dependabot-bundler 0.331.0 → 0.332.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d913e03bbafff1bf6a1e905d3f6102572f398f2231748e7f3dc431cf67dae8b
-  data.tar.gz: df7093e86cc83e024a6d6527fa6b8e1b180e1db936a7ae98f216e537a7561600
+  metadata.gz: 0373cdfce669d8fb9d4fb6081a0b2660c58217e1c309cbc49e772971ba5f9f1a
+  data.tar.gz: f0a48edc13f2826d1177be53e368fb9bb9957d50f53bfb1ecdf62b7dc3a13b34
 SHA512:
-  metadata.gz: ae5d37a7e93a31327fd166a9f491bcc032a77e739b45de5e0abf306c4f0cd0c9a5c09036ebad1540c88b539ede05abb0164f185c5434144db81d003279a43320
-  data.tar.gz: fb3c5408c9a52a44df3caa36cd962bf29aa9ecca9d2ffec30d0a23ba5e58c743db813c072b5864bc273675b48c8bca28700b48e7c4adc8b410d7115aff97d0d5
+  metadata.gz: f259e4c088e2e8ccbf1a343e216b606681c4e40538a5aa6306fb508b176904467bbaaeeb9f73a8050e16c14d249204be42444640f1f0485f0da45c4127fdf468
+  data.tar.gz: e0a5c41f18681d4db017a5c6e28646739af2315d89a59e937ad2fee2a6078fb6d48b00c8da8652324616640c95ef740b683442b3bbd2059a77178aa0c9475632

data/lib/dependabot/bundler/file_parser.rb

@@ -122,21 +122,17 @@ module Dependabot
           parsed_gemfile.each do |dep|
             next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
 
-            dep =
-              Dependency.new(
-                name: dep.fetch("name"),
-                version: dependency_version(dep.fetch("name"))&.to_s,
-                requirements: [{
-                  requirement: gemfile_declaration_finder.enhanced_req_string(dep),
-                  groups: dep.fetch("groups").map(&:to_sym),
-                  source: dep.fetch("source")&.transform_keys(&:to_sym),
-                  file: file.name
-                }],
-                package_manager: "bundler"
-              )
-
-            file.dependencies << dep
-            dependencies << dep
+            dependencies << Dependency.new(
+              name: dep.fetch("name"),
+              version: dependency_version(dep.fetch("name"))&.to_s,
+              requirements: [{
+                requirement: gemfile_declaration_finder.enhanced_req_string(dep),
+                groups: dep.fetch("groups").map(&:to_sym),
+                source: dep.fetch("source")&.transform_keys(&:to_sym),
+                file: file.name
+              }],
+              package_manager: "bundler"
+            )
           end
         end
 
@@ -144,7 +140,7 @@ module Dependabot
       end
 
       sig { returns(DependencySet) }
-      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity,Metrics/AbcSize
+      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity
         @gemspec_dependencies = T.let(@gemspec_dependencies, T.nilable(DependencySet))
         return @gemspec_dependencies if @gemspec_dependencies
 
@@ -159,7 +155,7 @@ module Dependabot
             parsed_gemspec(gemspec).each do |dependency|
               next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
 
-              dep = Dependency.new(
+              queue << Dependency.new(
                 name: dependency.fetch("name"),
                 version: dependency_version(dependency.fetch("name"))&.to_s,
                 requirements: [{
@@ -174,9 +170,6 @@ module Dependabot
                 }],
                 package_manager: "bundler"
               )
-
-              gemspec.dependencies << dep
-              queue << dep
             end
           end
         end
@@ -198,23 +191,15 @@ module Dependabot
         parsed_lockfile.specs.each do |dependency|
           next if dependency.source.is_a?(::Bundler::Source::Path)
 
-          # if a dependency is listed in the lockfiles' DEPENDENCIES section,
-          # then it is a direct dependency & we want to keep track of that fact
-          is_direct = parsed_lockfile.dependencies.key?(dependency.name)
-
-          dep = Dependency.new(
+          dependencies << Dependency.new(
             name: dependency.name,
             version: dependency_version(dependency.name)&.to_s,
             requirements: [],
             package_manager: "bundler",
             subdependency_metadata: [{
               production: production_dep_names.include?(dependency.name)
-            }],
-            direct_relationship: is_direct
+            }]
           )
-
-          T.must(lockfile).dependencies << dep
-          dependencies << dep
         end
 
         dependencies
@@ -357,10 +342,6 @@ module Dependabot
           get_original_file("Gemfile.lock") || get_original_file("gems.locked"),
           T.nilable(Dependabot::DependencyFile)
         )
-
-        # Set the lockfile as higher priority so we know to ignore the Gemfile, etc
-        # when producing a graph.
-        @lockfile&.tap { |f| f.priority = 1 }
       end
 
       sig { returns(T.untyped) }

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -43,17 +43,25 @@ module Dependabot
           @credentials = credentials
 
           @source_type = T.let(nil, T.nilable(String))
+          @options = T.let({}, T::Hash[Symbol, T.untyped])
+          @repo_contents_path = T.let(nil, T.nilable(String))
         end
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { override.returns(T::Array[T.untyped]) }
         attr_reader :dependency_files
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { override.returns(T::Array[T.untyped]) }
         attr_reader :credentials
 
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
         sig { returns(Dependabot::Package::PackageDetails) }
         def fetch
           case source_type

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/update_checker"
@@ -10,11 +10,33 @@ module Dependabot
   module Bundler
     class UpdateChecker < UpdateCheckers::Base
       class ConflictingDependencyResolver
+        extend T::Sig
+
         require_relative "shared_bundler_helpers"
+
         include SharedBundlerHelpers
 
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
         attr_reader :options
 
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: T.nilable(String),
+            credentials: T::Array[Dependabot::Credential],
+            options: T::Hash[Symbol, T.untyped]
+          )
+            .void
+        end
         def initialize(dependency_files:, repo_contents_path:, credentials:, options:)
           @dependency_files = dependency_files
           @repo_contents_path = repo_contents_path
@@ -31,6 +53,13 @@ module Dependabot
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            target_version: String
+          )
+            .returns(T::Array[T::Hash[String, String]])
+        end
         def conflicting_dependencies(dependency:, target_version:)
           return [] if lockfile.nil?
 
@@ -44,7 +73,7 @@ module Dependabot
                 dependency_name: dependency.name,
                 target_version: target_version,
                 credentials: credentials,
-                lockfile_name: lockfile.name
+                lockfile_name: T.must(lockfile).name
               }
             )
           end
@@ -52,8 +81,12 @@ module Dependabot
 
         private
 
+        sig { override.returns(String) }
         def bundler_version
-          @bundler_version ||= Helpers.bundler_version(lockfile)
+          @bundler_version ||= T.let(
+            Helpers.bundler_version(lockfile),
+            T.nilable(String)
+          )
         end
       end
     end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/bundler/file_parser"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
@@ -14,14 +15,28 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class ForceUpdater
+        extend T::Sig
+
         require_relative "shared_bundler_helpers"
+
         include SharedBundlerHelpers
 
-        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
-                       credentials:, target_version:,
-                       requirements_update_strategy:,
-                       update_multiple_dependencies: true,
-                       options:)
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            target_version: Dependabot::Version,
+            requirements_update_strategy: Dependabot::RequirementsUpdateStrategy,
+            options: T::Hash[Symbol, T.untyped],
+            repo_contents_path: T.nilable(String),
+            update_multiple_dependencies: T::Boolean
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, target_version:,
+                       requirements_update_strategy:, options:,
+                       repo_contents_path: nil,
+                       update_multiple_dependencies: true)
           @dependency                   = dependency
           @dependency_files             = dependency_files
           @repo_contents_path           = repo_contents_path
@@ -30,28 +45,50 @@ module Dependabot
           @requirements_update_strategy = requirements_update_strategy
           @update_multiple_dependencies = update_multiple_dependencies
           @options                      = options
+
+          @updated_dependencies         = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+          @original_dependencies        = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+          @bundler_version              = T.let(nil, T.nilable(String))
         end
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def updated_dependencies
           @updated_dependencies ||= force_update
         end
 
-        private
-
-        attr_reader :dependency
+        # Abstract method implementations
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { override.returns(T.nilable(String)) }
         attr_reader :repo_contents_path
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        private
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(Dependabot::Version) }
         attr_reader :target_version
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :requirements_update_strategy
-        attr_reader :options
 
+        sig { returns(T::Boolean) }
         def update_multiple_dependencies?
           @update_multiple_dependencies
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def force_update
-          requirement = dependency.requirements.find { |req| req[:file] == gemfile.name }
+          requirement = dependency.requirements.find { |req| req[:file] == T.must(gemfile).name }
 
           valid_gem_version?(target_version)
 
@@ -71,8 +108,8 @@ module Dependabot
                 dependency_name: dependency.name,
                 target_version: target_version,
                 credentials: credentials,
-                gemfile_name: gemfile.name,
-                lockfile_name: lockfile.name,
+                gemfile_name: T.must(gemfile).name,
+                lockfile_name: T.must(lockfile).name,
                 update_multiple_dependencies: update_multiple_dependencies?
               }
             )
@@ -82,7 +119,9 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
         end
+        # rubocop:enable Metrics/AbcSize
 
+        sig { params(target_version: T.nilable(Dependabot::Version)).returns(TrueClass) }
         def valid_gem_version?(target_version)
           # to rule out empty, non gem info ending up in as target_version
           return true if target_version.is_a?(Gem::Version)
@@ -92,6 +131,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable
         end
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def original_dependencies
           @original_dependencies ||=
             FileParser.new(
@@ -101,6 +141,13 @@ module Dependabot
             ).parse
         end
 
+        sig do
+          params(
+            updated_deps: T::Array[T::Hash[String, T.untyped]],
+            specs: T::Array[T::Hash[String, T.untyped]]
+          )
+            .returns(T::Array[Dependabot::Dependency])
+        end
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -114,12 +161,13 @@ module Dependabot
               original_dependencies.find { |d| d.name == dep.fetch("name") }
             spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-            next if spec.fetch("version") == original_dep.version
+            next if T.must(spec).fetch("version") == T.must(original_dep).version
 
             build_dependency(original_dep, spec)
           end
         end
 
+        sig { params(original_dep: T.untyped, updated_spec: T.untyped).returns(Dependabot::Dependency) }
         def build_dependency(original_dep, updated_spec)
           Dependency.new(
             name: updated_spec.fetch("name"),
@@ -138,27 +186,32 @@ module Dependabot
           )
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Hash[String, T.untyped])) }
         def source_for(dependency)
           dependency.requirements
                     .find { |r| r.fetch(:source) }
                     &.fetch(:source)
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
 
+        sig { returns(String) }
         def sanitized_lockfile_body
           re = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
-          lockfile.content.gsub(re, "")
+          T.must(T.must(lockfile).content).gsub(re, "")
         end
 
+        sig { void }
         def write_temporary_dependency_files
           dependency_files.each do |file|
             path = file.name
@@ -166,9 +219,10 @@ module Dependabot
             File.write(path, file.content)
           end
 
-          File.write(lockfile.name, sanitized_lockfile_body) if lockfile
+          File.write(T.must(lockfile).name, sanitized_lockfile_body) if lockfile
         end
 
+        sig { override.returns(String) }
         def bundler_version
           @bundler_version ||= Helpers.bundler_version(lockfile)
         end

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -23,8 +23,17 @@ module Dependabot
 
         abstract!
 
-        sig { returns(T::Hash[Symbol, T.untyped]) }
-        attr_reader :options
+        sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+        def options; end
+
+        sig { abstract.returns(T::Array[Dependabot::DependencyFile]) }
+        def dependency_files; end
+
+        sig { abstract.returns(T.nilable(String)) }
+        def repo_contents_path; end
+
+        sig { abstract.returns(T::Array[Dependabot::Credential]) }
+        def credentials; end
 
         GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/
         GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./
@@ -51,21 +60,24 @@ module Dependabot
           Bundler::Fetcher::FallbackError
         ).freeze
 
-        attr_reader :dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
-
         #########################
         # Bundler context setup #
         #########################
 
-        def in_a_native_bundler_context(error_handling: true)
+        sig do
+          params(
+            error_handling: T::Boolean,
+            _blk: T.proc.params(arg0: String).returns(T.untyped)
+          )
+            .returns(T.untyped)
+        end
+        def in_a_native_bundler_context(error_handling: true, &_blk)
           SharedHelpers
             .in_a_temporary_repo_directory(base_directory,
                                            repo_contents_path) do |tmp_dir|
             write_temporary_dependency_files
 
-            yield(tmp_dir)
+            yield(tmp_dir.to_s)
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
           retry_count ||= 0
@@ -75,10 +87,12 @@ module Dependabot
           error_handling ? handle_bundler_errors(e) : raise
         end
 
+        sig { returns(String) }
         def base_directory
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def retryable_error?(error)
           return true if error.error_class == "JSON::ParserError"
           return true if RETRYABLE_ERRORS.include?(error.error_class)
@@ -92,6 +106,7 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/MethodLength
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).void }
         def handle_bundler_errors(error)
           if error.error_class == "JSON::ParserError"
             msg = "Error evaluating your dependency files: #{error.message}"
@@ -105,25 +120,22 @@ module Dependabot
             # We couldn't evaluate the Gemfile, let alone resolve it
             raise Dependabot::DependencyFileNotEvaluatable, msg
           when "Bundler::Source::Git::MissingGitRevisionError"
-            gem_name =
-              error.message.match(GIT_REF_REGEX)
-                   .named_captures["path"]
-                   .split("/").last
-            raise GitDependencyReferenceNotFound, gem_name
+            match_data = error.message.match(GIT_REF_REGEX)
+            gem_name = T.must(T.must(match_data).named_captures["path"])
+                        .split("/").last
+            raise GitDependencyReferenceNotFound, T.must(gem_name)
           when "Bundler::PathError"
-            gem_name =
-              error.message.match(PATH_REGEX)
-                   .named_captures["path"]
-                   .split("/").last.split("-")[0..-2].join
+            match_data = error.message.match(PATH_REGEX)
+            path = T.must(T.must(match_data).named_captures["path"])
+            gem_name = T.must(T.must(path.split("/").last).split("-")[0..-2]).join
             raise Dependabot::PathDependenciesNotReachable, [gem_name]
           when "Bundler::Source::Git::GitCommandError"
             if error.message.match?(GIT_REGEX)
               # We couldn't find the specified branch / commit (or the two
               # weren't compatible).
-              gem_name =
-                error.message.match(GIT_REGEX)
-                     .named_captures["path"]
-                     .split("/").last.split("-")[0..-2].join
+              match_data = error.message.match(GIT_REGEX)
+              path = T.must(T.must(match_data).named_captures["path"])
+              gem_name = T.must(T.must(path.split("/").last).split("-")[0..-2]).join
               raise GitDependencyReferenceNotFound, gem_name
             end
 
@@ -144,24 +156,24 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           when "Bundler::Fetcher::AuthenticationRequiredError"
             regex = BundlerErrorPatterns::MISSING_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::AuthenticationForbiddenError"
             regex = BundlerErrorPatterns::FORBIDDEN_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::BadAuthenticationError"
             regex = BundlerErrorPatterns::BAD_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::CertificateFailureError"
             regex = BundlerErrorPatterns::BAD_CERT_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceCertificateFailure, source
           when "Bundler::HTTPError"
             regex = BundlerErrorPatterns::HTTP_ERR_REGEX
             if error.message.match?(regex)
-              source = error.message.match(regex)[:source]
+              source = T.must(T.must(error.message.match(regex))[:source])
               raise if [
                 "rubygems.org",
                 "www.rubygems.org"
@@ -184,6 +196,7 @@ module Dependabot
         # rubocop:enable Metrics/AbcSize
         # rubocop:enable Metrics/MethodLength
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def inaccessible_git_dependencies
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
             git_specs = NativeHelpers.run_bundler_subprocess(
@@ -192,7 +205,7 @@ module Dependabot
               options: options,
               args: {
                 dir: tmp_dir,
-                gemfile_name: gemfile.name,
+                gemfile_name: T.must(gemfile).name,
                 credentials: credentials
               }
             )
@@ -210,8 +223,10 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def jfrog_source
-          return @jfrog_source unless defined?(@jfrog_source)
+          @jfrog_source = T.let(@jfrog_source, T.nilable(String)) if @jfrog_source.nil?
+          return @jfrog_source unless @jfrog_source.nil?
 
           @jfrog_source = in_a_native_bundler_context(error_handling: false) do |dir|
             NativeHelpers.run_bundler_subprocess(
@@ -220,16 +235,14 @@ module Dependabot
               options: options,
               args: {
                 dir: dir,
-                gemfile_name: gemfile.name,
+                gemfile_name: T.must(gemfile).name,
                 credentials: credentials
               }
             )
           end
         end
 
-        sig { abstract.returns(String) }
-        def bundler_version; end
-
+        sig { void }
         def write_temporary_dependency_files
           dependency_files.each do |file|
             path = file.name
@@ -237,23 +250,32 @@ module Dependabot
             File.write(path, file.content)
           end
 
-          File.write(lockfile.name, lockfile.content) if lockfile
+          lockfile_obj = lockfile
+          File.write(lockfile_obj.name, lockfile_obj.content) if lockfile_obj
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def private_registry_credentials
           credentials
             .select { |cred| cred["type"] == "rubygems_server" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
+
+        private
+
+        sig { abstract.returns(String) }
+        def bundler_version; end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
 
 require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
@@ -15,19 +16,36 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class VersionResolver
+        extend T::Sig
+
         require_relative "file_preparer"
         require_relative "latest_version_finder"
         require_relative "shared_bundler_helpers"
         include SharedBundlerHelpers
 
-        def initialize(dependency:, unprepared_dependency_files:,
-                       repo_contents_path: nil, credentials:, ignored_versions:,
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            unprepared_dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            options: T::Hash[Symbol, T.untyped],
+            repo_contents_path: T.nilable(String),
+            raise_on_ignored: T::Boolean,
+            replacement_git_pin: T.nilable(String),
+            remove_git_source: T::Boolean,
+            unlock_requirement: T::Boolean,
+            latest_allowable_version: T.nilable(T.any(String, Dependabot::Version)),
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(dependency:, unprepared_dependency_files:, credentials:, ignored_versions:, options:,
+                       repo_contents_path: nil,
                        raise_on_ignored: false,
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
                        latest_allowable_version: nil,
-                       cooldown_options: nil,
-                       options:)
+                       cooldown_options: nil)
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
           @credentials                 = credentials
@@ -41,50 +59,77 @@ module Dependabot
           @cooldown_options            = cooldown_options
           @options                     = options
 
-          @latest_allowable_version_incompatible_with_ruby = false
+          @latest_allowable_version_incompatible_with_ruby = T.let(false, T::Boolean)
+          @latest_resolvable_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @gemspec_ruby_unlocked = T.let(false, T::Boolean)
+          @bundler_version = T.let(nil, T.nilable(String))
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_resolvable_version_details
           @latest_resolvable_version_details ||=
             fetch_latest_resolvable_version_details
         end
 
+        sig { returns(T::Boolean) }
         def latest_allowable_version_incompatible_with_ruby?
           @latest_allowable_version_incompatible_with_ruby
         end
 
+        # Abstract method implementations
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        def dependency_files
+          @dependency_files ||=
+            FilePreparer.new(
+              dependency: dependency,
+              dependency_files: unprepared_dependency_files,
+              replacement_git_pin: replacement_git_pin,
+              remove_git_source: remove_git_source?,
+              unlock_requirement: unlock_requirement?,
+              latest_allowable_version: latest_allowable_version
+            ).prepared_dependency_files
+        end
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :unprepared_dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T.nilable(String)) }
         attr_reader :replacement_git_pin
+
+        sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
         attr_reader :latest_allowable_version
-        attr_reader :options
 
+        sig { returns(T::Boolean) }
         def remove_git_source?
           @remove_git_source
         end
 
+        sig { returns(T::Boolean) }
         def unlock_requirement?
           @unlock_requirement
         end
 
-        def dependency_files
-          @dependency_files ||=
-            FilePreparer.new(
-              dependency: dependency,
-              dependency_files: unprepared_dependency_files,
-              replacement_git_pin: replacement_git_pin,
-              remove_git_source: remove_git_source?,
-              unlock_requirement: unlock_requirement?,
-              latest_allowable_version: latest_allowable_version
-            ).prepared_dependency_files
-        end
-
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def fetch_latest_resolvable_version_details
           return latest_version_details unless gemfile
 
@@ -100,7 +145,7 @@ module Dependabot
                 args: {
                   dependency_name: dependency.name,
                   dependency_requirements: dependency.requirements,
-                  gemfile_name: gemfile.name,
+                  gemfile_name: T.must(gemfile).name,
                   lockfile_name: lockfile&.name,
                   dir: tmp_dir,
                   credentials: credentials
@@ -136,12 +181,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def circular_dependency_at_new_version?(error)
           return false unless error.error_class.include?("CyclicDependencyError")
 
           error.message.include?("'#{dependency.name}'")
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def error_due_to_restrictive_upper_bound?(error)
           # We see this when the dependency doesn't appear in the lockfile and
           # has an overly restrictive upper bound that we've added, either due
@@ -152,6 +199,7 @@ module Dependabot
           error.message.include?("#{dependency.name} ")
         end
 
+        sig { params(error: T.untyped).returns(T::Boolean) }
         def ruby_lock_error?(error)
           return false unless conflict_on_ruby?(error)
           return false if @gemspec_ruby_unlocked
@@ -159,6 +207,7 @@ module Dependabot
           dependency_files.any? { |f| f.name.end_with?(".gemspec") }
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def conflict_on_ruby?(error)
           if bundler_version == "1"
             error.message.include?(" for gem \"ruby\0\"")
@@ -167,6 +216,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def regenerate_dependency_files_without_ruby_lock
           @dependency_files =
             FilePreparer.new(
@@ -178,8 +228,10 @@ module Dependabot
               latest_allowable_version: latest_allowable_version,
               lock_ruby_version: false
             ).prepared_dependency_files
+          true
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_details
           @latest_version_details ||=
             LatestVersionFinder.new(
@@ -194,6 +246,7 @@ module Dependabot
             ).latest_version_details
         end
 
+        sig { params(details: T.untyped).returns(T::Boolean) }
         def ruby_version_incompatible?(details)
           # It's only the old index we have a problem with
           return false unless details[:fetcher] == "Bundler::Fetcher::Dependency"
@@ -231,16 +284,19 @@ module Dependabot
           false
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
 
+        sig { override.returns(String) }
         def bundler_version
           @bundler_version ||= Helpers.bundler_version(lockfile)
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.331.0
+  version: 0.332.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.332.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.331.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
 rdoc_options: []
 require_paths:
 - lib