dependabot-common 0.383.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fb1a4d6243812d664a20067d226c2eec111080d39e7337217744a58a9d8f0b6
-  data.tar.gz: 609737fc8b6040222a744d58ea03f8587fec15136cb835d319c31b798f7ebf32
+  metadata.gz: 58033d13e6a5c0bee14915505c98d752b8a6f2e26ffb96a4ba6d95ca66057bc3
+  data.tar.gz: 0a6c8eebbffb115434da53fbd171236690f1594a617f16fb4e29b1addfc81308
 SHA512:
-  metadata.gz: 5e3042cb52f78e0396e75a3c6707a6706a1e2f4f1e12fc16310079eae0ae08336f688a75a92795cc6a8ba50ba62b9d0b9168b3ca4d5780439c7bccf574ab4179
-  data.tar.gz: a15d7f181d2d4afd8b5bf3e72f0450827d435f8e61e98f7863bfa0c254e8e2b983bb831901f1c95d27da8abfe791bf673d6c6e7fcc29b8d5e61c0e3c631ea9e6
+  metadata.gz: 5defea48ad000e82511496f0cb413945bf6ba2a5070361af5f1fa5e6411a11679a24de9e852c478f48fba3299d3678865e2faf97158c310ee429f6ac368fee5c
+  data.tar.gz: fcf737b08310353b51bc3b32a53f24546e8bf30aa58a9a0b9e91e025921728bdcba378da8b68f9dc592b1bec349ff487a5d21a2683ab1ad76fa1d8b748ca066b

data/lib/dependabot/command_helpers.rb

@@ -20,46 +20,46 @@ module Dependabot
     end
 
     OutputObserver = T.type_alias do
-      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
+      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.anything]))
     end
 
     EnvCmdItem = T.type_alias do
       T.any(
         String,
-        T::Hash[T.any(String, Symbol), T.untyped]
+        T::Hash[T.any(String, Symbol), T.anything]
       )
     end
 
     class ProcessStatus
       extend T::Sig
 
-      sig { params(process_status: Process::Status, custom_exitstatus: T.nilable(Integer)).void }
+      sig { params(process_status: T.nilable(Process::Status), custom_exitstatus: T.nilable(Integer)).void }
       def initialize(process_status, custom_exitstatus = nil)
-        @process_status = process_status
+        @process_status = T.let(process_status, T.nilable(Process::Status))
         @custom_exitstatus = custom_exitstatus
       end
 
       # Return the exit status, either from the process status or the custom one
       sig { returns(Integer) }
       def exitstatus
-        @custom_exitstatus || @process_status.exitstatus || 0
+        @custom_exitstatus || @process_status&.exitstatus || 0
       end
 
       # Determine if the process was successful
       sig { returns(T::Boolean) }
       def success?
-        @custom_exitstatus.nil? ? @process_status.success? || false : @custom_exitstatus.zero?
+        @custom_exitstatus.nil? ? @process_status&.success? || false : @custom_exitstatus.zero?
       end
 
       # Return the PID of the process (if available)
       sig { returns(T.nilable(Integer)) }
       def pid
-        @process_status.pid
+        @process_status&.pid
       end
 
       sig { returns(T.nilable(Integer)) }
       def termsig
-        @process_status.termsig
+        @process_status&.termsig
       end
 
       # String representation of the status
@@ -68,7 +68,7 @@ module Dependabot
         if @custom_exitstatus
           "pid #{pid || 'unknown'}: exit #{@custom_exitstatus} (custom status)"
         else
-          @process_status.to_s
+          @process_status&.to_s || "unknown status"
         end
       end
     end

data/lib/dependabot/config/file.rb

@@ -102,33 +102,68 @@ module Dependabot
         T::Hash[String, String]
       )
 
-      sig { params(cfg: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Array[IgnoreCondition]) }
+      sig { params(cfg: T.nilable(T::Hash[Symbol, T.anything])).returns(T::Array[IgnoreCondition]) }
       def ignore_conditions(cfg)
-        ignores = cfg&.dig(:ignore) || []
-        ignores.map do |ic|
+        array_values(cfg&.dig(:ignore)).map do |raw|
+          ic = hash_values(raw)
           IgnoreCondition.new(
-            dependency_name: ic[:"dependency-name"],
-            versions: ic[:versions],
-            update_types: ic[:"update-types"]
+            dependency_name: T.must(string_value(ic[:"dependency-name"])),
+            versions: string_array(ic[:versions]),
+            update_types: string_array(ic[:"update-types"])
           )
         end
       end
 
       sig do
-        params(cfg: T.nilable(T::Hash[Symbol, T.untyped])).returns(UpdateConfig::CommitMessageOptions)
+        params(cfg: T.nilable(T::Hash[Symbol, T.anything])).returns(UpdateConfig::CommitMessageOptions)
       end
       def commit_message_options(cfg)
-        commit_message = cfg&.dig(:"commit-message") || {}
+        commit_message = hash_values(cfg&.dig(:"commit-message"))
+        prefix = string_value(commit_message[:prefix])
         UpdateConfig::CommitMessageOptions.new(
-          prefix: commit_message[:prefix],
-          prefix_development: commit_message[:"prefix-development"] || commit_message[:prefix],
-          include: commit_message[:include]
+          prefix: prefix,
+          prefix_development: string_value(commit_message[:"prefix-development"]) || prefix,
+          include: string_value(commit_message[:include])
         )
       end
 
-      sig { params(cfg: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Array[String]) }
+      sig { params(cfg: T.nilable(T::Hash[Symbol, T.anything])).returns(T::Array[String]) }
       def exclude_paths(cfg)
-        Array(cfg&.dig(:"exclude-paths") || [])
+        string_array(cfg&.dig(:"exclude-paths")) || []
+      end
+
+      # The methods below narrow the loosely typed, parsed-YAML config values
+      # (Symbol-keyed hashes whose values are arbitrary) into the specific
+      # types the config objects expect.
+
+      sig { params(value: T.anything).returns(T.nilable(String)) }
+      def string_value(value)
+        case value
+        when String then value
+        end
+      end
+
+      sig { params(value: T.anything).returns(T::Hash[Symbol, T.anything]) }
+      def hash_values(value)
+        case value
+        when Hash then value
+        else {}
+        end
+      end
+
+      sig { params(value: T.anything).returns(T::Array[T.anything]) }
+      def array_values(value)
+        case value
+        when Array then value
+        else []
+        end
+      end
+
+      sig { params(value: T.anything).returns(T.nilable(T::Array[String])) }
+      def string_array(value)
+        case value
+        when Array then value.map(&:to_s)
+        end
       end
     end
   end

data/lib/dependabot/config/ignore_condition.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/errors.rb

@@ -23,7 +23,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -142,7 +142,7 @@ module Dependabot
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -226,7 +226,7 @@ module Dependabot
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -416,7 +416,7 @@ module Dependabot
 
     interface!
 
-    sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+    sig { abstract.returns(T::Hash[Symbol, T.anything]) }
     def sentry_context; end
   end
 
@@ -484,7 +484,7 @@ module Dependabot
       super(message || error_type)
     end
 
-    sig { params(hash: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Hash[Symbol, T.untyped]) }
+    sig { params(hash: T.nilable(T::Hash[Symbol, T.anything])).returns(T::Hash[Symbol, T.anything]) }
     def detail(hash = nil)
       {
         "error-type": error_type,

data/lib/dependabot/experiments.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,21 +7,21 @@ module Dependabot
   module Experiments
     extend T::Sig
 
-    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.untyped])
+    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.anything])
 
-    sig { returns(T::Hash[T.any(String, Symbol), T.untyped]) }
+    sig { returns(T::Hash[T.any(String, Symbol), T.anything]) }
     def self.reset!
       @experiments = {}
     end
 
-    sig { params(name: T.any(String, Symbol), value: T.untyped).void }
+    sig { params(name: T.any(String, Symbol), value: T.anything).void }
     def self.register(name, value)
       @experiments[name.to_sym] = value
     end
 
     sig { params(name: T.any(String, Symbol)).returns(T::Boolean) }
     def self.enabled?(name)
-      !!@experiments[name.to_sym]
+      @experiments[name.to_sym] ? true : false
     end
   end
 end

data/lib/dependabot/file_parsers/base.rb

@@ -25,7 +25,7 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Source)) }
       attr_reader :source
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig { returns(T::Boolean) }
@@ -40,7 +40,7 @@ module Dependabot
           repo_contents_path: T.nilable(String),
           credentials: T::Array[Dependabot::Credential],
           reject_external_code: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         )
           .void
       end

data/lib/dependabot/file_updaters/base.rb

@@ -26,7 +26,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -35,7 +35,7 @@ module Dependabot
           dependency_files: T::Array[Dependabot::DependencyFile],
           credentials: T::Array[Dependabot::Credential],
           repo_contents_path: T.nilable(String),
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path: nil, options: {})

data/lib/dependabot/git_commit_checker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "time"
 require "sorbet-runtime"
 require "gitlab"
 require "dependabot/clients/github_with_retries"
@@ -15,10 +16,15 @@ require "dependabot/dependency"
 require "dependabot/credential"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_tag_details"
+require "dependabot/package/package_release"
+require "dependabot/package/release_cooldown_options"
+require "dependabot/update_checkers/cooldown_calculation"
+require "dependabot/git_cooldown_date_resolver"
 module Dependabot
   # rubocop:disable Metrics/ClassLength
   class GitCommitChecker
     extend T::Sig
+    include Dependabot::GitCooldownDateResolver
 
     VERSION_REGEX = /
       (?<version>
@@ -174,9 +180,35 @@ module Dependabot
       max_local_tag_for_lower_precision(allowed_refs)
     end
 
-    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
-    def local_tag_for_latest_version
-      max_local_tag(allowed_version_tags)
+    # Returns the latest allowed version tag, or nil when every candidate tag is
+    # still within its cooldown window. All cooldown handling — the nil /
+    # disabled / excluded short-circuits and the logging — lives in
+    # #apply_cooldown, so this method stays a thin orchestration step.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_latest_version(cooldown_options = nil)
+      filtered_tags = apply_cooldown(allowed_version_tags, cooldown_options)
+      return nil if filtered_tags.nil?
+
+      max_local_tag(filtered_tags)
+    end
+
+    # Returns the latest allowed version tag, but only when the dependency is
+    # pinned to a ref that looks like a version. Most ecosystems share this
+    # precondition before resolving a newer version tag for a git dependency,
+    # so it lives here instead of being repeated at each call site. Returns nil
+    # for dependencies that aren't pinned to a version (e.g. branch- or
+    # SHA-pinned), which never want a version-tag update.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_pinned_version_ref(cooldown_options = nil)
+      return nil unless pinned_ref_looks_like_version?
+
+      local_tag_for_latest_version(cooldown_options)
     end
 
     sig { returns(T::Array[Dependabot::GitTagDetails]) }
@@ -285,6 +317,30 @@ module Dependabot
       allowed_versions(local_tags, filter_by_prefix: false)
     end
 
+    # Returns the allowed version tags paired with their parsed release
+    # dates as a single list, so callers don't have to re-correlate two
+    # separate lists (tags and tag-dates) by tag name themselves.
+    sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+    def allowed_version_tags_with_release_dates
+      allowed_version_tags.map do |tag|
+        Dependabot::Package::PackageRelease.new(
+          version: T.cast(version_from_tag(tag), Dependabot::Version),
+          tag: tag.name,
+          released_at: release_date_for_tag_name(tag.name)
+        )
+      end
+    end
+
+    sig { override.returns(T.nilable(String)) }
+    def cooldown_source_url
+      dependency_source_details&.fetch(:url, nil)
+    end
+
+    sig { override.returns(T::Array[Dependabot::Credential]) }
+    def cooldown_credentials
+      credentials
+    end
+
     private
 
     sig { returns(Dependabot::Dependency) }
@@ -689,7 +745,9 @@ module Dependabot
             source: T.must(source),
             credentials: credentials
           )
-          client.releases(T.must(source).repo, per_page: 100)
+          # The Octokit RBI types this as non-nil, but it can be nil at runtime
+          # (e.g. an empty/unexpected registry response), so guard against it.
+          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
         rescue Octokit::Error
           []
         end,
@@ -712,6 +770,107 @@ module Dependabot
       T.must(T.must(name.match(VERSION_REGEX)).named_captures.fetch("version"))
     end
 
+    # Filters out git tags that are still within their cooldown window. Returns
+    # the candidate tags unchanged when cooldown does not apply (no options,
+    # disabled, or the dependency is excluded), and nil when every candidate tag
+    # is still within its cooldown window, so the caller proposes no update.
+    sig do
+      params(
+        candidate_tags: T::Array[Dependabot::GitRef],
+        cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+      ).returns(T.nilable(T::Array[Dependabot::GitRef]))
+    end
+    def apply_cooldown(candidate_tags, cooldown_options)
+      if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(cooldown_options, dependency.name)
+        return candidate_tags
+      end
+
+      cooldown = T.must(cooldown_options)
+      filtered_tags = candidate_tags.reject { |tag| tag_in_cooldown_period?(tag, cooldown) }
+
+      if filtered_tags.empty? && candidate_tags.any?
+        Dependabot.logger.info(
+          "All git tags for #{dependency.name} are within their cooldown period; skipping update"
+        )
+        return nil
+      end
+
+      filtered_tags
+    end
+
+    sig do
+      params(tag: Dependabot::GitRef, cooldown: Dependabot::Package::ReleaseCooldownOptions)
+        .returns(T::Boolean)
+    end
+    def tag_in_cooldown_period?(tag, cooldown)
+      released_at = release_date_for_tag_name(tag.name)
+      return false unless released_at
+
+      cooldown_days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
+        cooldown,
+        T.cast(current_version, T.nilable(Dependabot::Version)),
+        T.cast(version_from_tag(tag), Dependabot::Version)
+      )
+
+      in_cooldown = Dependabot::UpdateCheckers::CooldownCalculation
+                    .within_cooldown_window?(released_at, cooldown_days)
+
+      if in_cooldown
+        passed_days = (Time.now.to_i - released_at.to_i) /
+                      Dependabot::UpdateCheckers::CooldownCalculation::DAY_IN_SECONDS
+        Dependabot.logger.info(
+          "Filtered git tag #{tag.name} for #{dependency.name}: released " \
+          "#{released_at.strftime('%Y-%m-%d')} (#{passed_days}/#{cooldown_days} cooldown days)"
+        )
+      end
+
+      in_cooldown
+    end
+
+    # The allowed version tags may carry a "tags/" prefix (when the dependency
+    # is pinned via "tags/<ref>"), whereas refs_for_tag_with_detail returns the
+    # raw tag names, so we try both forms to line dates up regardless of prefix.
+    #
+    # A GitHub Release's published_at is preferred when available, falling back
+    # to the tag creation date from refs_for_tag_with_detail. This mirrors the
+    # priority used by Dependabot::GitCooldownDateResolver.
+    sig { params(tag_name: String).returns(T.nilable(Time)) }
+    def release_date_for_tag_name(tag_name)
+      normalized = normalize_tag_name(tag_name)
+
+      github_release_published_at(normalized) ||
+        release_dates_by_tag_name[tag_name] ||
+        release_dates_by_tag_name[normalized]
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def release_dates_by_tag_name
+      @release_dates_by_tag_name ||= T.let(
+        build_release_dates_by_tag_name,
+        T.nilable(T::Hash[String, Time])
+      )
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def build_release_dates_by_tag_name
+      dates = T.let({}, T::Hash[String, Time])
+      refs_for_tag_with_detail.each do |detail|
+        released_at = parse_release_date(detail.release_date)
+        dates[detail.tag] = released_at if released_at
+      end
+      dates
+    end
+
+    sig { params(release_date: T.nilable(String)).returns(T.nilable(Time)) }
+    def parse_release_date(release_date)
+      return nil if release_date.nil? || release_date.empty?
+
+      Time.parse(release_date)
+    rescue ArgumentError => e
+      Dependabot.logger.error("Invalid release date format: #{release_date} (#{e.message})")
+      nil
+    end
+
     sig { returns(T.class_of(Gem::Version)) }
     def version_class
       @version_class ||= T.let(

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -1,7 +1,6 @@
 # typed: strict
 # frozen_string_literal: true
 
-require "cgi"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
@@ -40,7 +39,7 @@ module Dependabot
       sig { returns(T.nilable(ReleaseCooldownOptions)) }
       attr_reader :cooldown_options
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -52,7 +51,7 @@ module Dependabot
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
           cooldown_options: T.nilable(ReleaseCooldownOptions),
           raise_on_ignored: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(
@@ -336,7 +335,7 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::Requirement]) }
       def ignore_requirements
         ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
       end

data/lib/dependabot/package/package_release.rb

@@ -24,7 +24,7 @@ module Dependabot
           package_type: T.nilable(String),
           language: T.nilable(Dependabot::Package::PackageLanguage),
           tag: T.nilable(String),
-          details: T::Hash[String, T.untyped]
+          details: T::Hash[String, T.anything]
         ).void
       end
       def initialize(
@@ -50,7 +50,7 @@ module Dependabot
         @package_type = T.let(package_type, T.nilable(String))
         @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
         @tag = T.let(tag, T.nilable(String))
-        @details = T.let(details, T::Hash[String, T.untyped])
+        @details = T.let(details, T::Hash[String, T.anything])
       end
 
       sig { returns(Dependabot::Version) }
@@ -83,7 +83,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :tag
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(T::Hash[String, T.anything]) }
       attr_reader :details
 
       sig { returns(T::Boolean) }

data/lib/dependabot/pull_request_creator/commit_message_options.rb

@@ -0,0 +1,70 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class PullRequestCreator
+    # Typed view over the `commit_message_options` hash threaded into the PR
+    # creator's title and prefix builders. The raw options arrive as a loosely
+    # typed hash sourced from user config, so this parses the known keys once at
+    # the boundary and lets downstream builders use typed readers instead of
+    # digging an untyped hash.
+    class CommitMessageOptions
+      extend T::Sig
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :prefix
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :prefix_development
+
+      sig { returns(T::Boolean) }
+      attr_reader :include_scope
+
+      sig do
+        params(
+          prefix: T.nilable(String),
+          prefix_development: T.nilable(String),
+          include_scope: T::Boolean
+        ).void
+      end
+      def initialize(prefix: nil, prefix_development: nil, include_scope: false)
+        @prefix = prefix
+        @prefix_development = prefix_development
+        @include_scope = include_scope
+      end
+
+      # Parses a raw options hash. Unknown keys are ignored, and absent or
+      # non-string prefixes become nil.
+      sig { params(options: T::Hash[Symbol, T.anything]).returns(CommitMessageOptions) }
+      def self.from_hash(options)
+        new(
+          prefix: coerce_string(options[:prefix]),
+          prefix_development: coerce_string(options[:prefix_development]),
+          include_scope: options[:include_scope] ? true : false
+        )
+      end
+
+      sig { params(value: T.anything).returns(T.nilable(String)) }
+      def self.coerce_string(value)
+        case value
+        when String then value
+        end
+      end
+      private_class_method :coerce_string
+
+      # True when an explicit (non-nil) prefix was provided.
+      sig { returns(T::Boolean) }
+      def prefix?
+        !prefix.nil?
+      end
+
+      # True when an explicit (non-nil) development prefix was provided.
+      sig { returns(T::Boolean) }
+      def prefix_development?
+        !prefix_development.nil?
+      end
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -247,7 +247,7 @@ module Dependabot
           end
         end
 
-        sig { params(details: T::Hash[String, T.untyped]).returns(String) }
+        sig { params(details: T::Hash[String, T.anything]).returns(String) }
         def vulnerability_version_range_lines(details)
           msg = ""
           %w(
@@ -256,9 +256,12 @@ module Dependabot
             affected_versions
           ).each do |tp|
             type = T.must(tp.split("_").first).capitalize
-            next unless details[tp]
+            versions = case (value = details[tp])
+                       when Array then value
+                       end
+            next unless versions
 
-            versions_string = details[tp].any? ? details[tp].join("; ") : "none"
+            versions_string = versions.any? ? versions.join("; ") : "none"
             versions_string = versions_string.gsub(/(?<!\\)~/, '\~')
             msg += "> #{type} versions: #{versions_string}\n"
           end

data/lib/dependabot/pull_request_creator/message_builder/title_builder.rb

@@ -1,9 +1,10 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
 require "dependabot/dependency"
 require "dependabot/logger"
+require "dependabot/pull_request_creator/commit_message_options"
 require "dependabot/pull_request_creator/pr_name_prefixer"
 
 module Dependabot
@@ -25,7 +26,7 @@ module Dependabot
         sig { returns(T.nilable(Dependabot::PullRequestCreator::PrNamePrefixer)) }
         attr_reader :prefixer
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(CommitMessageOptions)) }
         attr_reader :commit_message_options
 
         sig { returns(T.nilable(T::Array[Dependabot::Dependency])) }
@@ -35,14 +36,17 @@ module Dependabot
           params(
             base_title: String,
             prefixer: T.nilable(Dependabot::PullRequestCreator::PrNamePrefixer),
-            commit_message_options: T.nilable(T::Hash[Symbol, T.untyped]),
+            commit_message_options: T.nilable(T::Hash[Symbol, T.anything]),
             dependencies: T.nilable(T::Array[Dependabot::Dependency])
           ).void
         end
         def initialize(base_title:, prefixer: nil, commit_message_options: nil, dependencies: nil)
           @base_title = base_title
           @prefixer = prefixer
-          @commit_message_options = commit_message_options
+          @commit_message_options = T.let(
+            commit_message_options && CommitMessageOptions.from_hash(commit_message_options),
+            T.nilable(CommitMessageOptions)
+          )
           @dependencies = dependencies
         end
 
@@ -85,12 +89,12 @@ module Dependabot
         # but without requiring source/credentials.
         sig { returns(String) }
         def build_explicit_prefix
-          return "" unless commit_message_options&.key?(:prefix)
+          return "" unless commit_message_options&.prefix?
 
           prefix = explicit_prefix_string
           return "" if prefix.empty?
 
-          prefix += "(#{scope})" if commit_message_options&.dig(:include_scope)
+          prefix += "(#{scope})" if commit_message_options&.include_scope
           # Append colon after alphanumeric or closing bracket to follow
           # conventional commit format (e.g., "chore: ..." or "fix(deps): ...")
           prefix += ":" if prefix.match?(/[A-Za-z0-9\)\]]\Z/)
@@ -101,11 +105,11 @@ module Dependabot
         sig { returns(String) }
         def explicit_prefix_string
           if production_dependencies?
-            commit_message_options&.dig(:prefix).to_s
-          elsif commit_message_options&.key?(:prefix_development)
-            commit_message_options&.dig(:prefix_development).to_s
+            commit_message_options&.prefix.to_s
+          elsif commit_message_options&.prefix_development?
+            commit_message_options&.prefix_development.to_s
           else
-            commit_message_options&.dig(:prefix).to_s
+            commit_message_options&.prefix.to_s
           end
         end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -45,10 +45,10 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :pr_message_footer
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, T.anything])) }
       attr_reader :commit_message_options
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(T::Hash[String, T::Array[T::Hash[String, String]]]) }
       attr_reader :vulnerabilities_fixed
 
       sig { returns(T.nilable(String)) }
@@ -79,8 +79,8 @@ module Dependabot
           credentials: T::Array[Dependabot::Credential],
           pr_message_header: T.nilable(String),
           pr_message_footer: T.nilable(String),
-          commit_message_options: T.nilable(T::Hash[Symbol, T.untyped]),
-          vulnerabilities_fixed: T::Hash[String, T.untyped],
+          commit_message_options: T.nilable(T::Hash[Symbol, T.anything]),
+          vulnerabilities_fixed: T::Hash[String, T::Array[T::Hash[String, String]]],
           github_redirection_service: T.nilable(String),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           pr_message_max_length: T.nilable(Integer),
@@ -379,7 +379,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def custom_trailers
-        trailers = commit_message_options&.dig(:trailers)
+        trailers = T.cast(commit_message_options&.dig(:trailers), T.nilable(Object))
         return if trailers.nil?
         raise("Commit trailers must be a Hash object") unless trailers.is_a?(Hash)
 
@@ -395,7 +395,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def signoff_message
-        signoff_details = commit_message_options&.dig(:signoff_details)
+        signoff_details = T.cast(commit_message_options&.dig(:signoff_details), T.nilable(Object))
         return unless signoff_details.is_a?(Hash)
         return unless signoff_details[:name] && signoff_details[:email]
 
@@ -404,7 +404,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def on_behalf_of_message
-        signoff_details = commit_message_options&.dig(:signoff_details)
+        signoff_details = T.cast(commit_message_options&.dig(:signoff_details), T.nilable(Object))
         return unless signoff_details.is_a?(Hash)
         return unless signoff_details[:org_name] && signoff_details[:org_email]
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -9,6 +9,7 @@ require "dependabot/clients/codecommit"
 require "dependabot/clients/github_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/pull_request_creator"
+require "dependabot/pull_request_creator/commit_message_options"
 
 module Dependabot
   class PullRequestCreator
@@ -39,7 +40,7 @@ module Dependabot
           dependencies: T::Array[Dependency],
           credentials: T::Array[Dependabot::Credential],
           security_fix: T::Boolean,
-          commit_message_options: T.nilable(T::Hash[Symbol, T.untyped])
+          commit_message_options: T.nilable(T::Hash[Symbol, T.anything])
         )
           .void
       end
@@ -54,7 +55,10 @@ module Dependabot
         @source                 = source
         @credentials            = credentials
         @security_fix           = security_fix
-        @commit_message_options = commit_message_options
+        @commit_message_options = T.let(
+          commit_message_options && CommitMessageOptions.from_hash(commit_message_options),
+          T.nilable(CommitMessageOptions)
+        )
       end
 
       sig { returns(String) }
@@ -85,7 +89,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(CommitMessageOptions)) }
       attr_reader :commit_message_options
 
       sig { returns(T::Boolean) }
@@ -96,7 +100,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def commit_prefix
         # If a preferred prefix has been explicitly provided, use it
-        return prefix_from_explicitly_provided_details if commit_message_options&.key?(:prefix)
+        return prefix_from_explicitly_provided_details if commit_message_options&.prefix?
 
         # Otherwise, if there is a previous Dependabot commit and it used a
         # known style, use that as our model for subsequent commits
@@ -112,7 +116,7 @@ module Dependabot
         prefix = explicitly_provided_prefix_string
         return if prefix.empty?
 
-        prefix += "(#{scope})" if commit_message_options&.dig(:include_scope)
+        prefix += "(#{scope})" if commit_message_options&.include_scope
         prefix += ":" if prefix.match?(/[A-Za-z0-9\)\]]\Z/)
         prefix += " " unless prefix.end_with?(" ")
         prefix
@@ -121,14 +125,14 @@ module Dependabot
       # rubocop:disable Metrics/PerceivedComplexity
       sig { returns(String) }
       def explicitly_provided_prefix_string
-        raise "No explicitly provided prefix!" unless commit_message_options&.key?(:prefix)
+        raise "No explicitly provided prefix!" unless commit_message_options&.prefix?
 
         if dependencies.any?(&:production?)
-          commit_message_options&.dig(:prefix).to_s
-        elsif commit_message_options&.key?(:prefix_development)
-          commit_message_options&.dig(:prefix_development).to_s
+          commit_message_options&.prefix.to_s
+        elsif commit_message_options&.prefix_development?
+          commit_message_options&.prefix_development.to_s
         else
-          commit_message_options&.dig(:prefix).to_s
+          commit_message_options&.prefix.to_s
         end
       end
       # rubocop:enable Metrics/PerceivedComplexity

data/lib/dependabot/pull_request_creator.rb

@@ -97,10 +97,10 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :signature_key
 
-    sig { returns(T::Hash[Symbol, T.untyped]) }
+    sig { returns(T::Hash[Symbol, T.anything]) }
     attr_reader :commit_message_options
 
-    sig { returns(T::Hash[String, String]) }
+    sig { returns(T::Hash[String, T::Array[T::Hash[String, String]]]) }
     attr_reader :vulnerabilities_fixed
 
     AzureReviewers = T.type_alias { T.nilable(T::Array[String]) }
@@ -132,7 +132,7 @@ module Dependabot
     sig { returns(T.nilable(T::Hash[String, String])) }
     attr_reader :custom_headers
 
-    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { returns(T.nilable(T::Hash[Symbol, T.anything])) }
     attr_reader :provider_metadata
 
     sig { returns(T.nilable(Dependabot::DependencyGroup)) }
@@ -156,8 +156,8 @@ module Dependabot
         custom_labels: T.nilable(T::Array[String]),
         author_details: T.nilable(T::Hash[Symbol, String]),
         signature_key: T.nilable(String),
-        commit_message_options: T::Hash[Symbol, T.untyped],
-        vulnerabilities_fixed: T::Hash[String, String],
+        commit_message_options: T::Hash[Symbol, T.anything],
+        vulnerabilities_fixed: T::Hash[String, T::Array[T::Hash[String, String]]],
         reviewers: Reviewers,
         assignees: T.nilable(T.any(T::Array[String], T::Array[Integer])),
         milestone: T.nilable(T.any(T::Array[String], Integer)),
@@ -169,7 +169,7 @@ module Dependabot
         github_redirection_service: String,
         custom_headers: T.nilable(T::Hash[String, String]),
         require_up_to_date_base: T::Boolean,
-        provider_metadata: T.nilable(T::Hash[Symbol, T.untyped]),
+        provider_metadata: T.nilable(T::Hash[Symbol, T.anything]),
         message: T.nilable(
           T.any(Dependabot::PullRequestCreator::Message, Dependabot::PullRequestCreator::MessageBuilder)
         ),
@@ -253,7 +253,7 @@ module Dependabot
     # TODO: This returns client-specific objects.
     # We should create a standard interface (`Dependabot::PullRequest`) and
     # then convert to that
-    sig { returns(T.untyped) }
+    sig { returns(T.anything) }
     def create
       case source.provider
       when "github" then github_creator.create

data/lib/dependabot/registry_client.rb

@@ -21,8 +21,8 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[T.any(String, Symbol), T.untyped],
-        options: T::Hash[Symbol, T.untyped]
+        headers: T::Hash[T.any(String, Symbol), T.anything],
+        options: T::Hash[Symbol, T.anything]
       )
         .returns(Excon::Response)
     end
@@ -43,8 +43,8 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[T.any(String, Symbol), T.untyped],
-        options: T::Hash[Symbol, T.untyped]
+        headers: T::Hash[T.any(String, Symbol), T.anything],
+        options: T::Hash[Symbol, T.anything]
       )
         .returns(Excon::Response)
     end

data/lib/dependabot/simple_instrumentor.rb

@@ -9,14 +9,14 @@ module Dependabot
       extend T::Sig
       extend T::Generic
 
-      sig { returns(T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void])) }
+      sig { returns(T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void])) }
       attr_accessor :subscribers
 
-      sig { params(block: T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void).void }
+      sig { params(block: T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void).void }
       def subscribe(&block)
         @subscribers ||= T.let(
           [],
-          T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void])
+          T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void])
         )
         @subscribers << block
       end
@@ -25,7 +25,7 @@ module Dependabot
         type_parameters(:T)
           .params(
             name: String,
-            params: T::Hash[Symbol, T.untyped],
+            params: T::Hash[Symbol, T.anything],
             block: T.proc.returns(T.type_parameter(:T))
           )
           .returns(T.nilable(T.type_parameter(:T)))

data/lib/dependabot/update_checkers/base.rb

@@ -46,7 +46,7 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
       attr_reader :update_cooldown
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -61,7 +61,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         )
           .void
       end
@@ -233,7 +233,7 @@ module Dependabot
       # instances are returned as-is; plain hashes are wrapped. Re-wrapping
       # would produce a value-equal copy, so skipping it avoids needless
       # allocations.
-      sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[Dependabot::DependencyRequirement]) }
+      sig { params(requirements: T::Array[T::Hash[Symbol, T.anything]]).returns(T::Array[Dependabot::DependencyRequirement]) }
       def wrap_requirements(requirements)
         requirements.map do |requirement|
           requirement.is_a?(Dependabot::DependencyRequirement) ? requirement : Dependabot::DependencyRequirement.create(requirement)
@@ -406,7 +406,7 @@ module Dependabot
           version_class.correct?(latest_version.to_s)) || false
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def changed_requirements
         (updated_requirements - dependency.requirements)
       end

data/lib/dependabot/version.rb

@@ -32,6 +32,19 @@ module Dependabot
       version.to_s.match?(ANCHORED_VERSION_PATTERN)
     end
 
+    # RubyGems 4 eagerly computes a numeric sort key in Gem::Version#initialize and
+    # skips it for prereleases. Dependabot's subclasses override #prerelease? with
+    # ecosystem-specific semantics, so a version with alphabetic segments (e.g.
+    # "1.0.0.RELEASE" or "2.0.0.post1") can report prerelease? == false and reach
+    # RubyGems' radix comparison, which raises when a segment is a String. Returning
+    # nil for those versions falls back to the segment-by-segment comparison.
+    sig { override.overridable.returns(T.nilable(Integer)) }
+    def compute_sort_key
+      return if canonical_segments.any?(String)
+
+      super
+    end
+
     sig { overridable.returns(String) }
     def to_semver
       @original_version

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.383.0"
+  VERSION = "0.385.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -580,6 +580,7 @@ files:
 - lib/dependabot/pull_request_creator/branch_namer/multi_ecosystem_strategy.rb
 - lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb
 - lib/dependabot/pull_request_creator/codecommit.rb
+- lib/dependabot/pull_request_creator/commit_message_options.rb
 - lib/dependabot/pull_request_creator/commit_signer.rb
 - lib/dependabot/pull_request_creator/github.rb
 - lib/dependabot/pull_request_creator/gitlab.rb
@@ -620,7 +621,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib
@@ -635,7 +636,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.7
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Shared code used across Dependabot Core
 test_files: []