dependabot-cargo 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '05078f5575e3921c69b7c00b73064f0e2a49992c0296b6fabfcb1ac0ea8fc9e9'
-  data.tar.gz: 9b1f99e9db2b5534f35abef47de2762a3e9e209e9f48f4723c1277b3b1369046
+  metadata.gz: 45898e2e894023fb481da89044263d6f4a3e6791719c40cc1413815ed5d3abf2
+  data.tar.gz: bd691e2c7daf7172a83dc39929e6cedd5e221b57edaac7b83b52d54e3235956a
 SHA512:
-  metadata.gz: d8ec56f6721d1322f29d426ccef73f17cdb4c9ba586633ea81e31a5f20853437d50e5cbf62fc1b85fbf4bf0d3fe30f8d0916d0b5c327ccac1391d70d428982dc
-  data.tar.gz: 26a80a7d0d5381a61293990a10768b7960bf97544a8df163ec65b2dc96c9cbfc66aa0c311107428f5e9af65e7f69889a185def6ef7b4244ecdd51f31da7ae6c9
+  metadata.gz: 6baf89c602bf3f9585415500d7020d6fa6b2437e87e51c0c8a94beca3bca91a7cbc09d8504449b8126a86b933e5b43413d70ead886377aaff3b2df5dde805c55
+  data.tar.gz: c19750334737189611ae01268d90bd0e3c759e64004ba2aad9acf25e6974f816fa3dd3a2640bb7898275aa42d09815429e737ddfe2621364d8f8e910f1382573

data/lib/dependabot/cargo/file_parser.rb

@@ -42,7 +42,7 @@ module Dependabot
         # TODO: Currently, Dependabot can't handle dependencies that have
         # multiple sources. Fix that!
         dependencies.reject do |dep|
-          dep.requirements.map { |r| r.fetch(:source) }.uniq.count > 1
+          dep.requirements.map(&:source).uniq.count > 1
         end
       end
 

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -255,8 +255,8 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def git_source_url
           dependency.previous_requirements
-                    &.find { |r| r.dig(:source, :type) == "git" }
-                    &.dig(:source, :url)
+                    &.find { |r| r.source_string("type") == "git" }
+                    &.source_string("url")
         end
 
         sig { returns(String) }
@@ -779,9 +779,9 @@ module Dependabot
         # only when no current git source exists.
         sig { params(key: Symbol).returns(T.nilable(String)) }
         def git_source_detail(key)
-          source = dependency.requirements.find { |r| r.dig(:source, :type) == "git" }&.dig(:source) ||
-                   dependency.previous_requirements&.find { |r| r.dig(:source, :type) == "git" }&.dig(:source)
-          source&.dig(key)
+          requirement = dependency.requirements.find { |r| r.source_string("type") == "git" } ||
+                        dependency.previous_requirements&.find { |r| r.source_string("type") == "git" }
+          requirement&.source_string(key.to_s)
         end
 
         sig do

data/lib/dependabot/cargo/file_updater/manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -65,7 +65,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - (dependency.previous_requirements || [])
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |requirement| requirement.file == file.name }
         end
 
         sig { params(content: String, filename: String, dependency: Dependabot::Dependency).returns(String) }
@@ -82,16 +82,16 @@ module Dependabot
           reqs.each do |new_req, old_req|
             next if old_req.nil?
 
-            raise "Bad req match" unless new_req[:file] == old_req[:file]
-            next if new_req[:requirement] == old_req[:requirement]
-            next unless new_req[:file] == filename
+            raise "Bad req match" unless new_req.file == old_req.file
+            next if new_req.requirement == old_req.requirement
+            next unless new_req.file == filename
 
             updated_content =
               update_manifest_req(
                 content: updated_content,
                 dep: dependency,
-                old_req: old_req.fetch(:requirement),
-                new_req: new_req.fetch(:requirement)
+                old_req: T.must(old_req.requirement_string),
+                new_req: T.must(new_req.requirement_string)
               )
           end
 
@@ -102,13 +102,13 @@ module Dependabot
         def update_git_pin(content:, filename:, dependency:)
           updated_pin =
             dependency.requirements
-                      .find { |r| r[:file] == filename }
-                      &.dig(:source, :ref)
+                      .find { |r| r.file == filename }
+                      &.source_string("ref")
 
           old_pin =
             dependency.previous_requirements
-                      &.find { |r| r[:file] == filename }
-                      &.dig(:source, :ref)
+                      &.find { |r| r.file == filename }
+                      &.source_string("ref")
 
           return content unless old_pin
 
@@ -116,7 +116,7 @@ module Dependabot
             content: content,
             dep: dependency,
             old_pin: old_pin,
-            new_pin: updated_pin
+            new_pin: T.must(updated_pin)
           )
         end
 

data/lib/dependabot/cargo/file_updater/workspace_manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -39,7 +39,7 @@ module Dependabot
 
         sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
         def workspace_dependency?(dep)
-          dep.requirements.any? { |r| r[:groups]&.include?("workspace.dependencies") }
+          dep.requirements.any? { |r| r.groups&.include?("workspace.dependencies") }
         end
 
         sig { params(content: String, dep: Dependabot::Dependency).returns(String) }
@@ -66,8 +66,8 @@ module Dependabot
 
         sig { params(requirements: T.nilable(T::Array[Dependabot::DependencyRequirement])).returns(T.nilable(String)) }
         def find_workspace_requirement(requirements)
-          requirements&.find { |r| r[:groups]&.include?("workspace.dependencies") }
-                      &.fetch(:requirement)
+          requirements&.find { |r| r.groups&.include?("workspace.dependencies") }
+                      &.requirement_string
         end
 
         sig { params(section: String, dep_name: String, old_req: String, new_req: String).returns(String) }

data/lib/dependabot/cargo/metadata_finder.rb

@@ -54,26 +54,15 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        info = T.cast(
-          dependency.requirements.filter_map { |r| r[:source] }.first,
-          T.nilable(T::Hash[T.any(String, Symbol), T.anything])
-        )
-        return unless info
-
-        url = info[:url] || info["url"]
-        Source.from_url(T.cast(url, T.nilable(String)))
+        Source.from_url(dependency.source_string("url", allowed_types: ["git"]))
       end
 
       sig { returns(T.nilable(T::Hash[String, T.anything])) }
       def crates_listing
         return @crates_listing unless @crates_listing.nil?
 
-        info = T.cast(
-          dependency.requirements.filter_map { |r| r[:source] }.first,
-          T.nilable(T::Hash[T.any(String, Symbol), T.anything])
-        )
-        index = T.cast((info && (info[:index] || info["index"])) || CRATES_IO_API, String)
-        hdrs = build_headers(index, info)
+        index = dependency.source_string("index") || CRATES_IO_API
+        hdrs = build_headers(index, dependency.source_string("name"))
 
         url = metadata_fetch_url(dependency, index)
         response = fetch_metadata(url, hdrs)
@@ -82,16 +71,14 @@ module Dependabot
       end
 
       sig do
-        params(index: String, info: T.nilable(T::Hash[T.any(String, Symbol), T.anything]))
+        params(index: String, registry_name: T.nilable(String))
           .returns(T::Hash[String, String])
       end
-      def build_headers(index, info)
+      def build_headers(index, registry_name)
         hdrs = { "User-Agent" => "Dependabot (dependabot.com)" }
         return hdrs if index == CRATES_IO_API
+        return hdrs if registry_name.nil?
 
-        return hdrs if info.nil?
-
-        registry_name = T.cast(info["name"] || info[:name], T.nilable(String))
         credentials.find { |cred| cred["type"] == "cargo_registry" && cred["registry"] == registry_name }&.tap do |cred|
           hdrs["Authorization"] = "Token #{cred['token']}"
         end

data/lib/dependabot/cargo/package/package_details_fetcher.rb

@@ -75,11 +75,10 @@ module Dependabot
         def crates_listing
           return @crates_listing unless @crates_listing.nil?
 
-          info = fetch_dependency_info
-          index = fetch_index(info)
+          index = fetch_index
 
           hdrs = default_headers
-          hdrs.merge!(auth_headers(info)) if index != CRATES_IO_API
+          hdrs.merge!(auth_headers) if index != CRATES_IO_API
 
           url = metadata_fetch_url(dependency, index)
 
@@ -95,17 +94,9 @@ module Dependabot
           T.must(@crates_listing)
         end
 
-        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
-        def fetch_dependency_info
-          T.cast(
-            dependency.requirements.filter_map { |r| r[:source] }.first,
-            T.nilable(T::Hash[T.any(String, Symbol), T.anything])
-          )
-        end
-
-        sig { params(info: T.nilable(T::Hash[T.any(String, Symbol), T.anything])).returns(String) }
-        def fetch_index(info)
-          T.cast((info && (info[:index] || info["index"])) || CRATES_IO_API, String)
+        sig { returns(String) }
+        def fetch_index
+          dependency.source_string("index") || CRATES_IO_API
         end
 
         sig { returns(T::Hash[String, String]) }
@@ -113,9 +104,9 @@ module Dependabot
           { "User-Agent" => "Dependabot (dependabot.com)" }
         end
 
-        sig { params(info: T.nilable(T::Hash[T.any(String, Symbol), T.anything])).returns(T::Hash[String, String]) }
-        def auth_headers(info)
-          registry_name = T.cast(info && (info[:name] || info["name"]), T.nilable(String))
+        sig { returns(T::Hash[String, String]) }
+        def auth_headers
+          registry_name = dependency.source_string("name")
           registry_creds = credentials.find do |cred|
             cred["type"] == "cargo_registry" && cred["registry"] == registry_name
           end
@@ -178,7 +169,7 @@ module Dependabot
           return true if dependency.numeric_version&.prerelease?
 
           dependency.requirements.any? do |req|
-            reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
+            reqs = (req.requirement_string || "").split(",").map(&:strip)
             reqs.any? { |r| r.match?(/[A-Za-z]/) }
           end
         end

data/lib/dependabot/cargo/update_checker/file_preparer.rb

@@ -238,8 +238,8 @@ module Dependabot
         sig { params(filename: String).returns(String) }
         def temporary_requirement_for_resolution(filename)
           original_req = dependency.requirements
-                                   .find { |r| r.fetch(:file) == filename }
-                                   &.fetch(:requirement)
+                                   .find { |r| r.file == filename }
+                                   &.requirement_string
 
           lower_bound_req =
             if original_req && !unlock_requirement?
@@ -268,11 +268,12 @@ module Dependabot
               dependency.version
             else
               version_from_requirement =
-                dependency.requirements.filter_map { |r| r.fetch(:requirement) }
-                                       .flat_map { |req_str| Cargo::Requirement.new(req_str) }
-                                       .flat_map(&:requirements)
-                                       .reject { |req_array| req_array.first.start_with?("<") }
-                                       .map(&:last)
+                dependency.requirements
+                          .filter_map(&:requirement_string)
+                          .flat_map { |req_str| Cargo::Requirement.new(req_str) }
+                          .flat_map(&:requirements)
+                          .reject { |req_array| req_array.first.start_with?("<") }
+                          .map(&:last)
                           .max&.to_s
 
               version_from_requirement || 0

data/lib/dependabot/cargo/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -49,7 +49,7 @@ module Dependabot
           return true if dependency.numeric_version&.prerelease?
 
           dependency.requirements.any? do |req|
-            reqs = (req.fetch(:requirement) || "").split(",").map(&:strip)
+            reqs = (req.requirement_string || "").split(",").map(&:strip)
             reqs.any? { |r| r.match?(/[A-Za-z]/) }
           end
         end

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -36,7 +36,7 @@ module Dependabot
         sig do
           params(
             requirements: T::Array[Dependabot::DependencyRequirement],
-            updated_source: T.nilable(T::Hash[T.any(String, Symbol), T.anything]),
+            updated_source: T.nilable(Dependabot::DependencyRequirement::ObjectHash),
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             target_version: T.nilable(T.any(String, Gem::Version))
           ).void
@@ -71,7 +71,7 @@ module Dependabot
           requirements.map do |req|
             req = Dependabot::DependencyRequirement.create(req.merge(source: updated_source))
             next req unless target_version
-            next req if req[:requirement].nil?
+            next req if req.requirement.nil?
 
             # TODO: Add a RequirementsUpdateStrategy::WidenRanges options
             if update_strategy == Dependabot::RequirementsUpdateStrategy::BumpVersionsIfNecessary
@@ -87,7 +87,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
+        sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
         attr_reader :updated_source
 
         sig { returns(Dependabot::RequirementsUpdateStrategy) }
@@ -105,7 +105,7 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement(req)
-          string_reqs = req[:requirement].split(",").map(&:strip)
+          string_reqs = T.must(req.requirement_string).split(",").map(&:strip)
 
           new_requirement =
             if (exact_req = exact_req(string_reqs))
@@ -128,7 +128,7 @@ module Dependabot
 
         sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_version_requirement_if_needed(req)
-          string_reqs = req[:requirement].split(",").map(&:strip)
+          string_reqs = T.must(req.requirement_string).split(",").map(&:strip)
           ruby_reqs = string_reqs.map { |r| Dependabot::Cargo::Requirement.new(r) }
 
           return req if ruby_reqs.all? { |r| r.satisfied_by?(target_version) }

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -485,8 +485,8 @@ module Dependabot
             )
             next unless checker.git_dependency?
 
-            url = T.must(dep.requirements.find { |r| r.dig(:source, :type) == "git" })
-                   .fetch(:source).fetch(:url)
+            requirement = T.must(dep.requirements.find { |r| r.source_string("type") == "git" })
+            url = T.must(requirement.source_string("url"))
 
             if checker.git_repo_reachable?
               T.must(@reachable_git_urls) << url
@@ -616,8 +616,8 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def git_source_url
           dependency.requirements
-                    .find { |r| r.dig(:source, :type) == "git" }
-                    &.dig(:source, :url)
+                    .find { |r| r.source_string("type") == "git" }
+                    &.source_string("url")
         end
 
         sig { returns(String) }

data/lib/dependabot/cargo/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -221,7 +221,8 @@ module Dependabot
         # of the latest tag that looks like a version.
         if git_commit_checker.pinned_ref_looks_like_version?
           latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
-          return latest_tag&.fetch(:commit_sha) || dependency.version
+          commit_sha = T.cast(latest_tag&.fetch(:commit_sha), T.nilable(String))
+          return commit_sha || dependency.version
         end
 
         # If the dependency is pinned to a tag that doesn't look like a
@@ -241,7 +242,7 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
-          return T.must(new_tag).fetch(:commit_sha)
+          return T.cast(T.must(new_tag).fetch(:commit_sha), String)
         end
 
         # If the dependency is pinned then there's nothing we can do.
@@ -270,7 +271,7 @@ module Dependabot
           dependency_files: dependency_files,
           dependency: dependency,
           unlock_requirement: true,
-          replacement_git_pin: replacement_tag.fetch(:tag)
+          replacement_git_pin: T.cast(replacement_tag.fetch(:tag), String)
         ).prepared_dependency_files
 
         VersionResolver.new(
@@ -353,7 +354,7 @@ module Dependabot
         latest_resolvable_version
       end
 
-      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
+      sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -362,18 +363,39 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = T.must(git_commit_checker.local_tag_for_latest_version(update_cooldown))
-          return T.must(dependency_source_details).merge(ref: new_tag.fetch(:tag))
+          return source_with_ref(T.must(dependency_source_details), T.cast(new_tag.fetch(:tag), String))
         end
 
         # Otherwise return the original source
         dependency_source_details
       end
 
-      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
+      sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
       def dependency_source_details
         dependency.source_details
       end
 
+      sig do
+        params(
+          source: Dependabot::DependencyRequirement::ObjectHash,
+          ref: String
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def source_with_ref(source, ref)
+        updated_source = source.dup
+        key = if source.key?(:ref)
+                :ref
+              elsif source.key?("ref")
+                "ref"
+              elsif source.keys.any?(Symbol)
+                :ref
+              else
+                "ref"
+              end
+        updated_source[key] = ref
+        updated_source
+      end
+
       sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib