dependabot-common 0.246.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afa14b1e2f804f1713004ae03cf9ba9ac2ed546794d736bbeedef24d18f8be7b
-  data.tar.gz: 012a72964c4ae5f6140ab6a81d101f227bd84445a2e04b77395252ae66771bc8
+  metadata.gz: c92ad460f0349deb2012116104501e807bd6d061fe4f5a96a0cfbd8128d3b78b
+  data.tar.gz: f0668f3d3a2106c3245416727393e8a0a2e284fa1f44d05b40d531c4b31b2f38
 SHA512:
-  metadata.gz: 367510a477d1b7a1d362f69a8a4a8bdcfb1d89f355f442291d3640c247391e924612b51bbe3393b146dcfb621d1faf53ab7dc364bf4eba134c17389a781d4ba0
-  data.tar.gz: ae0d0af76bbea879c4cf4faec7c1be85067cec9918c1c7ad2818b60c160d5da93bcb11a5c3bd9287d4b9f11256de46eb0758f56db98ef2586ec2c3d4e514ed17
+  metadata.gz: 8a12d9ebf2c2ab8075e431704cdd3733c854b91b4c0abe761e33d8a9b64a18d9ecb303d063d11f5e0f10200a4b0199409e28ff0e36593eb0288163074cb2e74a
+  data.tar.gz: cb05c3efac2f10c2d6eea5758d0d50eed8cd77d7681c3d0a505b94f43a3cccb2fd436efdbd08bab73cd2940f8dfbba91e61dbbea6a929054d7318dd71d3d7ae3

data/lib/dependabot/errors.rb

@@ -7,6 +7,18 @@ require "dependabot/utils"
 module Dependabot
   extend T::Sig
 
+  module ErrorAttributes
+    BACKTRACE         = "error-backtrace"
+    CLASS             = "error-class"
+    DETAILS           = "error-details"
+    FINGERPRINT       = "fingerprint"
+    MESSAGE           = "error-message"
+    DEPENDENCIES      = "job-dependencies"
+    DEPENDENCY_GROUPS = "job-dependency-groups"
+    JOB_ID            = "job-id"
+    PACKAGE_MANAGER   = "package-manager"
+  end
+
   # rubocop:disable Metrics/MethodLength
   sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.fetcher_error_details(error)

data/lib/dependabot/file_fetchers/base.rb

@@ -354,11 +354,6 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Boolean) }
-      def recurse_submodules_when_cloning?
-        false
-      end
-
       sig do
         returns(
           T.any(
@@ -776,7 +771,6 @@ module Dependabot
       # rubocop:disable Metrics/MethodLength
       # rubocop:disable Metrics/PerceivedComplexity
       # rubocop:disable Metrics/BlockLength
-      # rubocop:disable Metrics/CyclomaticComplexity
       sig { params(target_directory: T.nilable(String)).returns(String) }
       def _clone_repo_contents(target_directory:)
         SharedHelpers.with_git_configured(credentials: credentials) do
@@ -789,11 +783,7 @@ module Dependabot
 
           clone_options = StringIO.new
           clone_options << "--no-tags --depth 1"
-          clone_options << if recurse_submodules_when_cloning?
-                             " --recurse-submodules --shallow-submodules"
-                           else
-                             " --no-recurse-submodules"
-                           end
+          clone_options << " --recurse-submodules --shallow-submodules"
           clone_options << " --branch #{source.branch} --single-branch" if source.branch
 
           submodule_cloning_failed = false
@@ -805,7 +795,7 @@ module Dependabot
               CMD
             )
 
-            @submodules = find_submodules(path) if recurse_submodules_when_cloning?
+            @submodules = find_submodules(path)
           rescue SharedHelpers::HelperSubprocessFailed => e
             if GIT_RETRYABLE_ERRORS.any? { |error| error.match?(e.message) } && retries < 5
               retries += 1
@@ -835,20 +825,20 @@ module Dependabot
             Dir.chdir(path) do
               fetch_options = StringIO.new
               fetch_options << "--depth 1"
-              fetch_options << if recurse_submodules_when_cloning? && !submodule_cloning_failed
-                                 " --recurse-submodules=on-demand"
-                               else
+              fetch_options << if submodule_cloning_failed
                                  " --no-recurse-submodules"
+                               else
+                                 " --recurse-submodules=on-demand"
                                end
               # Need to fetch the commit due to the --depth 1 above.
               SharedHelpers.run_shell_command("git fetch #{fetch_options.string} origin #{source.commit}")
 
               reset_options = StringIO.new
               reset_options << "--hard"
-              reset_options << if recurse_submodules_when_cloning? && !submodule_cloning_failed
-                                 " --recurse-submodules"
-                               else
+              reset_options << if submodule_cloning_failed
                                  " --no-recurse-submodules"
+                               else
+                                 " --recurse-submodules"
                                end
               # Set HEAD to this commit so later calls so git reset HEAD will work.
               SharedHelpers.run_shell_command("git reset #{reset_options.string} #{source.commit}")
@@ -862,7 +852,6 @@ module Dependabot
       # rubocop:enable Metrics/MethodLength
       # rubocop:enable Metrics/PerceivedComplexity
       # rubocop:enable Metrics/BlockLength
-      # rubocop:enable Metrics/CyclomaticComplexity
 
       sig { params(str: String).returns(String) }
       def decode_binary_string(str)

data/lib/dependabot/file_updaters/base.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+
 require "dependabot/credential"
 
 module Dependabot
@@ -9,6 +10,7 @@ module Dependabot
     class Base
       extend T::Sig
       extend T::Helpers
+
       abstract!
 
       sig { returns(T::Array[Dependabot::Dependency]) }

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -46,7 +46,7 @@ module Dependabot
           [
             prefix,
             package_manager,
-            T.must(files.first).directory.tr(" ", "-"),
+            files.first&.directory&.tr(" ", "-"),
             target_branch
           ].compact
         end

data/lib/dependabot/pull_request_creator/message_builder/issue_linker.rb

@@ -21,10 +21,10 @@ module Dependabot
           /\[(?<tag>(?:\#|GH-)?\d+)\]\(\)/i
         ].freeze, T::Array[Regexp])
 
-        sig { returns(String) }
+        sig { returns(T.nilable(String)) }
         attr_reader :source_url
 
-        sig { params(source_url: String).void }
+        sig { params(source_url: T.nilable(String)).void }
         def initialize(source_url:)
           @source_url = source_url
         end
@@ -46,9 +46,18 @@ module Dependabot
                      .match("#{REPO_REGEX}#{TAG_REGEX}")
                      &.named_captures
                      &.fetch("repo", nil)
-              source = repo ? "https://github.com/#{repo}" : source_url
 
-              "[#{repo ? (repo + tag) : tag}](#{source}/issues/#{number})"
+              source = if repo
+                         "https://github.com/#{repo}"
+                       elsif source_url
+                         source_url
+                       end
+
+              if source
+                "[#{repo ? (repo + tag) : tag}](#{source}/issues/#{number})"
+              else
+                issue_link
+              end
             end
           end
         end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -233,10 +233,17 @@ module Dependabot
 
       sig { returns(String) }
       def group_pr_name
+        directories_from_dependencies = dependencies.to_set { |dep| dep.metadata[:directory] }
+
+        directories_with_updates = source.directories&.filter do |directory|
+          directories_from_dependencies.include?(directory)
+        end
+
         updates = dependencies.map(&:name).uniq.count
 
         if source.directories
-          "bump the #{T.must(dependency_group).name} across #{T.must(source.directories).count} directories " \
+          "bump the #{T.must(dependency_group).name} across #{T.must(directories_with_updates).count} " \
+            "#{T.must(directories_with_updates).count > 1 ? 'directories' : 'directory'} " \
             "with #{updates} update#{'s' if updates > 1}"
         else
           "bump the #{T.must(dependency_group).name} group#{pr_name_directory} with #{updates} update#{if updates > 1

data/lib/dependabot/registry_client.rb

@@ -19,7 +19,7 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[Symbol, T.untyped],
+        headers: T::Hash[T.any(String, Symbol), T.untyped],
         options: T::Hash[Symbol, T.untyped]
       )
         .returns(Excon::Response)
@@ -40,7 +40,7 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[Symbol, T.untyped],
+        headers: T::Hash[T.any(String, Symbol), T.untyped],
         options: T::Hash[Symbol, T.untyped]
       )
         .returns(Excon::Response)

data/lib/dependabot/requirements_update_strategy.rb

@@ -0,0 +1,13 @@
+# typed: strong
+# frozen_string_literal: true
+
+module Dependabot
+  class RequirementsUpdateStrategy < T::Enum
+    enums do
+      BumpVersions = new("bump_versions")
+      BumpVersionsIfNecessary = new("bump_versions_if_necessary")
+      LockfileOnly = new("lockfile_only")
+      WidenRanges = new("widen_ranges")
+    end
+  end
+end

data/lib/dependabot/update_checkers/base.rb

@@ -4,8 +4,9 @@
 require "json"
 require "sorbet-runtime"
 
-require "dependabot/utils"
+require "dependabot/requirements_update_strategy"
 require "dependabot/security_advisory"
+require "dependabot/utils"
 
 module Dependabot
   module UpdateCheckers
@@ -34,7 +35,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
       attr_reader :security_advisories
 
-      sig { returns(T.nilable(Symbol)) }
+      sig { returns(T.nilable(Dependabot::RequirementsUpdateStrategy)) }
       attr_reader :requirements_update_strategy
 
       sig { returns(T.nilable(Dependabot::DependencyGroup)) }
@@ -52,7 +53,7 @@ module Dependabot
           ignored_versions: T::Array[String],
           raise_on_ignored: T::Boolean,
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
-          requirements_update_strategy: T.nilable(Symbol),
+          requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           options: T::Hash[Symbol, T.untyped]
         )

data/lib/dependabot/update_checkers/version_filters.rb

@@ -9,11 +9,21 @@ module Dependabot
       extend T::Sig
 
       sig do
-        params(
-          versions_array: T::Array[T.any(Gem::Version, T::Hash[Symbol, Gem::Version])],
-          security_advisories: T::Array[SecurityAdvisory]
-        )
-          .returns(T::Array[T.any(Gem::Version, T::Hash[Symbol, Gem::Version])])
+        # Tricky generics explanation:
+        # There's a type T that is either a Gem::Version or a Hash with a :version key
+        # The method returns an array of T
+        # So whichever is provided as input, the output will be an array of the same type.
+        # https://sorbet.org/docs/generics#placing-bounds-on-generic-methods
+        type_parameters(:T)
+          .params(
+            versions_array: T::Array[
+              T.any(
+                T.all(T.type_parameter(:T), Gem::Version),
+                T.all(T.type_parameter(:T), T::Hash[Symbol, Gem::Version])
+              )],
+            security_advisories: T::Array[SecurityAdvisory]
+          )
+          .returns(T::Array[T.type_parameter(:T)])
       end
       def self.filter_vulnerable_versions(versions_array, security_advisories)
         versions_array.reject do |v|

data/lib/dependabot/version.rb

@@ -10,59 +10,22 @@ module Dependabot
 
     abstract!
 
-    sig do
-      override
-        .overridable
-        .params(
-          version: T.any(
-            String,
-            Integer,
-            Float,
-            Gem::Version,
-            NilClass
-          )
-        )
-        .void
-    end
+    VersionParameter = T.type_alias { T.nilable(T.any(String, Integer, Gem::Version)) }
+
+    sig { override.overridable.params(version: VersionParameter).void }
     def initialize(version)
       @original_version = T.let(version.to_s, String)
 
-      T.unsafe(super(version))
+      super
     end
 
-    sig do
-      override
-        .overridable
-        .params(
-          version: T.any(
-            String,
-            Integer,
-            Float,
-            Gem::Version,
-            NilClass
-          )
-        )
-        .returns(Dependabot::Version)
-    end
+    sig { override.overridable.params(version: VersionParameter).returns(Dependabot::Version) }
     def self.new(version)
       T.cast(super, Dependabot::Version)
     end
 
     # Opt-in to Rubygems 4 behavior
-    sig do
-      override
-        .overridable
-        .params(
-          version: T.any(
-            String,
-            Integer,
-            Float,
-            Gem::Version,
-            NilClass
-          )
-        )
-        .returns(T::Boolean)
-    end
+    sig { override.overridable.params(version: VersionParameter).returns(T::Boolean) }
     def self.correct?(version)
       return false if version.nil?
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.246.0"
+  VERSION = "0.247.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.246.0
+  version: 0.247.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-01 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -390,6 +390,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.19.0
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.27.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -547,6 +561,7 @@ files:
 - lib/dependabot/pull_request_updater/gitlab.rb
 - lib/dependabot/registry_client.rb
 - lib/dependabot/requirement.rb
+- lib/dependabot/requirements_update_strategy.rb
 - lib/dependabot/security_advisory.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
@@ -567,7 +582,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.246.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
 post_install_message: 
 rdoc_options: []
 require_paths: