dependabot-bun 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a26cc2bacba80d0257ab7818f69fbe7f5347e71eb1975a1558f5d49c145d0ebd
-  data.tar.gz: e472da36b4791b838a6e543f225f06b872a6f9d4966b76878f73043c99cb9db7
+  metadata.gz: 923b839c39e732c6fb6811cf6c9d1d7ec632278e3ea3e53a869091ebbf4ebf3f
+  data.tar.gz: 39e1cf8df33890c3eb795c37ca76d05a13407a0147cbd30c61cd89d192983aed
 SHA512:
-  metadata.gz: 61c9f416d4fd133198b90bf7e6d2f30e00745422dd9eed1e8f23c27b47db97511c999e1983a4c358508e1eba720b2489ef13bf1f44efe96963646b6e53be207b
-  data.tar.gz: 15e81fb3532a1bd2126d1a5d01e33ceab4b37e9b872802dd59248b10ac6d0555782d5b6006bd9e44295272da7f9114967e68b9635b4d72454e38058467de621b
+  metadata.gz: 4954f66e622be9eee7f56ab6ce81d65a8874b3308140b63d2c98bf2a0316eead317e296cb71e173b810170047995f9fc9fe9230b543fdbcf1939c2990399a207
+  data.tar.gz: 8f4ed98c474f44bd4f385ea10f54506294776b9b4a6ba2f72150d07c544b9eef60cdd3bddbe5a2ec93ebcf76eaa58281244bb5cebe4c5356d8d213e13225452a

data/lib/dependabot/bun/update_checker/conflicting_dependency_resolver.rb

@@ -37,7 +37,7 @@ module Dependabot
         #
         # @param dependency [Dependabot::Dependency] the dependency to check
         # @param target_version [String] the version to check
-        # @return [Array<Hash{String => String}]
+        # @return [Array<Hash{String => Object}]
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
@@ -46,7 +46,7 @@ module Dependabot
             dependency: Dependabot::Dependency,
             target_version: T.nilable(T.any(String, Dependabot::Version))
           )
-            .returns(T::Array[T::Hash[String, String]])
+            .returns(T::Array[Dependabot::UpdateCheckers::Conflict])
         end
         def conflicting_dependencies(dependency:, target_version:)
           SharedHelpers.in_a_temporary_directory do
@@ -63,7 +63,7 @@ module Dependabot
                 function: "yarn:findConflictingDependencies",
                 args: [Dir.pwd, dependency.name, target_version.to_s]
               ),
-              T::Array[T::Hash[String, String]]
+              T::Array[Dependabot::UpdateCheckers::Conflict]
             )
           end
         rescue SharedHelpers::HelperSubprocessFailed

data/lib/dependabot/bun/update_checker/latest_version_finder.rb

@@ -141,7 +141,7 @@ module Dependabot
             secure_versions =
               Dependabot::UpdateCheckers::VersionFilters
               .filter_vulnerable_versions(
-                T.unsafe(secure_versions),
+                secure_versions,
                 security_advisories
               )
             secure_versions = filter_ignored_versions(secure_versions)
@@ -237,7 +237,7 @@ module Dependabot
         def possible_previous_releases
           (package_details&.releases || [])
             .reject do |r|
-            r.version.prerelease? && !related_to_current_pre?(T.unsafe(r.version))
+            r.version.prerelease? && !related_to_current_pre?(r.version)
           end
             .sort_by(&:version).reverse
         end

data/lib/dependabot/bun/update_checker/version_resolver.rb

@@ -343,9 +343,11 @@ module Dependabot
           latest_types_version = latest_types_package_version
           return false unless latest_types_version
 
+          latest_types_version = T.cast(latest_types_version, Version)
+
           latest_allowable_ver = latest_allowable_version
           return false unless latest_allowable_ver.is_a?(Version) && latest_allowable_ver.backwards_compatible_with?(
-            T.unsafe(latest_types_version)
+            latest_types_version
           )
 
           return false unless version_class.correct?(types_pkg.version)
@@ -512,7 +514,7 @@ module Dependabot
             .possible_versions_with_details
             .select do |versions_with_details|
               version, details = versions_with_details
-              next false unless satisfies_peer_reqs_on_dep?(T.unsafe(version))
+              next false unless satisfies_peer_reqs_on_dep?(version)
               next true unless details["peerDependencies"]
               next true if version == version_for_dependency(dependency)
 

data/lib/dependabot/bun/update_checker/vulnerability_auditor.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -13,6 +13,7 @@ require "dependabot/bun/native_helpers"
 require "dependabot/bun/update_checker"
 require "dependabot/bun/update_checker/dependency_files_builder"
 require "dependabot/shared_helpers"
+require "dependabot/update_checkers/vulnerability_audit"
 
 module Dependabot
   module Bun
@@ -20,6 +21,8 @@ module Dependabot
       class VulnerabilityAuditor
         extend T::Sig
 
+        Audit = Dependabot::UpdateCheckers::VulnerabilityAudit
+
         sig do
           params(
             dependency_files: T::Array[Dependabot::DependencyFile],
@@ -32,7 +35,6 @@ module Dependabot
           @credentials = credentials
         end
 
-        # rubocop:disable Metrics/MethodLength
         # Finds any dependencies in the `package-lock.json` or `npm-shrinkwrap.json` that have
         # a subdependency on the given dependency that is locked to a vuln version range.
         #
@@ -40,36 +42,18 @@ module Dependabot
         #
         # @param dependency [Dependabot::Dependency] the dependency to check
         # @param security_advisories [Array<Dependabot::SecurityAdvisory>] advisories for the dependency
-        # @return [Hash<String, [String, Array<Hash<String, String>>]>] the audit results
-        #   * :dependency_name [String] the name of the dependency
-        #   * :fix_available [Boolean] whether a fix is available
-        #   * :current_version [String] the version of the dependency
-        #   * :target_version [String] the version of the dependency after the fix
-        #   * :fix_updates [Array<Hash<String, String>>] a list of dependencies to update in order to fix
-        #     * :dependency_name [String] the name of the blocking dependency
-        #     * :current_version [String] the current version of the blocking dependency
-        #     * :target_version [String] the target version of the blocking dependency
-        #     * :top_level_ancestors [Array<String>] the names of top-level dependencies with a transitive
-        #       dependency on the blocking dependency
-        #   * :top_level_ancestors [Array<String>] the names of all top-level dependencies with a transitive
-        #     dependency on the dependency
-        #   * :explanation [String] an explanation for why the project failed the vulnerability auditor run
+        # @return [Dependabot::UpdateCheckers::VulnerabilityAudit] the parsed audit result
         sig do
           params(
             dependency: Dependabot::Dependency,
             security_advisories: T::Array[Dependabot::SecurityAdvisory]
           )
-            .returns(T::Hash[String, T.untyped])
+            .returns(Audit)
         end
         def audit(dependency:, security_advisories:)
           Dependabot.logger.info("VulnerabilityAuditor: starting audit")
 
-          fix_unavailable = {
-            "dependency_name" => dependency.name,
-            "fix_available" => false,
-            "fix_updates" => [],
-            "top_level_ancestors" => []
-          }
+          fix_unavailable = Audit.unavailable(dependency_name: dependency.name)
 
           SharedHelpers.in_a_temporary_directory do
             dependency_files_builder = DependencyFilesBuilder.new(
@@ -86,20 +70,20 @@ module Dependabot
               }
             end
 
-            audit_result = T.cast(
+            audit_result = Audit.from_object(
               SharedHelpers.run_helper_subprocess(
                 command: NativeHelpers.helper_path,
                 function: "npm:vulnerabilityAuditor",
                 args: [Dir.pwd, vuln_versions]
-              ),
-              T::Hash[String, T.untyped]
+              )
             )
 
             validation_result = validate_audit_result(audit_result, security_advisories)
             if validation_result != :viable
               Dependabot.logger.info("VulnerabilityAuditor: audit result not viable: #{validation_result}")
-              fix_unavailable["explanation"] = explain_fix_unavailable(validation_result, dependency)
-              return fix_unavailable
+              return fix_unavailable.unavailable_with_explanation(
+                explain_fix_unavailable(validation_result, dependency)
+              )
             end
 
             Dependabot.logger.info("VulnerabilityAuditor: audit result viable")
@@ -109,7 +93,6 @@ module Dependabot
           log_helper_subprocess_failure(dependency, e)
           T.must(fix_unavailable)
         end
-        # rubocop:enable Metrics/MethodLength
 
         private
 
@@ -133,12 +116,12 @@ module Dependabot
 
         sig do
           params(
-            audit_result: T::Hash[String, T.untyped],
+            audit_result: Audit,
             security_advisories: T::Array[Dependabot::SecurityAdvisory]
           ).returns(Symbol)
         end
         def validate_audit_result(audit_result, security_advisories)
-          return :fix_unavailable unless audit_result["fix_available"]
+          return :fix_unavailable unless audit_result.fix_available
           return :dependency_still_vulnerable if dependency_still_vulnerable?(audit_result, security_advisories)
           return :downgrades_dependencies if downgrades_dependencies?(audit_result)
           return :fix_incomplete if fix_incomplete?(audit_result)
@@ -148,25 +131,26 @@ module Dependabot
 
         sig do
           params(
-            audit_result: T::Hash[String, T.untyped],
+            audit_result: Audit,
             security_advisories: T::Array[Dependabot::SecurityAdvisory]
           )
             .returns(T::Boolean)
         end
         def dependency_still_vulnerable?(audit_result, security_advisories)
           # vulnerable dependency is removed if the target version is nil
-          return false unless audit_result["target_version"]
+          target_version = audit_result.target_version
+          return false unless target_version
 
-          version = Version.new(audit_result["target_version"])
+          version = Version.new(target_version)
           security_advisories.any? { |a| a.vulnerable?(version) }
         end
 
-        sig { params(audit_result: T::Hash[String, T.untyped]).returns(T::Boolean) }
+        sig { params(audit_result: Audit).returns(T::Boolean) }
         def downgrades_dependencies?(audit_result)
-          return true if downgrades_version?(audit_result["current_version"], audit_result["target_version"])
+          return true if downgrades_version?(audit_result.current_version, audit_result.target_version)
 
-          audit_result["fix_updates"].any? do |update|
-            downgrades_version?(update["current_version"], update["target_version"])
+          audit_result.fix_updates.any? do |update|
+            downgrades_version?(update.current_version, update.target_version)
           end
         end
 
@@ -185,10 +169,10 @@ module Dependabot
           current > target
         end
 
-        sig { params(audit_result: T::Hash[String, T.untyped]).returns(T::Boolean) }
+        sig { params(audit_result: Audit).returns(T::Boolean) }
         def fix_incomplete?(audit_result)
-          audit_result["fix_updates"].any? { |update| !update.key?("target_version") } ||
-            audit_result["fix_updates"].empty?
+          audit_result.fix_updates.any? { |update| !update.target_version_provided? } ||
+            audit_result.fix_updates.empty?
         end
 
         sig do
@@ -200,15 +184,18 @@ module Dependabot
         def log_helper_subprocess_failure(dependency, error)
           # See `Dependabot::SharedHelpers.run_helper_subprocess` for details on error context
           context = error.error_context
+          function = T.cast(context[:function], T.nilable(String))
+          time_taken = T.cast(context[:time_taken], T.nilable(Float))
+          trace = error.trace&.join("\n")
 
           builder = ::StringIO.new
           builder << "VulnerabilityAuditor: "
-          builder << "#{context[:function]} " if context[:function]
+          builder << "#{function} " if function
           builder << "failed"
-          builder << " after #{context[:time_taken].truncate(2)}s" if context[:time_taken]
+          builder << " after #{time_taken.truncate(2)}s" if time_taken
           builder << " while auditing #{dependency.name}: "
           builder << error.message
-          builder << "\n" << context[:trace]
+          builder << "\n#{trace}" if trace
 
           msg = builder.string
           Dependabot.logger.info(msg) # TODO: is this the right log level?

data/lib/dependabot/bun/update_checker.rb

@@ -12,6 +12,8 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
+      Audit = Dependabot::UpdateCheckers::VulnerabilityAudit
+
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/library_detector"
       require_relative "update_checker/latest_version_finder"
@@ -52,7 +54,7 @@ module Dependabot
         @latest_version = T.let(nil, T.nilable(T.any(String, Gem::Version)))
         @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version)))
         @updated_requirements = T.let(nil, T.nilable(T::Array[Dependabot::DependencyRequirement]))
-        @vulnerability_audit = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+        @vulnerability_audit = T.let(nil, T.nilable(Audit))
         @vulnerable_versions = T.let(nil, T.nilable(T::Array[T.any(String, Gem::Version)]))
 
         @latest_version_for_git_dependency = T.let(nil, T.nilable(T.any(String, Gem::Version)))
@@ -116,9 +118,9 @@ module Dependabot
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         # This will require a full unlock to update multiple top level ancestors.
-        return if vulnerability_audit["fix_available"] && vulnerability_audit["top_level_ancestors"].count > 1
+        return if vulnerability_audit.fix_available && vulnerability_audit.top_level_ancestors.count > 1
 
-        T.unsafe(latest_version_finder.lowest_security_fix_version)
+        latest_version_finder.lowest_security_fix_version
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -155,10 +157,10 @@ module Dependabot
 
       sig do
         params(updated_version: T.any(String, Gem::Version))
-          .returns(T.nilable(T.any(String, T.untyped)))
+          .returns(T.nilable(T.any(String, Gem::Version)))
       end
       def latest_resolvable_previous_version(updated_version)
-        T.unsafe(version_resolver.latest_resolvable_previous_version(updated_version))
+        version_resolver.latest_resolvable_previous_version(updated_version)
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -198,7 +200,7 @@ module Dependabot
         library? ? RequirementsUpdateStrategy::WidenRanges : RequirementsUpdateStrategy::BumpVersions
       end
 
-      sig { override.returns(T::Array[T::Hash[String, String]]) }
+      sig { override.returns(T::Array[Dependabot::UpdateCheckers::Conflict]) }
       def conflicting_dependencies
         conflicts = ConflictingDependencyResolver.new(
           dependency_files: dependency_files,
@@ -209,9 +211,8 @@ module Dependabot
         )
         return conflicts unless vulnerability_audit_performed?
 
-        vulnerable = [vulnerability_audit].select do |hash|
-          !hash["fix_available"] && hash["explanation"]
-        end
+        audit = vulnerability_audit
+        vulnerable = !audit.fix_available && audit.explanation ? [audit.to_h] : []
 
         conflicts + vulnerable
       end
@@ -223,7 +224,7 @@ module Dependabot
         !!defined?(@vulnerability_audit)
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(Audit) }
       def vulnerability_audit
         @vulnerability_audit ||=
           VulnerabilityAuditor.new(
@@ -256,12 +257,12 @@ module Dependabot
 
         return false unless security_advisories.any?
 
-        vulnerability_audit["fix_available"]
+        vulnerability_audit.fix_available
       end
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
-        return conflicting_updated_dependencies if security_advisories.any? && vulnerability_audit["fix_available"]
+        return conflicting_updated_dependencies if security_advisories.any? && vulnerability_audit.fix_available
 
         T.must(version_resolver.dependency_updates_from_full_unlock)
          .map { |update_details| build_updated_dependency(update_details.transform_keys(&:to_sym)) }
@@ -273,8 +274,8 @@ module Dependabot
         top_level_dependencies = top_level_dependency_lookup
 
         updated_deps = []
-        vulnerability_audit["fix_updates"].each do |update|
-          dependency_name = update["dependency_name"]
+        vulnerability_audit.fix_updates.each do |update|
+          dependency_name = update.dependency_name
           requirements = top_level_dependencies[dependency_name]&.requirements || []
 
           updated_deps << build_updated_dependency(
@@ -283,8 +284,8 @@ module Dependabot
               package_manager: "bun",
               requirements: requirements
             ),
-            version: update["target_version"],
-            previous_version: update["current_version"]
+            version: update.target_version,
+            previous_version: update.current_version
           )
         end
         # rubocop:enable Metrics/AbcSize
@@ -294,7 +295,7 @@ module Dependabot
         # to include it so it's described in the PR and we'll pass validation
         # that this dependency is at a non-vulnerable version.
         if updated_deps.none? { |dep| dep.name == dependency.name }
-          target_version = vulnerability_audit["target_version"]
+          target_version = vulnerability_audit.target_version
           updated_deps << build_updated_dependency(
             dependency: dependency,
             version: target_version,
@@ -394,10 +395,8 @@ module Dependabot
       def latest_version_for_git_dependency
         @latest_version_for_git_dependency ||=
           if version_class.correct?(dependency.version)
-            T.unsafe(
-              latest_git_version_details[:version] &&
-                            version_class.new(latest_git_version_details[:version])
-            )
+            version = latest_git_version_details[:version]
+            version && version_class.new(version)
           else
             latest_git_version_details[:sha]
           end
@@ -466,7 +465,7 @@ module Dependabot
         git_commit_checker.git_dependency?
       end
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.nilable(String)]) }
       def latest_git_version_details
         semver_req =
           dependency.requirements
@@ -478,8 +477,8 @@ module Dependabot
         if semver_req || git_commit_checker.pinned_ref_looks_like_version?
           latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return {
-            sha: latest_tag&.fetch(:commit_sha),
-            version: latest_tag&.fetch(:tag)&.gsub(/^[^\d]*/, "")
+            sha: latest_tag&.commit_sha,
+            version: latest_tag&.tag&.gsub(/^[^\d]*/, "")
           }
         end
 
@@ -501,7 +500,7 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            !git_commit_checker.local_tag_for_latest_version(update_cooldown).nil?
           new_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
-          return dependency_source_details&.merge(ref: new_tag&.fetch(:tag))
+          return dependency_source_details&.merge(ref: new_tag&.tag)
         end
 
         # Otherwise return the original source

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bun
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -354,7 +354,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib