dependabot-common 0.386.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e4c26ec485eed8ebb4e35d9edfa4ab996658f450708439941ff8ca253ce0457
-  data.tar.gz: '045951912dda5a814efcf305b11ae28e5c6cd97a1e7f72f1c610650d2f9031cb'
+  metadata.gz: 29f29c96dbb5e187d5cdecfe015ecd60456ea004a7553a97b812416034451ebf
+  data.tar.gz: 1d6e5d04baaf18853476f074e742eb8a60113e2fdfa457db4b3019b1055b30ea
 SHA512:
-  metadata.gz: bb49cbf946335c722ca445b0c314909eb0cf1790b241b68461881873cf254afddb7b7b10a168879ded348af64bdb30f5093882c1221b8f3c7e3ca69bbf6bd59b
-  data.tar.gz: ed0b8a8a019adeed81707ee2aae27e1e7e50d8f4c0da2d66cfca4a952df713173706d091062d02cb5a5aa4c18b819747b76ec5f114595fdbb804c4bef9df208b
+  metadata.gz: 2c2d09853e0044b7dd6ed6ca9f56501ee8436f113eecec3d85506d1543b79994cb3544cb5718b6f55960f7257af74848e33bc330d956275f98a2d8220f09d4d6
+  data.tar.gz: 343ab8ddca784ef0e497987de868f0b405aeeb3bfb8f11c92ad24da3b6d067981fde09397e4d6a5633e2556bfa527f594f432dc4ca9aa79cd9b2b556be930e52

data/lib/dependabot/clients/github_release.rb

@@ -0,0 +1,61 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sawyer"
+require "sorbet-runtime"
+require "time"
+
+module Dependabot
+  module Clients
+    # Typed view over the release fields returned by Octokit.
+    class GithubRelease < T::ImmutableStruct
+      extend T::Sig
+
+      const :id, T.nilable(Integer)
+      const :name, T.nilable(String)
+      const :tag_name, String
+      const :body, T.nilable(String)
+      const :html_url, T.nilable(String)
+      const :prerelease, T::Boolean
+      const :published_at, T.nilable(Time)
+
+      sig { params(resource: Sawyer::Resource).returns(T.nilable(GithubRelease)) }
+      def self.from_resource(resource)
+        tag_name = T.cast(resource[:tag_name], Object)
+        return unless tag_name.is_a?(String)
+
+        id = T.cast(resource[:id], Object)
+        prerelease = T.cast(resource[:prerelease], Object)
+
+        new(
+          id: id.is_a?(Integer) ? id : nil,
+          name: string_value(resource, :name),
+          tag_name: tag_name,
+          body: string_value(resource, :body),
+          html_url: string_value(resource, :html_url),
+          prerelease: prerelease == true,
+          published_at: time_value(resource, :published_at)
+        )
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol).returns(T.nilable(String)) }
+      def self.string_value(resource, key)
+        value = T.cast(resource[key], Object)
+        value.is_a?(String) ? value : nil
+      end
+      private_class_method :string_value
+
+      sig { params(resource: Sawyer::Resource, key: Symbol).returns(T.nilable(Time)) }
+      def self.time_value(resource, key)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Time)
+        return unless value.is_a?(String)
+
+        Time.parse(value)
+      rescue ArgumentError
+        nil
+      end
+      private_class_method :time_value
+    end
+  end
+end

data/lib/dependabot/dependency_requirement.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -33,18 +33,23 @@ module Dependabot
     extend T::Sig
     extend T::Generic
 
-    # The values of a requirement entry are heterogeneous and
-    # ecosystem-specific, so this bridge class is necessarily untyped at
-    # the Hash level; the typed readers below are the migration path.
-    # rubocop:disable Sorbet/ForbidTUntyped
+    Group = T.type_alias { T.any(String, Symbol) }
+    ObjectHash = T.type_alias { T::Hash[T.any(Symbol, String), Object] }
+    Requirement = T.type_alias { T.any(String, Symbol) }
+    Input = T.type_alias { T.any(DependencyRequirement, ObjectHash) }
+
     K = type_member { { fixed: Symbol } }
+    # Hash-style access remains dynamic until ecosystem callers migrate to the
+    # typed readers. Keeping that compatibility here avoids a flag-day change.
+    # rubocop:disable Sorbet/ForbidTUntyped
     V = type_member { { fixed: T.untyped } }
     Elem = type_member { { fixed: [Symbol, T.untyped] } }
+    # rubocop:enable Sorbet/ForbidTUntyped
 
     # Builds a DependencyRequirement from a requirement hash, symbolising
     # top-level keys. Accepts both plain hashes and existing
     # DependencyRequirement instances and always returns a new instance.
-    sig { params(hash: T::Hash[T.any(Symbol, String), T.untyped]).returns(DependencyRequirement) }
+    sig { params(hash: Input).returns(DependencyRequirement) }
     def self.create(hash)
       requirement = new
       requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
@@ -52,16 +57,21 @@ module Dependabot
     end
 
     # The version constraint string, e.g. ">= 1.0, < 2.0". Nil when the
-    # dependency is pinned by a lockfile rather than a manifest constraint.
-    sig { returns(T.nilable(String)) }
+    # dependency is pinned by a lockfile rather than a manifest constraint,
+    # or :unfixable when no valid updated requirement can be generated.
+    sig { returns(T.nilable(Requirement)) }
     def requirement
-      self[:requirement]
+      value = T.cast(self[:requirement], T.nilable(Object))
+      return if value.nil?
+      return value if value.is_a?(String) || value == :unfixable
+
+      raise TypeError, "requirement must be a string, :unfixable, or nil"
     end
 
     # The manifest file this requirement was declared in, e.g. "Gemfile".
     sig { returns(T.nilable(String)) }
     def file
-      self[:file]
+      optional_string(:file)
     end
 
     # The dependency groups this requirement belongs to, e.g. ["dev"] or
@@ -69,26 +79,61 @@ module Dependabot
     # Nilable because some requirement entries are constructed with
     # groups: nil, and the reader must reflect that to stay a drop-in for
     # the underlying hash access under sorbet-runtime.
-    sig { returns(T.nilable(T::Array[T.untyped])) }
+    sig { returns(T.nilable(T::Array[Group])) }
     def groups
-      self[:groups]
+      value = T.cast(self[:groups], T.nilable(Object))
+      return if value.nil?
+      raise TypeError, "groups must be an array of strings or symbols, or nil" unless value.is_a?(Array)
+
+      value.each do |raw_group|
+        group = T.cast(raw_group, Object)
+        next if group.is_a?(String) || group.is_a?(Symbol)
+
+        raise TypeError, "groups must be an array of strings or symbols, or nil"
+      end
+      value
     end
 
     # The source details for the dependency, e.g.
     # { type: "git", url: "https://github.com/..." }. Keys may be symbols
     # or strings depending on whether the requirement was built by a file
     # parser or deserialised from a job definition.
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(ObjectHash)) }
     def source
-      self[:source]
+      optional_object_hash(:source)
     end
 
     # Optional ecosystem-specific metadata about the requirement, e.g.
     # { property_name: "rails.version" }.
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(ObjectHash)) }
     def metadata
-      self[:metadata]
+      optional_object_hash(:metadata)
+    end
+
+    private
+
+    sig { params(key: Symbol).returns(T.nilable(String)) }
+    def optional_string(key)
+      value = T.cast(self[key], T.nilable(Object))
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "#{key} must be a string or nil"
+    end
+
+    sig { params(key: Symbol).returns(T.nilable(ObjectHash)) }
+    def optional_object_hash(key)
+      value = T.cast(self[key], T.nilable(Object))
+      return if value.nil?
+      raise TypeError, "#{key} must be a hash with string or symbol keys, or nil" unless value.is_a?(Hash)
+
+      value.each_key do |raw_nested_key|
+        nested_key = T.cast(raw_nested_key, Object)
+        next if nested_key.is_a?(String) || nested_key.is_a?(Symbol)
+
+        raise TypeError, "#{key} must be a hash with string or symbol keys, or nil"
+      end
+      value
     end
-    # rubocop:enable Sorbet/ForbidTUntyped
   end
 end

data/lib/dependabot/error_details.rb

@@ -0,0 +1,51 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class ErrorDetails < T::ImmutableStruct
+    extend T::Sig
+
+    DetailHash = T.type_alias { T::Hash[T.any(String, Symbol), T.anything] }
+    Detail = T.type_alias { T.any(String, DetailHash) }
+
+    const :error_type, String
+    const :error_detail, T.nilable(Detail)
+
+    sig { params(hash: T::Hash[Symbol, T.anything]).returns(ErrorDetails) }
+    def self.from_hash(hash)
+      raw_type = T.cast(hash[:"error-type"], Object)
+      raise TypeError, "error-type must be a string" unless raw_type.is_a?(String)
+
+      new(
+        error_type: raw_type,
+        error_detail: parse_detail(T.cast(hash[:"error-detail"], T.nilable(Object)))
+      )
+    end
+
+    sig { returns(T::Hash[Symbol, Object]) }
+    def to_h
+      result = T.let({ "error-type": error_type }, T::Hash[Symbol, Object])
+      result[:"error-detail"] = error_detail if error_detail
+      result
+    end
+
+    sig { params(value: T.nilable(Object)).returns(T.nilable(Detail)) }
+    def self.parse_detail(value)
+      return if value.nil?
+      return value if value.is_a?(String)
+      raise TypeError, "error-detail must be a string or hash" unless value.is_a?(Hash)
+
+      result = T.let({}, DetailHash)
+      value.each do |raw_key, raw_value|
+        key = T.cast(raw_key, Object)
+        raise TypeError, "error-detail keys must be strings or symbols" unless key.is_a?(String) || key.is_a?(Symbol)
+
+        result[key] = T.cast(raw_value, Object)
+      end
+      result
+    end
+    private_class_method :parse_detail
+  end
+end

data/lib/dependabot/errors.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/error_details"
 require "dependabot/utils"
 
 # rubocop:disable Metrics/ModuleLength
@@ -23,7 +24,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -138,11 +139,12 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -220,13 +222,14 @@ module Dependabot
       # and responsibility for fixing it is on them, not us. As a result we
       # quietly log these as errors
       { "error-type": "server_error" }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -400,7 +403,8 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:enable Metrics/MethodLength

data/lib/dependabot/file_fetchers/base.rb

@@ -70,7 +70,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path
 
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(T::Hash[Symbol, Object]) }
       attr_reader :options
 
       CLIENT_NOT_FOUND_ERRORS = T.let(
@@ -135,7 +135,7 @@ module Dependabot
             source: Dependabot::Source,
             credentials: T::Array[Dependabot::Credential],
             repo_contents_path: T.nilable(String),
-            options: T::Hash[String, String],
+            options: T::Hash[Symbol, Object],
             update_config: T.nilable(Dependabot::Config::UpdateConfig)
           )
           .void

data/lib/dependabot/git_commit_checker/source_details.rb

@@ -0,0 +1,42 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class GitCommitChecker
+    # Typed view over the source hash attached to a git dependency.
+    class SourceDetails < T::ImmutableStruct
+      extend T::Sig
+
+      const :type, T.nilable(String)
+      const :url, T.nilable(String)
+      const :branch, T.nilable(String)
+      const :ref, T.nilable(String)
+
+      sig do
+        params(details: T::Hash[T.any(String, Symbol), Object]).returns(SourceDetails)
+      end
+      def self.from_hash(details)
+        new(
+          type: string_value(details, :type),
+          url: string_value(details, :url),
+          branch: string_value(details, :branch),
+          ref: string_value(details, :ref)
+        )
+      end
+
+      sig do
+        params(
+          details: T::Hash[T.any(String, Symbol), Object],
+          key: Symbol
+        ).returns(T.nilable(String))
+      end
+      def self.string_value(details, key)
+        value = details.key?(key) ? details[key] : details[key.to_s]
+        value.is_a?(String) ? value : nil
+      end
+      private_class_method :string_value
+    end
+  end
+end

data/lib/dependabot/git_commit_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -14,7 +14,9 @@ require "dependabot/utils"
 require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/git_metadata_fetcher"
+require "dependabot/git_commit_checker/source_details"
 require "dependabot/git_tag_details"
 require "dependabot/package/package_release"
 require "dependabot/package/release_cooldown_options"
@@ -46,7 +48,7 @@ module Dependabot
         ignored_versions: T::Array[String],
         raise_on_ignored: T::Boolean,
         consider_version_branches_pinned: T::Boolean,
-        dependency_source_details: T.nilable(T::Hash[Symbol, String])
+        dependency_source_details: T.nilable(T::Hash[Symbol, Object])
       )
         .void
     end
@@ -63,14 +65,15 @@ module Dependabot
       @ignored_versions = ignored_versions
       @raise_on_ignored = raise_on_ignored
       @consider_version_branches_pinned = consider_version_branches_pinned
-      @dependency_source_details = dependency_source_details
+      @dependency_source_details = T.let(
+        dependency_source_details && SourceDetails.from_hash(dependency_source_details),
+        T.nilable(SourceDetails)
+      )
     end
 
     sig { returns(T::Boolean) }
     def git_dependency?
-      return false if dependency_source_details.nil?
-
-      dependency_source_details&.fetch(:type) == "git"
+      dependency_source_details&.type == "git"
     end
 
     # rubocop:disable Metrics/PerceivedComplexity
@@ -78,7 +81,7 @@ module Dependabot
     def pinned?
       raise "Not a git dependency!" unless git_dependency?
 
-      branch = dependency_source_details&.fetch(:branch)
+      branch = dependency_source_details&.branch
 
       return false if ref.nil?
       return false if branch == ref
@@ -118,7 +121,7 @@ module Dependabot
     sig { returns(T::Array[GitRef]) }
     def tags
       GitMetadataFetcher.new(
-        url: dependency.source_details&.fetch(:url, nil),
+        url: T.must(source_details&.url),
         credentials: credentials
       ).tags
     end
@@ -128,7 +131,7 @@ module Dependabot
       T.must(
         T.let(
           GitMetadataFetcher.new(
-            url: dependency.source_details&.fetch(:url, nil),
+            url: T.must(source_details&.url),
             credentials: credentials
           ).ref_details_for_pinned_ref(ref),
           T.nilable(Excon::Response)
@@ -282,9 +285,12 @@ module Dependabot
       false
     end
 
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(SourceDetails)) }
     def dependency_source_details
-      @dependency_source_details || dependency.source_details(allowed_types: ["git"])
+      @dependency_source_details ||= begin
+        details = dependency.source_details(allowed_types: ["git"])
+        SourceDetails.from_hash(details) if details
+      end
     end
 
     sig { returns(T::Array[Dependabot::GitTagWithDetail]) }
@@ -333,7 +339,7 @@ module Dependabot
 
     sig { override.returns(T.nilable(String)) }
     def cooldown_source_url
-      dependency_source_details&.fetch(:url, nil)
+      dependency_source_details&.url
     end
 
     sig { override.returns(T::Array[Dependabot::Credential]) }
@@ -478,9 +484,11 @@ module Dependabot
 
     sig { params(tags: T::Array[Dependabot::GitRef]).returns(T::Array[Dependabot::GitRef]) }
     def handle_tag_prefix(tags)
-      if dependency_source_details&.fetch(:ref, nil)&.start_with?("tags/")
+      if dependency_source_details&.ref&.start_with?("tags/")
         tags = tags.map do |tag|
-          tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+          duplicated_tag = tag.dup
+          duplicated_tag.name = "tags/#{tag.name}"
+          duplicated_tag
         end
       end
 
@@ -519,8 +527,11 @@ module Dependabot
       client = Clients::GithubWithRetries
                .for_github_dot_com(credentials: credentials)
 
-      # TODO: create this method instead of relying on method_missing
-      T.unsafe(client.compare(T.must(listing_source_repo), ref1, ref2)).status
+      comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      status = T.cast(comparison[:status], Object)
+      raise TypeError, "GitHub comparison status must be a string" unless status.is_a?(String)
+
+      status
     end
 
     sig { params(ref1: String, ref2: String).returns(String) }
@@ -529,9 +540,11 @@ module Dependabot
                .for_gitlab_dot_com(credentials: credentials)
 
       comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      commits = T.cast(comparison["commits"], Object)
+      raise TypeError, "GitLab comparison commits must be an array" unless commits.is_a?(Array)
 
-      if T.unsafe(comparison).commits.none? then "behind"
-      elsif T.unsafe(comparison).compare_same_ref then "identical"
+      if commits.empty? then "behind"
+      elsif T.cast(comparison["compare_same_ref"], Object) == true then "identical"
       else
         "ahead"
       end
@@ -550,7 +563,13 @@ module Dependabot
 
       # Conservatively assume that ref2 is ahead in the equality case, of
       # if we get an unexpected format (e.g., due to a 404)
-      if JSON.parse(response.body).fetch("values", ["x"]).none? then "behind"
+      comparison = T.cast(JSON.parse(response.body), Object)
+      raise TypeError, "Bitbucket comparison must be a hash" unless comparison.is_a?(Hash)
+
+      values = T.cast(comparison.fetch("values", ["x"]), Object)
+      raise TypeError, "Bitbucket comparison values must be an array" unless values.is_a?(Array)
+
+      if values.empty? then "behind"
       else
         "ahead"
       end
@@ -558,12 +577,12 @@ module Dependabot
 
     sig { returns(T.nilable(String)) }
     def ref_or_branch
-      ref || dependency_source_details&.fetch(:branch)
+      ref || dependency_source_details&.branch
     end
 
     sig { returns(T.nilable(String)) }
     def ref
-      dependency_source_details&.fetch(:ref)
+      dependency_source_details&.ref
     end
 
     sig { params(tag: String).returns(T::Boolean) }
@@ -667,9 +686,11 @@ module Dependabot
         begin
           tags = listing_repo_git_metadata_fetcher.tags
 
-          if dependency_source_details&.fetch(:ref, nil)&.start_with?("tags/")
+          if dependency_source_details&.ref&.start_with?("tags/")
             tags = tags.map do |tag|
-              tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+              duplicated_tag = tag.dup
+              duplicated_tag.name = "tags/#{tag.name}"
+              duplicated_tag
             end
           end
 
@@ -695,7 +716,7 @@ module Dependabot
 
     sig { returns(T::Boolean) }
     def wants_prerelease?
-      return false unless dependency_source_details&.fetch(:ref, nil)
+      return false unless dependency_source_details&.ref
       return false unless pinned_ref_looks_like_version?
 
       version = version_from_ref(T.must(ref))
@@ -732,7 +753,7 @@ module Dependabot
       false
     end
 
-    sig { returns(T::Array[T.untyped]) }
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def github_releases
       @github_releases ||= T.let(
         begin
@@ -747,11 +768,17 @@ module Dependabot
           )
           # The Octokit RBI types this as non-nil, but it can be nil at runtime
           # (e.g. an empty/unexpected registry response), so guard against it.
-          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
+          releases = T.let(
+            client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          (releases || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
         rescue Octokit::Error
           []
         end,
-        T.nilable(T::Array[T.untyped])
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
 
@@ -892,7 +919,7 @@ module Dependabot
       @local_repo_git_metadata_fetcher ||=
         T.let(
           GitMetadataFetcher.new(
-            url: dependency_source_details&.fetch(:url),
+            url: T.must(dependency_source_details&.url),
             credentials: credentials
           ),
           T.nilable(Dependabot::GitMetadataFetcher)
@@ -913,8 +940,14 @@ module Dependabot
 
     sig { returns(String) }
     def ref_pinned
-      dependency.source_details&.fetch(:ref, nil) ||
-        dependency.source_details&.fetch(:branch, nil) || "HEAD"
+      details = source_details
+      details&.ref || details&.branch || "HEAD"
+    end
+
+    sig { returns(T.nilable(SourceDetails)) }
+    def source_details
+      details = dependency.source_details
+      SourceDetails.from_hash(details) if details
     end
   end
   # rubocop:enable Metrics/ClassLength

data/lib/dependabot/git_cooldown_date_resolver.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/shared_helpers"
 require "dependabot/source"
@@ -45,7 +46,8 @@ module Dependabot
       releases = cached_github_releases
       unless releases.empty?
         release = releases.find { |r| r.tag_name == tag_name }
-        return release.published_at if release&.published_at
+        published_at = release&.published_at
+        return published_at if published_at
       end
 
       tag_creation_date(tag_name, commit_sha)
@@ -88,7 +90,7 @@ module Dependabot
 
     # Fetches and caches GitHub releases for the dependency source.
     # Returns an empty array for non-GitHub sources.
-    sig { returns(T::Array[T.untyped]) } # rubocop:disable Sorbet/ForbidTUntyped
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def cached_github_releases
       @cached_github_releases ||= T.let(
         begin
@@ -99,7 +101,13 @@ module Dependabot
               source: T.must(source),
               credentials: cooldown_credentials
             )
-            client.releases(T.must(source).repo, per_page: 100)
+            releases = T.let(
+              client.releases(T.must(source).repo, per_page: 100),
+              T.nilable(T::Array[Sawyer::Resource])
+            )
+            (releases || []).filter_map do |release|
+              Dependabot::Clients::GithubRelease.from_resource(release)
+            end
           else
             []
           end
@@ -107,7 +115,7 @@ module Dependabot
           Dependabot.logger.debug("Error fetching GitHub releases: #{e.message}")
           []
         end,
-        T.nilable(T::Array[T.untyped]) # rubocop:disable Sorbet/ForbidTUntyped
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
   end

data/lib/dependabot/git_metadata_fetcher.rb

@@ -147,12 +147,6 @@ module Dependabot
         raise "Unexpected response: #{response_with_git.status} - #{response_with_git.body}"
       end
 
-      if uri.match?(/github\.com/i)
-        response = response_with_git.data
-        response[:response_headers] = response[:headers] unless response.nil?
-        raise Octokit::Error.from_response(response)
-      end
-
       raise "Server error at #{uri}: #{response_with_git.body}" if response_with_git.status >= 500
 
       raise Dependabot::GitDependenciesNotReachable, [uri]
@@ -213,7 +207,7 @@ module Dependabot
       )
     end
 
-    sig { params(uri: String).returns(T.untyped) }
+    sig { params(uri: String).returns(GitResponse) }
     def fetch_raw_upload_pack_with_git_for(uri)
       service_pack_uri = uri
       service_pack_uri += ".git" unless service_pack_uri.end_with?(".git") || skip_git_suffix(uri)
@@ -329,7 +323,7 @@ module Dependabot
       T.must(line.split.first).chars.last(40).join
     end
 
-    sig { returns(T::Hash[Symbol, T.untyped]) }
+    sig { returns(T::Hash[Symbol, Object]) }
     def excon_defaults
       # Some git hosts are slow when returning a large number of tags
       SharedHelpers.excon_defaults(read_timeout: 20)
@@ -344,7 +338,7 @@ module Dependabot
 
     # Added method to fetch tags with their creation dates from a git repository. In case
     # private registry is used, it will clone the repository and fetch tags with their creation dates.
-    sig { params(uri: String).returns(T.untyped) }
+    sig { params(uri: String).returns(GitResponse) }
     def fetch_tags_with_detail_from_git_for(uri)
       uri_ending_with_git = uri
       uri_ending_with_git += ".git" unless uri_ending_with_git.end_with?(".git") || skip_git_suffix(uri)

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -1,9 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "time"
 
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/metadata_finders/base"
@@ -12,40 +14,62 @@ require "dependabot/utils"
 module Dependabot
   module MetadataFinders
     class Base
-      class GitLabRelease
+      class GitLabRelease < T::ImmutableStruct
         extend T::Sig
 
-        sig { returns(String) }
-        attr_reader :name
-
-        sig { returns(String) }
-        attr_reader :tag_name
-
-        sig { returns(String) }
-        attr_reader :body
-
-        sig { returns(String) }
-        attr_reader :html_url
+        const :name, String
+        const :tag_name, String
+        const :body, T.nilable(String)
+        const :html_url, String
+        const :authored_at, Time
 
         sig do
           params(
-            name: String,
-            tag_name: String,
-            body: String,
-            html_url: String
-          ).void
-        end
-        def initialize(name:, tag_name:, body:, html_url:)
-          @name = name
-          @tag_name = tag_name
-          @body = body
-          @html_url = html_url
+            tag: Gitlab::ObjectifiedHash,
+            source_url: String
+          ).returns(T.nilable(GitLabRelease))
         end
+        def self.from_tag(tag, source_url:)
+          name = T.cast(tag["name"], Object)
+          release = T.cast(tag["release"], Object)
+          commit = T.cast(tag["commit"], Object)
+          return unless name.is_a?(String)
+          return unless release.is_a?(Gitlab::ObjectifiedHash)
+          return unless commit.is_a?(Gitlab::ObjectifiedHash)
+
+          tag_name = T.cast(release["tag_name"], Object)
+          return unless tag_name.is_a?(String)
+
+          authored_at = time_value(T.cast(commit["authored_date"], Object))
+          return unless authored_at
+
+          description = T.cast(release["description"], Object)
+          new(
+            name: name,
+            tag_name: tag_name,
+            body: description.is_a?(String) ? description : nil,
+            html_url: "#{source_url}/tags/#{name}",
+            authored_at: authored_at
+          )
+        end
+
+        sig { params(value: Object).returns(T.nilable(Time)) }
+        def self.time_value(value)
+          return value if value.is_a?(Time)
+          return unless value.is_a?(String)
+
+          Time.parse(value)
+        rescue ArgumentError
+          nil
+        end
+        private_class_method :time_value
       end
 
       class ReleaseFinder
         extend T::Sig
 
+        ReleaseType = T.type_alias { T.any(Dependabot::Clients::GithubRelease, GitLabRelease) }
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -98,14 +122,13 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_dep_releases
           releases = all_releases
           dep_prefix = dependency.name.downcase
 
           releases_with_dependency_name =
             releases
-            .reject { |r| r.tag_name.nil? }
             .select { |r| r.tag_name.start_with?(dep_prefix) }
 
           return releases unless releases_with_dependency_name.any?
@@ -113,12 +136,12 @@ module Dependabot
           releases_with_dependency_name
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_releases
-          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[T.untyped]))
+          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[ReleaseType]))
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def relevant_releases
           releases = releases_since_previous_version
 
@@ -139,7 +162,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def releases_since_previous_version
           return [updated_release].compact unless previous_version
 
@@ -158,21 +181,21 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_previous_release(releases)
           return releases if releases.index(previous_release).nil?
 
           releases.first(T.must(releases.index(previous_release)))
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_updated_release(releases)
           return releases if releases.index(updated_release).nil?
 
           releases[releases.index(updated_release)..-1]
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
@@ -193,7 +216,7 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_updated_version(releases, conservative:)
           updated_version = version_class.new(new_version)
 
@@ -216,17 +239,17 @@ module Dependabot
           end
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def updated_release
           release_for_version(new_version)
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def previous_release
           release_for_version(previous_version)
         end
 
-        sig { params(version: T.nilable(String)).returns(T.untyped) }
+        sig { params(version: T.nilable(String)).returns(T.nilable(ReleaseType)) }
         def release_for_version(version)
           return nil unless version
 
@@ -236,22 +259,23 @@ module Dependabot
             all_dep_releases.find { |r| release_regex.match?(r.name.to_s) }
         end
 
-        sig { params(release: T.untyped).returns(String) }
+        sig { params(release: ReleaseType).returns(String) }
         def serialize_release(release)
-          rel = release
-          title = "## #{rel.name.to_s == '' ? rel.tag_name : rel.name}\n"
-          body = if rel.body.to_s.gsub(/\n*\z/m, "") == ""
+          name = release.name
+          title = "## #{name.to_s == '' ? release.tag_name : name}\n"
+          body = if release.body.to_s.gsub(/\n*\z/m, "") == ""
                    "No release notes provided."
                  else
-                   rel.body.gsub(/\n*\z/m, "")
+                   T.must(release.body).gsub(/\n*\z/m, "")
                  end
 
-          release_body_includes_title?(rel) ? body : title + body
+          release_body_includes_title?(release) ? body : title + body
         end
 
-        sig { params(release: T.untyped).returns(T::Boolean) }
+        sig { params(release: ReleaseType).returns(T::Boolean) }
         def release_body_includes_title?(release)
-          title = release.name.to_s == "" ? release.tag_name : release.name
+          name = release.name
+          title = name.nil? || name.empty? ? release.tag_name : name
           release.body.to_s.match?(/\A\s*\#*\s*#{Regexp.quote(title)}/m)
         end
 
@@ -265,7 +289,7 @@ module Dependabot
           dependency.version_class
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def fetch_dependency_releases
           return [] unless source
 
@@ -279,47 +303,45 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
         def fetch_github_releases
-          releases = github_client.releases(T.must(source).repo, per_page: 100)
-
-          # Remove any releases without a tag name. These are draft releases and
-          # aren't yet associated with a tag, so shouldn't be used.
-          releases = releases.reject { |r| T.unsafe(r).tag_name.nil? }
+          releases = parsed_github_releases
 
           clean_release_names =
-            releases.map { |r| T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, "") }
+            releases.map { |release| release.tag_name.gsub(/^[^0-9\.]*/, "") }
 
           if clean_release_names.all? { |nm| version_class.correct?(nm) }
-            releases.sort_by do |r|
-              version_class.new(T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, ""))
+            releases.sort_by do |release|
+              version_class.new(release.tag_name.gsub(/^[^0-9\.]*/, ""))
             end.reverse
           else
-            releases.sort_by { |r| T.unsafe(r).id }.reverse
+            releases.sort_by { |release| release.id || 0 }.reverse
           end
         rescue Octokit::NotFound, Octokit::UnavailableForLegalReasons
           []
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
+        def parsed_github_releases
+          resources = T.let(
+            github_client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          releases = (resources || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
+          releases
+        end
+
+        sig { returns(T::Array[GitLabRelease]) }
         def fetch_gitlab_releases
-          releases =
-            T.unsafe(
-              gitlab_client
-                           .tags(T.must(source).repo)
-            )
-             .select(&:release)
-             .sort_by { |r| T.unsafe(r).commit.authored_date }
-             .reverse
-
-          releases.map do |tag|
-            GitLabRelease.new(
-              name: T.unsafe(tag).name,
-              tag_name: T.unsafe(tag).release.tag_name,
-              body: T.unsafe(tag).release.description,
-              html_url: "#{T.must(source).url}/tags/#{T.unsafe(tag).name}"
-            )
+          tags = gitlab_client.tags(T.must(source).repo)
+          releases = tags.filter_map do |tag|
+            next unless tag.is_a?(Gitlab::ObjectifiedHash)
+
+            GitLabRelease.from_tag(tag, source_url: T.must(source).url)
           end
+          releases.sort_by(&:authored_at).reverse
         rescue Gitlab::Error::NotFound
           []
         end
@@ -359,20 +381,32 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def previous_ref
-          previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          previous_refs = T.must(dependency.previous_requirements).filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           previous_refs.first if previous_refs.one?
         end
 
         sig { returns(T.nilable(String)) }
         def new_ref
-          new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          new_refs = dependency.requirements.filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           new_refs.first if new_refs.one?
         end
 
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
+        def requirement_ref(requirement)
+          source = requirement.source
+          return unless source
+
+          symbol_ref = source[:ref]
+          return symbol_ref if symbol_ref.is_a?(String)
+
+          string_ref = source["ref"]
+          string_ref if string_ref.is_a?(String)
+        end
+
         sig { returns(T::Boolean) }
         def ref_changed?
           # We could go from multiple previous refs (nil) to a single new ref

data/lib/dependabot/package/release_cooldown_options.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -121,9 +121,9 @@ module Dependabot
 
             # Apply case transformation to content after prefix
             case branch_name_case
-            when "lower"
+            when "lowercase"
               content = content.downcase
-            when "upper"
+            when "uppercase"
               content = content.upcase
             end
 

data/lib/dependabot/version.rb

@@ -24,6 +24,15 @@ module Dependabot
       T.cast(super, Dependabot::Version)
     end
 
+    sig do
+      overridable
+        .params(_from_version: String, _to_version: String)
+        .returns(T.nilable(String))
+    end
+    def self.update_type(_from_version, _to_version)
+      nil
+    end
+
     # Opt-in to Rubygems 4 behavior
     sig { override.overridable.params(version: VersionParameter).returns(T::Boolean) }
     def self.correct?(version)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.386.0"
+  VERSION = "0.388.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -518,6 +518,7 @@ files:
 - lib/dependabot/clients/bitbucket.rb
 - lib/dependabot/clients/bitbucket_with_retries.rb
 - lib/dependabot/clients/codecommit.rb
+- lib/dependabot/clients/github_release.rb
 - lib/dependabot/clients/github_with_retries.rb
 - lib/dependabot/clients/gitlab_with_retries.rb
 - lib/dependabot/command_helpers.rb
@@ -536,6 +537,7 @@ files:
 - lib/dependabot/dependency_group.rb
 - lib/dependabot/dependency_requirement.rb
 - lib/dependabot/ecosystem.rb
+- lib/dependabot/error_details.rb
 - lib/dependabot/errors.rb
 - lib/dependabot/experiments.rb
 - lib/dependabot/file_fetchers.rb
@@ -552,6 +554,7 @@ files:
 - lib/dependabot/file_updaters/base.rb
 - lib/dependabot/file_updaters/vendor_updater.rb
 - lib/dependabot/git_commit_checker.rb
+- lib/dependabot/git_commit_checker/source_details.rb
 - lib/dependabot/git_cooldown_date_resolver.rb
 - lib/dependabot/git_metadata_fetcher.rb
 - lib/dependabot/git_ref.rb
@@ -622,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib