dependabot-common 0.238.0 → 0.240.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77312fe42bc6241de9c474fa2a1bab0dd3955bff4c2846bc057e52684f1b48bf
-  data.tar.gz: 72fbe948d041e0d1e2fd717fa98a2358e32413408ed2d147d6cbd58107d8d5ba
+  metadata.gz: c5411b63b39f43e2f41b430d63a0c105d3c8db50e355d3e0fb7b95c37350acc0
+  data.tar.gz: 1dc6db6e42d21fd8626dd06b46b355230db571d061940b358be515804987dec9
 SHA512:
-  metadata.gz: f108dbeb6f04a42d5b5b4e30baecad3d376bd82615e067b3ca2696bbdcefd875c55c4dd18da926b597641691e47edb034244d4d170030cbf8055d3c29e9de3cf
-  data.tar.gz: e14a429b7dadcd27eccd9e049fb6ebd4a405e8e86229eb683c47d1cb72e911a0da4ae3cab50a3a883000f49ef19e33716cfc2a1fd17181d89858da9644ff80e2
+  metadata.gz: 52447502758cd700e913e169bfadb0ad92587e988b5a2086ae77fe01e4ae7a09a985ad2c07b91c6a8ac09f5b2016d15c256f67d698f32bbc45a9b9d271dee489
+  data.tar.gz: 325168ff256723e4d503dcba9818bdf11a969e778edccbbf28882cc560ea67f7eeeb68b5e54e843409abaa19d5f9010f027e929c4f1c827619ca8efd50257093

data/lib/dependabot/config/file.rb

@@ -13,19 +13,19 @@ module Dependabot
       sig { returns(T::Array[T::Hash[Symbol, String]]) }
       attr_reader :updates
 
-      sig { returns T::Array[T.untyped] }
+      sig { returns(T::Hash[Symbol, T::Hash[Symbol, String]]) }
       attr_reader :registries
 
       sig do
         params(
           updates: T.nilable(T::Array[T::Hash[Symbol, String]]),
-          registries: T.nilable(T::Array[T.untyped])
+          registries: T.nilable(T::Hash[Symbol, T::Hash[Symbol, String]])
         )
           .void
       end
       def initialize(updates:, registries: nil)
         @updates = T.let(updates || [], T::Array[T::Hash[Symbol, String]])
-        @registries = T.let(registries || [], T::Array[T.untyped])
+        @registries = T.let(registries || {}, T::Hash[Symbol, T::Hash[Symbol, String]])
       end
 
       sig do

data/lib/dependabot/config/file_fetcher.rb

@@ -1,30 +1,37 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/file_fetchers/base"
 require "dependabot/config/file"
 
 module Dependabot
   module Config
     class FileFetcher < FileFetchers::Base
-      CONFIG_FILE_PATHS = %w(.github/dependabot.yml .github/dependabot.yaml).freeze
+      extend T::Sig
 
+      CONFIG_FILE_PATHS = T.let(%w(.github/dependabot.yml .github/dependabot.yaml).freeze, T::Array[String])
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         CONFIG_FILE_PATHS.any? { |file| filenames.include?(file) }
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain either a #{CONFIG_FILE_PATHS.join(' or a ')} file"
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def config_file
-        @config_file ||= files.first
+        @config_file ||= T.let(files.first, T.nilable(Dependabot::DependencyFile))
       end
 
       private
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_files
-        fetched_files = []
+        fetched_files = T.let([], T::Array[Dependabot::DependencyFile])
 
         CONFIG_FILE_PATHS.each do |file|
           fn = Pathname.new("/#{file}").relative_path_from(directory)

data/lib/dependabot/dependency.rb

@@ -143,7 +143,7 @@ module Dependabot
     def numeric_version
       return unless version && version_class.correct?(version)
 
-      @numeric_version ||= T.let(version_class.new(version), T.nilable(Dependabot::Version))
+      @numeric_version ||= T.let(version_class.new(T.must(version)), T.nilable(Dependabot::Version))
     end
 
     sig { returns(T::Hash[String, T.untyped]) }
@@ -300,7 +300,7 @@ module Dependabot
       requirements.select { |r| requirement_class.new(r[:requirement]).specific? }
     end
 
-    sig { returns(T.class_of(Gem::Requirement)) }
+    sig { returns(T.class_of(Dependabot::Requirement)) }
     def requirement_class
       Utils.requirement_class_for_package_manager(package_manager)
     end

data/lib/dependabot/dependency_file.rb

@@ -14,6 +14,8 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_accessor :content
 
+    # This is the directory of the job source, not the directory of the file itself.
+    # The name actually contains the relative path from the job directory.
     sig { returns(String) }
     attr_accessor :directory
 
@@ -38,11 +40,6 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_accessor :mode
 
-    # The directory that this file was fetched for. This is useful for multi-directory
-    # updates, where a set of files that are related to each other are updated together.
-    sig { returns(T.nilable(String)) }
-    attr_accessor :job_directory
-
     class ContentEncoding
       UTF_8 = "utf-8"
       BASE64 = "base64"
@@ -71,15 +68,14 @@ module Dependabot
         content_encoding: String,
         deleted: T::Boolean,
         operation: String,
-        mode: T.nilable(String),
-        job_directory: T.nilable(String)
+        mode: T.nilable(String)
       )
         .void
     end
     def initialize(name:, content:, directory: "/", type: "file",
                    support_file: false, vendored_file: false, symlink_target: nil,
                    content_encoding: ContentEncoding::UTF_8, deleted: false,
-                   operation: Operation::UPDATE, mode: nil, job_directory: nil)
+                   operation: Operation::UPDATE, mode: nil)
       @name = name
       @content = content
       @directory = T.let(clean_directory(directory), String)
@@ -88,7 +84,6 @@ module Dependabot
       @vendored_file = vendored_file
       @content_encoding = content_encoding
       @operation = operation
-      @job_directory = job_directory
 
       # Make deleted override the operation. Deleted is kept when operation
       # was introduced to keep compatibility with downstream dependants.
@@ -127,7 +122,6 @@ module Dependabot
         "mode" => mode
       }
 
-      details["job_directory"] = job_directory if job_directory
       details["symlink_target"] = symlink_target if symlink_target
       details
     end

data/lib/dependabot/errors.rb

@@ -1,11 +1,14 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
 require "dependabot/utils"
 
 module Dependabot
+  extend T::Sig
+
   # rubocop:disable Metrics/MethodLength
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -70,12 +73,13 @@ module Dependabot
       {
         "error-type": "octokit_rate_limited",
         "error-detail": {
-          "rate-limit-reset": error.response_headers["X-RateLimit-Reset"]
+          "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
     end
   end
 
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.parser_error_details(error)
     case error
     when Dependabot::DependencyFileNotEvaluatable
@@ -136,6 +140,7 @@ module Dependabot
     end
   end
 
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.updater_error_details(error)
     case error
     when Dependabot::DependencyFileNotResolvable
@@ -207,7 +212,7 @@ module Dependabot
       {
         "error-type": "octokit_rate_limited",
         "error-detail": {
-          "rate-limit-reset": error.response_headers["X-RateLimit-Reset"]
+          "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
     end
@@ -376,23 +381,28 @@ module Dependabot
   class DependencyFileNotFound < DependabotError
     extend T::Sig
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     attr_reader :file_path
 
+    sig { params(file_path: T.nilable(String), msg: T.nilable(String)).void }
     def initialize(file_path, msg = nil)
       @file_path = file_path
       super(msg || "#{file_path} not found")
     end
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     def file_name
-      T.must(file_path.split("/").last)
+      return unless file_path
+
+      T.must(file_path).split("/").last
     end
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     def directory
       # Directory should always start with a `/`
-      T.must(file_path.split("/")[0..-2]).join("/").sub(%r{^/*}, "/")
+      return unless file_path
+
+      T.must(T.must(file_path).split("/")[0..-2]).join("/").sub(%r{^/*}, "/")
     end
   end
 
@@ -434,8 +444,9 @@ module Dependabot
     sig { returns(String) }
     attr_reader :source
 
+    sig { params(source: T.nilable(String)).void }
     def initialize(source)
-      @source = T.let(sanitize_source(source), String)
+      @source = T.let(sanitize_source(T.must(source)), String)
       msg = "The following source could not be reached as it requires " \
             "authentication (and any provided details were invalid or lacked " \
             "the required permissions): #{@source}"

data/lib/dependabot/experiments.rb

@@ -1,18 +1,25 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Experiments
-    @experiments = {}
+    extend T::Sig
+
+    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.untyped])
 
+    sig { returns(T::Hash[T.any(String, Symbol), T.untyped]) }
     def self.reset!
       @experiments = {}
     end
 
+    sig { params(name: T.any(String, Symbol), value: T.untyped).void }
     def self.register(name, value)
       @experiments[name.to_sym] = value
     end
 
+    sig { params(name: T.any(String, Symbol)).returns(T::Boolean) }
     def self.enabled?(name)
       !!@experiments[name.to_sym]
     end

data/lib/dependabot/file_fetchers/base.rb

@@ -52,11 +52,15 @@ module Dependabot
         /^fatal: clone of '(?<url>.*)' into submodule path '.*' failed$/
       GIT_SUBMODULE_ERROR_REGEX = /(#{GIT_SUBMODULE_INACCESSIBLE_ERROR})|(#{GIT_SUBMODULE_CLONE_ERROR})/
 
-      sig { abstract.params(filenames: T::Array[String]).returns(T::Boolean) }
-      def self.required_files_in?(filenames); end
+      sig { overridable.params(filenames: T::Array[String]).returns(T::Boolean) }
+      def self.required_files_in?(filenames)
+        filenames.any?
+      end
 
-      sig { abstract.returns(String) }
-      def self.required_files_message; end
+      sig { overridable.returns(String) }
+      def self.required_files_message
+        "Required files are missing from configured directory"
+      end
 
       # Creates a new FileFetcher for retrieving `DependencyFile`s.
       #
@@ -85,6 +89,8 @@ module Dependabot
         @linked_paths = T.let({}, T::Hash[T.untyped, T.untyped])
         @submodules = T.let([], T::Array[T.untyped])
         @options = options
+
+        @files = T.let([], T::Array[DependencyFile])
       end
 
       sig { returns(String) }
@@ -104,10 +110,16 @@ module Dependabot
 
       sig { returns(T::Array[DependencyFile]) }
       def files
-        @files ||= T.let(
-          fetch_files.each { |f| f.job_directory = directory },
-          T.nilable(T::Array[DependencyFile])
-        )
+        return @files if @files.any?
+
+        files = fetch_files.compact
+        raise Dependabot::DependencyFileNotFound.new(nil, "No files found in #{directory}") unless files.any?
+
+        unless self.class.required_files_in?(files.map(&:name))
+          raise DependencyFileNotFound.new(nil, self.class.required_files_message)
+        end
+
+        @files = files
       end
 
       sig { abstract.returns(T::Array[DependencyFile]) }

data/lib/dependabot/metadata_finders.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/metadata_finders/base"
+
 module Dependabot
   module MetadataFinders
-    @metadata_finders = {}
+    extend T::Sig
+
+    @metadata_finders = T.let({}, T::Hash[String, T.class_of(Dependabot::MetadataFinders::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::MetadataFinders::Base)) }
     def self.for_package_manager(package_manager)
       metadata_finder = @metadata_finders[package_manager]
       return metadata_finder if metadata_finder
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, metadata_finder: T.class_of(Dependabot::MetadataFinders::Base)).void }
     def self.register(package_manager, metadata_finder)
       @metadata_finders[package_manager] = metadata_finder
     end

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -1,12 +1,43 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   class PullRequestCreator
     class BranchNamer
       class Base
-        attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length
+        extend T::Sig
+
+        sig { returns(T::Array[Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[DependencyFile]) }
+        attr_reader :files
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_branch
 
+        sig { returns(String) }
+        attr_reader :separator
+
+        sig { returns(String) }
+        attr_reader :prefix
+
+        sig { returns(T.nilable(Integer)) }
+        attr_reader :max_length
+
+        sig do
+          params(
+            dependencies: T::Array[Dependency],
+            files: T::Array[DependencyFile],
+            target_branch: T.nilable(String),
+            separator: String,
+            prefix: String,
+            max_length: T.nilable(Integer)
+          )
+            .void
+        end
         def initialize(dependencies:, files:, target_branch:, separator: "/",
                        prefix: "dependabot", max_length: nil)
           @dependencies  = dependencies
@@ -19,6 +50,7 @@ module Dependabot
 
         private
 
+        sig { params(ref_name: String).returns(String) }
         def sanitize_branch_name(ref_name)
           # General git ref validation
           sanitized_name = sanitize_ref(ref_name)
@@ -27,14 +59,15 @@ module Dependabot
           sanitized_name = sanitized_name.gsub("/", separator)
 
           # Shorten the ref in case users refs have length limits
-          if max_length && (sanitized_name.length > max_length)
-            sha = Digest::SHA1.hexdigest(sanitized_name)[0, max_length]
-            sanitized_name[[max_length - sha.size, 0].max..] = sha
+          if max_length && (sanitized_name.length > T.must(max_length))
+            sha = T.must(Digest::SHA1.hexdigest(sanitized_name)[0, T.must(max_length)])
+            sanitized_name[[T.must(max_length) - sha.size, 0].max..] = sha
           end
 
           sanitized_name
         end
 
+        sig { params(ref: String).returns(String) }
         def sanitize_ref(ref)
           # This isn't a complete implementation of git's ref validation, but it
           # covers most cases that crop up. Its list of allowed characters is a

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -1,13 +1,29 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/pull_request_creator/branch_namer/base"
 
 module Dependabot
   class PullRequestCreator
     class BranchNamer
       class DependencyGroupStrategy < Base
-        def initialize(dependencies:, files:, target_branch:, dependency_group:,
+        extend T::Sig
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            files: T::Array[Dependabot::DependencyFile],
+            target_branch: String,
+            dependency_group: Dependabot::DependencyGroup,
+            includes_security_fixes: T::Boolean,
+            separator: String,
+            prefix: String,
+            max_length: T.nilable(Integer)
+          )
+            .void
+        end
+        def initialize(dependencies:, files:, target_branch:, dependency_group:, includes_security_fixes:,
                        separator: "/", prefix: "dependabot", max_length: nil)
           super(
             dependencies: dependencies,
@@ -15,20 +31,24 @@ module Dependabot
             target_branch: target_branch,
             separator: separator,
             prefix: prefix,
-            max_length: max_length
+            max_length: max_length,
           )
 
           @dependency_group = dependency_group
+          @includes_security_fixes = includes_security_fixes
         end
 
+        sig { returns(String) }
         def new_branch_name
           sanitize_branch_name(File.join(prefixes, group_name_with_dependency_digest))
         end
 
         private
 
+        sig { returns(Dependabot::DependencyGroup) }
         attr_reader :dependency_group
 
+        sig { returns(T::Array[String]) }
         def prefixes
           [
             prefix,
@@ -44,22 +64,33 @@ module Dependabot
         #
         # Let's append a short hash digest of the dependency changes so that we can
         # meet this guarantee.
+        sig { returns(String) }
         def group_name_with_dependency_digest
-          "#{dependency_group.name}-#{dependency_digest}"
+          if @includes_security_fixes
+            "group-security-#{package_manager}-#{dependency_digest}"
+          else
+            "#{dependency_group.name}-#{dependency_digest}"
+          end
         end
 
+        sig { returns(T.nilable(String)) }
         def dependency_digest
-          @dependency_digest ||= Digest::MD5.hexdigest(dependencies.map do |dependency|
-            "#{dependency.name}-#{dependency.removed? ? 'removed' : dependency.version}"
-          end.sort.join(",")).slice(0, 10)
+          @dependency_digest ||= T.let(
+            Digest::MD5.hexdigest(dependencies.map do |dependency|
+                                    "#{dependency.name}-#{dependency.removed? ? 'removed' : dependency.version}"
+                                  end.sort.join(",")).slice(0, 10),
+            T.nilable(String)
+          )
         end
 
+        sig { returns(String) }
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
+        sig { returns(String) }
         def directory
-          files.first.directory.tr(" ", "-")
+          T.must(files.first).directory.tr(" ", "-")
         end
       end
     end

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -38,31 +38,31 @@ module Dependabot
           [
             prefix,
             package_manager,
-            files.first.directory.tr(" ", "-"),
+            T.must(files.first).directory.tr(" ", "-"),
             target_branch
           ].compact
         end
 
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
         def updating_a_property?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :property_name) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :property_name) }
         end
 
         def updating_a_dependency_set?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :dependency_set) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :dependency_set) }
         end
 
         def property_name
-          @property_name ||= dependencies.first.requirements
-                                         .find { |r| r.dig(:metadata, :property_name) }
-                                         &.dig(:metadata, :property_name)
+          @property_name ||= T.must(dependencies.first).requirements
+                              .find { |r| r.dig(:metadata, :property_name) }
+                              &.dig(:metadata, :property_name)
 
           raise "No property name!" unless @property_name
 
@@ -70,9 +70,9 @@ module Dependabot
         end
 
         def dependency_set
-          @dependency_set ||= dependencies.first.requirements
-                                          .find { |r| r.dig(:metadata, :dependency_set) }
-                                          &.dig(:metadata, :dependency_set)
+          @dependency_set ||= T.must(dependencies.first).requirements
+                               .find { |r| r.dig(:metadata, :dependency_set) }
+                               &.dig(:metadata, :dependency_set)
 
           raise "No dependency set!" unless @dependency_set
 
@@ -82,7 +82,7 @@ module Dependabot
         def branch_version_suffix
           dep = dependencies.first
 
-          if dep.removed?
+          if T.must(dep).removed?
             "-removed"
           elsif library? && ref_changed?(dep) && new_ref(dep)
             new_ref(dep)

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -11,10 +11,11 @@ require "dependabot/pull_request_creator/branch_namer/dependency_group_strategy"
 module Dependabot
   class PullRequestCreator
     class BranchNamer
-      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group
+      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group,
+                  :includes_security_fixes
 
       def initialize(dependencies:, files:, target_branch:, dependency_group: nil,
-                     separator: "/", prefix: "dependabot", max_length: nil)
+                     separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes: false)
         @dependencies  = dependencies
         @files         = files
         @target_branch = target_branch
@@ -22,6 +23,7 @@ module Dependabot
         @separator     = separator
         @prefix        = prefix
         @max_length    = max_length
+        @includes_security_fixes = includes_security_fixes
       end
 
       def new_branch_name
@@ -47,6 +49,7 @@ module Dependabot
               files: files,
               target_branch: target_branch,
               dependency_group: dependency_group,
+              includes_security_fixes: includes_security_fixes,
               separator: separator,
               prefix: prefix,
               max_length: max_length

data/lib/dependabot/pull_request_creator/github.rb

@@ -210,7 +210,7 @@ module Dependabot
 
             {
               path: file.realpath,
-              mode: (file.mode || Dependabot::DependencyFile::Mode::FILE),
+              mode: file.mode || Dependabot::DependencyFile::Mode::FILE,
               type: "blob"
             }.merge(content)
           end