dependabot-common 0.237.0 → 0.239.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e29557fff3ec856a4ebcb95a2b53dd70f91b5d7f2ea66cd6230e90dbcbbc2dc0
-  data.tar.gz: f6b2ce2a845422872e58b37681909fb4357bb1ebcac22c1085db113dc2429426
+  metadata.gz: 05ce845694a06ef06ec108aada0ff902b7b08a7a8fc41c23531e00b2252436ae
+  data.tar.gz: 72cc39025cf3a411bed2f82d113474dae965e57c06b15d1abe78f93794562c8c
 SHA512:
-  metadata.gz: 367d715ab3cb1b0c2c498555419e2212e9986c8e824128ce56695c00cdc190371fa0b7b9115258146ff0573f2e4a8461e1c66651b9d84bb2fdb7b0fe00b901ff
-  data.tar.gz: 4e5b3e040476f17cb7cf268ccc0cae90f17178da6a5954b14ca2a2ce280cf0f067b1ce8b88ecc8da5c04ae919cc34b670258b1555f9bfb707fb061cc8439acb3
+  metadata.gz: ee1859d83b60cf7ddeab1b98c04666198da262a86c5875ed6ff586c9637c877075d9687b3657f38e0bcbf5669584d545a790a2c68e82e9499e5c30b4353d9890
+  data.tar.gz: c4f99509fbd5846a9d07caa227cc67152933da70bea50246c1d6fe20ab9fc67cbb6d141753b89a4b7ed08bf9a73e4520a3c738fa33f4169ea5a19225db9698c6

data/lib/dependabot/clients/codecommit.rb

@@ -1,6 +1,7 @@
 # typed: true
 # frozen_string_literal: true
 
+require "aws-sdk-codecommit"
 require "dependabot/shared_helpers"
 
 module Dependabot

data/lib/dependabot/config/file.rb

@@ -13,19 +13,19 @@ module Dependabot
       sig { returns(T::Array[T::Hash[Symbol, String]]) }
       attr_reader :updates
 
-      sig { returns T::Array[T.untyped] }
+      sig { returns(T::Hash[Symbol, T::Hash[Symbol, String]]) }
       attr_reader :registries
 
       sig do
         params(
           updates: T.nilable(T::Array[T::Hash[Symbol, String]]),
-          registries: T.nilable(T::Array[T.untyped])
+          registries: T.nilable(T::Hash[Symbol, T::Hash[Symbol, String]])
         )
           .void
       end
       def initialize(updates:, registries: nil)
         @updates = T.let(updates || [], T::Array[T::Hash[Symbol, String]])
-        @registries = T.let(registries || [], T::Array[T.untyped])
+        @registries = T.let(registries || {}, T::Hash[Symbol, T::Hash[Symbol, String]])
       end
 
       sig do

data/lib/dependabot/dependency.rb

@@ -1,14 +1,23 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/version"
 
 module Dependabot
   class Dependency
-    @production_checks = {}
-    @display_name_builders = {}
-    @name_normalisers = {}
+    extend T::Sig
 
+    @production_checks = T.let(
+      {},
+      T::Hash[String, T.proc.params(arg0: T::Array[T.untyped]).returns(T::Boolean)]
+    )
+    @display_name_builders = T.let({}, T::Hash[String, T.proc.params(arg0: String).returns(String)])
+    @name_normalisers = T.let({}, T::Hash[String, T.proc.params(arg0: String).returns(String)])
+
+    sig do
+      params(package_manager: String).returns(T.proc.params(arg0: T::Array[T.untyped]).returns(T::Boolean))
+    end
     def self.production_check_for_package_manager(package_manager)
       production_check = @production_checks[package_manager]
       return production_check if production_check
@@ -16,62 +25,128 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig do
+      params(
+        package_manager: String,
+        production_check: T.proc.params(arg0: T::Array[T.untyped]).returns(T::Boolean)
+      )
+        .returns(T.proc.params(arg0: T::Array[T.untyped]).returns(T::Boolean))
+    end
     def self.register_production_check(package_manager, production_check)
       @production_checks[package_manager] = production_check
     end
 
+    sig { params(package_manager: String).returns(T.nilable(T.proc.params(arg0: String).returns(String))) }
     def self.display_name_builder_for_package_manager(package_manager)
       @display_name_builders[package_manager]
     end
 
+    sig { params(package_manager: String, name_builder: T.proc.params(arg0: String).returns(String)).void }
     def self.register_display_name_builder(package_manager, name_builder)
       @display_name_builders[package_manager] = name_builder
     end
 
+    sig { params(package_manager: String).returns(T.nilable(T.proc.params(arg0: String).returns(String))) }
     def self.name_normaliser_for_package_manager(package_manager)
       @name_normalisers[package_manager] || ->(name) { name }
     end
 
+    sig do
+      params(
+        package_manager: String,
+        name_builder: T.proc.params(arg0: String).returns(String)
+      ).void
+    end
     def self.register_name_normaliser(package_manager, name_builder)
       @name_normalisers[package_manager] = name_builder
     end
 
-    attr_reader :name, :version, :requirements, :package_manager,
-                :previous_version, :previous_requirements,
-                :subdependency_metadata, :metadata
+    sig { returns(String) }
+    attr_reader :name
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :version
+
+    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+    attr_reader :requirements
+
+    sig { returns(String) }
+    attr_reader :package_manager
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :previous_version
 
+    sig { returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
+    attr_reader :previous_requirements
+
+    sig { returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
+    attr_reader :subdependency_metadata
+
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    attr_reader :metadata
+
+    sig do
+      params(
+        name: String,
+        requirements: T::Array[T::Hash[String, String]],
+        package_manager: String,
+        # TODO: Make version a Dependabot::Version everywhere
+        version: T.nilable(T.any(String, Dependabot::Version)),
+        previous_version: T.nilable(String),
+        previous_requirements: T.nilable(T::Array[T::Hash[String, String]]),
+        subdependency_metadata: T.nilable(T::Array[T::Hash[String, String]]),
+        removed: T::Boolean,
+        metadata: T.nilable(T::Hash[String, String])
+      ).void
+    end
     def initialize(name:, requirements:, package_manager:, version: nil,
                    previous_version: nil, previous_requirements: nil,
                    subdependency_metadata: [], removed: false, metadata: {})
       @name = name
-      @version = version
-      @requirements = requirements.map { |req| symbolize_keys(req) }
+      @version = T.let(
+        case version
+        when Dependabot::Version then version.to_s
+        when String then version
+        end,
+        T.nilable(String)
+      )
+      @requirements = T.let(requirements.map { |req| symbolize_keys(req) }, T::Array[T::Hash[Symbol, String]])
       @previous_version = previous_version
-      @previous_requirements =
-        previous_requirements&.map { |req| symbolize_keys(req) }
+      @previous_requirements = T.let(
+        previous_requirements&.map { |req| symbolize_keys(req) },
+        T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+      )
       @package_manager = package_manager
       unless top_level? || subdependency_metadata == []
-        @subdependency_metadata = subdependency_metadata
-                                  &.map { |h| symbolize_keys(h) }
+        @subdependency_metadata = T.let(
+          subdependency_metadata&.map { |h| symbolize_keys(h) },
+          T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+        )
       end
       @removed = removed
-      @metadata = symbolize_keys(metadata || {})
+      @metadata = T.let(symbolize_keys(metadata || {}), T::Hash[Symbol, T.untyped])
 
       check_values
     end
 
+    sig { returns(T::Boolean) }
     def top_level?
       requirements.any?
     end
 
+    sig { returns(T::Boolean) }
     def removed?
       @removed
     end
 
+    sig { returns(T.nilable(Dependabot::Version)) }
     def numeric_version
-      @numeric_version ||= version_class.new(version) if version && version_class.correct?(version)
+      return unless version && version_class.correct?(version)
+
+      @numeric_version ||= T.let(version_class.new(version), T.nilable(Dependabot::Version))
     end
 
+    sig { returns(T::Hash[String, T.untyped]) }
     def to_h
       {
         "name" => name,
@@ -85,10 +160,12 @@ module Dependabot
       }.compact
     end
 
+    sig { returns(T::Boolean) }
     def appears_in_lockfile?
-      previous_version || (version && previous_requirements.nil?)
+      !!(previous_version || (version && previous_requirements.nil?))
     end
 
+    sig { returns(T::Boolean) }
     def production?
       return subdependency_production_check unless top_level?
 
@@ -99,10 +176,12 @@ module Dependabot
           .call(groups)
     end
 
+    sig { returns(T::Boolean) }
     def subdependency_production_check
       !subdependency_metadata&.all? { |h| h[:production] == false }
     end
 
+    sig { returns(String) }
     def display_name
       display_name_builder =
         self.class.display_name_builder_for_package_manager(package_manager)
@@ -111,6 +190,7 @@ module Dependabot
       display_name_builder.call(name)
     end
 
+    sig { returns(T.nilable(String)) }
     def humanized_previous_version
       # If we don't have a previous version, we *may* still be able to figure
       # one out if a ref was provided and has been changed (in which case the
@@ -119,48 +199,52 @@ module Dependabot
         return ref_changed? ? previous_ref : nil
       end
 
-      if previous_version.match?(/^[0-9a-f]{40}/)
+      if T.must(previous_version).match?(/^[0-9a-f]{40}/)
         return previous_ref if ref_changed? && previous_ref
 
-        "`#{previous_version[0..6]}`"
+        "`#{T.must(previous_version)[0..6]}`"
       elsif version == previous_version &&
             package_manager == "docker"
-        digest = docker_digest_from_reqs(previous_requirements)
-        "`#{digest.split(':').last[0..6]}`"
+        digest = docker_digest_from_reqs(T.must(previous_requirements))
+        "`#{T.must(T.must(digest).split(':').last)[0..6]}`"
       else
         previous_version
       end
     end
 
+    sig { returns(T.nilable(String)) }
     def humanized_version
       return if removed?
 
-      if version.match?(/^[0-9a-f]{40}/)
+      if T.must(version).match?(/^[0-9a-f]{40}/)
         return new_ref if ref_changed? && new_ref
 
-        "`#{version[0..6]}`"
+        "`#{T.must(version)[0..6]}`"
       elsif version == previous_version &&
             package_manager == "docker"
         digest = docker_digest_from_reqs(requirements)
-        "`#{digest.split(':').last[0..6]}`"
+        "`#{T.must(T.must(digest).split(':').last)[0..6]}`"
       else
         version
       end
     end
 
+    sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(String)) }
     def docker_digest_from_reqs(requirements)
       requirements
         .filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }
         .first
     end
 
+    sig { returns(T.nilable(String)) }
     def previous_ref
-      previous_refs = previous_requirements.filter_map do |r|
+      previous_refs = T.must(previous_requirements).filter_map do |r|
         r.dig(:source, "ref") || r.dig(:source, :ref)
       end.uniq
       previous_refs.first if previous_refs.count == 1
     end
 
+    sig { returns(T.nilable(String)) }
     def new_ref
       new_refs = requirements.filter_map do |r|
         r.dig(:source, "ref") || r.dig(:source, :ref)
@@ -168,12 +252,14 @@ module Dependabot
       new_refs.first if new_refs.count == 1
     end
 
+    sig { returns(T::Boolean) }
     def ref_changed?
       previous_ref != new_ref
     end
 
     # Returns all detected versions of the dependency. Only ecosystems that
     # support this feature will return more than the current version.
+    sig { returns(T::Array[T.nilable(String)]) }
     def all_versions
       all_versions = metadata[:all_versions]
       return [version].compact unless all_versions
@@ -184,34 +270,52 @@ module Dependabot
     # This dependency is being indirectly updated by an update to another
     # dependency. We don't need to try and update it ourselves but want to
     # surface it to the user in the PR.
+    sig { returns(T.nilable(T::Boolean)) }
     def informational_only?
       metadata[:information_only]
     end
 
+    sig { params(other: T.anything).returns(T::Boolean) }
     def ==(other)
-      other.instance_of?(self.class) && to_h == other.to_h
+      case other
+      when Dependency
+        to_h == other.to_h
+      else
+        false
+      end
     end
 
+    sig { returns(Integer) }
     def hash
       to_h.hash
     end
 
+    sig { params(other: T.anything).returns(T::Boolean) }
     def eql?(other)
       self == other
     end
 
+    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
     def specific_requirements
       requirements.select { |r| requirement_class.new(r[:requirement]).specific? }
     end
 
+    sig { returns(T.class_of(Gem::Requirement)) }
     def requirement_class
       Utils.requirement_class_for_package_manager(package_manager)
     end
 
+    sig { returns(T.class_of(Dependabot::Version)) }
     def version_class
       Utils.version_class_for_package_manager(package_manager)
     end
 
+    sig do
+      params(
+        allowed_types: T.nilable(T::Array[String])
+      )
+        .returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+    end
     def source_details(allowed_types: nil)
       sources = all_sources.uniq.compact
       sources.select! { |source| allowed_types.include?(source[:type].to_s) } if allowed_types
@@ -225,6 +329,7 @@ module Dependabot
       sources.first
     end
 
+    sig { returns(T.nilable(String)) }
     def source_type
       details = source_details
       return "default" if details.nil?
@@ -232,11 +337,12 @@ module Dependabot
       details[:type] || details.fetch("type")
     end
 
+    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
     def all_sources
       if top_level?
         requirements.map { |requirement| requirement.fetch(:source) }
       elsif subdependency_metadata
-        subdependency_metadata.filter_map { |data| data[:source] }
+        T.must(subdependency_metadata).filter_map { |data| data[:source] }
       else
         []
       end
@@ -244,6 +350,7 @@ module Dependabot
 
     private
 
+    sig { void }
     def check_values
       raise ArgumentError, "blank strings must not be provided as versions" if [version, previous_version].any?("")
 
@@ -251,6 +358,7 @@ module Dependabot
       check_subdependency_metadata
     end
 
+    sig { void }
     def check_requirement_fields
       requirement_fields = [requirements, previous_requirements].compact
       unless requirement_fields.all?(Array) &&
@@ -273,15 +381,17 @@ module Dependabot
       raise ArgumentError, "blank strings must not be provided as requirements"
     end
 
+    sig { void }
     def check_subdependency_metadata
       return unless subdependency_metadata
 
       unless subdependency_metadata.is_a?(Array) &&
-             subdependency_metadata.all?(Hash)
+             T.must(subdependency_metadata).all?(Hash)
         raise ArgumentError, "subdependency_metadata must be an array of hashes"
       end
     end
 
+    sig { params(hash: T::Hash[String, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
     def symbolize_keys(hash)
       hash.keys.to_h { |k| [k.to_sym, hash[k]] }
     end

data/lib/dependabot/dependency_file.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "pathname"