dependabot-bundler 0.331.0 → 0.333.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d913e03bbafff1bf6a1e905d3f6102572f398f2231748e7f3dc431cf67dae8b
-  data.tar.gz: df7093e86cc83e024a6d6527fa6b8e1b180e1db936a7ae98f216e537a7561600
+  metadata.gz: ed2db4c89c832c17cf73a1183c1ca6645f8f8c141a357526eb997691227dade6
+  data.tar.gz: 41f43a96a647a712ba845860aaecd0bcca8a5aa316c93e578c271f5f7aabd50d
 SHA512:
-  metadata.gz: ae5d37a7e93a31327fd166a9f491bcc032a77e739b45de5e0abf306c4f0cd0c9a5c09036ebad1540c88b539ede05abb0164f185c5434144db81d003279a43320
-  data.tar.gz: fb3c5408c9a52a44df3caa36cd962bf29aa9ecca9d2ffec30d0a23ba5e58c743db813c072b5864bc273675b48c8bca28700b48e7c4adc8b410d7115aff97d0d5
+  metadata.gz: 8e1ed157de7a72eb7d78ca0cafce120e2517e1142a1f38a2fb676edd787db470da46f782f091123028c9a45c647d77f15740e4ee12fa189be9dbd1176f77aae8
+  data.tar.gz: 99d4ccb5ccb39ed52adca7aaaeb84e34356b7efa263541fbdd7a00cbca100b818d52311c3145f2abc73da100fb8e318b05c2fa9fbc5d501c5a7a0d06ff936bad

data/lib/dependabot/bundler/file_fetcher.rb

@@ -4,6 +4,7 @@
 require "sorbet-runtime"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/file_filtering"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/cached_lockfile_parser"
 require "dependabot/errors"
@@ -52,7 +53,13 @@ module Dependabot
         fetched_files += path_gemspecs
         fetched_files += find_included_files(fetched_files)
 
-        uniq_files(fetched_files)
+        # Filter excluded files from final collection
+        unique_files = uniq_files(fetched_files)
+        filtered_files = unique_files.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files
       end
 
       private
@@ -174,8 +181,12 @@ module Dependabot
         end
 
         @find_included_files ||= T.let(
-          paths.map { |path| fetch_file_from_host(path) }
-               .tap { |req_files| req_files.each { |f| f.support_file = true } },
+          paths.filter_map do |path|
+            # Skip excluded included files
+            next nil if Dependabot::FileFiltering.should_exclude_path?(path, "included file", @exclude_paths)
+
+            fetch_file_from_host(path)
+          end.tap { |req_files| req_files.each { |f| f.support_file = true } }, # rubocop:disable Style/MultilineBlockChain
           T.nilable(T::Array[DependencyFile])
         )
       end
@@ -238,6 +249,15 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
+          # Skip excluded child Gemfiles
+          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
+             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(path, @exclude_paths)
+            raise Dependabot::DependencyFileNotEvaluatable,
+                  "Cannot process requirements: '#{file.name}' references excluded file '#{path}'. " \
+                  "Please either remove the reference from '#{file.name}' " \
+                  "or update your exclude_paths configuration."
+          end
+
           fetched_file = fetch_file_from_host(path)
           grandchild_gemfiles = fetch_child_gemfiles(
             file: fetched_file,

data/lib/dependabot/bundler/file_parser.rb

@@ -20,6 +20,7 @@ module Dependabot
   module Bundler
     class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
+
       require "dependabot/file_parsers/base/dependency_set"
       require "dependabot/bundler/file_parser/file_preparer"
       require "dependabot/bundler/file_parser/gemfile_declaration_finder"
@@ -122,21 +123,17 @@ module Dependabot
           parsed_gemfile.each do |dep|
             next unless gemfile_declaration_finder.gemfile_includes_dependency?(dep)
 
-            dep =
-              Dependency.new(
-                name: dep.fetch("name"),
-                version: dependency_version(dep.fetch("name"))&.to_s,
-                requirements: [{
-                  requirement: gemfile_declaration_finder.enhanced_req_string(dep),
-                  groups: dep.fetch("groups").map(&:to_sym),
-                  source: dep.fetch("source")&.transform_keys(&:to_sym),
-                  file: file.name
-                }],
-                package_manager: "bundler"
-              )
-
-            file.dependencies << dep
-            dependencies << dep
+            dependencies << Dependency.new(
+              name: dep.fetch("name"),
+              version: dependency_version(dep.fetch("name"))&.to_s,
+              requirements: [{
+                requirement: gemfile_declaration_finder.enhanced_req_string(dep),
+                groups: dep.fetch("groups").map(&:to_sym),
+                source: dep.fetch("source")&.transform_keys(&:to_sym),
+                file: file.name
+              }],
+              package_manager: "bundler"
+            )
           end
         end
 
@@ -144,7 +141,7 @@ module Dependabot
       end
 
       sig { returns(DependencySet) }
-      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity,Metrics/AbcSize
+      def gemspec_dependencies # rubocop:disable Metrics/PerceivedComplexity
         @gemspec_dependencies = T.let(@gemspec_dependencies, T.nilable(DependencySet))
         return @gemspec_dependencies if @gemspec_dependencies
 
@@ -159,7 +156,7 @@ module Dependabot
             parsed_gemspec(gemspec).each do |dependency|
               next unless gemspec_declaration_finder.gemspec_includes_dependency?(dependency)
 
-              dep = Dependency.new(
+              queue << Dependency.new(
                 name: dependency.fetch("name"),
                 version: dependency_version(dependency.fetch("name"))&.to_s,
                 requirements: [{
@@ -174,9 +171,6 @@ module Dependabot
                 }],
                 package_manager: "bundler"
               )
-
-              gemspec.dependencies << dep
-              queue << dep
             end
           end
         end
@@ -198,23 +192,15 @@ module Dependabot
         parsed_lockfile.specs.each do |dependency|
           next if dependency.source.is_a?(::Bundler::Source::Path)
 
-          # if a dependency is listed in the lockfiles' DEPENDENCIES section,
-          # then it is a direct dependency & we want to keep track of that fact
-          is_direct = parsed_lockfile.dependencies.key?(dependency.name)
-
-          dep = Dependency.new(
+          dependencies << Dependency.new(
             name: dependency.name,
             version: dependency_version(dependency.name)&.to_s,
             requirements: [],
             package_manager: "bundler",
             subdependency_metadata: [{
               production: production_dep_names.include?(dependency.name)
-            }],
-            direct_relationship: is_direct
+            }]
           )
-
-          T.must(lockfile).dependencies << dep
-          dependencies << dep
         end
 
         dependencies
@@ -357,10 +343,6 @@ module Dependabot
           get_original_file("Gemfile.lock") || get_original_file("gems.locked"),
           T.nilable(Dependabot::DependencyFile)
         )
-
-        # Set the lockfile as higher priority so we know to ignore the Gemfile, etc
-        # when producing a graph.
-        @lockfile&.tap { |f| f.priority = 1 }
       end
 
       sig { returns(T.untyped) }

data/lib/dependabot/bundler/metadata_finder.rb

@@ -204,7 +204,7 @@ module Dependabot
           cred["type"] == "rubygems_server" && cred.replaces_base?
         end
         host = credential ? credential["host"] : "rubygems.org"
-        @base_url = "https://#{host}#{host&.end_with?('/') ? '' : '/'}"
+        @base_url = "https://#{host}#{'/' unless host&.end_with?('/')}"
       end
 
       def registry_auth_headers

data/lib/dependabot/bundler/package/package_details_fetcher.rb

@@ -43,17 +43,25 @@ module Dependabot
           @credentials = credentials
 
           @source_type = T.let(nil, T.nilable(String))
+          @options = T.let({}, T::Hash[Symbol, T.untyped])
+          @repo_contents_path = T.let(nil, T.nilable(String))
         end
 
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { override.returns(T::Array[T.untyped]) }
         attr_reader :dependency_files
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { override.returns(T::Array[T.untyped]) }
         attr_reader :credentials
 
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
         sig { returns(Dependabot::Package::PackageDetails) }
         def fetch
           case source_type

data/lib/dependabot/bundler/update_checker/conflicting_dependency_resolver.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/update_checker"
@@ -10,11 +10,33 @@ module Dependabot
   module Bundler
     class UpdateChecker < UpdateCheckers::Base
       class ConflictingDependencyResolver
+        extend T::Sig
+
         require_relative "shared_bundler_helpers"
+
         include SharedBundlerHelpers
 
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
         attr_reader :options
 
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: T.nilable(String),
+            credentials: T::Array[Dependabot::Credential],
+            options: T::Hash[Symbol, T.untyped]
+          )
+            .void
+        end
         def initialize(dependency_files:, repo_contents_path:, credentials:, options:)
           @dependency_files = dependency_files
           @repo_contents_path = repo_contents_path
@@ -31,6 +53,13 @@ module Dependabot
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            target_version: String
+          )
+            .returns(T::Array[T::Hash[String, String]])
+        end
         def conflicting_dependencies(dependency:, target_version:)
           return [] if lockfile.nil?
 
@@ -44,7 +73,7 @@ module Dependabot
                 dependency_name: dependency.name,
                 target_version: target_version,
                 credentials: credentials,
-                lockfile_name: lockfile.name
+                lockfile_name: T.must(lockfile).name
               }
             )
           end
@@ -52,8 +81,12 @@ module Dependabot
 
         private
 
+        sig { override.returns(String) }
         def bundler_version
-          @bundler_version ||= Helpers.bundler_version(lockfile)
+          @bundler_version ||= T.let(
+            Helpers.bundler_version(lockfile),
+            T.nilable(String)
+          )
         end
       end
     end

data/lib/dependabot/bundler/update_checker/force_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/bundler/file_parser"
 require "dependabot/bundler/file_updater/lockfile_updater"
 require "dependabot/bundler/native_helpers"
@@ -14,14 +15,28 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class ForceUpdater
+        extend T::Sig
+
         require_relative "shared_bundler_helpers"
+
         include SharedBundlerHelpers
 
-        def initialize(dependency:, dependency_files:, repo_contents_path: nil,
-                       credentials:, target_version:,
-                       requirements_update_strategy:,
-                       update_multiple_dependencies: true,
-                       options:)
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            target_version: Dependabot::Version,
+            requirements_update_strategy: Dependabot::RequirementsUpdateStrategy,
+            options: T::Hash[Symbol, T.untyped],
+            repo_contents_path: T.nilable(String),
+            update_multiple_dependencies: T::Boolean
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, target_version:,
+                       requirements_update_strategy:, options:,
+                       repo_contents_path: nil,
+                       update_multiple_dependencies: true)
           @dependency                   = dependency
           @dependency_files             = dependency_files
           @repo_contents_path           = repo_contents_path
@@ -30,28 +45,50 @@ module Dependabot
           @requirements_update_strategy = requirements_update_strategy
           @update_multiple_dependencies = update_multiple_dependencies
           @options                      = options
+
+          @updated_dependencies         = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+          @original_dependencies        = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+          @bundler_version              = T.let(nil, T.nilable(String))
         end
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def updated_dependencies
           @updated_dependencies ||= force_update
         end
 
-        private
-
-        attr_reader :dependency
+        # Abstract method implementations
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { override.returns(T.nilable(String)) }
         attr_reader :repo_contents_path
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        private
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(Dependabot::Version) }
         attr_reader :target_version
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :requirements_update_strategy
-        attr_reader :options
 
+        sig { returns(T::Boolean) }
         def update_multiple_dependencies?
           @update_multiple_dependencies
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def force_update
-          requirement = dependency.requirements.find { |req| req[:file] == gemfile.name }
+          requirement = dependency.requirements.find { |req| req[:file] == T.must(gemfile).name }
 
           valid_gem_version?(target_version)
 
@@ -71,8 +108,8 @@ module Dependabot
                 dependency_name: dependency.name,
                 target_version: target_version,
                 credentials: credentials,
-                gemfile_name: gemfile.name,
-                lockfile_name: lockfile.name,
+                gemfile_name: T.must(gemfile).name,
+                lockfile_name: T.must(lockfile).name,
                 update_multiple_dependencies: update_multiple_dependencies?
               }
             )
@@ -82,7 +119,9 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           end
         end
+        # rubocop:enable Metrics/AbcSize
 
+        sig { params(target_version: T.nilable(Dependabot::Version)).returns(TrueClass) }
         def valid_gem_version?(target_version)
           # to rule out empty, non gem info ending up in as target_version
           return true if target_version.is_a?(Gem::Version)
@@ -92,6 +131,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable
         end
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         def original_dependencies
           @original_dependencies ||=
             FileParser.new(
@@ -101,6 +141,13 @@ module Dependabot
             ).parse
         end
 
+        sig do
+          params(
+            updated_deps: T::Array[T::Hash[String, T.untyped]],
+            specs: T::Array[T::Hash[String, T.untyped]]
+          )
+            .returns(T::Array[Dependabot::Dependency])
+        end
         def dependencies_from(updated_deps, specs)
           # You might think we'd want to remove dependencies whose version
           # hadn't changed from this array. We don't. We still need to unlock
@@ -114,12 +161,13 @@ module Dependabot
               original_dependencies.find { |d| d.name == dep.fetch("name") }
             spec = specs.find { |d| d.fetch("name") == dep.fetch("name") }
 
-            next if spec.fetch("version") == original_dep.version
+            next if T.must(spec).fetch("version") == T.must(original_dep).version
 
             build_dependency(original_dep, spec)
           end
         end
 
+        sig { params(original_dep: T.untyped, updated_spec: T.untyped).returns(Dependabot::Dependency) }
         def build_dependency(original_dep, updated_spec)
           Dependency.new(
             name: updated_spec.fetch("name"),
@@ -138,27 +186,32 @@ module Dependabot
           )
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Hash[String, T.untyped])) }
         def source_for(dependency)
           dependency.requirements
                     .find { |r| r.fetch(:source) }
                     &.fetch(:source)
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
 
+        sig { returns(String) }
         def sanitized_lockfile_body
           re = FileUpdater::LockfileUpdater::LOCKFILE_ENDING
-          lockfile.content.gsub(re, "")
+          T.must(T.must(lockfile).content).gsub(re, "")
         end
 
+        sig { void }
         def write_temporary_dependency_files
           dependency_files.each do |file|
             path = file.name
@@ -166,9 +219,10 @@ module Dependabot
             File.write(path, file.content)
           end
 
-          File.write(lockfile.name, sanitized_lockfile_body) if lockfile
+          File.write(T.must(lockfile).name, sanitized_lockfile_body) if lockfile
         end
 
+        sig { override.returns(String) }
         def bundler_version
           @bundler_version ||= Helpers.bundler_version(lockfile)
         end

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -122,12 +122,8 @@ module Dependabot
           @wants_prerelease ||= T.let(
             begin
               current_version = dependency.numeric_version
-              if current_version&.prerelease?
-                true
-              else
-                dependency.requirements.any? do |req|
-                  req[:requirement].match?(/[a-z]/i)
-                end
+              current_version&.prerelease? || dependency.requirements.any? do |req|
+                req[:requirement].match?(/[a-z]/i)
               end
             end, T.nilable(T::Boolean)
           )

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -23,8 +23,17 @@ module Dependabot
 
         abstract!
 
-        sig { returns(T::Hash[Symbol, T.untyped]) }
-        attr_reader :options
+        sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+        def options; end
+
+        sig { abstract.returns(T::Array[Dependabot::DependencyFile]) }
+        def dependency_files; end
+
+        sig { abstract.returns(T.nilable(String)) }
+        def repo_contents_path; end
+
+        sig { abstract.returns(T::Array[Dependabot::Credential]) }
+        def credentials; end
 
         GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/
         GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./
@@ -51,21 +60,24 @@ module Dependabot
           Bundler::Fetcher::FallbackError
         ).freeze
 
-        attr_reader :dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
-
         #########################
         # Bundler context setup #
         #########################
 
-        def in_a_native_bundler_context(error_handling: true)
+        sig do
+          params(
+            error_handling: T::Boolean,
+            _blk: T.proc.params(arg0: String).returns(T.untyped)
+          )
+            .returns(T.untyped)
+        end
+        def in_a_native_bundler_context(error_handling: true, &_blk)
           SharedHelpers
             .in_a_temporary_repo_directory(base_directory,
                                            repo_contents_path) do |tmp_dir|
             write_temporary_dependency_files
 
-            yield(tmp_dir)
+            yield(tmp_dir.to_s)
           end
         rescue SharedHelpers::HelperSubprocessFailed => e
           retry_count ||= 0
@@ -75,10 +87,12 @@ module Dependabot
           error_handling ? handle_bundler_errors(e) : raise
         end
 
+        sig { returns(String) }
         def base_directory
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def retryable_error?(error)
           return true if error.error_class == "JSON::ParserError"
           return true if RETRYABLE_ERRORS.include?(error.error_class)
@@ -92,6 +106,7 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/MethodLength
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).void }
         def handle_bundler_errors(error)
           if error.error_class == "JSON::ParserError"
             msg = "Error evaluating your dependency files: #{error.message}"
@@ -105,25 +120,22 @@ module Dependabot
             # We couldn't evaluate the Gemfile, let alone resolve it
             raise Dependabot::DependencyFileNotEvaluatable, msg
           when "Bundler::Source::Git::MissingGitRevisionError"
-            gem_name =
-              error.message.match(GIT_REF_REGEX)
-                   .named_captures["path"]
-                   .split("/").last
-            raise GitDependencyReferenceNotFound, gem_name
+            match_data = error.message.match(GIT_REF_REGEX)
+            gem_name = T.must(T.must(match_data).named_captures["path"])
+                        .split("/").last
+            raise GitDependencyReferenceNotFound, T.must(gem_name)
           when "Bundler::PathError"
-            gem_name =
-              error.message.match(PATH_REGEX)
-                   .named_captures["path"]
-                   .split("/").last.split("-")[0..-2].join
+            match_data = error.message.match(PATH_REGEX)
+            path = T.must(T.must(match_data).named_captures["path"])
+            gem_name = T.must(T.must(path.split("/").last).split("-")[0..-2]).join
             raise Dependabot::PathDependenciesNotReachable, [gem_name]
           when "Bundler::Source::Git::GitCommandError"
             if error.message.match?(GIT_REGEX)
               # We couldn't find the specified branch / commit (or the two
               # weren't compatible).
-              gem_name =
-                error.message.match(GIT_REGEX)
-                     .named_captures["path"]
-                     .split("/").last.split("-")[0..-2].join
+              match_data = error.message.match(GIT_REGEX)
+              path = T.must(T.must(match_data).named_captures["path"])
+              gem_name = T.must(T.must(path.split("/").last).split("-")[0..-2]).join
               raise GitDependencyReferenceNotFound, gem_name
             end
 
@@ -144,24 +156,24 @@ module Dependabot
             raise Dependabot::DependencyFileNotResolvable, msg
           when "Bundler::Fetcher::AuthenticationRequiredError"
             regex = BundlerErrorPatterns::MISSING_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::AuthenticationForbiddenError"
             regex = BundlerErrorPatterns::FORBIDDEN_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::BadAuthenticationError"
             regex = BundlerErrorPatterns::BAD_AUTH_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           when "Bundler::Fetcher::CertificateFailureError"
             regex = BundlerErrorPatterns::BAD_CERT_REGEX
-            source = error.message.match(regex)[:source]
+            source = T.must(T.must(error.message.match(regex))[:source])
             raise Dependabot::PrivateSourceCertificateFailure, source
           when "Bundler::HTTPError"
             regex = BundlerErrorPatterns::HTTP_ERR_REGEX
             if error.message.match?(regex)
-              source = error.message.match(regex)[:source]
+              source = T.must(T.must(error.message.match(regex))[:source])
               raise if [
                 "rubygems.org",
                 "www.rubygems.org"
@@ -184,6 +196,7 @@ module Dependabot
         # rubocop:enable Metrics/AbcSize
         # rubocop:enable Metrics/MethodLength
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def inaccessible_git_dependencies
           in_a_native_bundler_context(error_handling: false) do |tmp_dir|
             git_specs = NativeHelpers.run_bundler_subprocess(
@@ -192,7 +205,7 @@ module Dependabot
               options: options,
               args: {
                 dir: tmp_dir,
-                gemfile_name: gemfile.name,
+                gemfile_name: T.must(gemfile).name,
                 credentials: credentials
               }
             )
@@ -210,8 +223,10 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def jfrog_source
-          return @jfrog_source unless defined?(@jfrog_source)
+          @jfrog_source = T.let(@jfrog_source, T.nilable(String)) if @jfrog_source.nil?
+          return @jfrog_source unless @jfrog_source.nil?
 
           @jfrog_source = in_a_native_bundler_context(error_handling: false) do |dir|
             NativeHelpers.run_bundler_subprocess(
@@ -220,16 +235,14 @@ module Dependabot
               options: options,
               args: {
                 dir: dir,
-                gemfile_name: gemfile.name,
+                gemfile_name: T.must(gemfile).name,
                 credentials: credentials
               }
             )
           end
         end
 
-        sig { abstract.returns(String) }
-        def bundler_version; end
-
+        sig { void }
         def write_temporary_dependency_files
           dependency_files.each do |file|
             path = file.name
@@ -237,23 +250,32 @@ module Dependabot
             File.write(path, file.content)
           end
 
-          File.write(lockfile.name, lockfile.content) if lockfile
+          lockfile_obj = lockfile
+          File.write(lockfile_obj.name, lockfile_obj.content) if lockfile_obj
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def private_registry_credentials
           credentials
             .select { |cred| cred["type"] == "rubygems_server" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
+
+        private
+
+        sig { abstract.returns(String) }
+        def bundler_version; end
       end
     end
   end

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
 
 require "dependabot/bundler/helpers"
 require "dependabot/bundler/update_checker"
@@ -15,19 +16,36 @@ module Dependabot
   module Bundler
     class UpdateChecker
       class VersionResolver
+        extend T::Sig
+
         require_relative "file_preparer"
         require_relative "latest_version_finder"
         require_relative "shared_bundler_helpers"
         include SharedBundlerHelpers
 
-        def initialize(dependency:, unprepared_dependency_files:,
-                       repo_contents_path: nil, credentials:, ignored_versions:,
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            unprepared_dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            options: T::Hash[Symbol, T.untyped],
+            repo_contents_path: T.nilable(String),
+            raise_on_ignored: T::Boolean,
+            replacement_git_pin: T.nilable(String),
+            remove_git_source: T::Boolean,
+            unlock_requirement: T::Boolean,
+            latest_allowable_version: T.nilable(T.any(String, Dependabot::Version)),
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(dependency:, unprepared_dependency_files:, credentials:, ignored_versions:, options:,
+                       repo_contents_path: nil,
                        raise_on_ignored: false,
                        replacement_git_pin: nil, remove_git_source: false,
                        unlock_requirement: true,
                        latest_allowable_version: nil,
-                       cooldown_options: nil,
-                       options:)
+                       cooldown_options: nil)
           @dependency                  = dependency
           @unprepared_dependency_files = unprepared_dependency_files
           @credentials                 = credentials
@@ -41,50 +59,77 @@ module Dependabot
           @cooldown_options            = cooldown_options
           @options                     = options
 
-          @latest_allowable_version_incompatible_with_ruby = false
+          @latest_allowable_version_incompatible_with_ruby = T.let(false, T::Boolean)
+          @latest_resolvable_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @gemspec_ruby_unlocked = T.let(false, T::Boolean)
+          @bundler_version = T.let(nil, T.nilable(String))
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_resolvable_version_details
           @latest_resolvable_version_details ||=
             fetch_latest_resolvable_version_details
         end
 
+        sig { returns(T::Boolean) }
         def latest_allowable_version_incompatible_with_ruby?
           @latest_allowable_version_incompatible_with_ruby
         end
 
+        # Abstract method implementations
+        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        attr_reader :options
+
+        sig { override.returns(T::Array[Dependabot::DependencyFile]) }
+        def dependency_files
+          @dependency_files ||=
+            FilePreparer.new(
+              dependency: dependency,
+              dependency_files: unprepared_dependency_files,
+              replacement_git_pin: replacement_git_pin,
+              remove_git_source: remove_git_source?,
+              unlock_requirement: unlock_requirement?,
+              latest_allowable_version: latest_allowable_version
+            ).prepared_dependency_files
+        end
+
+        sig { override.returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig { override.returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :unprepared_dependency_files
-        attr_reader :repo_contents_path
-        attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T.nilable(String)) }
         attr_reader :replacement_git_pin
+
+        sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
         attr_reader :latest_allowable_version
-        attr_reader :options
 
+        sig { returns(T::Boolean) }
         def remove_git_source?
           @remove_git_source
         end
 
+        sig { returns(T::Boolean) }
         def unlock_requirement?
           @unlock_requirement
         end
 
-        def dependency_files
-          @dependency_files ||=
-            FilePreparer.new(
-              dependency: dependency,
-              dependency_files: unprepared_dependency_files,
-              replacement_git_pin: replacement_git_pin,
-              remove_git_source: remove_git_source?,
-              unlock_requirement: unlock_requirement?,
-              latest_allowable_version: latest_allowable_version
-            ).prepared_dependency_files
-        end
-
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def fetch_latest_resolvable_version_details
           return latest_version_details unless gemfile
 
@@ -100,7 +145,7 @@ module Dependabot
                 args: {
                   dependency_name: dependency.name,
                   dependency_requirements: dependency.requirements,
-                  gemfile_name: gemfile.name,
+                  gemfile_name: T.must(gemfile).name,
                   lockfile_name: lockfile&.name,
                   dir: tmp_dir,
                   credentials: credentials
@@ -136,12 +181,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def circular_dependency_at_new_version?(error)
           return false unless error.error_class.include?("CyclicDependencyError")
 
           error.message.include?("'#{dependency.name}'")
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def error_due_to_restrictive_upper_bound?(error)
           # We see this when the dependency doesn't appear in the lockfile and
           # has an overly restrictive upper bound that we've added, either due
@@ -152,6 +199,7 @@ module Dependabot
           error.message.include?("#{dependency.name} ")
         end
 
+        sig { params(error: T.untyped).returns(T::Boolean) }
         def ruby_lock_error?(error)
           return false unless conflict_on_ruby?(error)
           return false if @gemspec_ruby_unlocked
@@ -159,6 +207,7 @@ module Dependabot
           dependency_files.any? { |f| f.name.end_with?(".gemspec") }
         end
 
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def conflict_on_ruby?(error)
           if bundler_version == "1"
             error.message.include?(" for gem \"ruby\0\"")
@@ -167,6 +216,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def regenerate_dependency_files_without_ruby_lock
           @dependency_files =
             FilePreparer.new(
@@ -178,8 +228,10 @@ module Dependabot
               latest_allowable_version: latest_allowable_version,
               lock_ruby_version: false
             ).prepared_dependency_files
+          true
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_details
           @latest_version_details ||=
             LatestVersionFinder.new(
@@ -194,6 +246,7 @@ module Dependabot
             ).latest_version_details
         end
 
+        sig { params(details: T.untyped).returns(T::Boolean) }
         def ruby_version_incompatible?(details)
           # It's only the old index we have a problem with
           return false unless details[:fetcher] == "Bundler::Fetcher::Dependency"
@@ -231,16 +284,19 @@ module Dependabot
           false
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def gemfile
           dependency_files.find { |f| f.name == "Gemfile" } ||
             dependency_files.find { |f| f.name == "gems.rb" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           dependency_files.find { |f| f.name == "Gemfile.lock" } ||
             dependency_files.find { |f| f.name == "gems.locked" }
         end
 
+        sig { override.returns(String) }
         def bundler_version
           @bundler_version ||= Helpers.bundler_version(lockfile)
         end

data/lib/dependabot/bundler/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater/requirement_replacer"
@@ -17,40 +17,53 @@ module Dependabot
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/conflicting_dependency_resolver"
+      extend T::Sig
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Bundler::Version))) }
       def latest_version
         return latest_version_for_git_dependency if git_dependency?
 
         latest_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Bundler::Version))) }
       def latest_resolvable_version
         return latest_resolvable_version_for_git_dependency if git_dependency?
 
         latest_resolvable_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Bundler::Version)) }
       def lowest_security_fix_version
-        latest_version_finder(remove_git_source: false)
-          .lowest_security_fix_version
+        T.cast(
+          latest_version_finder(remove_git_source: false).lowest_security_fix_version,
+          T.nilable(Dependabot::Bundler::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Dependabot::Bundler::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
-        return latest_resolvable_version if git_dependency?
+        return T.cast(latest_resolvable_version, T.nilable(Dependabot::Bundler::Version)) if git_dependency?
 
         lowest_fix =
           latest_version_finder(remove_git_source: false)
           .lowest_security_fix_version
-        return unless lowest_fix && resolvable?(lowest_fix)
+        return unless lowest_fix && resolvable?(T.cast(lowest_fix, Dependabot::Bundler::Version))
 
-        lowest_fix
+        T.cast(lowest_fix, Dependabot::Bundler::Version)
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Bundler::Version))) }
       def latest_resolvable_version_with_no_unlock
         current_ver = dependency.version
         return current_ver if git_dependency? && git_commit_checker.pinned?
 
+        @latest_resolvable_version_detail_with_no_unlock = T.let(
+          @latest_resolvable_version_detail_with_no_unlock,
+          T.nilable(T::Hash[Symbol, T.untyped])
+        )
+
         @latest_resolvable_version_detail_with_no_unlock ||=
           version_resolver(remove_git_source: false, unlock_requirement: false)
           .latest_resolvable_version_details
@@ -62,6 +75,7 @@ module Dependabot
         end
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         latest_version_for_req_updater = latest_version_details&.fetch(:version)&.to_s
         latest_resolvable_version_for_req_updater = preferred_resolvable_version_details&.fetch(:version)&.to_s
@@ -75,9 +89,10 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         return true if requirements_unlocked?
-        return false if requirements_update_strategy.lockfile_only?
+        return false if T.must(requirements_update_strategy).lockfile_only?
 
         dependency.specific_requirements
                   .all? do |req|
@@ -92,6 +107,7 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(Dependabot::RequirementsUpdateStrategy)) }
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
@@ -104,6 +120,7 @@ module Dependabot
         end
       end
 
+      sig { override.returns(T::Array[T::Hash[String, String]]) }
       def conflicting_dependencies
         ConflictingDependencyResolver.new(
           dependency_files: dependency_files,
@@ -112,16 +129,18 @@ module Dependabot
           options: options
         ).conflicting_dependencies(
           dependency: dependency,
-          target_version: lowest_security_fix_version
+          target_version: lowest_security_fix_version.to_s # Convert Version to String
         )
       end
 
       private
 
+      sig { returns(T::Boolean) }
       def requirements_unlocked?
         dependency.specific_requirements.none?
       end
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         return false unless latest_version
         return false if version_resolver(remove_git_source: false).latest_allowable_version_incompatible_with_ruby?
@@ -139,22 +158,26 @@ module Dependabot
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         force_updater.updated_dependencies
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def preferred_resolvable_version_details
         return { version: lowest_resolvable_security_fix_version } if vulnerable?
 
         latest_resolvable_version_details
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      sig { params(version: Dependabot::Bundler::Version).returns(T.untyped) }
       def resolvable?(version)
-        @resolvable ||= {}
+        @resolvable ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         return @resolvable[version] if @resolvable.key?(version)
 
         @resolvable[version] =
@@ -165,7 +188,7 @@ module Dependabot
               repo_contents_path: repo_contents_path,
               credentials: credentials,
               target_version: version,
-              requirements_update_strategy: requirements_update_strategy,
+              requirements_update_strategy: T.must(requirements_update_strategy),
               update_multiple_dependencies: false,
               options: options
             ).updated_dependencies
@@ -175,8 +198,9 @@ module Dependabot
           end
       end
 
+      sig { params(tag: T.nilable(String)).returns(T.untyped) }
       def git_tag_resolvable?(tag)
-        @git_tag_resolvable ||= {}
+        @git_tag_resolvable ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         return @git_tag_resolvable[tag] if @git_tag_resolvable.key?(tag)
 
         @git_tag_resolvable[tag] =
@@ -198,20 +222,23 @@ module Dependabot
           end
       end
 
+      sig { params(remove_git_source: T::Boolean).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_version_details(remove_git_source: false)
-        @latest_version_details ||= {}
+        @latest_version_details ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @latest_version_details[remove_git_source] ||=
           latest_version_finder(remove_git_source: remove_git_source)
           .latest_version_details
       end
 
+      sig { params(remove_git_source: T::Boolean).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_resolvable_version_details(remove_git_source: false)
-        @latest_resolvable_version_details ||= {}
+        @latest_resolvable_version_details ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @latest_resolvable_version_details[remove_git_source] ||=
           version_resolver(remove_git_source: remove_git_source)
           .latest_resolvable_version_details
       end
 
+      sig { returns(T.nilable(T.any(String, Dependabot::Bundler::Version))) }
       def latest_version_for_git_dependency
         latest_release =
           latest_version_details(remove_git_source: true)
@@ -238,6 +265,7 @@ module Dependabot
         dependency.version
       end
 
+      sig { returns(T.any(String, T.nilable(Dependabot::Bundler::Version))) }
       def latest_resolvable_version_for_git_dependency
         latest_release = latest_resolvable_version_without_git_source
 
@@ -255,7 +283,7 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return new_tag.fetch(:tag_sha)
+          return new_tag&.fetch(:tag_sha)
         end
 
         # If the dependency is pinned to a tag that doesn't look like a
@@ -263,6 +291,7 @@ module Dependabot
         dependency.version
       end
 
+      sig { returns(T.any(String, T.nilable(Dependabot::Bundler::Version))) }
       def latest_resolvable_version_without_git_source
         return nil unless latest_version.is_a?(Gem::Version)
 
@@ -272,6 +301,7 @@ module Dependabot
         nil
       end
 
+      sig { returns(T.any(String, T.nilable(Dependabot::Bundler::Version))) }
       def latest_resolvable_commit_with_unchanged_git_source
         details = latest_resolvable_version_details(remove_git_source: false)
 
@@ -285,6 +315,7 @@ module Dependabot
         nil
       end
 
+      sig { returns(T::Boolean) }
       def latest_git_tag_is_resolvable?
         latest_tag_details = git_commit_checker.local_tag_for_latest_version
         return false unless latest_tag_details
@@ -292,12 +323,14 @@ module Dependabot
         git_tag_resolvable?(latest_tag_details.fetch(:tag))
       end
 
+      sig { params(release: T.untyped).returns(T::Boolean) }
       def git_branch_or_ref_in_release?(release)
         return false unless release
 
         git_commit_checker.branch_or_ref_in_release?(release)
       end
 
+      sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -306,31 +339,42 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return dependency_source_details.merge(ref: new_tag.fetch(:tag))
+          return T.must(dependency_source_details).merge(ref: T.must(new_tag).fetch(:tag))
         end
 
         # Otherwise return the original source
         dependency_source_details
       end
 
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
       def dependency_source_details
         dependency.source_details
       end
 
+      sig { returns(Dependabot::Bundler::UpdateChecker::ForceUpdater) }
       def force_updater
+        if @force_updater.nil?
+          @force_updater = T.let(@force_updater,
+                                 T.nilable(Dependabot::Bundler::UpdateChecker::ForceUpdater))
+        end
         @force_updater ||=
           ForceUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials,
-            target_version: latest_version,
-            requirements_update_strategy: requirements_update_strategy,
+            target_version: T.cast(latest_version, Dependabot::Version),
+            requirements_update_strategy: T.must(requirements_update_strategy),
             options: options
           )
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
+        if @git_commit_checker.nil?
+          @git_commit_checker = T.let(@git_commit_checker,
+                                      T.nilable(Dependabot::GitCommitChecker))
+        end
         @git_commit_checker ||=
           GitCommitChecker.new(
             dependency: dependency,
@@ -338,8 +382,9 @@ module Dependabot
           )
       end
 
+      sig { params(remove_git_source: T::Boolean, unlock_requirement: T::Boolean).returns(T.untyped) }
       def version_resolver(remove_git_source:, unlock_requirement: true)
-        @version_resolver ||= {}
+        @version_resolver ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @version_resolver[remove_git_source] ||= {}
         @version_resolver[remove_git_source][unlock_requirement] ||=
           VersionResolver.new(
@@ -357,8 +402,9 @@ module Dependabot
           )
       end
 
+      sig { params(remove_git_source: T::Boolean).returns(Dependabot::Bundler::UpdateChecker::LatestVersionFinder) }
       def latest_version_finder(remove_git_source:)
-        @latest_version_finder ||= {}
+        @latest_version_finder ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @latest_version_finder[remove_git_source] ||=
           begin
             prepared_dependency_files = prepared_dependency_files(
@@ -379,6 +425,13 @@ module Dependabot
           end
       end
 
+      sig do
+        params(
+          remove_git_source: T::Boolean,
+          unlock_requirement: T::Boolean,
+          latest_allowable_version: T.nilable(T.any(String, Dependabot::Bundler::Version))
+        ).returns(T::Array[Dependabot::DependencyFile])
+      end
       def prepared_dependency_files(remove_git_source:, unlock_requirement:,
                                     latest_allowable_version: nil)
         FilePreparer.new(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.331.0
+  version: 0.333.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.333.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.331.0
+        version: 0.333.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -225,14 +225,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -322,7 +322,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.331.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.333.0
 rdoc_options: []
 require_paths:
 - lib