dependabot-cargo 0.246.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd168fc7b44a8cdec31d77ed2dd743cec23ec961c40cffa4369109eb3bc1f8e2
-  data.tar.gz: bc41641e7d4ed98d8fe89e313d08ea5456f431f721733d91548a7190f0695b39
+  metadata.gz: e26960512a782b8d3fb39ceab669647f4ef8b95e86b4c2e4472f6a04cf9c47d2
+  data.tar.gz: 8cbb82ddbfcd0c27d00decd5c4d4d3550d23dba5d2c3b2dc8273ab46812fbd32
 SHA512:
-  metadata.gz: 237b5831076f63fd17295d8a90e5a43c530349917be2dcd597575336b7dd0e03fc7347e5b4ff9bf1e0f26c3f2cbdd8d7a9b96e6382f3ea5bf5239fa9ca39b7e5
-  data.tar.gz: 5aab89a380e61dd894da9079213dea6a292513c00cb926d1b6c0fb01933cd68571f23aff8db84a231684bce4d76ddc78f943e727b2128230eee163e85e00633b
+  metadata.gz: efb823315833ba89a79ea8146f688a75076735054c9dd8f7d79178894de56c745385811bdef24b61f4fa8180c355358b353fb74f24e57d6629c87c4c18cd8d85
+  data.tar.gz: 56837eb8876162aad943a8d80661adf29cdd273cad2124675670f9ce263adf41780696d14bc1a96432007acbaf8453e058c53b5633131c11a15112a76a397447

data/lib/dependabot/cargo/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "pathname"
@@ -84,7 +84,7 @@ module Dependabot
 
       def path_dependency_files(fetched_files)
         @path_dependency_files ||= {}
-        fetched_path_dependency_files = []
+        fetched_path_dependency_files = T.let([], T::Array[Dependabot::DependencyFile])
         fetched_files.each do |file|
           @path_dependency_files[file.name] ||=
             fetch_path_dependency_files(
@@ -171,7 +171,7 @@ module Dependabot
 
       # rubocop:enable Metrics/PerceivedComplexity
       def path_dependency_paths_from_file(file)
-        paths = []
+        paths = T.let([], T::Array[String])
 
         workspace = parsed_file(file).fetch("workspace", {})
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
@@ -300,7 +300,7 @@ module Dependabot
       def expand_workspaces(path)
         path = Pathname.new(path).cleanpath.to_path
         dir = directory.gsub(%r{(^/|/$)}, "")
-        unglobbed_path = path.split("*").first.gsub(%r{(?<=/)[^/]*$}, "")
+        unglobbed_path = T.must(path.split("*").first).gsub(%r{(?<=/)[^/]*$}, "")
 
         repo_contents(dir: unglobbed_path, raise_errors: false)
           .select { |file| file.type == "dir" }

data/lib/dependabot/cargo/update_checker/latest_version_finder.rb

@@ -5,11 +5,14 @@ require "excon"
 require "dependabot/cargo/update_checker"
 require "dependabot/update_checkers/version_filters"
 require "dependabot/registry_client"
+require "sorbet-runtime"
 
 module Dependabot
   module Cargo
     class UpdateChecker
       class LatestVersionFinder
+        extend T::Sig
+
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, raise_on_ignored: false,
                        security_advisories:)
@@ -52,12 +55,18 @@ module Dependabot
           versions.min
         end
 
+        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
-          versions_array.reject(&:prerelease?)
+          filtered = versions_array.reject(&:prerelease?)
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} pre-release versions")
+          end
+          filtered
         end
 
+        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
         def filter_ignored_versions(versions_array)
           filtered = versions_array
                      .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
@@ -65,6 +74,10 @@ module Dependabot
             raise Dependabot::AllVersionsIgnored
           end
 
+          if versions_array.count > filtered.count
+            Dependabot.logger.info("Filtered out #{versions_array.count - filtered.count} ignored versions")
+          end
+
           filtered
         end
 

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -7,19 +7,30 @@
 # - https://steveklabnik.github.io/semver/semver/index.html                    #
 ################################################################################
 
+require "sorbet-runtime"
+
 require "dependabot/cargo/update_checker"
 require "dependabot/cargo/requirement"
 require "dependabot/cargo/version"
+require "dependabot/requirements_update_strategy"
 
 module Dependabot
   module Cargo
     class UpdateChecker
       class RequirementsUpdater
+        extend T::Sig
+
         class UnfixableRequirement < StandardError; end
 
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-*]+)*/
-        ALLOWED_UPDATE_STRATEGIES =
-          %i(lockfile_only bump_versions bump_versions_if_necessary).freeze
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
 
         def initialize(requirements:, updated_source:, update_strategy:,
                        target_version:)
@@ -35,7 +46,7 @@ module Dependabot
         end
 
         def updated_requirements
-          return requirements if update_strategy == :lockfile_only
+          return requirements if update_strategy == RequirementsUpdateStrategy::LockfileOnly
 
           # NOTE: Order is important here. The FileUpdater needs the updated
           # requirement at index `i` to correspond to the previous requirement
@@ -45,8 +56,8 @@ module Dependabot
             next req unless target_version
             next req if req[:requirement].nil?
 
-            # TODO: Add a widen_ranges options
-            if update_strategy == :bump_versions_if_necessary
+            # TODO: Add a RequirementsUpdateStrategy::WidenRanges options
+            if update_strategy == RequirementsUpdateStrategy::BumpVersionsIfNecessary
               update_version_requirement_if_needed(req)
             else
               update_version_requirement(req)

data/lib/dependabot/cargo/update_checker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/git_commit_checker"
+require "dependabot/requirements_update_strategy"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 
@@ -77,15 +78,15 @@ module Dependabot
       end
 
       def requirements_unlocked_or_can_be?
-        requirements_update_strategy != :lockfile_only
+        requirements_update_strategy != RequirementsUpdateStrategy::LockfileOnly
       end
 
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
-        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+        return @requirements_update_strategy if @requirements_update_strategy
 
         # Otherwise, widen ranges for libraries and bump versions for apps
-        library? ? :bump_versions_if_necessary : :bump_versions
+        library? ? RequirementsUpdateStrategy::BumpVersionsIfNecessary : RequirementsUpdateStrategy::BumpVersions
       end
 
       private

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.246.0
+  version: 0.247.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-01 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.246.0
+        version: 0.247.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.246.0
+        version: 0.247.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -136,6 +136,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -247,7 +261,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.246.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
 post_install_message: 
 rdoc_options: []
 require_paths: