dependabot-common 0.384.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4011821492cf0ae915acc4d9b0783f699f5522946eac07bbef8973e8692df1f9
-  data.tar.gz: 7502e7687e79b39ec94fad1c9318e1b40b7cdf7965c8c1818ebda3a7a914b8ee
+  metadata.gz: 4e4c26ec485eed8ebb4e35d9edfa4ab996658f450708439941ff8ca253ce0457
+  data.tar.gz: '045951912dda5a814efcf305b11ae28e5c6cd97a1e7f72f1c610650d2f9031cb'
 SHA512:
-  metadata.gz: c5f9708f6197bf0fe6e6dd22b971e41522f7deb6af1963786276dd5246d3177741768e4065d437c4ad3906ff0d0d91afd10b41a0108c0e553a14be2ae1dfde5f
-  data.tar.gz: 1e9ebca6d67ec61d619f36e71cfd02cd92c1aca3d6701b47ff4a94c95f2abcdb05277de57902d4dea2b1d5bb6410cabbc027c81bb0e8884bbee84d31cd43e2f4
+  metadata.gz: bb49cbf946335c722ca445b0c314909eb0cf1790b241b68461881873cf254afddb7b7b10a168879ded348af64bdb30f5093882c1221b8f3c7e3ca69bbf6bd59b
+  data.tar.gz: ed0b8a8a019adeed81707ee2aae27e1e7e50d8f4c0da2d66cfca4a952df713173706d091062d02cb5a5aa4c18b819747b76ec5f114595fdbb804c4bef9df208b

data/lib/dependabot/command_helpers.rb

@@ -20,46 +20,46 @@ module Dependabot
     end
 
     OutputObserver = T.type_alias do
-      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.untyped]))
+      T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.anything]))
     end
 
     EnvCmdItem = T.type_alias do
       T.any(
         String,
-        T::Hash[T.any(String, Symbol), T.untyped]
+        T::Hash[T.any(String, Symbol), T.anything]
       )
     end
 
     class ProcessStatus
       extend T::Sig
 
-      sig { params(process_status: Process::Status, custom_exitstatus: T.nilable(Integer)).void }
+      sig { params(process_status: T.nilable(Process::Status), custom_exitstatus: T.nilable(Integer)).void }
       def initialize(process_status, custom_exitstatus = nil)
-        @process_status = process_status
+        @process_status = T.let(process_status, T.nilable(Process::Status))
         @custom_exitstatus = custom_exitstatus
       end
 
       # Return the exit status, either from the process status or the custom one
       sig { returns(Integer) }
       def exitstatus
-        @custom_exitstatus || @process_status.exitstatus || 0
+        @custom_exitstatus || @process_status&.exitstatus || 0
       end
 
       # Determine if the process was successful
       sig { returns(T::Boolean) }
       def success?
-        @custom_exitstatus.nil? ? @process_status.success? || false : @custom_exitstatus.zero?
+        @custom_exitstatus.nil? ? @process_status&.success? || false : @custom_exitstatus.zero?
       end
 
       # Return the PID of the process (if available)
       sig { returns(T.nilable(Integer)) }
       def pid
-        @process_status.pid
+        @process_status&.pid
       end
 
       sig { returns(T.nilable(Integer)) }
       def termsig
-        @process_status.termsig
+        @process_status&.termsig
       end
 
       # String representation of the status
@@ -68,7 +68,7 @@ module Dependabot
         if @custom_exitstatus
           "pid #{pid || 'unknown'}: exit #{@custom_exitstatus} (custom status)"
         else
-          @process_status.to_s
+          @process_status&.to_s || "unknown status"
         end
       end
     end

data/lib/dependabot/dependency_graphers/base.rb

@@ -3,6 +3,8 @@
 
 require "sorbet-runtime"
 
+require "dependabot/dependency_file"
+
 module Dependabot
   module DependencyGraphers
     # This is a small value class that specifies the information we expect to be returned for each
@@ -20,6 +22,29 @@ module Dependabot
       const :dependencies, T::Array[String]
     end
 
+    # A manifest group is a subset of a directory's dependency files that stands on its own as a valid
+    # parser input, plus the single file that the group's dependencies should be attributed to.
+    #
+    # - `primary` is the attribution target (the file that owns the group's dependencies in the snapshot).
+    # - `files` is everything the parser needs to resolve the group, including the primary and any sibling
+    #   files pulled in only to satisfy cross-references.
+    #
+    # Most ecosystems have exactly one group per directory (a manifest + optional lockfile).
+    #
+    # Ecosystems where multiple independent manifests routinely share a directory override `manifest_groups`
+    # to return one group per independent manifest using ecosystem-specific rules (e.g. Python layered requirements)
+    class ManifestGroup < T::ImmutableStruct
+      const :primary, Dependabot::DependencyFile
+      const :files, T::Array[Dependabot::DependencyFile]
+    end
+
+    # The resolved output for a single manifest group: the file to attribute to, and the dependencies
+    # resolved from that group's files.
+    class ManifestGroupSnapshot < T::ImmutableStruct
+      const :manifest_file, Dependabot::DependencyFile
+      const :resolved_dependencies, T::Hash[String, ResolvedDependency]
+    end
+
     class Base
       extend T::Sig
       extend T::Helpers
@@ -78,8 +103,86 @@ module Dependabot
         end
       end
 
+      # Partitions the parsed directory into one or more manifest groups.
+      #
+      # The default is a single group spanning the whole directory, attributed to `relevant_dependency_file`.
+      #
+      # Ecosystems where multiple independent manifests share a directory should override this to return
+      # one group per manifest.
+      sig { overridable.returns(T::Array[ManifestGroup]) }
+      def manifest_groups
+        [ManifestGroup.new(primary: relevant_dependency_file, files: dependency_files)]
+      end
+
+      # Resolves each manifest group into a snapshot.
+      #
+      # When there is a single group, the common case for most ecosystems, we attribute all resolved dependencies
+      # to the group's primary without further work required.
+      #
+      # When there are multiple groups, we instantiate a new scoped grapher for the group's files and resolve each
+      # independently.
+      sig { returns(T::Array[ManifestGroupSnapshot]) }
+      def manifest_group_snapshots
+        @manifest_group_snapshots ||= T.let(
+          build_manifest_group_snapshots,
+          T.nilable(T::Array[ManifestGroupSnapshot])
+        )
+      end
+
       private
 
+      sig { returns(T::Array[ManifestGroupSnapshot]) }
+      def build_manifest_group_snapshots
+        groups = manifest_groups
+
+        if groups.one?
+          group = T.must(groups.first)
+          return [ManifestGroupSnapshot.new(
+            manifest_file: group.primary,
+            resolved_dependencies: resolved_dependencies
+          )]
+        end
+
+        groups.map do |group|
+          scoped = scoped_grapher(group.files)
+          snapshot = ManifestGroupSnapshot.new(
+            manifest_file: group.primary,
+            resolved_dependencies: scoped.resolved_dependencies
+          )
+          # Ensure we propagate any error flags from the scoped grapher.
+          absorb_error_state(scoped)
+          snapshot
+        end
+      end
+
+      # Propagates a scoped grapher's subdependency error state onto this grapher so callers can inspect the
+      # aggregate result of resolving every group.
+      sig { params(scoped: Dependabot::DependencyGraphers::Base).void }
+      def absorb_error_state(scoped)
+        return unless scoped.errored_fetching_subdependencies
+
+        errored_fetching_subdependencies!
+        # We keep the last subdependency error we see - the full error dialogue will be present in the logs,
+        # this just ensures job summary dialogues have something to show.
+        @subdependency_error = scoped.subdependency_error unless scoped.subdependency_error.nil?
+      end
+
+      # Builds a grapher of the same class scoped to a subset of the directory's files, reusing the current
+      # file parser's configuration. Used to resolve a single manifest group in isolation.
+      sig { params(files: T::Array[Dependabot::DependencyFile]).returns(Dependabot::DependencyGraphers::Base) }
+      def scoped_grapher(files)
+        scoped_parser = file_parser.class.new(
+          dependency_files: files,
+          source: file_parser.source,
+          repo_contents_path: file_parser.repo_contents_path,
+          credentials: file_parser.credentials,
+          reject_external_code: file_parser.reject_external_code?,
+          options: file_parser.options
+        )
+
+        self.class.new(file_parser: scoped_parser)
+      end
+
       sig { returns(Dependabot::FileParsers::Base) }
       attr_reader :file_parser
 

data/lib/dependabot/errors.rb

@@ -23,7 +23,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -142,7 +142,7 @@ module Dependabot
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -226,7 +226,7 @@ module Dependabot
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -416,7 +416,7 @@ module Dependabot
 
     interface!
 
-    sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+    sig { abstract.returns(T::Hash[Symbol, T.anything]) }
     def sentry_context; end
   end
 
@@ -484,7 +484,7 @@ module Dependabot
       super(message || error_type)
     end
 
-    sig { params(hash: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Hash[Symbol, T.untyped]) }
+    sig { params(hash: T.nilable(T::Hash[Symbol, T.anything])).returns(T::Hash[Symbol, T.anything]) }
     def detail(hash = nil)
       {
         "error-type": error_type,

data/lib/dependabot/experiments.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -7,21 +7,21 @@ module Dependabot
   module Experiments
     extend T::Sig
 
-    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.untyped])
+    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.anything])
 
-    sig { returns(T::Hash[T.any(String, Symbol), T.untyped]) }
+    sig { returns(T::Hash[T.any(String, Symbol), T.anything]) }
     def self.reset!
       @experiments = {}
     end
 
-    sig { params(name: T.any(String, Symbol), value: T.untyped).void }
+    sig { params(name: T.any(String, Symbol), value: T.anything).void }
     def self.register(name, value)
       @experiments[name.to_sym] = value
     end
 
     sig { params(name: T.any(String, Symbol)).returns(T::Boolean) }
     def self.enabled?(name)
-      !!@experiments[name.to_sym]
+      @experiments[name.to_sym] ? true : false
     end
   end
 end

data/lib/dependabot/file_parsers/base.rb

@@ -25,7 +25,7 @@ module Dependabot
       sig { returns(T.nilable(Dependabot::Source)) }
       attr_reader :source
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig { returns(T::Boolean) }
@@ -40,7 +40,7 @@ module Dependabot
           repo_contents_path: T.nilable(String),
           credentials: T::Array[Dependabot::Credential],
           reject_external_code: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         )
           .void
       end

data/lib/dependabot/file_updaters/base.rb

@@ -26,7 +26,7 @@ module Dependabot
       sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -35,7 +35,7 @@ module Dependabot
           dependency_files: T::Array[Dependabot::DependencyFile],
           credentials: T::Array[Dependabot::Credential],
           repo_contents_path: T.nilable(String),
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path: nil, options: {})

data/lib/dependabot/git_commit_checker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "excon"
+require "time"
 require "sorbet-runtime"
 require "gitlab"
 require "dependabot/clients/github_with_retries"
@@ -15,10 +16,15 @@ require "dependabot/dependency"
 require "dependabot/credential"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_tag_details"
+require "dependabot/package/package_release"
+require "dependabot/package/release_cooldown_options"
+require "dependabot/update_checkers/cooldown_calculation"
+require "dependabot/git_cooldown_date_resolver"
 module Dependabot
   # rubocop:disable Metrics/ClassLength
   class GitCommitChecker
     extend T::Sig
+    include Dependabot::GitCooldownDateResolver
 
     VERSION_REGEX = /
       (?<version>
@@ -174,9 +180,35 @@ module Dependabot
       max_local_tag_for_lower_precision(allowed_refs)
     end
 
-    sig { returns(T.nilable(Dependabot::GitTagDetails)) }
-    def local_tag_for_latest_version
-      max_local_tag(allowed_version_tags)
+    # Returns the latest allowed version tag, or nil when every candidate tag is
+    # still within its cooldown window. All cooldown handling — the nil /
+    # disabled / excluded short-circuits and the logging — lives in
+    # #apply_cooldown, so this method stays a thin orchestration step.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_latest_version(cooldown_options = nil)
+      filtered_tags = apply_cooldown(allowed_version_tags, cooldown_options)
+      return nil if filtered_tags.nil?
+
+      max_local_tag(filtered_tags)
+    end
+
+    # Returns the latest allowed version tag, but only when the dependency is
+    # pinned to a ref that looks like a version. Most ecosystems share this
+    # precondition before resolving a newer version tag for a git dependency,
+    # so it lives here instead of being repeated at each call site. Returns nil
+    # for dependencies that aren't pinned to a version (e.g. branch- or
+    # SHA-pinned), which never want a version-tag update.
+    sig do
+      params(cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+        .returns(T.nilable(Dependabot::GitTagDetails))
+    end
+    def local_tag_for_pinned_version_ref(cooldown_options = nil)
+      return nil unless pinned_ref_looks_like_version?
+
+      local_tag_for_latest_version(cooldown_options)
     end
 
     sig { returns(T::Array[Dependabot::GitTagDetails]) }
@@ -285,6 +317,30 @@ module Dependabot
       allowed_versions(local_tags, filter_by_prefix: false)
     end
 
+    # Returns the allowed version tags paired with their parsed release
+    # dates as a single list, so callers don't have to re-correlate two
+    # separate lists (tags and tag-dates) by tag name themselves.
+    sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+    def allowed_version_tags_with_release_dates
+      allowed_version_tags.map do |tag|
+        Dependabot::Package::PackageRelease.new(
+          version: T.cast(version_from_tag(tag), Dependabot::Version),
+          tag: tag.name,
+          released_at: release_date_for_tag_name(tag.name)
+        )
+      end
+    end
+
+    sig { override.returns(T.nilable(String)) }
+    def cooldown_source_url
+      dependency_source_details&.fetch(:url, nil)
+    end
+
+    sig { override.returns(T::Array[Dependabot::Credential]) }
+    def cooldown_credentials
+      credentials
+    end
+
     private
 
     sig { returns(Dependabot::Dependency) }
@@ -689,7 +745,9 @@ module Dependabot
             source: T.must(source),
             credentials: credentials
           )
-          client.releases(T.must(source).repo, per_page: 100)
+          # The Octokit RBI types this as non-nil, but it can be nil at runtime
+          # (e.g. an empty/unexpected registry response), so guard against it.
+          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
         rescue Octokit::Error
           []
         end,
@@ -712,6 +770,107 @@ module Dependabot
       T.must(T.must(name.match(VERSION_REGEX)).named_captures.fetch("version"))
     end
 
+    # Filters out git tags that are still within their cooldown window. Returns
+    # the candidate tags unchanged when cooldown does not apply (no options,
+    # disabled, or the dependency is excluded), and nil when every candidate tag
+    # is still within its cooldown window, so the caller proposes no update.
+    sig do
+      params(
+        candidate_tags: T::Array[Dependabot::GitRef],
+        cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+      ).returns(T.nilable(T::Array[Dependabot::GitRef]))
+    end
+    def apply_cooldown(candidate_tags, cooldown_options)
+      if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(cooldown_options, dependency.name)
+        return candidate_tags
+      end
+
+      cooldown = T.must(cooldown_options)
+      filtered_tags = candidate_tags.reject { |tag| tag_in_cooldown_period?(tag, cooldown) }
+
+      if filtered_tags.empty? && candidate_tags.any?
+        Dependabot.logger.info(
+          "All git tags for #{dependency.name} are within their cooldown period; skipping update"
+        )
+        return nil
+      end
+
+      filtered_tags
+    end
+
+    sig do
+      params(tag: Dependabot::GitRef, cooldown: Dependabot::Package::ReleaseCooldownOptions)
+        .returns(T::Boolean)
+    end
+    def tag_in_cooldown_period?(tag, cooldown)
+      released_at = release_date_for_tag_name(tag.name)
+      return false unless released_at
+
+      cooldown_days = Dependabot::UpdateCheckers::CooldownCalculation.cooldown_days_for(
+        cooldown,
+        T.cast(current_version, T.nilable(Dependabot::Version)),
+        T.cast(version_from_tag(tag), Dependabot::Version)
+      )
+
+      in_cooldown = Dependabot::UpdateCheckers::CooldownCalculation
+                    .within_cooldown_window?(released_at, cooldown_days)
+
+      if in_cooldown
+        passed_days = (Time.now.to_i - released_at.to_i) /
+                      Dependabot::UpdateCheckers::CooldownCalculation::DAY_IN_SECONDS
+        Dependabot.logger.info(
+          "Filtered git tag #{tag.name} for #{dependency.name}: released " \
+          "#{released_at.strftime('%Y-%m-%d')} (#{passed_days}/#{cooldown_days} cooldown days)"
+        )
+      end
+
+      in_cooldown
+    end
+
+    # The allowed version tags may carry a "tags/" prefix (when the dependency
+    # is pinned via "tags/<ref>"), whereas refs_for_tag_with_detail returns the
+    # raw tag names, so we try both forms to line dates up regardless of prefix.
+    #
+    # A GitHub Release's published_at is preferred when available, falling back
+    # to the tag creation date from refs_for_tag_with_detail. This mirrors the
+    # priority used by Dependabot::GitCooldownDateResolver.
+    sig { params(tag_name: String).returns(T.nilable(Time)) }
+    def release_date_for_tag_name(tag_name)
+      normalized = normalize_tag_name(tag_name)
+
+      github_release_published_at(normalized) ||
+        release_dates_by_tag_name[tag_name] ||
+        release_dates_by_tag_name[normalized]
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def release_dates_by_tag_name
+      @release_dates_by_tag_name ||= T.let(
+        build_release_dates_by_tag_name,
+        T.nilable(T::Hash[String, Time])
+      )
+    end
+
+    sig { returns(T::Hash[String, Time]) }
+    def build_release_dates_by_tag_name
+      dates = T.let({}, T::Hash[String, Time])
+      refs_for_tag_with_detail.each do |detail|
+        released_at = parse_release_date(detail.release_date)
+        dates[detail.tag] = released_at if released_at
+      end
+      dates
+    end
+
+    sig { params(release_date: T.nilable(String)).returns(T.nilable(Time)) }
+    def parse_release_date(release_date)
+      return nil if release_date.nil? || release_date.empty?
+
+      Time.parse(release_date)
+    rescue ArgumentError => e
+      Dependabot.logger.error("Invalid release date format: #{release_date} (#{e.message})")
+      nil
+    end
+
     sig { returns(T.class_of(Gem::Version)) }
     def version_class
       @version_class ||= T.let(

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -39,7 +39,7 @@ module Dependabot
       sig { returns(T.nilable(ReleaseCooldownOptions)) }
       attr_reader :cooldown_options
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(T::Hash[Symbol, T.anything]) }
       attr_reader :options
 
       sig do
@@ -51,7 +51,7 @@ module Dependabot
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
           cooldown_options: T.nilable(ReleaseCooldownOptions),
           raise_on_ignored: T::Boolean,
-          options: T::Hash[Symbol, T.untyped]
+          options: T::Hash[Symbol, T.anything]
         ).void
       end
       def initialize(
@@ -335,7 +335,7 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::Requirement]) }
       def ignore_requirements
         ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
       end

data/lib/dependabot/package/package_release.rb

@@ -24,7 +24,7 @@ module Dependabot
           package_type: T.nilable(String),
           language: T.nilable(Dependabot::Package::PackageLanguage),
           tag: T.nilable(String),
-          details: T::Hash[String, T.untyped]
+          details: T::Hash[String, T.anything]
         ).void
       end
       def initialize(
@@ -50,7 +50,7 @@ module Dependabot
         @package_type = T.let(package_type, T.nilable(String))
         @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
         @tag = T.let(tag, T.nilable(String))
-        @details = T.let(details, T::Hash[String, T.untyped])
+        @details = T.let(details, T::Hash[String, T.anything])
       end
 
       sig { returns(Dependabot::Version) }
@@ -83,7 +83,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :tag
 
-      sig { returns(T::Hash[String, T.untyped]) }
+      sig { returns(T::Hash[String, T.anything]) }
       attr_reader :details
 
       sig { returns(T::Boolean) }