dependabot-common 0.381.0 → 0.383.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d1bc1965fa1a1b0995cf9a71e47f098f471c2727513d3a69d7c8cf35b82a3cc3
-  data.tar.gz: 4273d18c7f649c135c28db5f864d82dc120f56a683a2b5fd823a09a486fc530b
+  metadata.gz: 1fb1a4d6243812d664a20067d226c2eec111080d39e7337217744a58a9d8f0b6
+  data.tar.gz: 609737fc8b6040222a744d58ea03f8587fec15136cb835d319c31b798f7ebf32
 SHA512:
-  metadata.gz: 72acbd4917a61c50117d9014f26ac4cae89567215682764b01506c1a36f4eb80df3245f4ca4cad9ad7ab0f5d834e9e4540a67a6ea0dab5441d2d9c0a62f6acff
-  data.tar.gz: d2acef41e94afb6b5d0d171139e615adbbcc491e89a35ec78d7852b2d745e301ea3f9ec212b035452f7898cdfd791c8e2ff25decf021e5bc2fbda58011879688
+  metadata.gz: 5e3042cb52f78e0396e75a3c6707a6706a1e2f4f1e12fc16310079eae0ae08336f688a75a92795cc6a8ba50ba62b9d0b9168b3ca4d5780439c7bccf574ab4179
+  data.tar.gz: a15d7f181d2d4afd8b5bf3e72f0450827d435f8e61e98f7863bfa0c254e8e2b983bb831901f1c95d27da8abfe791bf673d6c6e7fcc29b8d5e61c0e3c631ea9e6

data/lib/dependabot/config/ignore_condition.rb

@@ -52,7 +52,7 @@ module Dependabot
         update_types.map(&:downcase).filter_map(&:strip)
       end
 
-      sig { params(dependency: Dependency).returns(T::Array[T.untyped]) }
+      sig { params(dependency: Dependency).returns(T::Array[String]) }
       def versions_by_type(dependency)
         version = correct_version_for(dependency)
         return [] unless version

data/lib/dependabot/credential.rb

@@ -11,10 +11,20 @@ module Dependabot
 
     def_delegators :@credential, :fetch, :keys, :[]=, :delete, :slice, :values, :entries
 
-    sig { params(credential: T::Hash[String, T.any(T::Boolean, String)]).void }
+    sig { params(credential: T::Hash[String, T.any(T::Boolean, String, T::Array[String])]).void }
     def initialize(credential)
       @replaces_base = T.let(credential["replaces-base"] == true, T::Boolean)
       credential.delete("replaces-base")
+
+      raw_scope = credential.delete("scope")
+      @scope = T.let(
+        case raw_scope
+        when String then [raw_scope]
+        when Array then raw_scope
+        end,
+        T.nilable(T::Array[String])
+      )
+
       @credential = T.let(T.unsafe(credential), T::Hash[String, String])
     end
 
@@ -23,6 +33,9 @@ module Dependabot
       @replaces_base
     end
 
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :scope
+
     sig { params(key: String).returns(T.nilable(String)) }
     def [](key)
       @credential[key]

data/lib/dependabot/dependency.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency_requirement"
 require "dependabot/version"
 
 module Dependabot
@@ -90,7 +91,7 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :version
 
-    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+    sig { returns(T::Array[Dependabot::DependencyRequirement]) }
     attr_reader :requirements
 
     sig { returns(String) }
@@ -99,7 +100,7 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :previous_version
 
-    sig { returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
+    sig { returns(T.nilable(T::Array[Dependabot::DependencyRequirement])) }
     attr_reader :previous_requirements
 
     sig { returns(T.nilable(String)) }
@@ -124,7 +125,6 @@ module Dependabot
     sig { returns(T.nilable(Time)) }
     attr_accessor :attribution_timestamp
 
-    # rubocop:disable Metrics/AbcSize
     # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
@@ -162,12 +162,15 @@ module Dependabot
         T.nilable(String)
       )
       @version = nil if @version == ""
-      @requirements = T.let(requirements.map { |req| symbolize_keys(req) }, T::Array[T::Hash[Symbol, T.untyped]])
+      @requirements = T.let(
+        requirements.map { |req| DependencyRequirement.create(req) },
+        T::Array[Dependabot::DependencyRequirement]
+      )
       @previous_version = previous_version
       @previous_version = nil if @previous_version == ""
       @previous_requirements = T.let(
-        previous_requirements&.map { |req| symbolize_keys(req) },
-        T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+        previous_requirements&.map { |req| DependencyRequirement.create(req) },
+        T.nilable(T::Array[Dependabot::DependencyRequirement])
       )
       @package_manager = package_manager
       @directory = directory
@@ -181,7 +184,6 @@ module Dependabot
       @metadata = T.let(symbolize_keys(metadata || {}), T::Hash[Symbol, T.untyped])
       check_values
     end
-    # rubocop:enable Metrics/AbcSize
     # rubocop:enable Metrics/PerceivedComplexity
 
     sig { returns(T::Boolean) }
@@ -272,7 +274,7 @@ module Dependabot
       end
     end
 
-    sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(String)) }
+    sig { params(requirements: T::Array[Dependabot::DependencyRequirement]).returns(T.nilable(String)) }
     def docker_digest_from_reqs(requirements)
       requirements
         .filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }
@@ -340,9 +342,9 @@ module Dependabot
       self == other
     end
 
-    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+    sig { returns(T::Array[Dependabot::DependencyRequirement]) }
     def specific_requirements
-      requirements.select { |r| requirement_class.new(r[:requirement]).specific? }
+      requirements.select { |r| requirement_class.new(r.requirement).specific? }
     end
 
     sig { returns(T.class_of(Dependabot::Requirement)) }

data/lib/dependabot/dependency_file.rb

@@ -123,7 +123,7 @@ module Dependabot
       raise "Only symlinked files must specify a target!" if symlink_target
     end
 
-    sig { returns(T::Hash[String, T.untyped]) }
+    sig { returns(T::Hash[String, T.nilable(T.any(String, T::Boolean))]) }
     def to_h
       details = {
         "name" => name,

data/lib/dependabot/dependency_group.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/experiments"
@@ -28,10 +28,23 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :group_by
 
+    # The following readers are parsed once from the raw rules hash so callers
+    # get typed access instead of repeatedly casting rules["patterns"] and
+    # friends at every use site. A nil value means the rule is absent (which the
+    # matching logic treats differently from an empty list).
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :patterns
+
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :exclude_patterns
+
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :update_types
+
     sig do
       params(
         name: String,
-        rules: T::Hash[String, T.untyped],
+        rules: T::Hash[String, T.any(String, T::Array[String])],
         applies_to: T.nilable(String)
       )
         .void
@@ -41,7 +54,10 @@ module Dependabot
       # For backwards compatibility, if no applies_to is provided, default to "version-updates"
       @applies_to = T.let(applies_to || "version-updates", String)
       @rules = rules
-      @group_by = T.let(rules["group-by"], T.nilable(String))
+      @group_by = T.let(string_rule(rules, "group-by"), T.nilable(String))
+      @patterns = T.let(string_array_rule(rules, "patterns"), T.nilable(T::Array[String]))
+      @exclude_patterns = T.let(string_array_rule(rules, "exclude-patterns"), T.nilable(T::Array[String]))
+      @update_types = T.let(string_array_rule(rules, "update-types"), T.nilable(T::Array[String]))
       @dependencies = T.let([], T::Array[Dependabot::Dependency])
     end
 
@@ -75,16 +91,18 @@ module Dependabot
 
     sig { params(dependency_name: String).returns(T::Boolean) }
     def matches_pattern?(dependency_name)
-      return true unless rules.key?("patterns") # If no patterns are defined, we pass this check by default
+      patterns = self.patterns
+      return true if patterns.nil? # If no patterns are defined, we pass this check by default
 
-      T.unsafe(rules["patterns"]).any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
+      patterns.any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
     end
 
     sig { params(dependency_name: String).returns(T::Boolean) }
     def matches_excluded_pattern?(dependency_name)
-      return false unless rules.key?("exclude-patterns") # If there are no exclusions, fail by default
+      exclude_patterns = self.exclude_patterns
+      return false if exclude_patterns.nil? # If there are no exclusions, fail by default
 
-      T.unsafe(rules["exclude-patterns"]).any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
+      exclude_patterns.any? { |rule| WildcardMatcher.match?(rule, dependency_name) }
     end
 
     sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
@@ -102,5 +120,42 @@ module Dependabot
     def experimental_rules_enabled?
       Dependabot::Experiments.enabled?(:grouped_updates_experimental_rules)
     end
+
+    # Reads a rule whose value is expected to be a single string (e.g.
+    # "group-by"), returning nil when the key is absent or the value is not a
+    # string.
+    sig do
+      params(
+        rules: T::Hash[String, T.any(String, T::Array[String])],
+        key: String
+      )
+        .returns(T.nilable(String))
+    end
+    def string_rule(rules, key)
+      value = rules[key]
+      value.is_a?(String) ? value : nil
+    end
+
+    # Reads a rule whose value is expected to be a list of strings (e.g.
+    # "patterns", "exclude-patterns", "update-types"). Returns nil when the key
+    # is absent so callers can distinguish "rule not set" from "empty list", and
+    # coerces a lone string into a single-element list.
+    sig do
+      params(
+        rules: T::Hash[String, T.any(String, T::Array[String])],
+        key: String
+      )
+        .returns(T.nilable(T::Array[String]))
+    end
+    def string_array_rule(rules, key)
+      return nil unless rules.key?(key)
+
+      value = rules[key]
+      case value
+      when Array then value.grep(String)
+      when String then [value]
+      else []
+      end
+    end
   end
 end

data/lib/dependabot/dependency_requirement.rb

@@ -0,0 +1,94 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  # A single requirement entry within Dependency#requirements, e.g.:
+  #
+  #   {
+  #     requirement: ">= 1.0, < 2.0",
+  #     file: "Gemfile",
+  #     groups: [:default],
+  #     source: { type: "rubygems", url: "https://rubygems.org" },
+  #     metadata: { property_name: "rails.version" } # optional
+  #   }
+  #
+  # Subclasses Hash so it is a drop-in replacement at call sites (and in
+  # type annotations) that treat requirement entries as
+  # T::Hash[Symbol, T.untyped], while exposing typed readers for the
+  # well-known keys. New code should prefer the typed readers; hash-style
+  # access remains supported while call sites are migrated gradually.
+  #
+  # Wire compatibility: instances serialise to JSON exactly like the plain
+  # hash they were created from, and compare equal (==/eql?/#hash) to plain
+  # hashes with the same content, so existing comparisons, Array/Set
+  # operations, and API payloads are unaffected.
+  #
+  # Note on Hash methods: in Ruby 3+, #merge, #dup and #compact preserve
+  # this class, while #select, #reject, #except, #transform_values and
+  # #to_h return plain Hash instances. Dependency#initialize re-wraps
+  # whatever it is given, so both styles remain safe.
+  class DependencyRequirement < Hash
+    extend T::Sig
+    extend T::Generic
+
+    # The values of a requirement entry are heterogeneous and
+    # ecosystem-specific, so this bridge class is necessarily untyped at
+    # the Hash level; the typed readers below are the migration path.
+    # rubocop:disable Sorbet/ForbidTUntyped
+    K = type_member { { fixed: Symbol } }
+    V = type_member { { fixed: T.untyped } }
+    Elem = type_member { { fixed: [Symbol, T.untyped] } }
+
+    # Builds a DependencyRequirement from a requirement hash, symbolising
+    # top-level keys. Accepts both plain hashes and existing
+    # DependencyRequirement instances and always returns a new instance.
+    sig { params(hash: T::Hash[T.any(Symbol, String), T.untyped]).returns(DependencyRequirement) }
+    def self.create(hash)
+      requirement = new
+      requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
+      requirement
+    end
+
+    # The version constraint string, e.g. ">= 1.0, < 2.0". Nil when the
+    # dependency is pinned by a lockfile rather than a manifest constraint.
+    sig { returns(T.nilable(String)) }
+    def requirement
+      self[:requirement]
+    end
+
+    # The manifest file this requirement was declared in, e.g. "Gemfile".
+    sig { returns(T.nilable(String)) }
+    def file
+      self[:file]
+    end
+
+    # The dependency groups this requirement belongs to, e.g. ["dev"] or
+    # [:default]. Element types vary by ecosystem (strings or symbols).
+    # Nilable because some requirement entries are constructed with
+    # groups: nil, and the reader must reflect that to stay a drop-in for
+    # the underlying hash access under sorbet-runtime.
+    sig { returns(T.nilable(T::Array[T.untyped])) }
+    def groups
+      self[:groups]
+    end
+
+    # The source details for the dependency, e.g.
+    # { type: "git", url: "https://github.com/..." }. Keys may be symbols
+    # or strings depending on whether the requirement was built by a file
+    # parser or deserialised from a job definition.
+    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    def source
+      self[:source]
+    end
+
+    # Optional ecosystem-specific metadata about the requirement, e.g.
+    # { property_name: "rails.version" }.
+    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    def metadata
+      self[:metadata]
+    end
+    # rubocop:enable Sorbet/ForbidTUntyped
+  end
+end

data/lib/dependabot/errors.rb

@@ -97,6 +97,11 @@ module Dependabot
         "error-type": "path_dependencies_not_reachable",
         "error-detail": { dependencies: error.dependencies }
       }
+    when Dependabot::PrivateRegistryConfigNotFound
+      {
+        "error-type": "private_registry_config_not_found",
+        "error-detail": { source: error.source }
+      }
     when Dependabot::PrivateSourceAuthenticationFailure
       {
         "error-type": "private_source_authentication_failure",
@@ -238,6 +243,16 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    when Dependabot::BlockedDependencyVersion
+      {
+        "error-type": "blocked_dependency_version",
+        "error-detail": {
+          "dependency-name": error.dependency_name,
+          "blocked-version": error.blocked_version,
+          "version-requirement": error.version_requirement,
+          reason: error.reason
+        }.compact
+      }
     when Dependabot::DependencyFileNotEvaluatable
       {
         "error-type": "dependency_file_not_evaluatable",
@@ -687,6 +702,22 @@ module Dependabot
   # Source level errors #
   #######################
 
+  class PrivateRegistryConfigNotFound < DependabotError
+    extend T::Sig
+
+    sig { returns(String) }
+    attr_reader :source
+
+    sig { params(source: String).void }
+    def initialize(source)
+      @source = T.let(sanitize_source(source), String)
+      msg = "Private npm registries require either a .npmrc file in your repository, " \
+            "or explicit `scope`/`replaces-base` configuration in dependabot.yml. " \
+            "Registry: #{@source}"
+      super(msg)
+    end
+  end
+
   class PrivateSourceAuthenticationFailure < DependabotError
     extend T::Sig
 
@@ -709,10 +740,10 @@ module Dependabot
     sig { returns(String) }
     attr_reader :source
 
-    sig { params(source: T.nilable(String)).void }
-    def initialize(source)
+    sig { params(source: T.nilable(String), error_message: T.nilable(String)).void }
+    def initialize(source, error_message = nil)
       @source = T.let(sanitize_source(T.must(source)), String)
-      msg = "Bad response error while accessing source: #{@source}"
+      msg = error_message ? sanitize_source(error_message) : "Bad response error while accessing source: #{@source}"
       super(msg)
     end
   end
@@ -901,6 +932,46 @@ module Dependabot
   # Raised by UpdateChecker if all candidate updates are ignored
   class AllVersionsIgnored < DependabotError; end
 
+  # Raised when regenerating a lockfile would introduce or change a transitive
+  # (indirect) dependency to a version that matches a configured blocked version.
+  # The offending change is rejected so the blocked version is never shipped,
+  # while other dependencies are still allowed to update.
+  class BlockedDependencyVersion < DependabotError
+    extend T::Sig
+
+    sig { returns(String) }
+    attr_reader :dependency_name
+
+    sig { returns(String) }
+    attr_reader :blocked_version
+
+    sig { returns(String) }
+    attr_reader :version_requirement
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :reason
+
+    sig do
+      params(
+        dependency_name: String,
+        blocked_version: String,
+        version_requirement: String,
+        reason: T.nilable(String)
+      ).void
+    end
+    def initialize(dependency_name:, blocked_version:, version_requirement:, reason: nil)
+      @dependency_name = dependency_name
+      @blocked_version = blocked_version
+      @version_requirement = version_requirement
+      @reason = reason
+
+      msg = "Update blocked: transitive dependency #{dependency_name} #{blocked_version} " \
+            "matches blocked version requirement '#{version_requirement}'"
+      msg += " (reason: #{reason})" if reason && !reason.empty?
+      super(msg)
+    end
+  end
+
   # Raised by FileParser if processing may execute external code in the update context
   class UnexpectedExternalCode < DependabotError; end
 

data/lib/dependabot/file_parsers/base/dependency_set.rb

@@ -33,7 +33,7 @@ module Dependabot
           @dependencies.values.filter_map(&:combined)
         end
 
-        sig { params(dep: Dependabot::Dependency).returns(T.untyped) }
+        sig { params(dep: Dependabot::Dependency).returns(T.self_type) }
         def <<(dep)
           T.must(@dependencies[key_for_dependency(dep)]) << dep
           self

data/lib/dependabot/file_parsers/base.rb

@@ -28,6 +28,11 @@ module Dependabot
       sig { returns(T::Hash[Symbol, T.untyped]) }
       attr_reader :options
 
+      sig { returns(T::Boolean) }
+      def reject_external_code?
+        @reject_external_code
+      end
+
       sig do
         params(
           dependency_files: T::Array[Dependabot::DependencyFile],

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -120,25 +120,46 @@ module Dependabot
 
       sig do
         overridable
-          .params(parameters: T::Hash[Symbol, T.untyped])
+          .params(
+            name: String,
+            content: T.nilable(String),
+            directory: String,
+            type: String,
+            support_file: T::Boolean,
+            vendored_file: T::Boolean,
+            symlink_target: T.nilable(String),
+            content_encoding: String,
+            deleted: T::Boolean,
+            operation: String,
+            mode: T.nilable(String)
+          )
           .returns(Dependabot::DependencyFile)
       end
-      def create_dependency_file(parameters)
+      def create_dependency_file(
+        name:,
+        content: nil,
+        directory: "/",
+        type: "file",
+        support_file: false,
+        vendored_file: false,
+        symlink_target: nil,
+        content_encoding: Dependabot::DependencyFile::ContentEncoding::UTF_8,
+        deleted: false,
+        operation: Dependabot::DependencyFile::Operation::UPDATE,
+        mode: nil
+      )
         Dependabot::DependencyFile.new(
-          name: parameters.fetch(:name),
-          content: parameters[:content],
-          directory: parameters.fetch(:directory, "/"),
-          type: parameters.fetch(:type, "file"),
-          support_file: parameters.fetch(:support_file, false),
-          vendored_file: parameters.fetch(:vendored_file, false),
-          symlink_target: parameters[:symlink_target],
-          content_encoding: parameters.fetch(
-            :content_encoding,
-            Dependabot::DependencyFile::ContentEncoding::UTF_8
-          ),
-          deleted: parameters.fetch(:deleted, false),
-          operation: parameters.fetch(:operation, Dependabot::DependencyFile::Operation::UPDATE),
-          mode: parameters[:mode]
+          name: name,
+          content: content,
+          directory: directory,
+          type: type,
+          support_file: support_file,
+          vendored_file: vendored_file,
+          symlink_target: symlink_target,
+          content_encoding: content_encoding,
+          deleted: deleted,
+          operation: operation,
+          mode: mode
         )
       end
     end

data/lib/dependabot/file_updaters/vendor_updater.rb

@@ -31,27 +31,51 @@ module Dependabot
 
       private
 
+      # VendorUpdater always flags files as vendored, so it accepts but ignores
+      # the vendored_file argument. The parameter must stay to keep the override
+      # signature compatible with ArtifactUpdater#create_dependency_file.
       sig do
         override
-          .params(parameters: T::Hash[Symbol, T.untyped])
+          .params(
+            name: String,
+            content: T.nilable(String),
+            directory: String,
+            type: String,
+            support_file: T::Boolean,
+            vendored_file: T::Boolean,
+            symlink_target: T.nilable(String),
+            content_encoding: String,
+            deleted: T::Boolean,
+            operation: String,
+            mode: T.nilable(String)
+          )
           .returns(Dependabot::DependencyFile)
       end
-      def create_dependency_file(parameters)
-        Dependabot::DependencyFile.new(
-          name: parameters.fetch(:name),
-          content: parameters[:content],
-          directory: parameters.fetch(:directory, "/"),
-          type: parameters.fetch(:type, "file"),
-          support_file: parameters.fetch(:support_file, false),
+      def create_dependency_file(
+        name:,
+        content: nil,
+        directory: "/",
+        type: "file",
+        support_file: false,
+        vendored_file: false, # rubocop:disable Lint/UnusedMethodArgument
+        symlink_target: nil,
+        content_encoding: Dependabot::DependencyFile::ContentEncoding::UTF_8,
+        deleted: false,
+        operation: Dependabot::DependencyFile::Operation::UPDATE,
+        mode: nil
+      )
+        super(
+          name: name,
+          content: content,
+          directory: directory,
+          type: type,
+          support_file: support_file,
           vendored_file: true,
-          symlink_target: parameters[:symlink_target],
-          content_encoding: parameters.fetch(
-            :content_encoding,
-            Dependabot::DependencyFile::ContentEncoding::UTF_8
-          ),
-          deleted: parameters.fetch(:deleted, false),
-          operation: parameters.fetch(:operation, Dependabot::DependencyFile::Operation::UPDATE),
-          mode: parameters[:mode]
+          symlink_target: symlink_target,
+          content_encoding: content_encoding,
+          deleted: deleted,
+          operation: operation,
+          mode: mode
         )
       end
     end

data/lib/dependabot/git_commit_checker.rb

@@ -14,6 +14,7 @@ require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/credential"
 require "dependabot/git_metadata_fetcher"
+require "dependabot/git_tag_details"
 module Dependabot
   # rubocop:disable Metrics/ClassLength
   class GitCommitChecker
@@ -159,31 +160,31 @@ module Dependabot
       local_repo_git_metadata_fetcher.head_commit_for_ref(name)
     end
 
-    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
     def local_ref_for_latest_version_matching_existing_precision
       allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs
 
       max_local_tag_for_current_precision(allowed_refs)
     end
 
-    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
     def local_ref_for_latest_version_lower_precision
       allowed_refs = local_tag_for_pinned_sha ? allowed_version_tags : allowed_version_refs
 
       max_local_tag_for_lower_precision(allowed_refs)
     end
 
-    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
     def local_tag_for_latest_version
       max_local_tag(allowed_version_tags)
     end
 
-    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+    sig { returns(T::Array[Dependabot::GitTagDetails]) }
     def local_tags_for_allowed_versions_matching_existing_precision
       select_matching_existing_precision(allowed_version_tags).filter_map { |t| to_local_tag(t) }
     end
 
-    sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+    sig { returns(T::Array[Dependabot::GitTagDetails]) }
     def local_tags_for_allowed_versions
       allowed_version_tags.filter_map { |t| to_local_tag(t) }
     end
@@ -272,7 +273,7 @@ module Dependabot
       local_tags_matching_sha(commit_sha).map(&:name)
     end
 
-    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
     def max_local_tag(tags)
       max_version_tag = tags.max_by { |t| version_from_tag(t) }
 
@@ -295,12 +296,12 @@ module Dependabot
     sig { returns(T::Array[String]) }
     attr_reader :ignored_versions
 
-    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
     def max_local_tag_for_current_precision(tags)
       max_local_tag(select_matching_existing_precision(tags))
     end
 
-    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { params(tags: T::Array[Dependabot::GitRef]).returns(T.nilable(Dependabot::GitTagDetails)) }
     def max_local_tag_for_lower_precision(tags)
       max_local_tag(select_lower_precision(tags))
     end
@@ -553,17 +554,17 @@ module Dependabot
       prefix.length > 1 ? prefix.gsub(/v$/i, "") : prefix.gsub(/^v$/i, "")
     end
 
-    sig { params(tag: T.nilable(Dependabot::GitRef)).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { params(tag: T.nilable(Dependabot::GitRef)).returns(T.nilable(Dependabot::GitTagDetails)) }
     def to_local_tag(tag)
       return unless tag
 
       version = version_from_tag(tag)
-      {
+      GitTagDetails.new(
         tag: tag.name,
         version: version,
         commit_sha: tag.commit_sha,
         tag_sha: tag.ref_sha
-      }
+      )
     end
 
     sig { returns(T.nilable(String)) }

data/lib/dependabot/git_cooldown_date_resolver.rb

@@ -0,0 +1,114 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/clients/github_with_retries"
+require "dependabot/shared_helpers"
+require "dependabot/source"
+
+module Dependabot
+  # Shared logic for resolving release dates from git-based sources for cooldown
+  # purposes. Used by ecosystems that rely on git tags (pre-commit, GitHub Actions)
+  # rather than package registries.
+  #
+  # Priority: GitHub Release published_at > tag creation date (for-each-ref) > commit date.
+  #
+  # Including classes must implement:
+  #   - `cooldown_source_url` — returns the git source URL
+  #   - `cooldown_credentials` — returns the credentials array
+  module GitCooldownDateResolver
+    extend T::Sig
+    extend T::Helpers
+
+    abstract!
+
+    # The git source URL for the dependency (e.g. "https://github.com/owner/repo")
+    sig { abstract.returns(T.nilable(String)) }
+    def cooldown_source_url; end
+
+    # Credentials for GitHub API access
+    sig { abstract.returns(T::Array[Dependabot::Credential]) }
+    def cooldown_credentials; end
+
+    # Strips the `tags/` prefix that GitCommitChecker may add when the pinned
+    # ref starts with `tags/`, preventing construction of invalid refs like
+    # `refs/tags/tags/v1.0.0`.
+    sig { params(tag_name: String).returns(String) }
+    def normalize_tag_name(tag_name)
+      tag_name.delete_prefix("tags/")
+    end
+
+    # Resolves the best available date for a candidate tag.
+    # Priority: GitHub Release published_at > tag creation date > commit date.
+    sig { params(tag_name: String, commit_sha: String).returns(Time) }
+    def resolve_candidate_date(tag_name, commit_sha)
+      releases = cached_github_releases
+      unless releases.empty?
+        release = releases.find { |r| r.tag_name == tag_name }
+        return release.published_at if release&.published_at
+      end
+
+      tag_creation_date(tag_name, commit_sha)
+    end
+
+    # Looks up the GitHub Release published_at date for a given tag name.
+    # Returns nil if no release exists for this tag.
+    sig { params(tag_name: String).returns(T.nilable(Time)) }
+    def github_release_published_at(tag_name)
+      releases = cached_github_releases
+      return nil if releases.empty?
+
+      release = releases.find { |r| r.tag_name == tag_name }
+      return nil unless release&.published_at
+
+      release.published_at
+    rescue StandardError => e
+      Dependabot.logger.debug("Error fetching GitHub release date for #{tag_name}: #{e.message}")
+      nil
+    end
+
+    # Returns the tag creation date for cooldown purposes (used inside bare clone).
+    # Priority: tag creation date from for-each-ref > commit date fallback.
+    sig { params(tag_name: String, commit_sha: String).returns(Time) }
+    def tag_creation_date(tag_name, commit_sha)
+      tag_date_str = SharedHelpers.run_shell_command(
+        "git for-each-ref --format=\"%(creatordate:iso)\" \"refs/tags/#{tag_name}\"",
+        fingerprint: "git for-each-ref --format=\"%(creatordate:iso)\" \"refs/tags/<tag_name>\""
+      ).strip
+
+      if tag_date_str.empty?
+        tag_date_str = SharedHelpers.run_shell_command(
+          "git show --no-patch --format=\"%cd\" --date=iso #{commit_sha}",
+          fingerprint: "git show --no-patch --format=\"%cd\" --date=iso <commit_sha>"
+        ).strip
+      end
+
+      Time.parse(tag_date_str)
+    end
+
+    # Fetches and caches GitHub releases for the dependency source.
+    # Returns an empty array for non-GitHub sources.
+    sig { returns(T::Array[T.untyped]) } # rubocop:disable Sorbet/ForbidTUntyped
+    def cached_github_releases
+      @cached_github_releases ||= T.let(
+        begin
+          url = cooldown_source_url
+          source = Source.from_url(url)
+          if source&.provider == "github"
+            client = Dependabot::Clients::GithubWithRetries.for_source(
+              source: T.must(source),
+              credentials: cooldown_credentials
+            )
+            client.releases(T.must(source).repo, per_page: 100)
+          else
+            []
+          end
+        rescue StandardError => e
+          Dependabot.logger.debug("Error fetching GitHub releases: #{e.message}")
+          []
+        end,
+        T.nilable(T::Array[T.untyped]) # rubocop:disable Sorbet/ForbidTUntyped
+      )
+    end
+  end
+end

data/lib/dependabot/git_tag_details.rb

@@ -0,0 +1,78 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  # A git tag (or ref) resolved to a version, as produced by GitCommitChecker's
+  # local_tag_for_* / local_ref_for_* methods, e.g.:
+  #
+  #   {
+  #     tag: "v1.2.0",
+  #     version: Dependabot::Version.new("1.2.0"),
+  #     commit_sha: "a1b2c3...",
+  #     tag_sha: "d4e5f6..." # nil for lightweight tags
+  #   }
+  #
+  # Distinct from Dependabot::GitTagWithDetail, which carries a tag name and
+  # release date for cooldown handling.
+  #
+  # Subclasses Hash so it is a drop-in replacement at the many call sites that
+  # read entries with [:key] / fetch and treat them as
+  # T::Hash[Symbol, T.untyped], while exposing typed readers for the well-known
+  # keys. Instances compare equal (Hash#==) to plain hashes with the same
+  # content, so existing comparisons and API payloads are unaffected.
+  class GitTagDetails < Hash
+    extend T::Sig
+    extend T::Generic
+
+    # The values are heterogeneous (strings and a version object), so this
+    # bridge class is necessarily untyped at the Hash level; the typed readers
+    # below are the migration path.
+    # rubocop:disable Sorbet/ForbidTUntyped
+    K = type_member { { fixed: Symbol } }
+    V = type_member { { fixed: T.untyped } }
+    Elem = type_member { { fixed: [Symbol, T.untyped] } }
+    # rubocop:enable Sorbet/ForbidTUntyped
+
+    sig do
+      params(
+        tag: String,
+        version: T.nilable(Gem::Version),
+        commit_sha: T.nilable(String),
+        tag_sha: T.nilable(String)
+      ).void
+    end
+    def initialize(tag:, version: nil, commit_sha: nil, tag_sha: nil)
+      super()
+      self[:tag] = tag
+      self[:version] = version
+      self[:commit_sha] = commit_sha
+      self[:tag_sha] = tag_sha
+    end
+
+    # The tag or ref name, e.g. "v1.2.0".
+    sig { returns(String) }
+    def tag
+      self[:tag]
+    end
+
+    # The version parsed from the tag name.
+    sig { returns(T.nilable(Gem::Version)) }
+    def version
+      self[:version]
+    end
+
+    # The SHA of the commit the tag points at.
+    sig { returns(T.nilable(String)) }
+    def commit_sha
+      self[:commit_sha]
+    end
+
+    # The SHA of the tag object itself (nil for lightweight tags).
+    sig { returns(T.nilable(String)) }
+    def tag_sha
+      self[:tag_sha]
+    end
+  end
+end

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -145,7 +145,7 @@ module Dependabot
         end
 
         # TODO: Refactor me so that Composer doesn't need to be special cased
-        sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T::Boolean) }
+        sig { params(requirements: T.nilable(T::Array[Dependabot::DependencyRequirement])).returns(T::Boolean) }
         def git_source?(requirements)
           # Special case Composer, which uses git as a source but handles tags
           # internally

data/lib/dependabot/notices.rb

@@ -59,8 +59,8 @@ module Dependabot
 
     # Converts the Notice object to a hash.
     # @return [Hash] The hash representation of the notice.
-    sig { returns(T::Hash[Symbol, T.untyped]) }
-    def to_hash
+    sig { returns(T::Hash[Symbol, T.any(String, T::Boolean)]) }
+    def to_h
       {
         mode: @mode,
         type: @type,

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -1,6 +1,7 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "digest"
 require "sorbet-runtime"
 
 module Dependabot
@@ -70,9 +71,10 @@ module Dependabot
           sanitized_name = sanitized_name.gsub("/", separator)
 
           # Shorten the ref in case users refs have length limits
-          if max_length && (sanitized_name.length > T.must(max_length))
-            sha = T.must(Digest::SHA1.hexdigest(sanitized_name)[0, T.must(max_length)])
-            sanitized_name[[T.must(max_length) - sha.size, 0].max..] = sha
+          branch_name_max_length = max_length
+          if branch_name_max_length && (sanitized_name.length > branch_name_max_length)
+            sha = T.must(Digest::SHA1.hexdigest(sanitized_name)[0, branch_name_max_length])
+            sanitized_name[[branch_name_max_length - sha.size, 0].max..] = sha
           end
 
           sanitized_name

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -119,21 +119,21 @@ module Dependabot
 
         sig { params(dependency: Dependabot::Dependency).returns(String) }
         def sanitized_requirement(dependency)
-          new_library_requirement(dependency)
-            .delete(" ")
-            .gsub("!=", "neq-")
-            .gsub(">=", "gte-")
-            .gsub("<=", "lte-")
-            .gsub("~>", "tw-")
-            .gsub("^", "tw-")
-            .gsub("||", "or-")
-            .gsub("~", "approx-")
-            .gsub("~=", "tw-")
-            .gsub(/==*/, "eq-")
-            .gsub(">", "gt-")
-            .gsub("<", "lt-")
-            .gsub("*", "star")
-            .gsub(",", "-and-")
+          T.must(new_library_requirement(dependency))
+           .delete(" ")
+           .gsub("!=", "neq-")
+           .gsub(">=", "gte-")
+           .gsub("<=", "lte-")
+           .gsub("~>", "tw-")
+           .gsub("^", "tw-")
+           .gsub("||", "or-")
+           .gsub("~", "approx-")
+           .gsub("~=", "tw-")
+           .gsub(/==*/, "eq-")
+           .gsub(">", "gt-")
+           .gsub("<", "lt-")
+           .gsub("*", "star")
+           .gsub(",", "-and-")
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
@@ -176,7 +176,7 @@ module Dependabot
           previous_ref(dependency) != new_ref(dependency)
         end
 
-        sig { params(dependency: Dependabot::Dependency).returns(T.untyped) }
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def new_library_requirement(dependency)
           updated_reqs =
             dependency.requirements - T.must(dependency.previous_requirements)

data/lib/dependabot/pull_request_creator.rb

@@ -197,7 +197,7 @@ module Dependabot
       milestone: nil,
       branch_name_separator: "/",
       branch_name_prefix: "dependabot",
-      branch_name_max_length: nil,
+      branch_name_max_length: 100,
       label_language: false,
       automerge_candidate: false,
       github_redirection_service: DEFAULT_GITHUB_REDIRECTION_SERVICE,

data/lib/dependabot/pull_request_updater.rb

@@ -40,7 +40,7 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :commit_message
 
-    sig { returns(T::Hash[Symbol, T.untyped]) }
+    sig { returns(T::Hash[Symbol, Integer]) }
     attr_reader :provider_metadata
 
     sig do
@@ -54,7 +54,7 @@ module Dependabot
         author_details: T.nilable(T::Hash[Symbol, String]),
         signature_key: T.nilable(String),
         commit_message: T.nilable(String),
-        provider_metadata: T::Hash[Symbol, T.untyped]
+        provider_metadata: T::Hash[Symbol, Integer]
       )
         .void
     end
@@ -84,7 +84,7 @@ module Dependabot
 
     # TODO: Each implementation returns a client-specific type.
     #       We should standardise this to return a `Dependabot::Branch` type instead.
-    sig { returns(T.untyped) }
+    sig { returns(T.untyped) } # rubocop:disable Sorbet/ForbidTUntyped
     def update
       case source.provider
       when "github" then github_updater.update
@@ -120,7 +120,7 @@ module Dependabot
         files: files,
         credentials: credentials,
         pull_request_number: pull_request_number,
-        target_project_id: T.cast(provider_metadata[:target_project_id], T.nilable(Integer))
+        target_project_id: provider_metadata[:target_project_id]
       )
     end
 

data/lib/dependabot/requirements_updater/base.rb

@@ -3,6 +3,8 @@
 
 require "sorbet-runtime"
 
+require "dependabot/dependency_requirement"
+
 module Dependabot
   module RequirementsUpdater
     module Base
@@ -15,7 +17,7 @@ module Dependabot
 
       interface!
 
-      sig { abstract.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { abstract.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements; end
 
       private

data/lib/dependabot/update_checkers/base.rb

@@ -182,7 +182,7 @@ module Dependabot
         dependency.version
       end
 
-      sig { overridable.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { overridable.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         raise NotImplementedError
       end
@@ -226,6 +226,20 @@ module Dependabot
 
       private
 
+      # Wraps an array of raw requirement hashes (e.g. the output of an
+      # ecosystem RequirementsUpdater) into typed DependencyRequirement
+      # objects, so updated_requirements overrides can satisfy the typed
+      # return contract. Entries that are already DependencyRequirement
+      # instances are returned as-is; plain hashes are wrapped. Re-wrapping
+      # would produce a value-equal copy, so skipping it avoids needless
+      # allocations.
+      sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[Dependabot::DependencyRequirement]) }
+      def wrap_requirements(requirements)
+        requirements.map do |requirement|
+          requirement.is_a?(Dependabot::DependencyRequirement) ? requirement : Dependabot::DependencyRequirement.create(requirement)
+        end
+      end
+
       sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
       def active_advisories
         security_advisories.select { |a| a.vulnerable?(T.must(current_version)) }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.381.0"
+  VERSION = "0.383.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.383.0
 platform: ruby
 authors:
 - Dependabot
@@ -534,6 +534,7 @@ files:
 - lib/dependabot/dependency_graphers/base.rb
 - lib/dependabot/dependency_graphers/generic.rb
 - lib/dependabot/dependency_group.rb
+- lib/dependabot/dependency_requirement.rb
 - lib/dependabot/ecosystem.rb
 - lib/dependabot/errors.rb
 - lib/dependabot/experiments.rb
@@ -551,8 +552,10 @@ files:
 - lib/dependabot/file_updaters/base.rb
 - lib/dependabot/file_updaters/vendor_updater.rb
 - lib/dependabot/git_commit_checker.rb
+- lib/dependabot/git_cooldown_date_resolver.rb
 - lib/dependabot/git_metadata_fetcher.rb
 - lib/dependabot/git_ref.rb
+- lib/dependabot/git_tag_details.rb
 - lib/dependabot/git_tag_with_detail.rb
 - lib/dependabot/logger.rb
 - lib/dependabot/metadata_finders.rb
@@ -617,7 +620,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
 rdoc_options: []
 require_paths:
 - lib