dependabot-cargo 0.311.0 → 0.312.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f08d202894fce9b04e7de128f5866402562d011918711e693a668babf4daf19b
-  data.tar.gz: 350bfab13e3d0727d5c7f6f68c405b16b9413e457478366f74857f02b1a21e19
+  metadata.gz: dc6005c288fca9a7265b60df2f5378c8da5112dbf921c546f28703545fa4a3a3
+  data.tar.gz: d8a0a9b18a4d817e51436b45078187fd1f2e19fa7ccad03af86d45d5484cc35e
 SHA512:
-  metadata.gz: 3afff08137063cb43cf15ee5949862949aa029a19eea323d7c774c0b7d5c3762e9057cc4b5a9e2ff6591a70ad08c4264d2fca59ca12804a4d4af9902eceb2457
-  data.tar.gz: e9126cd2757808192174503f8788287b1383ee461aa8fcb203c6a1ab3e2b718ec3f57e9c9628d321923c2324371edcbd20cc9726b4f3884a12455ab9e2ba4cb6
+  metadata.gz: 17e7aa764c53d1af95f4657b1b39a1dbf69a27926bfc0bab2cd8918dc372be6edbd56dd10caad3801503763ffbb41c9ab72a0642e88f509bc2b6711ed0ec72b6
+  data.tar.gz: 788d13ab539e7d1baca4c2b6f0f3a10b6d6756cffa9079d04f5539ab10786b9e3667b31b565c7ddddc15023408681c1b39cc03f664e9a884f625b01d7491254f

data/lib/dependabot/cargo/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "pathname"
@@ -17,17 +17,20 @@ module Dependabot
       extend T::Sig
       extend T::Helpers
 
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.include?("Cargo.toml")
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a Cargo.toml."
       end
 
+      sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def ecosystem_versions
         channel = if rust_toolchain
-                    TomlRB.parse(rust_toolchain.content).fetch("toolchain", nil)&.fetch("channel", nil)
+                    TomlRB.parse(T.must(rust_toolchain).content).fetch("toolchain", nil)&.fetch("channel", nil)
                   else
                     "default"
                   end
@@ -39,7 +42,7 @@ module Dependabot
         }
       rescue TomlRB::ParseError
         raise Dependabot::DependencyFileNotParseable.new(
-          rust_toolchain.path,
+          T.must(rust_toolchain).path,
           "only rust-toolchain files formatted as TOML are supported, the non-TOML format was deprecated by Rust"
         )
       end
@@ -48,15 +51,18 @@ module Dependabot
       def fetch_files
         fetched_files = T.let([], T::Array[DependencyFile])
         fetched_files << cargo_toml
-        fetched_files << cargo_lock if cargo_lock
-        fetched_files << cargo_config if cargo_config
-        fetched_files << rust_toolchain if rust_toolchain
+        fetched_files << T.must(cargo_lock) if cargo_lock
+        fetched_files << T.must(cargo_config) if cargo_config
+        fetched_files << T.must(rust_toolchain) if rust_toolchain
         fetched_files += fetch_path_dependency_and_workspace_files
         fetched_files.uniq
       end
 
       private
 
+      sig do
+        params(files: T.nilable(T::Array[Dependabot::DependencyFile])).returns(T::Array[Dependabot::DependencyFile])
+      end
       def fetch_path_dependency_and_workspace_files(files = nil)
         fetched_files = files || [cargo_toml]
 
@@ -73,8 +79,9 @@ module Dependabot
         fetch_path_dependency_and_workspace_files(updated_files)
       end
 
+      sig { params(cargo_toml: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
       def workspace_files(cargo_toml)
-        @workspace_files ||= {}
+        @workspace_files ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::DependencyFile]]))
         @workspace_files[cargo_toml.name] ||=
           fetch_workspace_files(
             file: cargo_toml,
@@ -82,8 +89,9 @@ module Dependabot
           )
       end
 
+      sig { params(fetched_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[Dependabot::DependencyFile]) }
       def path_dependency_files(fetched_files)
-        @path_dependency_files ||= {}
+        @path_dependency_files ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::DependencyFile]]))
         fetched_path_dependency_files = T.let([], T::Array[Dependabot::DependencyFile])
         fetched_files.each do |file|
           @path_dependency_files[file.name] ||=
@@ -93,12 +101,19 @@ module Dependabot
                                         fetched_path_dependency_files
             )
 
-          fetched_path_dependency_files += @path_dependency_files[file.name]
+          fetched_path_dependency_files += T.must(@path_dependency_files[file.name])
         end
 
         fetched_path_dependency_files
       end
 
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          previously_fetched_files: T::Array[Dependabot::DependencyFile]
+        )
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
       def fetch_workspace_files(file:, previously_fetched_files:)
         current_dir = file.name.rpartition("/").first
         current_dir = nil if current_dir == ""
@@ -125,6 +140,13 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig do
+        params(
+          file: Dependabot::DependencyFile,
+          previously_fetched_files: T::Array[Dependabot::DependencyFile]
+        )
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
       def fetch_path_dependency_files(file:, previously_fetched_files:)
         current_dir = file.name.rpartition("/").first
         current_dir = nil if current_dir == ""
@@ -165,6 +187,7 @@ module Dependabot
               unfetchable_required_path_deps
       end
 
+      sig { params(dependencies: T::Hash[T.untyped, T.untyped]).returns(T::Array[String]) }
       def collect_path_dependencies_paths(dependencies)
         paths = []
         dependencies.each do |_, details|
@@ -176,6 +199,7 @@ module Dependabot
       end
 
       # rubocop:enable Metrics/PerceivedComplexity
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def path_dependency_paths_from_file(file)
         paths = T.let([], T::Array[String])
 
@@ -198,6 +222,7 @@ module Dependabot
         paths
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def replacement_path_dependency_paths_from_file(file)
         paths = []
 
@@ -226,6 +251,7 @@ module Dependabot
 
       # See if this Cargo manifest inherits any property from a workspace
       # (e.g. edition = { workspace = true }).
+      sig { params(hash: T::Hash[T.untyped, T.untyped]).returns(T::Boolean) }
       def workspace_member?(hash)
         hash.each do |key, value|
           if key == "workspace" && value == true
@@ -277,6 +303,7 @@ module Dependabot
         nil
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def workspace_dependency_paths_from_file(file)
         if parsed_file(file)["workspace"] &&
            !parsed_file(file)["workspace"].key?("members")
@@ -306,6 +333,7 @@ module Dependabot
       # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
       # rubocop:disable Metrics/AbcSize
+      sig { params(file: Dependabot::DependencyFile, path: String).returns(T::Boolean) }
       def required_path?(file, path)
         # Paths specified in dependency declaration
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
@@ -356,6 +384,7 @@ module Dependabot
       # rubocop:enable Metrics/PerceivedComplexity
       # rubocop:enable Metrics/CyclomaticComplexity
 
+      sig { params(path: String).returns(T::Array[String]) }
       def expand_workspaces(path)
         path = Pathname.new(path).cleanpath.to_path
         dir = directory.gsub(%r{(^/|/$)}, "")
@@ -367,31 +396,39 @@ module Dependabot
           .select { |filename| File.fnmatch?(path, filename) }
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(T::Hash[T.untyped, T.untyped]) }
       def parsed_file(file)
         TomlRB.parse(file.content)
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
+      sig { returns(Dependabot::DependencyFile) }
       def cargo_toml
-        @cargo_toml ||= fetch_file_from_host("Cargo.toml")
+        @cargo_toml ||= T.let(fetch_file_from_host("Cargo.toml"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def cargo_lock
-        return @cargo_lock if defined?(@cargo_lock)
-
-        @cargo_lock = fetch_file_if_present("Cargo.lock")
+        @cargo_lock ||= T.let(
+          fetch_file_if_present("Cargo.lock"),
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def cargo_config
         return @cargo_config if defined?(@cargo_config)
 
         @cargo_config = fetch_support_file(".cargo/config.toml")
 
-        @cargo_config ||= fetch_support_file(".cargo/config")
-                          &.tap { |f| f.name = ".cargo/config.toml" }
+        @cargo_config ||= T.let(
+          fetch_support_file(".cargo/config")&.tap { |f| f.name = ".cargo/config.toml" },
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def rust_toolchain
         return @rust_toolchain if defined?(@rust_toolchain)
 
@@ -400,8 +437,10 @@ module Dependabot
         # Per https://rust-lang.github.io/rustup/overrides.html the file can
         # have a `.toml` extension, but the non-extension version is preferred.
         # Renaming here to simplify finding it later in the code.
-        @rust_toolchain ||= fetch_support_file("rust-toolchain.toml")
-                            &.tap { |f| f.name = "rust-toolchain" }
+        @rust_toolchain ||= T.let(
+          fetch_support_file("rust-toolchain.toml")&.tap { |f| f.name = "rust-toolchain" },
+          T.nilable(Dependabot::DependencyFile)
+        )
       end
     end
   end

data/lib/dependabot/cargo/file_updater.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "toml-rb"
+
 require "dependabot/git_commit_checker"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
@@ -10,9 +12,12 @@ require "dependabot/shared_helpers"
 module Dependabot
   module Cargo
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/manifest_updater"
       require_relative "file_updater/lockfile_updater"
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /Cargo\.toml$/, # Matches Cargo.toml in the root directory or any subdirectory
@@ -20,6 +25,7 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         # Returns an array of updated files. Only files that have been updated
         # should be returned.
@@ -35,9 +41,9 @@ module Dependabot
             )
         end
 
-        if lockfile && updated_lockfile_content != lockfile.content
+        if lockfile && updated_lockfile_content != T.must(lockfile).content
           updated_files <<
-            updated_file(file: lockfile, content: updated_lockfile_content)
+            updated_file(file: T.must(lockfile), content: updated_lockfile_content)
         end
 
         raise "No files changed!" if updated_files.empty?
@@ -47,10 +53,12 @@ module Dependabot
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No Cargo.toml!" unless get_original_file("Cargo.toml")
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_manifest_content(file)
         ManifestUpdater.new(
           dependencies: dependencies,
@@ -58,24 +66,31 @@ module Dependabot
         ).updated_manifest_content
       end
 
+      sig { returns(String) }
       def updated_lockfile_content
-        @updated_lockfile_content ||=
+        @updated_lockfile_content ||= T.let(
           LockfileUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
             credentials: credentials
-          ).updated_lockfile_content
+          ).updated_lockfile_content,
+          T.nilable(String)
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def manifest_files
-        @manifest_files ||=
+        @manifest_files ||= T.let(
           dependency_files
           .select { |f| f.name.end_with?("Cargo.toml") }
-          .reject(&:support_file?)
+          .reject(&:support_file?),
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("Cargo.lock")
+        @lockfile ||= T.let(get_original_file("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

data/lib/dependabot/cargo/registry_fetcher.rb

@@ -1,41 +1,52 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 
 module Dependabot
   module Cargo
     class RegistryFetcher < Dependabot::FileFetchers::Base
+      extend T::Sig
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.include?("config.json")
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a config.json"
       end
 
+      sig { returns(String) }
       def dl
-        parsed_config_json["dl"].chomp("/")
+        T.must(parsed_config_json["dl"]).chomp("/")
       end
 
+      sig { returns(String) }
       def api
-        parsed_config_json["api"].chomp("/")
+        T.must(parsed_config_json["api"]).chomp("/")
       end
 
       private
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_files
         fetched_files = []
         fetched_files << config_json
       end
 
+      sig { returns(T::Hash[String, String]) }
       def parsed_config_json
-        @parsed_config_json ||= JSON.parse(config_json.content)
+        @parsed_config_json ||= T.let(JSON.parse(T.must(config_json.content)), T.nilable(T::Hash[String, String]))
       end
 
+      sig { returns(Dependabot::DependencyFile) }
       def config_json
-        @config_json ||= fetch_file_from_host("config.json")
+        @config_json ||= T.let(fetch_file_from_host("config.json"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

data/lib/dependabot/cargo/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 ################################################################################
@@ -21,11 +21,12 @@ module Dependabot
       quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
       version_pattern = Cargo::Version::VERSION_PATTERN
 
-      PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze, String)
       PATTERN = /\A#{PATTERN_RAW}\z/
 
       # Use Cargo::Version rather than Gem::Version to ensure that
       # pre-release versions aren't transformed.
+      sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
       def self.parse(obj)
         return ["=", Cargo::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
 
@@ -47,9 +48,10 @@ module Dependabot
         [new(requirement_string)]
       end
 
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
-          req_string.split(",").map(&:strip).map do |r|
+          T.must(req_string).split(",").map(&:strip).map do |r|
             convert_rust_constraint_to_ruby_constraint(r.strip)
           end
         end
@@ -59,6 +61,7 @@ module Dependabot
 
       private
 
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
       def convert_rust_constraint_to_ruby_constraint(req_string)
         if req_string.include?("*")
           ruby_range(req_string.gsub(/(?:\.|^)[*]/, "").gsub(/^[^\d]/, ""))
@@ -70,6 +73,7 @@ module Dependabot
         end
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_tilde_req(req_string)
         version = req_string.gsub(/^~/, "")
         parts = version.split(".")
@@ -77,6 +81,7 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(String) }
       def ruby_range(req_string)
         parts = req_string.split(".")
 
@@ -91,12 +96,13 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^/, "")
         parts = version.split(".")
         first_non_zero = parts.find { |d| d != "0" }
         first_non_zero_index =
-          first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          first_non_zero ? T.must(parts.index(first_non_zero)) : parts.count - 1
         upper_bound = parts.map.with_index do |part, i|
           if i < first_non_zero_index then part
           elsif i == first_non_zero_index then (part.to_i + 1).to_s

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.311.0
+  version: 0.312.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-05-01 00:00:00.000000000 Z
+date: 2025-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.311.0
+        version: 0.312.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.311.0
+        version: 0.312.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -99,98 +99,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -265,7 +265,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.312.0
 rdoc_options: []
 require_paths:
 - lib