dependabot-common 0.232.0 → 0.234.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 07f0955f06c02ad1e76f3fb987d63ad6eb391442e0bf51a66f51f20020437cf1
-  data.tar.gz: 660dd52a79fc8529d621dec221849c0baa09de69a3e3cef6bc71d5c3ae322387
+  metadata.gz: 621688a92a0526cbe086c2fe30d824e0827ba4d98f7a7f4218560f80311579a2
+  data.tar.gz: 9643f1ea4eb456787c3b6db3962e0c5fe67cb793fff44415be1b4c6d1f6d79c0
 SHA512:
-  metadata.gz: 42194277fe832e0590ecb48037a90d06943d33d514216f82fd028a4822215292042b6b1f0fb9dfce7728d2100e8b0ef1571b9d067fbbc7492807c0db371e860e
-  data.tar.gz: 5f0397b9b76dc38c1adc68c86dd8ef37c16b516ff36f6a8ef0e2f94c285ecbc5586395ede542af9133a3137e24593304a5fcc3199cc7208e93f1dada63c06519
+  metadata.gz: a3461d4923d3826280c52e4ddbb936e55ec13e2f1d448b8a99b66a2f0d6996a5db592f06810084b8f8a9795c1d4d7070d40f24bbe3e444b1563ac61cc58cd35f
+  data.tar.gz: 9903829aa7321ee5c3f7840a62bc32baa9c6be48d3b4ad682c939b65a78d965d7ff0c6eefbe683a868b4af945aeb204d12c8c4a908fe9f597346a4ff08a4d6ce

data/lib/dependabot/clients/azure.rb

@@ -1,12 +1,15 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
 require "excon"
+require "sorbet-runtime"
 
 module Dependabot
   module Clients
     class Azure
+      extend T::Sig
+
       class NotFound < StandardError; end
 
       class InternalServerError < StandardError; end
@@ -253,8 +256,9 @@ module Dependabot
         JSON.parse(response.body).fetch("value")
       end
 
+      sig { params(url: String).returns(Excon::Response) }
       def get(url)
-        response = nil
+        response = T.let(nil, T.nilable(Excon::Response))
 
         retry_connection_failures do
           response = Excon.get(
@@ -267,20 +271,21 @@ module Dependabot
             )
           )
 
-          raise InternalServerError if response.status == 500
-          raise BadGateway if response.status == 502
-          raise ServiceNotAvailable if response.status == 503
+          raise InternalServerError if response&.status == 500
+          raise BadGateway if response&.status == 502
+          raise ServiceNotAvailable if response&.status == 503
         end
 
-        raise Unauthorized if response.status == 401
-        raise Forbidden if response.status == 403
-        raise NotFound if response.status == 404
+        raise Unauthorized if response&.status == 401
+        raise Forbidden if response&.status == 403
+        raise NotFound if response&.status == 404
 
-        response
+        T.must(response)
       end
 
-      def post(url, json)
-        response = nil
+      sig { params(url: String, json: String).returns(Excon::Response) }
+      def post(url, json) # rubocop:disable Metrics/PerceivedComplexity
+        response = T.let(nil, T.nilable(Excon::Response))
 
         retry_connection_failures do
           response = Excon.post(
@@ -298,25 +303,26 @@ module Dependabot
             )
           )
 
-          raise InternalServerError if response.status == 500
-          raise BadGateway if response.status == 502
-          raise ServiceNotAvailable if response.status == 503
+          raise InternalServerError if response&.status == 500
+          raise BadGateway if response&.status == 502
+          raise ServiceNotAvailable if response&.status == 503
         end
 
-        raise Unauthorized if response.status == 401
+        raise Unauthorized if response&.status == 401
 
-        if response.status == 403
+        if response&.status == 403
           raise TagsCreationForbidden if tags_creation_forbidden?(response)
 
           raise Forbidden
         end
-        raise NotFound if response.status == 404
+        raise NotFound if response&.status == 404
 
-        response
+        T.must(response)
       end
 
+      sig { params(url: String, json: String).returns(Excon::Response) }
       def patch(url, json)
-        response = nil
+        response = T.let(nil, T.nilable(Excon::Response))
 
         retry_connection_failures do
           response = Excon.patch(
@@ -334,16 +340,16 @@ module Dependabot
             )
           )
 
-          raise InternalServerError if response.status == 500
-          raise BadGateway if response.status == 502
-          raise ServiceNotAvailable if response.status == 503
+          raise InternalServerError if response&.status == 500
+          raise BadGateway if response&.status == 502
+          raise ServiceNotAvailable if response&.status == 503
         end
 
-        raise Unauthorized if response.status == 401
-        raise Forbidden if response.status == 403
-        raise NotFound if response.status == 404
+        raise Unauthorized if response&.status == 401
+        raise Forbidden if response&.status == 403
+        raise NotFound if response&.status == 404
 
-        response
+        T.must(response)
       end
 
       private

data/lib/dependabot/clients/bitbucket.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"

data/lib/dependabot/clients/bitbucket_with_retries.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require_relative "bitbucket"
@@ -30,7 +30,7 @@ module Dependabot
 
       def initialize(max_retries: 3, **args)
         @max_retries = max_retries || 3
-        @client = Bitbucket.new(**args)
+        @client = Bitbucket.new(**T.unsafe(args))
       end
 
       def method_missing(method_name, *args, &block)

data/lib/dependabot/clients/codecommit.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -6,6 +6,8 @@ require "dependabot/shared_helpers"
 module Dependabot
   module Clients
     class CodeCommit
+      extend T::Sig
+
       class NotFound < StandardError; end
 
       #######################

data/lib/dependabot/clients/github_with_retries.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "octokit"
@@ -67,7 +67,7 @@ module Dependabot
       #################
 
       def fetch_commit(repo, branch)
-        response = ref(repo, "heads/#{branch}")
+        response = T.unsafe(self).ref(repo, "heads/#{branch}")
 
         raise Octokit::NotFound if response.is_a?(Array)
 
@@ -75,7 +75,7 @@ module Dependabot
       end
 
       def fetch_default_branch(repo)
-        repository(repo).default_branch
+        T.unsafe(self).repository(repo).default_branch
       end
 
       ############

data/lib/dependabot/clients/gitlab_with_retries.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "gitlab"
@@ -50,11 +50,11 @@ module Dependabot
       #################
 
       def fetch_commit(repo, branch)
-        branch(repo, branch).commit.id
+        T.unsafe(self).branch(repo, branch).commit.id
       end
 
       def fetch_default_branch(repo)
-        project(repo).default_branch
+        T.unsafe(self).project(repo).default_branch
       end
 
       ############

data/lib/dependabot/dependency_group.rb

@@ -10,21 +10,12 @@ require "yaml"
 
 module Dependabot
   class DependencyGroup
-    attr_reader :name, :rules, :dependencies, :handled_dependencies
+    attr_reader :name, :rules, :dependencies
 
     def initialize(name:, rules:)
       @name = name
       @rules = rules
       @dependencies = []
-      @handled_dependencies = Set.new
-    end
-
-    def add_to_handled(*dependencies)
-      @handled_dependencies += dependencies.map(&:name)
-    end
-
-    def add_all_to_handled
-      @handled_dependencies += dependencies.map(&:name)
     end
 
     def contains?(dependency)

data/lib/dependabot/errors.rb

@@ -76,6 +76,20 @@ module Dependabot
   # File level errors #
   #####################
 
+  class ToolVersionNotSupported < DependabotError
+    attr_reader :tool_name, :detected_version, :supported_versions
+
+    def initialize(tool_name, detected_version, supported_versions)
+      @tool_name = tool_name
+      @detected_version = detected_version
+      @supported_versions = supported_versions
+
+      msg = "Dependabot detected the following #{tool_name} requirement for your project: '#{detected_version}'." \
+            "\n\nCurrently, the following #{tool_name} versions are supported in Dependabot: #{supported_versions}."
+      super(msg)
+    end
+  end
+
   class DependencyFileNotFound < DependabotError
     attr_reader :file_path
 

data/lib/dependabot/file_fetchers.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/file_fetchers/base"
+
 module Dependabot
   module FileFetchers
-    @file_fetchers = {}
+    extend T::Sig
+
+    @file_fetchers = T.let({}, T::Hash[String, T.class_of(Dependabot::FileFetchers::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::FileFetchers::Base)) }
     def self.for_package_manager(package_manager)
       file_fetcher = @file_fetchers[package_manager]
       return file_fetcher if file_fetcher
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, file_fetcher: T.class_of(Dependabot::FileFetchers::Base)).void }
     def self.register(package_manager, file_fetcher)
       @file_fetchers[package_manager] = file_fetcher
     end

data/lib/dependabot/file_parsers.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/file_parsers/base"
+
 module Dependabot
   module FileParsers
-    @file_parsers = {}
+    extend T::Sig
+
+    @file_parsers = T.let({}, T::Hash[String, T.class_of(Dependabot::FileParsers::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::FileParsers::Base)) }
     def self.for_package_manager(package_manager)
       file_parser = @file_parsers[package_manager]
       return file_parser if file_parser
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, file_parser: T.class_of(Dependabot::FileParsers::Base)).void }
     def self.register(package_manager, file_parser)
       @file_parsers[package_manager] = file_parser
     end

data/lib/dependabot/file_updaters.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/file_updaters/base"
+
 module Dependabot
   module FileUpdaters
-    @file_updaters = {}
+    extend T::Sig
+
+    @file_updaters = T.let({}, T::Hash[String, T.class_of(Dependabot::FileUpdaters::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::FileUpdaters::Base)) }
     def self.for_package_manager(package_manager)
       file_updater = @file_updaters[package_manager]
       return file_updater if file_updater
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, file_updater: T.class_of(Dependabot::FileUpdaters::Base)).void }
     def self.register(package_manager, file_updater)
       @file_updaters[package_manager] = file_updater
     end

data/lib/dependabot/git_commit_checker.rb

@@ -24,12 +24,13 @@ module Dependabot
 
     def initialize(dependency:, credentials:,
                    ignored_versions: [], raise_on_ignored: false,
-                   consider_version_branches_pinned: false)
+                   consider_version_branches_pinned: false, dependency_source_details: nil)
       @dependency = dependency
       @credentials = credentials
       @ignored_versions = ignored_versions
       @raise_on_ignored = raise_on_ignored
       @consider_version_branches_pinned = consider_version_branches_pinned
+      @dependency_source_details = dependency_source_details
     end
 
     def git_dependency?
@@ -65,7 +66,11 @@ module Dependabot
     end
 
     def pinned_ref_looks_like_commit_sha?
-      ref_looks_like_commit_sha?(ref)
+      return false unless ref && ref_looks_like_commit_sha?(ref)
+
+      return false unless pinned?
+
+      local_repo_git_metadata_fetcher.head_commit_for_ref(ref).nil?
     end
 
     def head_commit_for_pinned_ref
@@ -73,11 +78,7 @@ module Dependabot
     end
 
     def ref_looks_like_commit_sha?(ref)
-      return false unless ref&.match?(/^[0-9a-f]{6,40}$/)
-
-      return false unless pinned?
-
-      local_repo_git_metadata_fetcher.head_commit_for_ref(ref).nil?
+      ref.match?(/^[0-9a-f]{6,40}$/)
     end
 
     def branch_or_ref_in_release?(version)
@@ -160,7 +161,15 @@ module Dependabot
     end
 
     def dependency_source_details
-      dependency.source_details(allowed_types: ["git"])
+      @dependency_source_details || dependency.source_details(allowed_types: ["git"])
+    end
+
+    def most_specific_version_tag_for_sha(commit_sha)
+      tags = local_tags.select { |t| t.commit_sha == commit_sha && version_class.correct?(t.name) }
+                       .sort_by { |t| version_class.new(t.name) }
+      return if tags.empty?
+
+      tags[-1].name
     end
 
     private
@@ -188,14 +197,6 @@ module Dependabot
       version.split(".").length
     end
 
-    def most_specific_version_tag_for_sha(commit_sha)
-      tags = local_tags.select { |t| t.commit_sha == commit_sha && version_class.correct?(t.name) }
-                       .sort_by { |t| version_class.new(t.name) }
-      return if tags.empty?
-
-      tags[-1].name
-    end
-
     def allowed_versions(local_tags)
       tags =
         local_tags

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -62,7 +62,7 @@ module Dependabot
         def property_name
           @property_name ||= dependencies.first.requirements
                                          .find { |r| r.dig(:metadata, :property_name) }
-                             &.dig(:metadata, :property_name)
+                                         &.dig(:metadata, :property_name)
 
           raise "No property name!" unless @property_name
 
@@ -72,7 +72,7 @@ module Dependabot
         def dependency_set
           @dependency_set ||= dependencies.first.requirements
                                           .find { |r| r.dig(:metadata, :dependency_set) }
-                              &.dig(:metadata, :dependency_set)
+                                          &.dig(:metadata, :dependency_set)
 
           raise "No dependency set!" unless @dependency_set
 

data/lib/dependabot/pull_request_creator/github.rb

@@ -247,8 +247,7 @@ module Dependabot
           @branch_name = ref.gsub(%r{^refs/heads/}, "")
           branch
         rescue Octokit::UnprocessableEntity => e
-          # Return quietly in the case of a race
-          return nil if e.message.match?(/Reference already exists/i)
+          raise if e.message.match?(/Reference already exists/i)
 
           retrying_branch_creation ||= false
           raise if retrying_branch_creation

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -416,7 +416,7 @@ module Dependabot
       def property_name
         @property_name ||= dependencies.first.requirements
                                        .find { |r| r.dig(:metadata, :property_name) }
-                           &.dig(:metadata, :property_name)
+                                       &.dig(:metadata, :property_name)
 
         raise "No property name!" unless @property_name
 
@@ -426,7 +426,7 @@ module Dependabot
       def dependency_set
         @dependency_set ||= dependencies.first.requirements
                                         .find { |r| r.dig(:metadata, :dependency_set) }
-                            &.dig(:metadata, :dependency_set)
+                                        &.dig(:metadata, :dependency_set)
 
         raise "No dependency set!" unless @dependency_set
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -393,8 +393,8 @@ module Dependabot
 
         @recent_codecommit_commit_messages.commits
                                           .find { |c| c.author.email == dependabot_email }
-          &.message
-          &.strip
+                                          &.message
+                                          &.strip
       end
 
       def azure_commit_author_email(commit)

data/lib/dependabot/shared_helpers.rb

@@ -64,7 +64,7 @@ module Dependabot
 
       def initialize(message:, error_context:, error_class: nil, trace: nil)
         super(message)
-        @error_class = error_class || ""
+        @error_class = error_class || "HelperSubprocessFailed"
         @error_context = error_context
         @fingerprint = error_context[:fingerprint] || error_context[:command]
         @trace = trace
@@ -142,8 +142,8 @@ module Dependabot
         error_context: error_context
       )
     end
-    # rubocop:enable Metrics/MethodLength
 
+    # rubocop:enable Metrics/MethodLength
     def self.check_out_of_memory_error(stderr, error_context)
       return unless stderr&.include?("JavaScript heap out of memory")
 

data/lib/dependabot/update_checkers.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/update_checkers/base"
+
 module Dependabot
   module UpdateCheckers
-    @update_checkers = {}
+    extend T::Sig
+
+    @update_checkers = T.let({}, T::Hash[String, T.class_of(Dependabot::UpdateCheckers::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::UpdateCheckers::Base)) }
     def self.for_package_manager(package_manager)
       update_checker = @update_checkers[package_manager]
       return update_checker if update_checker
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, update_checker: T.class_of(Dependabot::UpdateCheckers::Base)).void }
     def self.register(package_manager, update_checker)
       @update_checkers[package_manager] = update_checker
     end

data/lib/dependabot/utils.rb

@@ -1,18 +1,23 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "tmpdir"
 require "set"
+require "sorbet-runtime"
+require "dependabot/version"
 
 # TODO: in due course, these "registries" should live in a wrapper gem, not
 #       dependabot-core.
 module Dependabot
   module Utils
+    extend T::Sig
+
     BUMP_TMP_FILE_PREFIX = "dependabot_"
-    BUMP_TMP_DIR_PATH = File.expand_path(Dir::Tmpname.create("", "tmp") { nil })
+    BUMP_TMP_DIR_PATH = T.let(File.expand_path(Dir::Tmpname.create("", "tmp") { nil }), String)
 
-    @version_classes = {}
+    @version_classes = T.let({}, T::Hash[String, T.class_of(Dependabot::Version)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::Version)) }
     def self.version_class_for_package_manager(package_manager)
       version_class = @version_classes[package_manager]
       return version_class if version_class
@@ -20,12 +25,14 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, version_class: T.class_of(Dependabot::Version)).void }
     def self.register_version_class(package_manager, version_class)
       @version_classes[package_manager] = version_class
     end
 
-    @requirement_classes = {}
+    @requirement_classes = T.let({}, T::Hash[String, T.class_of(Gem::Requirement)])
 
+    sig { params(package_manager: String).returns(T.class_of(Gem::Requirement)) }
     def self.requirement_class_for_package_manager(package_manager)
       requirement_class = @requirement_classes[package_manager]
       return requirement_class if requirement_class
@@ -33,16 +40,19 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, requirement_class: T.class_of(Gem::Requirement)).void }
     def self.register_requirement_class(package_manager, requirement_class)
       @requirement_classes[package_manager] = requirement_class
     end
 
-    @cloning_package_managers = Set[]
+    @cloning_package_managers = T.let(Set[], T::Set[String])
 
+    sig { params(package_manager: String).returns(T::Boolean) }
     def self.always_clone_for_package_manager?(package_manager)
       @cloning_package_managers.include?(package_manager)
     end
 
+    sig { params(package_manager: String).void }
     def self.register_always_clone(package_manager)
       @cloning_package_managers << package_manager
     end

data/lib/dependabot.rb

@@ -1,6 +1,6 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.232.0"
+  VERSION = "0.234.0"
 end

data/lib/wildcard_matcher.rb

@@ -1,7 +1,10 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 class WildcardMatcher
+  extend T::Sig
+
+  sig { params(wildcard_string: T.nilable(String), candidate_string: T.nilable(String)).returns(T::Boolean) }
   def self.match?(wildcard_string, candidate_string)
     return false unless wildcard_string && candidate_string
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.232.0
+  version: 0.234.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-14 00:00:00.000000000 Z
+date: 2023-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -228,14 +228,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: 0.5.11026
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: 0.5.11026
 - !ruby/object:Gem::Dependency
   name: toml-rb
   requirement: !ruby/object:Gem::Requirement
@@ -284,20 +284,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: parallel_tests
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 4.2.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 4.2.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -396,6 +382,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.2.16
+- !ruby/object:Gem::Dependency
+  name: turbo_tests
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -514,7 +514,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.232.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.234.0
 post_install_message: 
 rdoc_options: []
 require_paths: