Base # rubocop:disable Metrics/ClassLength
+      extend T::Sig
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/library_detector"
       require_relative "update_checker/latest_version_finder"
@@ -20,6 +21,48 @@ module Dependabot
       require_relative "update_checker/conflicting_dependency_resolver"
       require_relative "update_checker/vulnerability_auditor"
 
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          dependency_files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[Dependabot::Credential],
+          repo_contents_path: T.nilable(String),
+          ignored_versions: T::Array[String],
+          raise_on_ignored: T::Boolean,
+          security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
+          dependency_group: T.nilable(Dependabot::DependencyGroup),
+          update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          options: T::Hash[Symbol, T.untyped]
+        )
+          .void
+      end
+      def initialize(dependency:, dependency_files:, credentials:, # rubocop:disable Metrics/AbcSize
+                     repo_contents_path: nil, ignored_versions: [],
+                     raise_on_ignored: false, security_advisories: [],
+                     requirements_update_strategy: nil, dependency_group: nil,
+                     update_cooldown: nil, options: {})
+        @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
+        @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
+        @updated_requirements = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+        @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+        @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
+
+        @latest_version_for_git_dependency = T.let(nil, T.nilable(T.any(String, Gem::Version)))
+        @latest_released_version = T.let(nil, T.nilable(Gem::Version))
+        @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+        @latest_version_finder = T.let(
+          nil, T.nilable(T.any(LatestVersionFinder, PackageLatestVersionFinder))
+        )
+        @version_resolver = T.let(nil, T.nilable(VersionResolver))
+        @subdependency_version_resolver = T.let(nil, T.nilable(SubdependencyVersionResolver))
+        @library = T.let(nil, T.nilable(T::Boolean))
+        @package_json = T.let(nil, T.nilable(Dependabot::DependencyFile))
+        @git_commit_checker = T.let(nil, T.nilable(Dependabot::GitCommitChecker))
+        super
+      end
+
+      sig { returns(T::Boolean) }
       def up_to_date?
         return false if security_update? &&
                         dependency.version &&
@@ -30,10 +73,12 @@ module Dependabot
         super
       end
 
+      sig { returns(T::Boolean) }
       def vulnerable?
         super || vulnerable_versions.any?
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         @latest_version ||=
           if git_dependency?
@@ -43,6 +88,7 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version
         return unless latest_version
 
@@ -56,13 +102,15 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         # This will require a full unlock to update multiple top level ancestors.
         return if vulnerability_audit["fix_available"] && vulnerability_audit["top_level_ancestors"].count > 1
 
-        latest_version_finder.lowest_security_fix_version
+        T.unsafe(latest_version_finder.lowest_security_fix_version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
@@ -83,6 +131,7 @@ module Dependabot
         lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
         return latest_resolvable_version unless dependency.top_level?
 
@@ -91,10 +140,15 @@ module Dependabot
         latest_version_finder.latest_version_with_no_unlock
       end
 
+      sig do
+        params(updated_version: T.any(String, Gem::Version))
+          .returns(T.nilable(T.any(String, T.untyped)))
+      end
       def latest_resolvable_previous_version(updated_version)
-        version_resolver.latest_resolvable_previous_version(updated_version)
+        T.unsafe(version_resolver.latest_resolvable_previous_version(updated_version))
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         resolvable_version =
           if preferred_resolvable_version.is_a?(version_class)
@@ -117,10 +171,12 @@ module Dependabot
           ).updated_requirements
       end
 
+      sig { returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
-        !requirements_update_strategy.lockfile_only?
+        !requirements_update_strategy&.lockfile_only?
       end
 
+      sig { returns(T.nilable(Dependabot::RequirementsUpdateStrategy)) }
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
@@ -129,6 +185,7 @@ module Dependabot
         library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersions
       end
 
+      sig { override.returns(T::Array[T::Hash[String, String]]) }
       def conflicting_dependencies
         conflicts = ConflictingDependencyResolver.new(
           dependency_files: dependency_files,
@@ -148,10 +205,12 @@ module Dependabot
 
       private
 
+      sig { returns(T::Boolean) }
       def vulnerability_audit_performed?
-        defined?(@vulnerability_audit)
+        !!defined?(@vulnerability_audit)
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def vulnerability_audit
         @vulnerability_audit ||=
           VulnerabilityAuditor.new(
@@ -163,6 +222,7 @@ module Dependabot
           )
       end
 
+      sig { returns(T::Array[T.any(String, Gem::Version)]) }
       def vulnerable_versions
         @vulnerable_versions ||=
           begin
@@ -175,6 +235,7 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         return false unless latest_version
 
@@ -185,14 +246,16 @@ module Dependabot
         vulnerability_audit["fix_available"]
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         return conflicting_updated_dependencies if security_advisories.any? && vulnerability_audit["fix_available"]
 
-        version_resolver.dependency_updates_from_full_unlock
-                        .map { |update_details| build_updated_dependency(update_details) }
+        T.must(version_resolver.dependency_updates_from_full_unlock)
+         .map { |update_details| build_updated_dependency(update_details.transform_keys(&:to_sym)) }
       end
 
       # rubocop:disable Metrics/AbcSize
+      sig { returns(T::Array[Dependabot::Dependency]) }
       def conflicting_updated_dependencies
         top_level_dependencies = top_level_dependency_lookup
 
@@ -233,6 +296,7 @@ module Dependabot
           updated_deps.reject { |dep| dep.name == dependency.name }
       end
 
+      sig { returns(T::Hash[String, Dependabot::Dependency]) }
       def top_level_dependency_lookup
         top_level_dependencies = FileParser.new(
           dependency_files: dependency_files,
@@ -243,6 +307,11 @@ module Dependabot
         top_level_dependencies.to_h { |dep| [dep.name, dep] }
       end
 
+      sig do
+        params(
+          update_details: T::Hash[Symbol, T.untyped]
+        ).returns(Dependabot::Dependency)
+      end
       def build_updated_dependency(update_details)
         original_dep = update_details.fetch(:dependency)
         removed = update_details.fetch(:removed, false)
@@ -267,9 +336,15 @@ module Dependabot
         )
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version, T.untyped))) }
       def latest_resolvable_transitive_security_fix_version_with_no_unlock
+        versions = T.let([], T::Array[Gem::Version])
+
+        latest = latest_released_version
+        versions.push(latest) if latest
+
         fix_possible = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
-          [latest_resolvable_version].compact,
+          versions,
           security_advisories
         ).any?
         return nil unless fix_possible
@@ -277,6 +352,7 @@ module Dependabot
         latest_resolvable_version
       end
 
+      sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock_for_git_dependency
         reqs = dependency.requirements.filter_map do |r|
           next if r.fetch(:requirement).nil?
@@ -300,21 +376,24 @@ module Dependabot
         git_commit_checker.head_commit_for_current_branch
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version_for_git_dependency
         @latest_version_for_git_dependency ||=
           if version_class.correct?(dependency.version)
-            latest_git_version_details[:version] &&
-              version_class.new(latest_git_version_details[:version])
+            T.unsafe(latest_git_version_details[:version] &&
+              version_class.new(latest_git_version_details[:version]))
           else
             latest_git_version_details[:sha]
           end
       end
 
+      sig { returns(T.nilable(Gem::Version)) }
       def latest_released_version
         @latest_released_version ||=
           latest_version_finder.latest_version_from_registry
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_version_details
         @latest_version_details ||=
           if git_dependency?
@@ -324,18 +403,37 @@ module Dependabot
           end
       end
 
+      sig { returns(T.any(LatestVersionFinder, PackageLatestVersionFinder)) }
       def latest_version_finder
         @latest_version_finder ||=
-          LatestVersionFinder.new(
-            dependency: dependency,
-            credentials: credentials,
-            dependency_files: dependency_files,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: raise_on_ignored,
-            security_advisories: security_advisories
-          )
+          if enable_cooldown?
+            PackageLatestVersionFinder.new(
+              dependency: dependency,
+              credentials: credentials,
+              dependency_files: dependency_files,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
+              security_advisories: security_advisories,
+              cooldown_options: @update_cooldown
+            )
+          else
+            LatestVersionFinder.new(
+              dependency: dependency,
+              credentials: credentials,
+              dependency_files: dependency_files,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
+              security_advisories: security_advisories
+            )
+          end
       end
 
+      sig { returns(T::Boolean) }
+      def enable_cooldown?
+        Dependabot::Experiments.enabled?(:enable_cooldown_for_bun)
+      end
+
+      sig { returns(VersionResolver) }
       def version_resolver
         @version_resolver ||=
           VersionResolver.new(
@@ -345,10 +443,13 @@ module Dependabot
             latest_allowable_version: latest_version,
             latest_version_finder: latest_version_finder,
             repo_contents_path: repo_contents_path,
-            dependency_group: dependency_group
+            dependency_group: dependency_group,
+            raise_on_ignored: raise_on_ignored,
+            update_cooldown: @update_cooldown
           )
       end
 
+      sig { returns(SubdependencyVersionResolver) }
       def subdependency_version_resolver
         @subdependency_version_resolver ||=
           SubdependencyVersionResolver.new(
@@ -361,10 +462,12 @@ module Dependabot
           )
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      sig { returns(T::Hash[Symbol, T.untyped]) }
       def latest_git_version_details
         semver_req =
           dependency.requirements
@@ -390,6 +493,7 @@ module Dependabot
         { sha: dependency.version }
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -398,13 +502,14 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            !git_commit_checker.local_tag_for_latest_version.nil?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return dependency_source_details.merge(ref: new_tag.fetch(:tag))
+          return dependency_source_details&.merge(ref: new_tag&.fetch(:tag))
         end
 
         # Otherwise return the original source
         dependency_source_details
       end
 
+      sig { returns(T::Boolean) }
       def library?
         return true unless dependency.version
         return true if dependency_files.any? { |f| f.name == "lerna.json" }
@@ -417,14 +522,20 @@ module Dependabot
           ).library?
       end
 
+      sig { returns(T::Boolean) }
       def security_update?
         security_advisories.any?
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def dependency_source_details
         original_source(dependency)
       end
 
+      sig do
+        params(updated_dependency: Dependabot::Dependency)
+          .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+      end
       def original_source(updated_dependency)
         sources =
           updated_dependency
@@ -433,14 +544,17 @@ module Dependabot
           .sort_by do |source|
             Package::RegistryFinder.central_registry?(source[:url]) ? 1 : 0
           end
+
         sources.first
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def package_json
         @package_json ||=
           dependency_files.find { |f| f.name == "package.json" }
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
         @git_commit_checker ||=
           GitCommitChecker.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.305.0
+  version: 0.306.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-06 00:00:00.000000000 Z
+date: 2025-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -348,7 +348,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.305.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.306.0
 post_install_message:
 rdoc_options: []
 require_paths: