dependabot-cargo 0.332.0 → 0.333.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b32ce25ebd9d7d1f9e9aeff3570a6aa5e47cfaf185f50de5bd489f4260af9fb
-  data.tar.gz: 29017d4973b7f791c554f48dce854d4fee46459c2ace075d0bcadf2819412707
+  metadata.gz: '091190197e180945f1979a4102768e43519a054c4dcccfad73bebd41d6f08abe'
+  data.tar.gz: 3bc3403ebacc832ea65c9e7cce7fcf8bd39728548bf8bf9c516bf6d07594d9f0
 SHA512:
-  metadata.gz: 0a8a6fcbe7f0838c02e8c8297e72950ccea7caca991a77186f3c7156909a65e2f9923b4e06cff4eb8ba6e4a50d419b6892b502c611216da67d98ae13853508c6
-  data.tar.gz: 7d0cc93881ef4f77cef16362801e12c2ba05bb38a6d104b83cd34d64a3511edf322c6104e7b6e24808af308597d4a13b29f95539e2b7a64ae41505d34a20d1ea
+  metadata.gz: 3aef8d8668764a7849ea0b03ce683103151b1cbed29d8c0b405767d45805295358328e9a1105b990a8b70413f74bd1e2b045b884311ea7a0a8e6ac6f937e8a03
+  data.tar.gz: c62c275d2fee1f4477db333d62ed8bcf1a5f2eea1045356e4150a0afccdcda5a65a819b6cb5630d0943e6ebb0a49a9fc7ff82dba3fc1783dc432970de8d27294

data/lib/dependabot/cargo/file_fetcher.rb

@@ -7,6 +7,7 @@ require "toml-rb"
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/file_filtering"
 require "dependabot/cargo/file_parser"
 
 # Docs on Cargo workspaces:
@@ -30,7 +31,7 @@ module Dependabot
       sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def ecosystem_versions
         channel = if rust_toolchain
-                    TomlRB.parse(T.must(rust_toolchain).content).fetch("toolchain", nil)&.fetch("channel", nil)
+                    TomlRB.parse(T.must(rust_toolchain).content).dig("toolchain", "channel")
                   else
                     "default"
                   end
@@ -55,7 +56,13 @@ module Dependabot
         fetched_files << T.must(cargo_config) if cargo_config
         fetched_files << T.must(rust_toolchain) if rust_toolchain
         fetched_files += fetch_path_dependency_and_workspace_files
-        fetched_files.uniq
+
+        # Filter excluded files from final collection
+        filtered_files = fetched_files.reject do |file|
+          Dependabot::FileFiltering.should_exclude_path?(file.name, "file from final collection", @exclude_paths)
+        end
+
+        filtered_files.uniq
       end
 
       private
@@ -125,6 +132,8 @@ module Dependabot
           next if previously_fetched_files.map(&:name).include?(path)
           next if file.name == path
 
+          next if Dependabot::FileFiltering.should_exclude_path?(path, "file from final collection", @exclude_paths)
+
           fetched_file = fetch_file_from_host(path, fetch_submodules: true)
           previously_fetched_files << fetched_file
           grandchild_requirement_files =
@@ -160,6 +169,8 @@ module Dependabot
             next if previously_fetched_files.map(&:name).include?(path)
             next if file.name == path
 
+            next if Dependabot::FileFiltering.should_exclude_path?(path, "file from final collection", @exclude_paths)
+
             fetched_file = fetch_file_from_host(path, fetch_submodules: true)
                            .tap { |f| f.support_file = true }
             previously_fetched_files << fetched_file

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -16,6 +16,7 @@ module Dependabot
       # rubocop:disable Metrics/ClassLength
       class LockfileUpdater
         extend T::Sig
+
         LOCKFILE_ENTRY_REGEX = /
           \[\[package\]\]\n
           (?:(?!^\[(?:\[package|metadata)).)+
@@ -123,7 +124,7 @@ module Dependabot
                   dependency.version
                 end
 
-          if ver && spec_options.count { |s| s.end_with?(ver) } == 1
+          if ver && spec_options.one? { |s| s.end_with?(ver) }
             @custom_specification = spec_options.find { |s| s.end_with?(ver) }
             return true
           elsif ver && spec_options.count { |s| s.end_with?(ver) } > 1

data/lib/dependabot/cargo/file_updater/manifest_updater.rb

@@ -1,22 +1,38 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
+require "dependabot/dependency"
+require "dependabot/dependency_file"
 require "dependabot/cargo/file_updater"
 
 module Dependabot
   module Cargo
     class FileUpdater
       class ManifestUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            manifest: Dependabot::DependencyFile
+          ).void
+        end
         def initialize(dependencies:, manifest:)
-          @dependencies = dependencies
-          @manifest = manifest
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @manifest = T.let(manifest, Dependabot::DependencyFile)
         end
 
+        sig { returns(String) }
         def updated_manifest_content
+          content = manifest.content
+          raise "Manifest has no content" if content.nil?
+
           dependencies
             .select { |dep| requirement_changed?(manifest, dep) }
-            .reduce(manifest.content.dup) do |content, dep|
-              updated_content = content
+            .reduce(content.dup) do |current_content, dep|
+              updated_content = current_content
 
               updated_content = update_requirements(
                 content: updated_content,
@@ -30,7 +46,7 @@ module Dependabot
                 dependency: dep
               )
 
-              raise "Expected content to change!" if content == updated_content
+              raise "Expected content to change!" if current_content == updated_content
 
               updated_content
             end
@@ -38,42 +54,51 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :manifest
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - (dependency.previous_requirements || [])
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end
 
+        sig { params(content: String, filename: String, dependency: Dependabot::Dependency).returns(String) }
         def update_requirements(content:, filename:, dependency:)
-          updated_content = content.dup
+          updated_content = T.let(content.dup, String)
 
           # The UpdateChecker ensures the order of requirements is preserved
           # when updating, so we can zip them together in new/old pairs.
           reqs = dependency.requirements
-                           .zip(dependency.previous_requirements)
+                           .zip(dependency.previous_requirements || [])
                            .reject { |new_req, old_req| new_req == old_req }
 
           # Loop through each changed requirement
           reqs.each do |new_req, old_req|
+            next if old_req.nil?
+
             raise "Bad req match" unless new_req[:file] == old_req[:file]
             next if new_req[:requirement] == old_req[:requirement]
             next unless new_req[:file] == filename
 
-            updated_content = update_manifest_req(
-              content: updated_content,
-              dep: dependency,
-              old_req: old_req.fetch(:requirement),
-              new_req: new_req.fetch(:requirement)
-            )
+            updated_content =
+              update_manifest_req(
+                content: updated_content,
+                dep: dependency,
+                old_req: old_req.fetch(:requirement),
+                new_req: new_req.fetch(:requirement)
+              )
           end
 
           updated_content
         end
 
+        sig { params(content: String, filename: String, dependency: Dependabot::Dependency).returns(String) }
         def update_git_pin(content:, filename:, dependency:)
           updated_pin =
             dependency.requirements
@@ -82,7 +107,7 @@ module Dependabot
 
           old_pin =
             dependency.previous_requirements
-                      .find { |r| r[:file] == filename }
+                      &.find { |r| r[:file] == filename }
                       &.dig(:source, :ref)
 
           return content unless old_pin
@@ -95,21 +120,31 @@ module Dependabot
           )
         end
 
+        sig do
+          params(
+            content: String,
+            dep: Dependabot::Dependency,
+            old_req: String,
+            new_req: String
+          ).returns(String)
+        end
         def update_manifest_req(content:, dep:, old_req:, new_req:)
           simple_declaration = content.scan(declaration_regex(dep))
                                       .find { |m| m.include?(old_req) }
 
           if simple_declaration
             simple_declaration_regex =
-              /(?:^|["'])#{Regexp.escape(simple_declaration)}/
+              /(?:^|["'])#{Regexp.escape(T.cast(simple_declaration, String))}/
             old_req_escaped = Regexp.escape(old_req)
             content.gsub(simple_declaration_regex) do |line|
               line.gsub(/.+=.*\K(#{old_req_escaped})/, new_req)
             end
           elsif content.match?(feature_declaration_version_regex(dep))
             content.gsub(feature_declaration_version_regex(dep)) do |part|
-              line = content.match(feature_declaration_version_regex(dep))
-                            .named_captures.fetch("version_declaration")
+              match_data = content.match(feature_declaration_version_regex(dep))
+              line = T.must(match_data).named_captures.fetch("version_declaration")
+              return content if line.nil?
+
               new_line = line.gsub(old_req, new_req)
               part.gsub(line, new_line)
             end
@@ -118,20 +153,31 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            content: String,
+            dep: Dependabot::Dependency,
+            old_pin: String,
+            new_pin: String
+          )
+            .returns(String)
+        end
         def update_manifest_pin(content:, dep:, old_pin:, new_pin:)
           simple_declaration = content.scan(declaration_regex(dep))
                                       .find { |m| m.include?(old_pin) }
 
           if simple_declaration
             simple_declaration_regex =
-              /(?:^|["'])#{Regexp.escape(simple_declaration)}/
+              /(?:^|["'])#{Regexp.escape(T.cast(simple_declaration, String))}/
             content.gsub(simple_declaration_regex) do |line|
               line.gsub(old_pin, new_pin)
             end
           elsif content.match?(feature_declaration_pin_regex(dep))
             content.gsub(feature_declaration_pin_regex(dep)) do |part|
-              line = content.match(feature_declaration_pin_regex(dep))
-                            .named_captures.fetch("pin_declaration")
+              match_data = content.match(feature_declaration_pin_regex(dep))
+              line = T.must(match_data).named_captures.fetch("pin_declaration")
+              return content if line.nil?
+
               new_line = line.gsub(old_pin, new_pin)
               part.gsub(line, new_line)
             end
@@ -140,10 +186,12 @@ module Dependabot
           end
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(Regexp) }
         def declaration_regex(dep)
           /(?:^|^\s*|["'])#{Regexp.escape(dep.name)}["']?(?:\s*\.version)?\s*=.*$/i
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(Regexp) }
         def feature_declaration_version_regex(dep)
           /
             #{Regexp.quote("dependencies.#{dep.name}]")}
@@ -152,6 +200,7 @@ module Dependabot
           /mx
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(Regexp) }
         def feature_declaration_pin_regex(dep)
           /
             #{Regexp.quote("dependencies.#{dep.name}]")}

data/lib/dependabot/cargo/metadata_finder.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
+
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
@@ -9,11 +11,20 @@ require "dependabot/registry_client"
 module Dependabot
   module Cargo
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
       SOURCE_KEYS = %w(repository homepage documentation).freeze
       CRATES_IO_API = "https://crates.io/api/v1/crates"
 
+      sig { params(dependency: Dependabot::Dependency, credentials: T::Array[Dependabot::Credential]).void }
+      def initialize(dependency:, credentials:)
+        super
+        @crates_listing = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+      end
+
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         case new_source_type
         when "default" then find_source_from_crates_listing
@@ -23,19 +34,22 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def new_source_type
         dependency.source_type
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_crates_listing
         potential_source_urls =
           SOURCE_KEYS
-          .filter_map { |key| crates_listing.dig("crate", key) }
+          .filter_map { |key| T.must(crates_listing).dig("crate", key) }
 
         source_url = potential_source_urls.find { |url| Source.from_url(url) }
         Source.from_url(source_url)
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
         info = dependency.requirements.filter_map { |r| r[:source] }.first
 
@@ -43,6 +57,7 @@ module Dependabot
         Source.from_url(url)
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def crates_listing
         return @crates_listing unless @crates_listing.nil?
 
@@ -56,17 +71,21 @@ module Dependabot
         @crates_listing = parse_response(response, index)
       end
 
+      sig { params(index: String, info: T.nilable(T::Hash[String, T.untyped])).returns(T::Hash[String, String]) }
       def build_headers(index, info)
         hdrs = { "User-Agent" => "Dependabot (dependabot.com)" }
         return hdrs if index == CRATES_IO_API
 
-        credentials.find { |cred| cred["type"] == "cargo_registry" && cred["registry"] == info[:name] }&.tap do |cred|
+        return hdrs if info.nil?
+
+        credentials.find { |cred| cred["type"] == "cargo_registry" && cred["registry"] == info["name"] }&.tap do |cred|
           hdrs["Authorization"] = "Token #{cred['token']}"
         end
 
         hdrs
       end
 
+      sig { params(url: String, headers: T::Hash[String, String]).returns(Excon::Response) }
       def fetch_metadata(url, headers)
         Excon.get(
           url,
@@ -75,6 +94,7 @@ module Dependabot
         )
       end
 
+      sig { params(response: Excon::Response, index: String).returns(T::Hash[String, T.untyped]) }
       def parse_response(response, index)
         if index.start_with?("sparse+")
           parsed_response = response.body.lines.map { |line| JSON.parse(line) }
@@ -84,6 +104,7 @@ module Dependabot
         end
       end
 
+      sig { params(dependency: Dependabot::Dependency, index: String).returns(String) }
       def metadata_fetch_url(dependency, index)
         return "#{index}/#{dependency.name}" if index == CRATES_IO_API
 

data/lib/dependabot/cargo/requirement.rb

@@ -89,7 +89,7 @@ module Dependabot
         return req_string if parts.count >= 3
 
         # If we have no parts then the version is completely unlocked
-        return ">= 0" if parts.count.zero?
+        return ">= 0" if parts.none?
 
         # If we have fewer than three parts we do a partial match
         parts << "0"

data/lib/dependabot/cargo/update_checker/file_preparer.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "toml-rb"
+
 require "dependabot/dependency_file"
 require "dependabot/cargo/file_parser"
 require "dependabot/cargo/update_checker"
@@ -12,6 +14,18 @@ module Dependabot
       # This class takes a set of dependency files and sanitizes them for use
       # in UpdateCheckers::Rust::Cargo.
       class FilePreparer
+        extend T::Sig
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            dependency: Dependabot::Dependency,
+            unlock_requirement: T::Boolean,
+            replacement_git_pin: T.nilable(String),
+            latest_allowable_version: T.nilable(T.any(String, Gem::Version))
+          )
+            .void
+        end
         def initialize(dependency_files:, dependency:,
                        unlock_requirement: true,
                        replacement_git_pin: nil,
@@ -21,8 +35,13 @@ module Dependabot
           @unlock_requirement       = unlock_requirement
           @replacement_git_pin      = replacement_git_pin
           @latest_allowable_version = latest_allowable_version
+          @lower_bound_version = T.let(nil, T.nilable(T.any(String, Integer)))
+          @manifest_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @toolchain = T.let(nil, T.nilable(Dependabot::DependencyFile))
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def prepared_dependency_files
           files = []
           files += manifest_files.map do |file|
@@ -39,21 +58,31 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T.nilable(String)) }
         attr_reader :replacement_git_pin
+
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
         attr_reader :latest_allowable_version
 
+        sig { returns(T::Boolean) }
         def unlock_requirement?
           @unlock_requirement
         end
 
+        sig { returns(T::Boolean) }
         def replace_git_pin?
           !replacement_git_pin.nil?
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def manifest_content_for_update_check(file)
-          content = file.content
+          content = T.must(file.content)
 
           unless file.support_file?
             content = replace_version_constraint(content, file.name)
@@ -67,6 +96,7 @@ module Dependabot
 
         # NOTE: We don't need to care about formatting in this method, since
         # we're only using the manifest to find the latest resolvable version
+        sig { params(content: String, filename: String).returns(String) }
         def replace_version_constraint(content, filename)
           parsed_manifest = TomlRB.parse(content)
 
@@ -89,6 +119,7 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
+        sig { params(parsed_manifest: T::Hash[String, T.untyped], filename: String).void }
         def replace_req_on_target_specific_deps!(parsed_manifest, filename)
           parsed_manifest.fetch("target", {}).each do |target, _|
             Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
@@ -114,6 +145,7 @@ module Dependabot
           end
         end
 
+        sig { params(content: String).returns(String) }
         def replace_git_pin(content)
           parsed_manifest = TomlRB.parse(content)
 
@@ -121,7 +153,7 @@ module Dependabot
             dependency_names_for_type(parsed_manifest, type).each do |name|
               req = parsed_manifest.dig(type, name)
               next unless req.is_a?(Hash)
-              next unless [req["tag"], req["rev"]].compact.uniq.count == 1
+              next unless [req["tag"], req["rev"]].compact.uniq.one?
 
               parsed_manifest[type][name]["tag"] = replacement_git_pin if req["tag"]
 
@@ -134,6 +166,7 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
+        sig { params(parsed_manifest: T::Hash[String, T.untyped]).void }
         def replace_git_pin_on_target_specific_deps!(parsed_manifest)
           parsed_manifest.fetch("target", {}).each do |target, _|
             Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
@@ -146,7 +179,7 @@ module Dependabot
               dependency_names.each do |name|
                 req = parsed_manifest.dig("target", target, type, name)
                 next unless req.is_a?(Hash)
-                next unless [req["tag"], req["rev"]].compact.uniq.count == 1
+                next unless [req["tag"], req["rev"]].compact.uniq.one?
 
                 if req["tag"]
                   parsed_manifest["target"][target][type][name]["tag"] =
@@ -162,6 +195,7 @@ module Dependabot
           end
         end
 
+        sig { params(content: String).returns(String) }
         def replace_ssh_urls(content)
           parsed_manifest = TomlRB.parse(content)
 
@@ -178,6 +212,7 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
+        sig { params(filename: String).returns(String) }
         def temporary_requirement_for_resolution(filename)
           original_req = dependency.requirements
                                    .find { |r| r.fetch(:file) == filename }
@@ -201,6 +236,7 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.any(String, Integer)) }
         def lower_bound_version
           @lower_bound_version ||=
             if git_dependency? && git_dependency_version
@@ -221,16 +257,18 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T.nilable(String)) }
         def git_dependency_version
           return unless lockfile
 
-          TomlRB.parse(lockfile.content)
+          TomlRB.parse(T.must(lockfile).content)
                 .fetch("package", [])
                 .select { |p| p["name"] == dependency.name }
                 .find { |p| p["source"].end_with?(dependency.version) }
                 .fetch("version")
         end
 
+        sig { params(parsed_manifest: T::Hash[String, T.untyped], type: String).returns(T::Array[String]) }
         def dependency_names_for_type(parsed_manifest, type)
           names = []
           parsed_manifest.fetch(type, {}).each do |nm, req|
@@ -241,6 +279,9 @@ module Dependabot
           names
         end
 
+        sig do
+          params(parsed_manifest: T::Hash[String, T.untyped], type: String, target: String).returns(T::Array[String])
+        end
         def dependency_names_for_type_and_target(parsed_manifest, type, target)
           names = []
           (parsed_manifest.dig("target", target, type) || {}).each do |nm, req|
@@ -251,13 +292,16 @@ module Dependabot
           names
         end
 
+        sig { params(name: String, declaration: T.untyped).returns(String) }
         def name_from_declaration(name, declaration)
           return name if declaration.is_a?(String)
+
           raise "Unexpected dependency declaration: #{declaration}" unless declaration.is_a?(Hash)
 
           declaration.fetch("package", name)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def manifest_files
           @manifest_files ||=
             dependency_files.select { |f| f.name.end_with?("Cargo.toml") }
@@ -267,15 +311,18 @@ module Dependabot
           @manifest_files
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           @lockfile ||= dependency_files.find { |f| f.name == "Cargo.lock" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def toolchain
           @toolchain ||=
             dependency_files.find { |f| f.name == "rust-toolchain" }
         end
 
+        sig { returns(T::Boolean) }
         def git_dependency?
           GitCommitChecker
             .new(dependency: dependency, credentials: [])

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 ################################################################################
@@ -25,26 +25,35 @@ module Dependabot
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-*]+)*/
         ALLOWED_UPDATE_STRATEGIES = T.let(
           [
-            RequirementsUpdateStrategy::LockfileOnly,
-            RequirementsUpdateStrategy::BumpVersions,
-            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+            Dependabot::RequirementsUpdateStrategy::LockfileOnly,
+            Dependabot::RequirementsUpdateStrategy::BumpVersions,
+            Dependabot::RequirementsUpdateStrategy::BumpVersionsIfNecessary
           ].freeze,
           T::Array[Dependabot::RequirementsUpdateStrategy]
         )
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            updated_source: T.nilable(T::Hash[T.any(String, Symbol), T.untyped]),
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            target_version: T.nilable(T.any(String, Gem::Version))
+          ).void
+        end
         def initialize(requirements:, updated_source:, update_strategy:,
                        target_version:)
-          @requirements = requirements
-          @updated_source = updated_source
-          @update_strategy = update_strategy
+          @requirements = T.let(requirements, T::Array[T::Hash[Symbol, T.untyped]])
+          @updated_source = T.let(updated_source, T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+          @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
 
           check_update_strategy
 
           return unless target_version && version_class.correct?(target_version)
 
-          @target_version = version_class.new(target_version)
+          @target_version = T.let(version_class.new(target_version), Gem::Version)
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -57,7 +66,7 @@ module Dependabot
             next req if req[:requirement].nil?
 
             # TODO: Add a RequirementsUpdateStrategy::WidenRanges options
-            if update_strategy == RequirementsUpdateStrategy::BumpVersionsIfNecessary
+            if update_strategy == Dependabot::RequirementsUpdateStrategy::BumpVersionsIfNecessary
               update_version_requirement_if_needed(req)
             else
               update_version_requirement(req)
@@ -67,17 +76,26 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         attr_reader :requirements
+
+        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
         attr_reader :updated_source
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T.nilable(Gem::Version)) }
         attr_reader :target_version
 
+        sig { void }
         def check_update_strategy
           return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
 
           raise "Unknown update strategy: #{update_strategy}"
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_version_requirement(req)
           string_reqs = req[:requirement].split(",").map(&:strip)
 
@@ -100,15 +118,17 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_version_requirement_if_needed(req)
           string_reqs = req[:requirement].split(",").map(&:strip)
-          ruby_reqs = string_reqs.map { |r| Cargo::Requirement.new(r) }
+          ruby_reqs = string_reqs.map { |r| Dependabot::Cargo::Requirement.new(r) }
 
           return req if ruby_reqs.all? { |r| r.satisfied_by?(target_version) }
 
           update_version_requirement(req)
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_version_string(req_string)
           new_target_parts = target_version.to_s.sub(/\+.*/, "").split(".")
           req_string.sub(VERSION_REGEX) do |old_version|
@@ -123,19 +143,22 @@ module Dependabot
           end
         end
 
+        sig { params(string_reqs: T::Array[String]).returns(T.nilable(String)) }
         def non_range_req(string_reqs)
           string_reqs.find { |r| r.include?("*") || r.match?(/^[\d~^]/) }
         end
 
+        sig { params(string_reqs: T::Array[String]).returns(T.nilable(String)) }
         def exact_req(string_reqs)
-          string_reqs.find { |r| Cargo::Requirement.new(r).exact? }
+          string_reqs.find { |r| Dependabot::Cargo::Requirement.new(r).exact? }
         end
 
+        sig { params(string_reqs: T::Array[String]).returns(T.any(String, Symbol)) }
         def update_range_requirements(string_reqs)
           string_reqs.map do |req|
             next req unless req.match?(/[<>]/)
 
-            ruby_req = Cargo::Requirement.new(req)
+            ruby_req = Dependabot::Cargo::Requirement.new(req)
             next req if ruby_req.satisfied_by?(target_version)
 
             raise UnfixableRequirement if req.start_with?(">")
@@ -144,7 +167,7 @@ module Dependabot
               if req.start_with?("<=")
                 update_version_string(old_version)
               else
-                update_greatest_version(old_version, target_version)
+                update_greatest_version(old_version, T.must(target_version))
               end
             end
           end.join(", ")
@@ -152,26 +175,28 @@ module Dependabot
           :unfixable
         end
 
+        sig { params(old_version: String, version_to_be_permitted: Gem::Version).returns(String) }
         def update_greatest_version(old_version, version_to_be_permitted)
           version = version_class.new(old_version)
           version = version.release if version.prerelease?
 
           index_to_update =
-            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+            version.segments.map.with_index { |seg, i| seg.to_i.zero? ? 0 : i }.max
 
           version.segments.map.with_index do |_, index|
             if index < index_to_update
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
+              version_to_be_permitted.segments[index].to_i + 1
             else
               0
             end
           end.join(".")
         end
 
+        sig { returns(T.class_of(Dependabot::Cargo::Version)) }
         def version_class
-          Cargo::Version
+          Dependabot::Cargo::Version
         end
       end
     end

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -14,6 +14,7 @@ module Dependabot
     class UpdateChecker
       class VersionResolver # rubocop:disable Metrics/ClassLength
         extend T::Sig
+
         UNABLE_TO_UPDATE = /Unable to update (?<url>.*?)$/
         BRANCH_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*to find branch `(?<branch>[^`]+)`/m
         REVSPEC_PATTERN = /revspec '.*' not found/
@@ -133,7 +134,7 @@ module Dependabot
                   dependency.version
                 end
 
-          if spec_options.count { |s| s.end_with?(T.must(ver)) } == 1
+          if spec_options.one? { |s| s.end_with?(T.must(ver)) }
             @custom_specification = spec_options.find { |s| s.end_with?(T.must(ver)) }
             return true
           elsif spec_options.count { |s| s.end_with?(T.must(ver)) } > 1

data/lib/dependabot/cargo/update_checker.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/git_commit_checker"
 require "dependabot/requirements_update_strategy"
 require "dependabot/update_checkers"
@@ -9,15 +11,18 @@ require "dependabot/update_checkers/base"
 module Dependabot
   module Cargo
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/file_preparer"
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         return if path_dependency?
 
-        @latest_version =
+        @latest_version = T.let(
           if git_dependency?
             latest_version_for_git_dependency
           elsif git_subdependency?
@@ -26,48 +31,64 @@ module Dependabot
             nil
           else
             latest_version_finder.latest_version
-          end
+          end,
+          T.nilable(T.any(String, Gem::Version))
+        )
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         return if path_dependency?
 
-        @latest_resolvable_version ||=
-          if git_dependency?
-            latest_resolvable_version_for_git_dependency
-          elsif git_subdependency?
-            # TODO: Dependabot can't update git sub-dependencies yet, because
-            # they can't be passed to GitCommitChecker.
-            nil
-          else
-            fetch_latest_resolvable_version(unlock_requirement: true)
-          end
+        @latest_resolvable_version = T.let(
+          @latest_resolvable_version ||
+            if git_dependency?
+              latest_resolvable_version_for_git_dependency
+            elsif git_subdependency?
+              # TODO: Dependabot can't update git sub-dependencies yet, because
+              # they can't be passed to GitCommitChecker.
+              nil
+            else
+              fetch_latest_resolvable_version(unlock_requirement: true)
+            end,
+          T.nilable(T.any(String, Gem::Version))
+        )
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
         return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
 
-        @lowest_resolvable_security_fix_version =
-          fetch_lowest_resolvable_security_fix_version
+        result = fetch_lowest_resolvable_security_fix_version
+        @lowest_resolvable_security_fix_version = T.let(
+          result.is_a?(Gem::Version) ? result : nil,
+          T.nilable(Gem::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version_with_no_unlock
         return if path_dependency?
 
-        @latest_resolvable_version_with_no_unlock ||=
-          if git_dependency?
-            latest_resolvable_commit_with_unchanged_git_source
-          else
-            fetch_latest_resolvable_version(unlock_requirement: false)
-          end
+        @latest_resolvable_version_with_no_unlock = T.let(
+          @latest_resolvable_version_with_no_unlock ||
+            if git_dependency?
+              latest_resolvable_commit_with_unchanged_git_source
+            else
+              fetch_latest_resolvable_version(unlock_requirement: false)
+            end,
+          T.nilable(T.any(String, Gem::Version))
+        )
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -77,10 +98,12 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { override.returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         !requirements_update_strategy.lockfile_only?
       end
 
+      sig { returns(Dependabot::RequirementsUpdateStrategy) }
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
@@ -91,15 +114,18 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Rust (yet)
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
+      sig { returns(T.nilable(String)) }
       def target_version
         # Unless we can resolve a new version, don't try to update to a latest
         # version (even for a library) as we rely on a resolvable version being
@@ -109,29 +135,37 @@ module Dependabot
         library? ? latest_version&.to_s : preferred_resolvable_version.to_s
       end
 
+      sig { returns(T::Boolean) }
       def library?
         # If it has a lockfile, treat it as an application. Otherwise treat it
         # as a library.
         dependency_files.none? { |f| f.name == "Cargo.lock" }
       end
 
+      sig { returns(LatestVersionFinder) }
       def latest_version_finder
-        @latest_version_finder ||=
-          LatestVersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            security_advisories: security_advisories,
-            cooldown_options: update_cooldown,
-            raise_on_ignored: raise_on_ignored
-          )
+        @latest_version_finder = T.let(
+          @latest_version_finder ||
+            LatestVersionFinder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              security_advisories: security_advisories,
+              cooldown_options: update_cooldown,
+              raise_on_ignored: raise_on_ignored
+            ),
+          T.nilable(LatestVersionFinder)
+        )
+        T.must(@latest_version_finder)
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version_for_git_dependency
         latest_git_version_sha
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_git_version_sha
         # If the gem isn't pinned, the latest version is just the latest
         # commit for the specified branch.
@@ -150,6 +184,7 @@ module Dependabot
         dependency.version
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version_for_git_dependency
         # If the gem isn't pinned, the latest version is just the latest
         # commit for the specified branch.
@@ -161,21 +196,28 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return new_tag.fetch(:commit_sha)
+          return T.must(new_tag).fetch(:commit_sha)
         end
 
         # If the dependency is pinned then there's nothing we can do.
         dependency.version
       end
 
+      sig { returns(T::Boolean) }
       def latest_git_tag_is_resolvable?
-        return @git_tag_resolvable if @latest_git_tag_is_resolvable_checked
+        unless defined?(@latest_git_tag_is_resolvable_checked)
+          @latest_git_tag_is_resolvable_checked = T.let(nil,
+                                                        T.nilable(T::Boolean))
+        end
+        @git_tag_resolvable = T.let(nil, T.nilable(T::Boolean)) unless defined?(@git_tag_resolvable)
+
+        return T.must(@git_tag_resolvable) if @latest_git_tag_is_resolvable_checked
 
         @latest_git_tag_is_resolvable_checked = true
 
         return false if git_commit_checker.local_tag_for_latest_version.nil?
 
-        replacement_tag = git_commit_checker.local_tag_for_latest_version
+        replacement_tag = T.must(git_commit_checker.local_tag_for_latest_version)
 
         prepared_files = FilePreparer.new(
           dependency_files: dependency_files,
@@ -197,6 +239,7 @@ module Dependabot
         @git_tag_resolvable = false
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_commit_with_unchanged_git_source
         fetch_latest_resolvable_version(unlock_requirement: false)
       rescue SharedHelpers::HelperSubprocessFailed => e
@@ -207,6 +250,7 @@ module Dependabot
         raise e
       end
 
+      sig { params(unlock_requirement: T::Boolean).returns(T.nilable(T.any(String, Gem::Version))) }
       def fetch_latest_resolvable_version(unlock_requirement:)
         prepared_files = FilePreparer.new(
           dependency_files: dependency_files,
@@ -223,6 +267,7 @@ module Dependabot
         ).latest_resolvable_version
       end
 
+      sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def fetch_lowest_resolvable_security_fix_version
         fix_version = lowest_security_fix_version
         return latest_resolvable_version if fix_version.nil?
@@ -248,6 +293,7 @@ module Dependabot
         latest_resolvable_version
       end
 
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -255,38 +301,47 @@ module Dependabot
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
-          return dependency_source_details.merge(ref: new_tag.fetch(:tag))
+          new_tag = T.must(git_commit_checker.local_tag_for_latest_version)
+          return T.must(dependency_source_details).merge(ref: new_tag.fetch(:tag))
         end
 
         # Otherwise return the original source
         dependency_source_details
       end
 
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
       def dependency_source_details
         dependency.source_details
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      sig { returns(T::Boolean) }
       def git_subdependency?
         return false if dependency.top_level?
 
         !version_class.correct?(dependency.version)
       end
 
+      sig { returns(T::Boolean) }
       def path_dependency?
         dependency.source_type == "path"
       end
 
+      sig { returns(GitCommitChecker) }
       def git_commit_checker
-        @git_commit_checker ||=
-          GitCommitChecker.new(
-            dependency: dependency,
-            credentials: credentials
-          )
+        @git_commit_checker = T.let(
+          @git_commit_checker ||
+            GitCommitChecker.new(
+              dependency: dependency,
+              credentials: credentials
+            ),
+          T.nilable(GitCommitChecker)
+        )
+        T.must(@git_commit_checker)
       end
     end
   end

data/lib/dependabot/cargo/version.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -11,26 +12,32 @@ require "dependabot/utils"
 module Dependabot
   module Cargo
     class Version < Dependabot::Version
+      extend T::Sig
+
       VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' \
                         '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
                         '(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?'
       ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
-        @version_string = version.to_s
+        @version_string = T.let(version.to_s, String)
         version = version.to_s.split("+").first if version.to_s.include?("+")
 
         super
       end
 
+      sig { override.returns(String) }
       def to_s
         @version_string
       end
 
+      sig { override.returns(String) }
       def inspect # :nodoc:
         "#<#{self.class} #{@version_string}>"
       end
 
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
         return false if version.nil?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.332.0
+  version: 0.333.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.332.0
+        version: 0.333.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.332.0
+        version: 0.333.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -211,14 +211,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '3.25'
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.332.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.333.0
 rdoc_options: []
 require_paths:
 - lib