dependabot-bundler 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43d670382313df98efe56ca75538daf1ef494b65bdb4dfa87e79bcb2f5ae3fdc
-  data.tar.gz: 46faf363b2a8e37874cc5516425abf14bf31a50c12573fac6c837d78aba6a182
+  metadata.gz: 956510bd31180ba35712d9450f6d0588b573479b136329ee45a34399374f7bdd
+  data.tar.gz: fb4afe0f709028f4e5856cadb69179046498382038bd361d93cd9a401e4b2bbf
 SHA512:
-  metadata.gz: 24a9688ad6a277c68a763f39a298e13b9c2a8a64fea6ecc57d2414ea55555d9cfb49ec5feeddc1ad99a99ce475625ef18a4f35ee83a1bb2e26666fecb166ae58
-  data.tar.gz: 9b8e28ec1cc08b2d841112f29d75e3d7545be0563dd69dd1f0a67cf693cf66759e175245cf88b658229ca90878aaaa53cc13ea40c5e400ae23a2738efdde0150
+  metadata.gz: d5d4dcc4184dbe5da513afbe5cd9656d413c9fd0d47861997122357fe30c01b722871684957fa8a0fa05a10f7807a27cd1a4532549b8cf8986e489a9d0af119c
+  data.tar.gz: 651fc49c1125f02e0cd5283cb7f58144c47d4ba95c52b427f57aa321fd39bd5f81d2e6d84e67a5ac025ee16436d06ecf56009fb7303bde33a963d03cbe96808c

data/lib/dependabot/bundler/update_checker/latest_version_finder.rb

@@ -43,7 +43,7 @@ module Dependabot
           options: {}
         )
           @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
-          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @latest_version_details = T.let(nil, T.nilable(VersionDetails))
           @releases_from_dependency_source = T.let(nil, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
           super
         end
@@ -57,11 +57,15 @@ module Dependabot
           ).fetch
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(VersionDetails)) }
         def latest_version_details
           @latest_version_details ||= begin
             latest_version = fetch_latest_version(language_version: nil)
-            latest_version ? { version: latest_version } : nil
+            if latest_version
+              raise TypeError, "expected a Bundler version" unless latest_version.is_a?(Dependabot::Bundler::Version)
+
+              VersionDetails.new(version: latest_version)
+            end
           end
         end
 

data/lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb

@@ -74,11 +74,12 @@ module Dependabot
         #########################
 
         sig do
-          params(
-            error_handling: T::Boolean,
-            _blk: T.proc.params(arg0: String).returns(T.untyped)
-          )
-            .returns(T.untyped)
+          type_parameters(:T)
+            .params(
+              error_handling: T::Boolean,
+              _blk: T.proc.params(arg0: String).returns(T.type_parameter(:T))
+            )
+            .returns(T.type_parameter(:T))
         end
         def in_a_native_bundler_context(error_handling: true, &_blk)
           SharedHelpers
@@ -115,7 +116,7 @@ module Dependabot
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/MethodLength
-        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).void }
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T.noreturn) }
         def handle_bundler_errors(error)
           if error.error_class == "JSON::ParserError"
             msg = "Error evaluating your dependency files: #{error.message}"

data/lib/dependabot/bundler/update_checker/version_details.rb

@@ -0,0 +1,81 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/shared_helpers"
+require "dependabot/bundler/version"
+require "dependabot/bundler/update_checker"
+
+module Dependabot
+  module Bundler
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      class VersionDetails < T::ImmutableStruct
+        extend T::Sig
+
+        class InvalidResult < SharedHelpers::HelperSubprocessFailed; end
+
+        ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+        const :version, Dependabot::Bundler::Version
+        const :ruby_version, T.nilable(String), default: nil
+        const :fetcher, T.nilable(String), default: nil
+        const :commit_sha, T.nilable(String), default: nil
+
+        sig { params(result: Object).returns(VersionDetails) }
+        def self.from_helper_result(result)
+          fields = object_fields(result)
+          new(
+            version: parse_version(fields["version"]),
+            ruby_version: optional_string(fields["ruby_version"], "ruby_version"),
+            fetcher: optional_string(fields["fetcher"], "fetcher"),
+            commit_sha: optional_string(fields["commit_sha"], "commit_sha")
+          )
+        end
+
+        sig { params(value: Object).returns(ObjectHash) }
+        def self.object_fields(value)
+          invalid_result(" must be an object") unless value.is_a?(Hash)
+
+          value.to_h do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            invalid_result(" keys must be strings") unless key.is_a?(String)
+
+            [key, T.cast(raw_value, Object)]
+          end
+        end
+        private_class_method :object_fields
+
+        sig { params(value: Object).returns(Dependabot::Bundler::Version) }
+        def self.parse_version(value)
+          invalid_result(".version must be a string") unless value.is_a?(String)
+
+          # Version.new's inherited signature returns the base class.
+          T.cast(Dependabot::Bundler::Version.new(value), Dependabot::Bundler::Version)
+        rescue ArgumentError
+          invalid_result(".version must be a valid version")
+        end
+        private_class_method :parse_version
+
+        sig { params(value: Object, field: String).returns(T.nilable(String)) }
+        def self.optional_string(value, field)
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          invalid_result(".#{field} must be a string or nil")
+        end
+        private_class_method :optional_string
+
+        sig { params(message: String).returns(T.noreturn) }
+        def self.invalid_result(message)
+          raise InvalidResult.new(
+            message: "resolve_version result#{message}",
+            error_class: "TypeError",
+            error_context: { function: "resolve_version" }
+          ),
+                cause: nil
+        end
+        private_class_method :invalid_result
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/update_checker/version_resolver.rb

@@ -67,14 +67,14 @@ module Dependabot
           @options                     = options
 
           @latest_allowable_version_incompatible_with_ruby = T.let(false, T::Boolean)
-          @latest_resolvable_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @latest_resolvable_version_details = T.let(nil, T.nilable(VersionDetails))
           @dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
-          @latest_version_details = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @latest_version_details = T.let(nil, T.nilable(VersionDetails))
           @gemspec_ruby_unlocked = T.let(false, T::Boolean)
           @bundler_version = T.let(nil, T.nilable(String))
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(VersionDetails)) }
         def latest_resolvable_version_details
           @latest_resolvable_version_details ||=
             fetch_latest_resolvable_version_details
@@ -136,7 +136,7 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(VersionDetails)) }
         def fetch_latest_resolvable_version_details
           return latest_version_details unless gemfile
 
@@ -145,7 +145,7 @@ module Dependabot
             # some errors we want to handle specifically ourselves, including
             # potentially retrying in the case of the Ruby version being locked
             in_a_native_bundler_context(error_handling: false) do |tmp_dir|
-              details = NativeHelpers.run_bundler_subprocess(
+              result = NativeHelpers.run_bundler_subprocess(
                 bundler_version: bundler_version,
                 function: "resolve_version",
                 options: options,
@@ -159,23 +159,24 @@ module Dependabot
                 }
               )
 
-              return latest_version_details if details == "latest"
+              result = T.cast(result, Object)
+              return latest_version_details if result == "latest"
+              return if result.nil?
 
-              if details
-                details.transform_keys!(&:to_sym)
+              details = VersionDetails.from_helper_result(result)
 
-                # If the old Gemfile index was used then it won't have checked
-                # Ruby compatibility. Fix that by doing the check manually and
-                # saying no update is possible if the Ruby version is a
-                # mismatch
-                return nil if ruby_version_incompatible?(details)
+              # If the old Gemfile index was used then it won't have checked
+              # Ruby compatibility. Fix that by doing the check manually and
+              # saying no update is possible if the Ruby version is a
+              # mismatch
+              return if ruby_version_incompatible?(details)
 
-                details[:version] = Dependabot::Bundler::Version.new(details[:version])
-              end
               details
             end
           end
         rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+          raise if e.is_a?(VersionDetails::InvalidResult)
+
           return if error_due_to_restrictive_upper_bound?(e)
           return if circular_dependency_at_new_version?(e)
 
@@ -184,7 +185,8 @@ module Dependabot
           handle_bundler_errors(e) unless ruby_lock_error?(e)
 
           @gemspec_ruby_unlocked = true
-          regenerate_dependency_files_without_ruby_lock && retry
+          regenerate_dependency_files_without_ruby_lock
+          retry
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
@@ -206,7 +208,7 @@ module Dependabot
           error.message.include?("#{dependency.name} ")
         end
 
-        sig { params(error: T.untyped).returns(T::Boolean) }
+        sig { params(error: Dependabot::SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def ruby_lock_error?(error)
           return false unless conflict_on_ruby?(error)
           return false if @gemspec_ruby_unlocked
@@ -223,7 +225,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Boolean) }
+        sig { void }
         def regenerate_dependency_files_without_ruby_lock
           @dependency_files =
             FilePreparer.new(
@@ -235,10 +237,9 @@ module Dependabot
               latest_allowable_version: latest_allowable_version,
               lock_ruby_version: false
             ).prepared_dependency_files
-          true
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(VersionDetails)) }
         def latest_version_details
           @latest_version_details ||=
             LatestVersionFinder.new(
@@ -253,13 +254,14 @@ module Dependabot
             ).latest_version_details
         end
 
-        sig { params(details: T.untyped).returns(T::Boolean) }
+        sig { params(details: VersionDetails).returns(T::Boolean) }
         def ruby_version_incompatible?(details)
           # It's only the old index we have a problem with
-          return false unless details[:fetcher] == "Bundler::Fetcher::Dependency"
+          return false unless details.fetcher == "Bundler::Fetcher::Dependency"
 
           # If no Ruby version is specified, we don't have a problem
-          return false unless details[:ruby_version]
+          ruby_version = details.ruby_version
+          return false unless ruby_version
 
           versions = Dependabot::RegistryClient.get(
             url: "https://rubygems.org/api/v1/versions/#{dependency.name}.json",
@@ -272,7 +274,7 @@ module Dependabot
 
           ruby_requirement =
             JSON.parse(versions.body)
-                .find { |version| version["number"] == details[:version] }
+                .find { |version| version["number"] == details.version.to_semver }
                 &.fetch("ruby_version", nil)
 
           # Give the benefit of the doubt if we can't find the version's
@@ -280,7 +282,7 @@ module Dependabot
           return false unless ruby_requirement
 
           ruby_requirement = Dependabot::Bundler::Requirement.new(ruby_requirement)
-          current_ruby_version = Dependabot::Bundler::Version.new(details[:ruby_version])
+          current_ruby_version = Dependabot::Bundler::Version.new(ruby_version)
 
           return false if ruby_requirement.satisfied_by?(current_ruby_version)
 

data/lib/dependabot/bundler/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/bundler/file_updater/requirement_replacer"
@@ -16,6 +16,7 @@ module Dependabot
     # ecosystem update checkers (npm_and_yarn, bun, docker, python) disable this cop
     # for the same reason, so the exception is retained deliberately.
     class UpdateChecker < Dependabot::UpdateCheckers::Base # rubocop:disable Metrics/ClassLength
+      require_relative "update_checker/version_details"
       require_relative "update_checker/force_updater"
       require_relative "update_checker/file_preparer"
       require_relative "update_checker/requirements_updater"
@@ -29,14 +30,14 @@ module Dependabot
       def latest_version
         return latest_version_for_git_dependency if git_dependency?
 
-        latest_version_details&.fetch(:version)
+        latest_version_details&.version
       end
 
       sig { override.returns(T.nilable(T.any(String, Dependabot::Bundler::Version))) }
       def latest_resolvable_version
         return latest_resolvable_version_for_git_dependency if git_dependency?
 
-        latest_resolvable_version_details&.fetch(:version)
+        latest_resolvable_version_details&.version
       end
 
       sig { override.returns(T.nilable(Dependabot::Bundler::Version)) }
@@ -67,7 +68,7 @@ module Dependabot
 
         @latest_resolvable_version_detail_with_no_unlock = T.let(
           @latest_resolvable_version_detail_with_no_unlock,
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(VersionDetails)
         )
 
         @latest_resolvable_version_detail_with_no_unlock ||=
@@ -75,16 +76,16 @@ module Dependabot
           .latest_resolvable_version_details
 
         if git_dependency?
-          @latest_resolvable_version_detail_with_no_unlock&.fetch(:commit_sha)
+          @latest_resolvable_version_detail_with_no_unlock&.commit_sha
         else
-          @latest_resolvable_version_detail_with_no_unlock&.fetch(:version)
+          @latest_resolvable_version_detail_with_no_unlock&.version
         end
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        latest_version_for_req_updater = latest_version_details&.fetch(:version)&.to_s
-        latest_resolvable_version_for_req_updater = preferred_resolvable_version_details&.fetch(:version)&.to_s
+        latest_version_for_req_updater = latest_version_details&.version&.to_s
+        latest_resolvable_version_for_req_updater = preferred_resolvable_version_details&.version&.to_s
 
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -204,9 +205,12 @@ module Dependabot
         force_updater.updated_dependencies
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(VersionDetails)) }
       def preferred_resolvable_version_details
-        return { version: lowest_resolvable_security_fix_version } if vulnerable?
+        if vulnerable?
+          version = lowest_resolvable_security_fix_version
+          return version && VersionDetails.new(version: version)
+        end
 
         latest_resolvable_version_details
       end
@@ -263,17 +267,17 @@ module Dependabot
           end
       end
 
-      sig { params(remove_git_source: T::Boolean).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(remove_git_source: T::Boolean).returns(T.nilable(VersionDetails)) }
       def latest_version_details(remove_git_source: false)
-        @latest_version_details ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+        @latest_version_details ||= T.let({}, T.nilable(T::Hash[T::Boolean, T.nilable(VersionDetails)]))
         @latest_version_details[remove_git_source] ||=
           latest_version_finder(remove_git_source: remove_git_source)
           .latest_version_details
       end
 
-      sig { params(remove_git_source: T::Boolean).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(remove_git_source: T::Boolean).returns(T.nilable(VersionDetails)) }
       def latest_resolvable_version_details(remove_git_source: false)
-        @latest_resolvable_version_details ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+        @latest_resolvable_version_details ||= T.let({}, T.nilable(T::Hash[T::Boolean, T.nilable(VersionDetails)]))
         @latest_resolvable_version_details[remove_git_source] ||=
           version_resolver(remove_git_source: remove_git_source)
           .latest_resolvable_version_details
@@ -283,7 +287,7 @@ module Dependabot
       def latest_version_for_git_dependency
         latest_release =
           latest_version_details(remove_git_source: true)
-          &.fetch(:version)
+          &.version
 
         # If there's been a release that includes the current pinned ref or
         # that the current branch is behind, we switch to that release.
@@ -329,12 +333,12 @@ module Dependabot
         dependency.version
       end
 
-      sig { returns(T.any(String, T.nilable(Dependabot::Bundler::Version))) }
+      sig { returns(T.nilable(Dependabot::Bundler::Version)) }
       def latest_resolvable_version_without_git_source
         return nil unless latest_version.is_a?(Gem::Version)
 
         latest_resolvable_version_details(remove_git_source: true)
-          &.fetch(:version)
+          &.version
       rescue Dependabot::DependencyFileNotResolvable
         nil
       end
@@ -346,9 +350,7 @@ module Dependabot
         # If this dependency has a git version in the Gemfile.lock but not in
         # the Gemfile (i.e., because they're out-of-sync) we might not get a
         # commit_sha back from Bundler. In that case, return `nil`.
-        return unless details&.key?(:commit_sha)
-
-        details.fetch(:commit_sha)
+        details&.commit_sha
       rescue Dependabot::DependencyFileNotResolvable
         nil
       end
@@ -361,7 +363,7 @@ module Dependabot
         git_tag_resolvable?(latest_tag_details.tag)
       end
 
-      sig { params(release: T.untyped).returns(T::Boolean) }
+      sig { params(release: T.nilable(Dependabot::Bundler::Version)).returns(T::Boolean) }
       def git_branch_or_ref_in_release?(release)
         return false unless release
 
@@ -423,11 +425,11 @@ module Dependabot
           )
       end
 
-      sig { params(remove_git_source: T::Boolean, unlock_requirement: T::Boolean).returns(T.untyped) }
+      sig { params(remove_git_source: T::Boolean, unlock_requirement: T::Boolean).returns(VersionResolver) }
       def version_resolver(remove_git_source:, unlock_requirement: true)
-        @version_resolver ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
-        @version_resolver[remove_git_source] ||= {}
-        @version_resolver[remove_git_source][unlock_requirement] ||=
+        @version_resolver ||= T.let({}, T.nilable(T::Hash[T::Boolean, T::Hash[T::Boolean, VersionResolver]]))
+        resolvers = @version_resolver[remove_git_source] ||= {}
+        resolvers[unlock_requirement] ||=
           VersionResolver.new(
             dependency: dependency,
             unprepared_dependency_files: dependency_files,
@@ -445,7 +447,7 @@ module Dependabot
 
       sig { params(remove_git_source: T::Boolean).returns(Dependabot::Bundler::UpdateChecker::LatestVersionFinder) }
       def latest_version_finder(remove_git_source:)
-        @latest_version_finder ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+        @latest_version_finder ||= T.let({}, T.nilable(T::Hash[T::Boolean, LatestVersionFinder]))
         @latest_version_finder[remove_git_source] ||=
           begin
             prepared_dependency_files = prepared_dependency_files(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: parallel
   requirement: !ruby/object:Gem::Requirement
@@ -354,6 +354,7 @@ files:
 - lib/dependabot/bundler/update_checker/latest_version_finder/dependency_source.rb
 - lib/dependabot/bundler/update_checker/requirements_updater.rb
 - lib/dependabot/bundler/update_checker/shared_bundler_helpers.rb
+- lib/dependabot/bundler/update_checker/version_details.rb
 - lib/dependabot/bundler/update_checker/version_resolver.rb
 - lib/dependabot/bundler/version.rb
 homepage: https://github.com/dependabot/dependabot-core
@@ -361,7 +362,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib