dependabot-common 0.384.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4011821492cf0ae915acc4d9b0783f699f5522946eac07bbef8973e8692df1f9
-  data.tar.gz: 7502e7687e79b39ec94fad1c9318e1b40b7cdf7965c8c1818ebda3a7a914b8ee
+  metadata.gz: 58033d13e6a5c0bee14915505c98d752b8a6f2e26ffb96a4ba6d95ca66057bc3
+  data.tar.gz: 0a6c8eebbffb115434da53fbd171236690f1594a617f16fb4e29b1addfc81308
 SHA512:
-  metadata.gz: c5f9708f6197bf0fe6e6dd22b971e41522f7deb6af1963786276dd5246d3177741768e4065d437c4ad3906ff0d0d91afd10b41a0108c0e553a14be2ae1dfde5f
-  data.tar.gz: 1e9ebca6d67ec61d619f36e71cfd02cd92c1aca3d6701b47ff4a94c95f2abcdb05277de57902d4dea2b1d5bb6410cabbc027c81bb0e8884bbee84d31cd43e2f4
+  metadata.gz: 5defea48ad000e82511496f0cb413945bf6ba2a5070361af5f1fa5e6411a11679a24de9e852c478f48fba3299d3678865e2faf97158c310ee429f6ac368fee5c
+  data.tar.gz: fcf737b08310353b51bc3b32a53f24546e8bf30aa58a9a0b9e91e025921728bdcba378da8b68f9dc592b1bec349ff487a5d21a2683ab1ad76fa1d8b748ca066b

data/lib/dependabot/command_helpers.rb

@@ -20,46 +20,46 @@ module Dependabot
     end
 
     OutputObserver = T.type_alias do
-      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
+      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.anything]))
     end
 
     EnvCmdItem = T.type_alias do
       T.any(
         String,
-        T::Hash[T.any(String, Symbol), T.untyped]
+        T::Hash[T.any(String, Symbol), T.anything]
       )
     end
 
     class ProcessStatus
       extend T::Sig
 
-      sig { params(process_status: Process::Status, custom_exitstatus: T.nilable(Integer)).void }
+      sig { params(process_status: T.nilable(Process::Status), custom_exitstatus: T.nilable(Integer)).void }
       def initialize(process_status, custom_exitstatus = nil)
-        @process_status = process_status
+        @process_status = T.let(process_status, T.nilable(Process::Status))
         @custom_exitstatus = custom_exitstatus
       end
 
       # Return the exit status, either from the process status or the custom one
       sig { returns(Integer) }
       def exitstatus
-        @custom_exitstatus || @process_status.exitstatus || 0
+        @custom_exitstatus || @process_status&.exitstatus || 0
       end
 
       # Determine if the process was successful
       sig { returns(T::Boolean) }
       def success?
-        @custom_exitstatus.nil? ? @process_status.success? || false : @custom_exitstatus.zero?
+        @custom_exitstatus.nil? ? @process_status&.success? || false : @custom_exitstatus.zero?
       end
 
       # Return the PID of the process (if available)
       sig { returns(T.nilable(Integer)) }
       def pid
-        @process_status.pid
+        @process_status&.pid
       end
 
       sig { returns(T.nilable(Integer)) }
       def termsig
-        @process_status.termsig
+        @process_status&.termsig
       end
 
       # String representation of the status
@@ -68,7 +68,7 @@ module Dependabot
         if @custom_exitstatus
           "pid #{pid || 'unknown'}: exit #{@custom_exitstatus} (custom status)"
         else
-          @process_status.to_s
+          @process_status&.to_s || "unknown status"
         end
       end
     end

data/lib/dependabot/errors.rb

@@ -23,7 +23,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -142,7 +142,7 @@ module Dependabot
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -226,7 +226,7 @@ module Dependabot
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -416,7 +416,7 @@ module Dependabot
 
     interface!
 
-    sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+    sig { abstract.returns(T::Hash[Symbol, T.anything]) }
     def sentry_context; end
   end
 
@@ -484,7 +484,7 @@ module Dependabot
       super(message || error_type)
     end
 
-    sig { params(hash: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Hash[Symbol, T.untyped]) }
+    sig { params(hash: T.nilable(T::Hash[Symbol, T.anything])).returns(T::Hash[Symbol, T.anything]) }
     def detail(hash = nil)
       {
         "error-type": error_type,

data/lib/dependabot/experiments.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,21 +7,21 @@ module Dependabot
   module Experiments
     extend T::Sig
 
-    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.untyped])
+    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.anything])
 
-    sig { returns(T::Hash[T.any(String, Symbol), T.untyped]) }
+    sig { returns(T::Hash[T.any(String, Symbol), T.anything]) }
     def self.reset!
       @experiments = {}
     end
 
-    sig { params(name: T.any(String, Symbol), value: T.untyped).void }
+    sig { params(name: T.any(String, Symbol), value: T.anything).void }
     def self.register(name, value)
       @experiments[name.to_sym] = value
     end
 
     sig { params(name: T.any(String, Symbol)).returns(T::Boolean) }
     def self.enabled?(name)
-      !!@experiments[name.to_sym]
+      @experiments[name.to_sym] ? true : false
     end
   end
 end

data/lib/dependabot/file_parsers/base.rb

@@ -25,7 +25,7 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Source)) }
       attr_reader :source
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig { returns(T::Boolean) }
@@ -40,7 +40,7 @@ module Dependabot
           repo_contents_path: T.nilable(String),
           credentials: T::Array[Dependabot::Credential],
           reject_external_code: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         )
           .void
       end

data/lib/dependabot/file_updaters/base.rb

@@ -26,7 +26,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -35,7 +35,7 @@ module Dependabot
           dependency_files: T::Array[Dependabot::DependencyFile],
           credentials: T::Array[Dependabot::Credential],
           repo_contents_path: T.nilable(String),
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path: nil, options: {})

data/lib/dependabot/git_commit_checker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "time"
 require "sorbet-runtime"
 require "gitlab"
 require "dependabot/clients/github_with_retries"
@@ -15,10 +16,15 @@ require "dependabot/dependency"
 require "dependabot/credential"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_tag_details"
+require "dependabot/package/package_release"
+require "dependabot/package/release_cooldown_options"
+require "dependabot/update_checkers/cooldown_calculation"
+require "dependabot/git_cooldown_date_resolver"
 module Dependabot
   # rubocop:disable Metrics/ClassLength
   class GitCommitChecker
     extend T::Sig
+    include Dependabot::GitCooldownDateResolver
 
     VERSION_REGEX = /
       (?<version>
@@ -174,9 +180,35 @@ module Dependabot
       max_local_tag_for_lower_precision(allowed_refs)
     end
 
-    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
-    def local_tag_for_latest_version
-      max_local_tag(allowed_version_tags)
+    # Returns the latest allowed version tag, or nil when every candidate tag is
+    # still within its cooldown window. All cooldown handling — the nil /
+    # disabled / excluded short-circuits and the logging — lives in
+    # #apply_cooldown, so this method stays a thin orchestration step.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_latest_version(cooldown_options = nil)
+      filtered_tags = apply_cooldown(allowed_version_tags, cooldown_options)
+      return nil if filtered_tags.nil?
+
+      max_local_tag(filtered_tags)
+    end
+
+    # Returns the latest allowed version tag, but only when the dependency is
+    # pinned to a ref that looks like a version. Most ecosystems share this
+    # precondition before resolving a newer version tag for a git dependency,
+    # so it lives here instead of being repeated at each call site. Returns nil
+    # for dependencies that aren't pinned to a version (e.g. branch- or
+    # SHA-pinned), which never want a version-tag update.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_pinned_version_ref(cooldown_options = nil)
+      return nil unless pinned_ref_looks_like_version?
+
+      local_tag_for_latest_version(cooldown_options)
     end
 
     sig { returns(T::Array[Dependabot::GitTagDetails]) }
@@ -285,6 +317,30 @@ module Dependabot
       allowed_versions(local_tags, filter_by_prefix: false)
     end
 
+    # Returns the allowed version tags paired with their parsed release
+    # dates as a single list, so callers don't have to re-correlate two
+    # separate lists (tags and tag-dates) by tag name themselves.
+    sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+    def allowed_version_tags_with_release_dates
+      allowed_version_tags.map do |tag|
+        Dependabot::Package::PackageRelease.new(
+          version: T.cast(version_from_tag(tag), Dependabot::Version),
+          tag: tag.name,
+          released_at: release_date_for_tag_name(tag.name)
+        )
+      end
+    end
+
+    sig { override.returns(T.nilable(String)) }
+    def cooldown_source_url
+      dependency_source_details&.fetch(:url, nil)
+    end
+
+    sig { override.returns(T::Array[Dependabot::Credential]) }
+    def cooldown_credentials
+      credentials
+    end
+
     private
 
     sig { returns(Dependabot::Dependency) }
@@ -689,7 +745,9 @@ module Dependabot
             source: T.must(source),
             credentials: credentials
           )
-          client.releases(T.must(source).repo, per_page: 100)
+          # The Octokit RBI types this as non-nil, but it can be nil at runtime
+          # (e.g. an empty/unexpected registry response), so guard against it.
+          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
         rescue Octokit::Error
           []
         end,
@@ -712,6 +770,107 @@ module Dependabot
       T.must(T.must(name.match(VERSION_REGEX)).named_captures.fetch("version"))
     end
 
+    # Filters out git tags that are still within their cooldown window. Returns
+    # the candidate tags unchanged when cooldown does not apply (no options,
+    # disabled, or the dependency is excluded), and nil when every candidate tag
+    # is still within its cooldown window, so the caller proposes no update.
+    sig do
+      params(
+        candidate_tags: T::Array[Dependabot::GitRef],
+        cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+      ).returns(T.nilable(T::Array[Dependabot::GitRef]))
+    end
+    def apply_cooldown(candidate_tags, cooldown_options)
+      if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(cooldown_options, dependency.name)
+        return candidate_tags
+      end
+
+      cooldown = T.must(cooldown_options)
+      filtered_tags = candidate_tags.reject { |tag| tag_in_cooldown_period?(tag, cooldown) }
+
+      if filtered_tags.empty? && candidate_tags.any?
+        Dependabot.logger.info(
+          "All git tags for #{dependency.name} are within their cooldown period; skipping update"
+        )
+        return nil
+      end
+
+      filtered_tags
+    end
+
+    sig do
+      params(tag: Dependabot::GitRef, cooldown: Dependabot::Package::ReleaseCooldownOptions)
+        .returns(T::Boolean)
+    end
+    def tag_in_cooldown_period?(tag, cooldown)
+      released_at = release_date_for_tag_name(tag.name)
+      return false unless released_at
+
+      cooldown_days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
+        cooldown,
+        T.cast(current_version, T.nilable(Dependabot::Version)),
+        T.cast(version_from_tag(tag), Dependabot::Version)
+      )
+
+      in_cooldown = Dependabot::UpdateCheckers::CooldownCalculation
+                    .within_cooldown_window?(released_at, cooldown_days)
+
+      if in_cooldown
+        passed_days = (Time.now.to_i - released_at.to_i) /
+                      Dependabot::UpdateCheckers::CooldownCalculation::DAY_IN_SECONDS
+        Dependabot.logger.info(
+          "Filtered git tag #{tag.name} for #{dependency.name}: released " \
+          "#{released_at.strftime('%Y-%m-%d')} (#{passed_days}/#{cooldown_days} cooldown days)"
+        )
+      end
+
+      in_cooldown
+    end
+
+    # The allowed version tags may carry a "tags/" prefix (when the dependency
+    # is pinned via "tags/<ref>"), whereas refs_for_tag_with_detail returns the
+    # raw tag names, so we try both forms to line dates up regardless of prefix.
+    #
+    # A GitHub Release's published_at is preferred when available, falling back
+    # to the tag creation date from refs_for_tag_with_detail. This mirrors the
+    # priority used by Dependabot::GitCooldownDateResolver.
+    sig { params(tag_name: String).returns(T.nilable(Time)) }
+    def release_date_for_tag_name(tag_name)
+      normalized = normalize_tag_name(tag_name)
+
+      github_release_published_at(normalized) ||
+        release_dates_by_tag_name[tag_name] ||
+        release_dates_by_tag_name[normalized]
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def release_dates_by_tag_name
+      @release_dates_by_tag_name ||= T.let(
+        build_release_dates_by_tag_name,
+        T.nilable(T::Hash[String, Time])
+      )
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def build_release_dates_by_tag_name
+      dates = T.let({}, T::Hash[String, Time])
+      refs_for_tag_with_detail.each do |detail|
+        released_at = parse_release_date(detail.release_date)
+        dates[detail.tag] = released_at if released_at
+      end
+      dates
+    end
+
+    sig { params(release_date: T.nilable(String)).returns(T.nilable(Time)) }
+    def parse_release_date(release_date)
+      return nil if release_date.nil? || release_date.empty?
+
+      Time.parse(release_date)
+    rescue ArgumentError => e
+      Dependabot.logger.error("Invalid release date format: #{release_date} (#{e.message})")
+      nil
+    end
+
     sig { returns(T.class_of(Gem::Version)) }
     def version_class
       @version_class ||= T.let(

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -39,7 +39,7 @@ module Dependabot
       sig { returns(T.nilable(ReleaseCooldownOptions)) }
       attr_reader :cooldown_options
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -51,7 +51,7 @@ module Dependabot
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
           cooldown_options: T.nilable(ReleaseCooldownOptions),
           raise_on_ignored: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(
@@ -335,7 +335,7 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::Requirement]) }
       def ignore_requirements
         ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
       end

data/lib/dependabot/package/package_release.rb

@@ -24,7 +24,7 @@ module Dependabot
           package_type: T.nilable(String),
           language: T.nilable(Dependabot::Package::PackageLanguage),
           tag: T.nilable(String),
-          details: T::Hash[String, T.untyped]
+          details: T::Hash[String, T.anything]
         ).void
       end
       def initialize(
@@ -50,7 +50,7 @@ module Dependabot
         @package_type = T.let(package_type, T.nilable(String))
         @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
         @tag = T.let(tag, T.nilable(String))
-        @details = T.let(details, T::Hash[String, T.untyped])
+        @details = T.let(details, T::Hash[String, T.anything])
       end
 
       sig { returns(Dependabot::Version) }
@@ -83,7 +83,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :tag
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(T::Hash[String, T.anything]) }
       attr_reader :details
 
       sig { returns(T::Boolean) }

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -45,10 +45,10 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :pr_message_footer
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, T.anything])) }
       attr_reader :commit_message_options
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(T::Hash[String, T::Array[T::Hash[String, String]]]) }
       attr_reader :vulnerabilities_fixed
 
       sig { returns(T.nilable(String)) }
@@ -79,8 +79,8 @@ module Dependabot
           credentials: T::Array[Dependabot::Credential],
           pr_message_header: T.nilable(String),
           pr_message_footer: T.nilable(String),
-          commit_message_options: T.nilable(T::Hash[Symbol, T.untyped]),
-          vulnerabilities_fixed: T::Hash[String, T.untyped],
+          commit_message_options: T.nilable(T::Hash[Symbol, T.anything]),
+          vulnerabilities_fixed: T::Hash[String, T::Array[T::Hash[String, String]]],
           github_redirection_service: T.nilable(String),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           pr_message_max_length: T.nilable(Integer),
@@ -379,7 +379,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def custom_trailers
-        trailers = commit_message_options&.dig(:trailers)
+        trailers = T.cast(commit_message_options&.dig(:trailers), T.nilable(Object))
         return if trailers.nil?
         raise("Commit trailers must be a Hash object") unless trailers.is_a?(Hash)
 
@@ -395,7 +395,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def signoff_message
-        signoff_details = commit_message_options&.dig(:signoff_details)
+        signoff_details = T.cast(commit_message_options&.dig(:signoff_details), T.nilable(Object))
         return unless signoff_details.is_a?(Hash)
         return unless signoff_details[:name] && signoff_details[:email]
 
@@ -404,7 +404,7 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def on_behalf_of_message
-        signoff_details = commit_message_options&.dig(:signoff_details)
+        signoff_details = T.cast(commit_message_options&.dig(:signoff_details), T.nilable(Object))
         return unless signoff_details.is_a?(Hash)
         return unless signoff_details[:org_name] && signoff_details[:org_email]
 

data/lib/dependabot/pull_request_creator.rb

@@ -97,10 +97,10 @@ module Dependabot
     sig { returns(T.nilable(String)) }
     attr_reader :signature_key
 
-    sig { returns(T::Hash[Symbol, T.untyped]) }
+    sig { returns(T::Hash[Symbol, T.anything]) }
     attr_reader :commit_message_options
 
-    sig { returns(T::Hash[String, String]) }
+    sig { returns(T::Hash[String, T::Array[T::Hash[String, String]]]) }
     attr_reader :vulnerabilities_fixed
 
     AzureReviewers = T.type_alias { T.nilable(T::Array[String]) }
@@ -132,7 +132,7 @@ module Dependabot
     sig { returns(T.nilable(T::Hash[String, String])) }
     attr_reader :custom_headers
 
-    sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+    sig { returns(T.nilable(T::Hash[Symbol, T.anything])) }
     attr_reader :provider_metadata
 
     sig { returns(T.nilable(Dependabot::DependencyGroup)) }
@@ -156,8 +156,8 @@ module Dependabot
         custom_labels: T.nilable(T::Array[String]),
         author_details: T.nilable(T::Hash[Symbol, String]),
         signature_key: T.nilable(String),
-        commit_message_options: T::Hash[Symbol, T.untyped],
-        vulnerabilities_fixed: T::Hash[String, String],
+        commit_message_options: T::Hash[Symbol, T.anything],
+        vulnerabilities_fixed: T::Hash[String, T::Array[T::Hash[String, String]]],
         reviewers: Reviewers,
         assignees: T.nilable(T.any(T::Array[String], T::Array[Integer])),
         milestone: T.nilable(T.any(T::Array[String], Integer)),
@@ -169,7 +169,7 @@ module Dependabot
         github_redirection_service: String,
         custom_headers: T.nilable(T::Hash[String, String]),
         require_up_to_date_base: T::Boolean,
-        provider_metadata: T.nilable(T::Hash[Symbol, T.untyped]),
+        provider_metadata: T.nilable(T::Hash[Symbol, T.anything]),
         message: T.nilable(
           T.any(Dependabot::PullRequestCreator::Message, Dependabot::PullRequestCreator::MessageBuilder)
         ),
@@ -253,7 +253,7 @@ module Dependabot
     # TODO: This returns client-specific objects.
     # We should create a standard interface (`Dependabot::PullRequest`) and
     # then convert to that
-    sig { returns(T.untyped) }
+    sig { returns(T.anything) }
     def create
       case source.provider
       when "github" then github_creator.create

data/lib/dependabot/registry_client.rb

@@ -21,8 +21,8 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[T.any(String, Symbol), T.untyped],
-        options: T::Hash[Symbol, T.untyped]
+        headers: T::Hash[T.any(String, Symbol), T.anything],
+        options: T::Hash[Symbol, T.anything]
       )
         .returns(Excon::Response)
     end
@@ -43,8 +43,8 @@ module Dependabot
     sig do
       params(
         url: String,
-        headers: T::Hash[T.any(String, Symbol), T.untyped],
-        options: T::Hash[Symbol, T.untyped]
+        headers: T::Hash[T.any(String, Symbol), T.anything],
+        options: T::Hash[Symbol, T.anything]
       )
         .returns(Excon::Response)
     end

data/lib/dependabot/simple_instrumentor.rb

@@ -9,14 +9,14 @@ module Dependabot
       extend T::Sig
       extend T::Generic
 
-      sig { returns(T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void])) }
+      sig { returns(T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void])) }
       attr_accessor :subscribers
 
-      sig { params(block: T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void).void }
+      sig { params(block: T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void).void }
       def subscribe(&block)
         @subscribers ||= T.let(
           [],
-          T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.untyped]).void])
+          T.nilable(T::Array[T.proc.params(name: String, params: T::Hash[Symbol, T.anything]).void])
         )
         @subscribers << block
       end
@@ -25,7 +25,7 @@ module Dependabot
         type_parameters(:T)
           .params(
             name: String,
-            params: T::Hash[Symbol, T.untyped],
+            params: T::Hash[Symbol, T.anything],
             block: T.proc.returns(T.type_parameter(:T))
           )
           .returns(T.nilable(T.type_parameter(:T)))

data/lib/dependabot/update_checkers/base.rb

@@ -46,7 +46,7 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
       attr_reader :update_cooldown
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -61,7 +61,7 @@ module Dependabot
           requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
           dependency_group: T.nilable(Dependabot::DependencyGroup),
           update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         )
           .void
       end
@@ -233,7 +233,7 @@ module Dependabot
       # instances are returned as-is; plain hashes are wrapped. Re-wrapping
       # would produce a value-equal copy, so skipping it avoids needless
       # allocations.
-      sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[Dependabot::DependencyRequirement]) }
+      sig { params(requirements: T::Array[T::Hash[Symbol, T.anything]]).returns(T::Array[Dependabot::DependencyRequirement]) }
       def wrap_requirements(requirements)
         requirements.map do |requirement|
           requirement.is_a?(Dependabot::DependencyRequirement) ? requirement : Dependabot::DependencyRequirement.create(requirement)
@@ -406,7 +406,7 @@ module Dependabot
           version_class.correct?(latest_version.to_s)) || false
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def changed_requirements
         (updated_requirements - dependency.requirements)
       end

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.384.0"
+  VERSION = "0.385.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -621,7 +621,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib