dependabot-bun 0.332.0 → 0.333.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3919992537bc4b53dd525f74f7fce840376638f1090c0219d268316ed7813325
-  data.tar.gz: 320eb12bd41ce2a548c4729e71e0648cc1bd5db6c610a1afa6ac3658ddba20a0
+  metadata.gz: 0eb056be9654d428163d857882cad03f7efb23a1e73462218712ba9847673f88
+  data.tar.gz: b8d3a89a900b410b940d6fe57a0f39c4bd5fe442fdc0d04ae9e5603d8c802d45
 SHA512:
-  metadata.gz: 46f8a8654bcb5129cc8269a051faa05f7ed55b87c2b914671c03adcc2417eb3d6cd8ff67661593a63e64a636b58ab75919fd1ff1a9c22b1328214570866e471f
-  data.tar.gz: 6330e96f1eba8225cdf2160498db0c841c55e14718b2308d3898a03cbbd2a914961206052b7476ebd034ea946f89aa7fabc1931aa609b43b12226fe3c1570866
+  metadata.gz: 5716bd87728a019983e174575e729a6a8631625d7d23c24e4bfb59dc572cd03946c2e2e360580dfda81cb9f0d9729c0fc3f83cf47e3c247a9c3998be9e19f61a
+  data.tar.gz: 0c0eed5a6922f0fd4a2bbf38688c79d5a46d2866129df2632f3e1f57b1fe40ec86f1a0c0b4b18e06f7943a1ae95db1866c3343bee7906a67e75f9703d04486d7

data/lib/dependabot/bun/bun_package_manager.rb

@@ -5,6 +5,7 @@ module Dependabot
   module Bun
     class BunPackageManager < Ecosystem::VersionManager
       extend T::Sig
+
       NAME = "bun"
       LOCKFILE_NAME = "bun.lock"
       RC_FILENAME = ".npmrc"

data/lib/dependabot/bun/file_fetcher.rb

@@ -11,6 +11,7 @@ require "dependabot/bun/helpers"
 require "dependabot/bun/package_manager"
 require "dependabot/bun/file_parser"
 require "dependabot/bun/file_parser/lockfile_parser"
+require "dependabot/file_filtering"
 
 module Dependabot
   module Bun
@@ -81,7 +82,12 @@ module Dependabot
         fetched_files += workspace_package_jsons
         fetched_files += path_dependencies(fetched_files)
 
-        fetched_files.uniq
+        # Filter excluded files from final collection
+        filtered_files = fetched_files.uniq.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files
       end
 
       private
@@ -185,6 +191,9 @@ module Dependabot
           cleaned_name = Pathname.new(filename).cleanpath.to_path
           next if fetched_files.map(&:name).include?(cleaned_name)
 
+          # Skip excluded path dependencies
+          next if Dependabot::FileFiltering.should_exclude_path?(cleaned_name, "path dependency file", @exclude_paths)
+
           begin
             file = fetch_file_from_host(filename, fetch_submodules: true)
             package_json_files << file
@@ -291,6 +300,9 @@ module Dependabot
         return [] unless parsed_package_json["workspaces"]
 
         workspace_paths(parsed_package_json["workspaces"]).filter_map do |workspace|
+          # Skip excluded workspace directories
+          next if Dependabot::FileFiltering.should_exclude_path?(workspace, "workspace directory", @exclude_paths)
+
           fetch_package_json_if_present(workspace)
         end
       end

data/lib/dependabot/bun/file_updater/bun_lockfile_updater.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/bun/helpers"
 require "dependabot/bun/package/registry_finder"
 require "dependabot/bun/registry_parser"
@@ -10,9 +12,20 @@ module Dependabot
   module Bun
     class FileUpdater < Dependabot::FileUpdaters::Base
       class BunLockfileUpdater
+        extend T::Sig
+
         require_relative "npmrc_builder"
         require_relative "package_json_updater"
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: String,
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
@@ -20,9 +33,10 @@ module Dependabot
           @credentials = credentials
         end
 
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def updated_bun_lock_content(bun_lock)
-          @updated_bun_lock_content ||= {}
-          return @updated_bun_lock_content[bun_lock.name] if @updated_bun_lock_content[bun_lock.name]
+          @updated_bun_lock_content ||= T.let({}, T.nilable(T::Hash[String, String]))
+          return T.must(@updated_bun_lock_content[bun_lock.name]) if @updated_bun_lock_content[bun_lock.name]
 
           new_content = run_bun_update(bun_lock: bun_lock)
           @updated_bun_lock_content[bun_lock.name] = new_content
@@ -32,19 +46,30 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(String) }
         attr_reader :repo_contents_path
-        attr_reader :credentials
 
-        ERR_PATTERNS = {
-          /get .* 404/i => Dependabot::DependencyNotFound,
-          /installfailed cloning repository/i => Dependabot::DependencyNotFound,
-          /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
-          /no version matching/i => Dependabot::DependencyFileNotResolvable,
-          /failed to resolve/i => Dependabot::DependencyFileNotResolvable
-        }.freeze
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
 
+        ERR_PATTERNS = T.let(
+          {
+            /get .* 404/i => Dependabot::DependencyNotFound,
+            /installfailed cloning repository/i => Dependabot::DependencyNotFound,
+            /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
+            /no version matching/i => Dependabot::DependencyFileNotResolvable,
+            /failed to resolve/i => Dependabot::DependencyFileNotResolvable
+          }.freeze,
+          T::Hash[Regexp, Dependabot::DependabotError]
+        )
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def run_bun_update(bun_lock:)
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             File.write(".npmrc", npmrc_content(bun_lock))
@@ -61,6 +86,7 @@ module Dependabot
           end
         end
 
+        sig { void }
         def run_bun_updater
           dependency_updates = dependencies.map do |d|
             "#{d.name}@#{d.version}"
@@ -72,14 +98,16 @@ module Dependabot
           )
         end
 
+        sig { void }
         def run_bun_install
           Helpers.run_bun_command(
             "install --save-text-lockfile"
           )
         end
 
+        sig { params(lockfile: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
         def lockfile_dependencies(lockfile)
-          @lockfile_dependencies ||= {}
+          @lockfile_dependencies ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::Dependency]]))
           @lockfile_dependencies[lockfile.name] ||=
             Bun::FileParser.new(
               dependency_files: [lockfile, *package_files],
@@ -88,6 +116,7 @@ module Dependabot
             ).parse
         end
 
+        sig { params(error: Dependabot::DependabotError, _bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
         def handle_bun_lock_updater_error(error, _bun_lock)
           error_message = error.message
 
@@ -98,6 +127,7 @@ module Dependabot
           raise error
         end
 
+        sig { void }
         def write_final_package_json_files
           package_files.each do |file|
             path = file.name
@@ -106,6 +136,7 @@ module Dependabot
           end
         end
 
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def npmrc_content(bun_lock)
           NpmrcBuilder.new(
             credentials: credentials,
@@ -114,27 +145,37 @@ module Dependabot
           ).npmrc_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def updated_package_json_content(file)
-          @updated_package_json_content ||= {}
+          @updated_package_json_content ||= T.let({}, T.nilable(T::Hash[String, String]))
           @updated_package_json_content[file.name] ||=
-            PackageJsonUpdater.new(
-              package_json: file,
-              dependencies: dependencies
-            ).updated_package_json.content
+            T.must(
+              PackageJsonUpdater.new(
+                package_json: file,
+                dependencies: dependencies
+              ).updated_package_json.content
+            )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_files
-          @package_files ||= dependency_files.select { |f| f.name.end_with?("package.json") }
+          @package_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("package.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(String) }
         def base_dir
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def npmrc_file
           dependency_files.find { |f| f.name == ".npmrc" }
         end
 
+        sig { params(message: String).returns(String) }
         def sanitize_message(message)
           message.gsub(/"|\[|\]|\}|\{/, "")
         end

data/lib/dependabot/bun/file_updater/package_json_preparer.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/bun/file_updater"
 require "dependabot/bun/file_parser"
 
@@ -8,10 +10,14 @@ module Dependabot
   module Bun
     class FileUpdater < Dependabot::FileUpdaters::Base
       class PackageJsonPreparer
+        extend T::Sig
+
+        sig { params(package_json_content: String).void }
         def initialize(package_json_content:)
           @package_json_content = package_json_content
         end
 
+        sig { returns(String) }
         def prepared_content
           content = package_json_content
           content = replace_ssh_sources(content)
@@ -20,6 +26,7 @@ module Dependabot
           content
         end
 
+        sig { params(content: String).returns(String) }
         def replace_ssh_sources(content)
           updated_content = content
 
@@ -33,6 +40,7 @@ module Dependabot
 
         # A bug prevents Yarn recognising that a directory is part of a
         # workspace if it is specified with a `./` prefix.
+        sig { params(content: String).returns(String) }
         def remove_workspace_path_prefixes(content)
           json = JSON.parse(content)
           return content unless json.key?("workspaces")
@@ -52,6 +60,7 @@ module Dependabot
           JSON.pretty_generate(json)
         end
 
+        sig { params(content: String).returns(String) }
         def remove_invalid_characters(content)
           content
             .gsub(/\{\{[^\}]*?\}\}/, "something") # {{ nm }} syntax not allowed
@@ -59,28 +68,31 @@ module Dependabot
             .gsub(%r{^\s*//.*}, " ") # comments are not allowed
         end
 
+        sig { returns(T::Array[String]) }
         def swapped_ssh_requirements
           git_ssh_requirements_to_swap
         end
 
         private
 
+        sig { returns(String) }
         attr_reader :package_json_content
 
+        sig { returns(T::Array[String]) }
         def git_ssh_requirements_to_swap
           return @git_ssh_requirements_to_swap if @git_ssh_requirements_to_swap
 
-          @git_ssh_requirements_to_swap = []
+          @git_ssh_requirements_to_swap = T.let([], T.nilable(T::Array[String]))
 
           Bun::FileParser.each_dependency(JSON.parse(package_json_content)) do |_, req, _t|
             next unless req.is_a?(String)
             next unless req.start_with?("git+ssh:")
 
             req = req.split("#").first
-            @git_ssh_requirements_to_swap << req
+            T.must(@git_ssh_requirements_to_swap) << T.must(req)
           end
 
-          @git_ssh_requirements_to_swap
+          T.must(@git_ssh_requirements_to_swap)
         end
       end
     end

data/lib/dependabot/bun/file_updater/package_json_updater.rb

@@ -60,7 +60,7 @@ module Dependabot
               )
 
               if Dependabot::Experiments.enabled?(:avoid_duplicate_updates_package_json) &&
-                 (content == new_content && unique_deps_count > 1)
+                 content == new_content && unique_deps_count > 1
 
                 # (we observed that) package.json does not always contains the same dependencies compared to
                 # "dependencies" list, for example, dependencies object can contain same name dependency "dep"=> "1.0.0"

data/lib/dependabot/bun/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -179,7 +179,7 @@ module Dependabot
           BunLockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
-            repo_contents_path: repo_contents_path,
+            repo_contents_path: T.must(repo_contents_path),
             credentials: credentials
           ),
           T.nilable(Dependabot::Bun::FileUpdater::BunLockfileUpdater)

data/lib/dependabot/bun/language.rb

@@ -7,6 +7,7 @@ module Dependabot
   module Bun
     class Language < Ecosystem::VersionManager
       extend T::Sig
+
       NAME = "node"
 
       SUPPORTED_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])

data/lib/dependabot/bun/metadata_finder.rb

@@ -73,7 +73,7 @@ module Dependabot
 
         all_version_listings
           .reject { |v, _| Time.parse(times[v]) > cutoff }
-          .filter_map { |_, d| d.fetch("_npmUser", nil)&.fetch("name", nil) }
+          .filter_map { |_, d| d.dig("_npmUser", "name") }
       end
 
       sig { returns(T.nilable(Source)) }

data/lib/dependabot/bun/native_helpers.rb

@@ -1,13 +1,19 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Bun
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.helper_path
         "node #{File.join(native_helpers_root, 'run.js')}"
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "bun") unless helpers_root.nil?

data/lib/dependabot/bun/pnpm_package_manager.rb

@@ -7,6 +7,7 @@ module Dependabot
   module Bun
     class PNPMPackageManager < Ecosystem::VersionManager
       extend T::Sig
+
       NAME = "pnpm"
       LOCKFILE_NAME = "pnpm-lock.yaml"
       PNPM_WS_YML_FILENAME = "pnpm-workspace.yaml"

data/lib/dependabot/bun/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -12,16 +12,22 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
-      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
+      AND_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/, Regexp)
+      OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
 
       # Override the version pattern to allow a 'v' prefix
       quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
       version_pattern = "v?#{Bun::Version::VERSION_PATTERN}"
 
-      PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze
-      PATTERN = /\A#{PATTERN_RAW}\z/
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze, String)
+      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
 
+      sig do
+        params(
+          obj: T.any(String, Gem::Version)
+        )
+          .returns(T::Array[T.any(String, T.nilable(Bun::Version))])
+      end
       def self.parse(obj)
         return ["=", nil] if obj.is_a?(String) && Version::VERSION_TAGS.include?(obj.strip)
         return ["=", Bun::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
@@ -52,9 +58,10 @@ module Dependabot
         end
       end
 
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
       def initialize(*requirements)
         requirements = requirements.flatten
-                                   .flat_map { |req_string| req_string.split(",").map(&:strip) }
+                                   .flat_map { |req_string| T.must(req_string).split(",").map(&:strip) }
                                    .flat_map { |req_string| convert_js_constraint_to_ruby_constraint(req_string) }
 
         super(requirements)
@@ -62,6 +69,7 @@ module Dependabot
 
       private
 
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
       def convert_js_constraint_to_ruby_constraint(req_string)
         return req_string if req_string.match?(/^([A-Za-uw-z]|v[^\d])/)
 
@@ -79,6 +87,7 @@ module Dependabot
         end
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_tilde_req(req_string)
         version = req_string.gsub(/^~\>?[\s=]*/, "")
         parts = version.split(".")
@@ -86,8 +95,11 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_hyphen_req(req_string)
-        lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+        parts = req_string.split(/\s+-\s+/)
+        lower_bound = T.must(parts[0])
+        upper_bound = T.must(parts[1])
         lower_bound_parts = lower_bound.split(".")
         lower_bound_parts.fill("0", lower_bound_parts.length...3)
 
@@ -105,6 +117,7 @@ module Dependabot
         [">= #{lower_bound_parts.join('.')}", upper_bound_range]
       end
 
+      sig { params(req_string: String).returns(String) }
       def ruby_range(req_string)
         parts = req_string.split(".")
         # If we have three or more parts then this is an exact match
@@ -115,13 +128,14 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^[\s=]*/, "")
         parts = version.split(".")
         parts.fill("x", parts.length...3)
         first_non_zero = parts.find { |d| d != "0" }
         first_non_zero_index =
-          first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          first_non_zero ? T.must(parts.index(first_non_zero)) : parts.count - 1
         # If the requirement has a blank minor or patch version increment the
         # previous index value with 1
         first_non_zero_index -= 1 if first_non_zero == "x"

data/lib/dependabot/bun/update_checker/conflicting_dependency_resolver.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/dependency"
 require "dependabot/errors"
 require "dependabot/logger"
@@ -15,6 +17,15 @@ module Dependabot
   module Bun
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       class ConflictingDependencyResolver
+        extend T::Sig
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependency_files:, credentials:)
           @dependency_files = dependency_files
           @credentials = credentials
@@ -30,6 +41,13 @@ module Dependabot
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            target_version: T.nilable(T.any(String, Dependabot::Version))
+          )
+            .returns(T::Array[T::Hash[String, String]])
+        end
         def conflicting_dependencies(dependency:, target_version:)
           SharedHelpers.in_a_temporary_directory do
             dependency_files_builder = DependencyFilesBuilder.new(
@@ -39,10 +57,13 @@ module Dependabot
             )
             dependency_files_builder.write_temporary_dependency_files
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
-              function: "yarn:findConflictingDependencies",
-              args: [Dir.pwd, dependency.name, target_version.to_s]
+            T.cast(
+              SharedHelpers.run_helper_subprocess(
+                command: NativeHelpers.helper_path,
+                function: "yarn:findConflictingDependencies",
+                args: [Dir.pwd, dependency.name, target_version.to_s]
+              ),
+              T::Array[T::Hash[String, String]]
             )
           end
         rescue SharedHelpers::HelperSubprocessFailed
@@ -51,7 +72,10 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
       end
     end

data/lib/dependabot/bun/update_checker/dependency_files_builder.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/bun/file_updater/npmrc_builder"
 require "dependabot/bun/file_updater/package_json_preparer"
 
@@ -8,12 +10,23 @@ module Dependabot
   module Bun
     class UpdateChecker
       class DependencyFilesBuilder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependency:, dependency_files:, credentials:)
           @dependency = dependency
           @dependency_files = dependency_files
           @credentials = credentials
         end
 
+        sig { void }
         def write_temporary_dependency_files
           write_lockfiles
 
@@ -26,34 +39,50 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def bun_locks
-          @bun_locks ||=
+          @bun_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("bun.lock") }
+            .select { |f| f.name.end_with?("bun.lock") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def root_bun_lock
-          @root_bun_lock ||=
+          @root_bun_lock ||= T.let(
             dependency_files
-            .find { |f| f.name == "bun.lock" }
+            .find { |f| f.name == "bun.lock" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def lockfiles
           [*bun_locks]
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_files
-          @package_files ||=
+          @package_files ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("package.json") }
+            .select { |f| f.name.end_with?("package.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig { void }
         def write_lockfiles
           bun_locks.each do |f|
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
@@ -61,12 +90,14 @@ module Dependabot
           end
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def prepared_package_json_content(file)
           Bun::FileUpdater::PackageJsonPreparer.new(
-            package_json_content: file.content
+            package_json_content: T.must(file.content)
           ).prepared_content
         end
 
+        sig { returns(String) }
         def npmrc_content
           Bun::FileUpdater::NpmrcBuilder.new(
             credentials: credentials,