dependabot-bundler 0.261.0 → 0.262.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8b215bdea5dc17ab35848e557529c8e22851f703a5fe3ef8965cf5bf9e15331
-  data.tar.gz: d453d01dccec321c438dff7c8f2107b4f6b75cbecaf67823e250988b860f78cd
+  metadata.gz: f3110295d89e7d09947a48ccb7a3c623684e62392a2467e5708dc83ca1d1c698
+  data.tar.gz: d675d23e1adab94cad313a607d02cc1712491f90d3fcd9649d6bd6874de223f9
 SHA512:
-  metadata.gz: 4319c06b8a84ade9b143ea5949e4be67d01e81a94d85d97f99d477f0fb2f836937bec1a752b61301fc2608183c38516bd13043d3f8fa12dcbc41dd717b262baa
-  data.tar.gz: 96ce46b41f6acec8899157a458fbe47f65812729bd2998d26c4241cb06e39c643b5935b53d358ed09374affb8df5b74862b8133c30419b4fa29ffb6881ec34c2
+  metadata.gz: 7c3680e4726f1b5999721dee5a0d2df0587f6ed4391a59a5ff3af16116c965088dd2cb582147e1ad7eb73c10b67bf05a9ac100d71a4229daf2ea63680c6a9f1e
+  data.tar.gz: 3a2e33646daacd25c82ae4be8a664f21ce41b185dba0d24ae2adee045e5c70c3be1e4baf3adfcd2f9cc65f53ba3ebb812041158564dd59e28dfe767f43ce2d9b

data/lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb

@@ -1,10 +1,11 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "pathname"
 require "parser/current"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module Bundler
@@ -12,32 +13,38 @@ module Dependabot
       # Finds the paths of any Gemfiles declared using `eval_gemfile` in the
       # passed Gemfile.
       class ChildGemfileFinder
+        extend T::Sig
+
+        sig { params(gemfile: Dependabot::DependencyFile).void }
         def initialize(gemfile:)
           @gemfile = gemfile
         end
 
+        sig { returns(T::Array[String]) }
         def child_gemfile_paths
-          ast = Parser::CurrentRuby.parse(gemfile.content)
+          ast = Parser::CurrentRuby.parse(gemfile&.content)
           find_child_gemfile_paths(ast)
         rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, gemfile.path
+          raise Dependabot::DependencyFileNotParseable, T.must(gemfile&.path)
         end
 
         private
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :gemfile
 
+        sig { params(node: T.untyped).returns(T::Array[String]) }
         def find_child_gemfile_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
           if declares_eval_gemfile?(node)
             path_node = node.children[2]
             unless path_node.type == :str
-              path = gemfile.path
+              path = gemfile&.path
               msg = "Dependabot only supports uninterpolated string arguments " \
                     "to eval_gemfile. Got " \
                     "`#{path_node.loc.expression.source}`"
-              raise Dependabot::DependencyFileNotParseable.new(path, msg)
+              raise Dependabot::DependencyFileNotParseable.new(T.must(path), msg)
             end
 
             path = path_node.loc.expression.source.gsub(/['"]/, "")
@@ -50,12 +57,14 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def current_dir
-          @current_dir ||= gemfile.name.rpartition("/").first
+          @current_dir ||= T.let(gemfile&.name&.rpartition("/")&.first, T.nilable(String))
           @current_dir = nil if @current_dir == ""
           @current_dir
         end
 
+        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
         def declares_eval_gemfile?(node)
           return false unless node.is_a?(Parser::AST::Node)
 

data/lib/dependabot/bundler/file_fetcher/gemspec_finder.rb

@@ -1,10 +1,11 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "pathname"
 require "parser/current"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module Bundler
@@ -12,21 +13,27 @@ module Dependabot
       # Finds the directories of any gemspecs declared using `gemspec` in the
       # passed Gemfile.
       class GemspecFinder
+        extend T::Sig
+
+        sig { params(gemfile: Dependabot::DependencyFile).void }
         def initialize(gemfile:)
           @gemfile = gemfile
         end
 
+        sig { returns(T::Array[String]) }
         def gemspec_directories
-          ast = Parser::CurrentRuby.parse(gemfile.content)
+          ast = Parser::CurrentRuby.parse(T.must(gemfile).content)
           find_gemspec_paths(ast)
         rescue Parser::SyntaxError
-          raise Dependabot::DependencyFileNotParseable, gemfile.path
+          raise Dependabot::DependencyFileNotParseable, T.must(gemfile).path
         end
 
         private
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :gemfile
 
+        sig { params(node: T.untyped).returns(T::Array[T.untyped]) }
         def find_gemspec_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
@@ -35,7 +42,7 @@ module Dependabot
             return [clean_path(".")] unless path_node
 
             unless path_node.type == :str
-              path = gemfile.path
+              path = T.must(gemfile).path
               msg = "Dependabot only supports uninterpolated string arguments " \
                     "to gemspec. Got " \
                     "`#{path_node.loc.expression.source}`"
@@ -51,18 +58,21 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def current_dir
-          @current_dir ||= gemfile.name.rpartition("/").first
+          @current_dir ||= T.let(gemfile&.name&.rpartition("/")&.first, T.nilable(String))
           @current_dir = nil if @current_dir == ""
           @current_dir
         end
 
+        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
         def declares_gemspec_dependency?(node)
           return false unless node.is_a?(Parser::AST::Node)
 
           node.children[1] == :gemspec
         end
 
+        sig { params(path: String).returns(Pathname) }
         def clean_path(path)
           if Pathname.new(path).absolute?
             base_path = Pathname.new(File.expand_path(Dir.pwd))
@@ -72,6 +82,7 @@ module Dependabot
           Pathname.new(path).cleanpath
         end
 
+        sig { params(node: Parser::AST::Node).returns(T.nilable(Parser::AST::Node)) }
         def path_node_for_gem_declaration(node)
           return unless node.children.last.is_a?(Parser::AST::Node)
           return unless node.children.last.type == :hash
@@ -87,6 +98,7 @@ module Dependabot
           path_hash_pair.children.last
         end
 
+        sig { params(node: Parser::AST::Node).returns(Symbol) }
         def key_from_hash_pair(node)
           node.children.first.children.first.to_sym
         end

data/lib/dependabot/bundler/file_fetcher/require_relative_finder.rb

@@ -1,10 +1,11 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "pathname"
 require "parser/current"
 require "dependabot/bundler/file_fetcher"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module Bundler
@@ -12,10 +13,14 @@ module Dependabot
       # Finds the paths of any files included using `require_relative` in the
       # passed file.
       class RequireRelativeFinder
+        extend T::Sig
+
+        sig { params(file: Dependabot::DependencyFile).void }
         def initialize(file:)
           @file = file
         end
 
+        sig { returns(T::Array[String]) }
         def require_relative_paths
           ast = Parser::CurrentRuby.parse(file.content)
           find_require_relative_paths(ast)
@@ -25,8 +30,10 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :file
 
+        sig { params(node: T.untyped).returns(T::Array[T.untyped]) }
         def find_require_relative_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
@@ -44,12 +51,14 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def current_dir
-          @current_dir ||= file.name.rpartition("/").first
+          @current_dir ||= T.let(file.name.rpartition("/").first, T.nilable(String))
           @current_dir = nil if @current_dir == ""
           @current_dir
         end
 
+        sig { params(node: Parser::AST::Node).returns(T::Boolean) }
         def declares_require_relative?(node)
           return false unless node.is_a?(Parser::AST::Node)
 

data/lib/dependabot/bundler/file_parser/file_preparer.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/dependency_file"
 require "dependabot/file_parsers/base"
 require "dependabot/bundler/file_updater/gemspec_sanitizer"
@@ -9,15 +10,19 @@ module Dependabot
   module Bundler
     class FileParser < Dependabot::FileParsers::Base
       class FilePreparer
+        extend T::Sig
+
+        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def prepared_dependency_files
           files = gemspecs.compact.map do |file|
             DependencyFile.new(
               name: file.name,
-              content: sanitize_gemspec_content(file.content),
+              content: sanitize_gemspec_content(T.must(file.content)),
               directory: file.directory,
               support_file: file.support_file?
             )
@@ -36,13 +41,16 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def evaled_gemfiles
           dependency_files
             .reject { |f| f.name.end_with?(".gemspec") }
@@ -54,33 +62,40 @@ module Dependabot
             .reject(&:support_file?)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def specification_files
           dependency_files.select { |f| f.name.end_with?(".specification") }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def gemspecs
           dependency_files.select { |f| f.name.end_with?(".gemspec") }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def ruby_version_file
           dependency_files.find { |f| f.name == ".ruby-version" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def tool_versions_file
           dependency_files.find { |f| f.name == ".tool-versions" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def imported_ruby_files
           dependency_files
             .select { |f| f.name.end_with?(".rb") }
             .reject { |f| f.name == "gems.rb" }
         end
 
+        sig { params(gemspec_content: String).returns(String) }
         def sanitize_gemspec_content(gemspec_content)
           # No need to set the version correctly - this is just an update
           # check so we're not going to persist any changes to the lockfile.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.261.0
+  version: 0.262.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-13 00:00:00.000000000 Z
+date: 2024-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.261.0
+        version: 0.262.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.261.0
+        version: 0.262.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.262.0
 post_install_message: 
 rdoc_options: []
 require_paths: