dependabot-common 0.387.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1af9eae7cb945bd312cf8a9fee63b2f4e42adcbc3d137208e2043b659052013d
-  data.tar.gz: f815b9a6961d5ecbd9c77ffdf296a9a048dbfadf21fae5ddebc4bbd8db6fbd2b
+  metadata.gz: 29f29c96dbb5e187d5cdecfe015ecd60456ea004a7553a97b812416034451ebf
+  data.tar.gz: 1d6e5d04baaf18853476f074e742eb8a60113e2fdfa457db4b3019b1055b30ea
 SHA512:
-  metadata.gz: 34737076727da04d065d0163c93fe1058cfbb3a86d79d2cfef2be4cf126d2fd4d335e204087d3c337e2d97f5ec0220878a1110e139f553805c4d36574e33cb5d
-  data.tar.gz: 5885a478a01996a6f382b3c2bedb29ff59ca557c0316582f14e9136bd3881dac04d20874862bc76a93a16119653a85c868d3d08c65e8cabb9fff1ae257124323
+  metadata.gz: 2c2d09853e0044b7dd6ed6ca9f56501ee8436f113eecec3d85506d1543b79994cb3544cb5718b6f55960f7257af74848e33bc330d956275f98a2d8220f09d4d6
+  data.tar.gz: 343ab8ddca784ef0e497987de868f0b405aeeb3bfb8f11c92ad24da3b6d067981fde09397e4d6a5633e2556bfa527f594f432dc4ca9aa79cd9b2b556be930e52

data/lib/dependabot/clients/github_release.rb

@@ -0,0 +1,61 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sawyer"
+require "sorbet-runtime"
+require "time"
+
+module Dependabot
+  module Clients
+    # Typed view over the release fields returned by Octokit.
+    class GithubRelease < T::ImmutableStruct
+      extend T::Sig
+
+      const :id, T.nilable(Integer)
+      const :name, T.nilable(String)
+      const :tag_name, String
+      const :body, T.nilable(String)
+      const :html_url, T.nilable(String)
+      const :prerelease, T::Boolean
+      const :published_at, T.nilable(Time)
+
+      sig { params(resource: Sawyer::Resource).returns(T.nilable(GithubRelease)) }
+      def self.from_resource(resource)
+        tag_name = T.cast(resource[:tag_name], Object)
+        return unless tag_name.is_a?(String)
+
+        id = T.cast(resource[:id], Object)
+        prerelease = T.cast(resource[:prerelease], Object)
+
+        new(
+          id: id.is_a?(Integer) ? id : nil,
+          name: string_value(resource, :name),
+          tag_name: tag_name,
+          body: string_value(resource, :body),
+          html_url: string_value(resource, :html_url),
+          prerelease: prerelease == true,
+          published_at: time_value(resource, :published_at)
+        )
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol).returns(T.nilable(String)) }
+      def self.string_value(resource, key)
+        value = T.cast(resource[key], Object)
+        value.is_a?(String) ? value : nil
+      end
+      private_class_method :string_value
+
+      sig { params(resource: Sawyer::Resource, key: Symbol).returns(T.nilable(Time)) }
+      def self.time_value(resource, key)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Time)
+        return unless value.is_a?(String)
+
+        Time.parse(value)
+      rescue ArgumentError
+        nil
+      end
+      private_class_method :time_value
+    end
+  end
+end

data/lib/dependabot/dependency_requirement.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -33,18 +33,23 @@ module Dependabot
     extend T::Sig
     extend T::Generic
 
-    # The values of a requirement entry are heterogeneous and
-    # ecosystem-specific, so this bridge class is necessarily untyped at
-    # the Hash level; the typed readers below are the migration path.
-    # rubocop:disable Sorbet/ForbidTUntyped
+    Group = T.type_alias { T.any(String, Symbol) }
+    ObjectHash = T.type_alias { T::Hash[T.any(Symbol, String), Object] }
+    Requirement = T.type_alias { T.any(String, Symbol) }
+    Input = T.type_alias { T.any(DependencyRequirement, ObjectHash) }
+
     K = type_member { { fixed: Symbol } }
+    # Hash-style access remains dynamic until ecosystem callers migrate to the
+    # typed readers. Keeping that compatibility here avoids a flag-day change.
+    # rubocop:disable Sorbet/ForbidTUntyped
     V = type_member { { fixed: T.untyped } }
     Elem = type_member { { fixed: [Symbol, T.untyped] } }
+    # rubocop:enable Sorbet/ForbidTUntyped
 
     # Builds a DependencyRequirement from a requirement hash, symbolising
     # top-level keys. Accepts both plain hashes and existing
     # DependencyRequirement instances and always returns a new instance.
-    sig { params(hash: T::Hash[T.any(Symbol, String), T.untyped]).returns(DependencyRequirement) }
+    sig { params(hash: Input).returns(DependencyRequirement) }
     def self.create(hash)
       requirement = new
       requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
@@ -52,16 +57,21 @@ module Dependabot
     end
 
     # The version constraint string, e.g. ">= 1.0, < 2.0". Nil when the
-    # dependency is pinned by a lockfile rather than a manifest constraint.
-    sig { returns(T.nilable(String)) }
+    # dependency is pinned by a lockfile rather than a manifest constraint,
+    # or :unfixable when no valid updated requirement can be generated.
+    sig { returns(T.nilable(Requirement)) }
     def requirement
-      self[:requirement]
+      value = T.cast(self[:requirement], T.nilable(Object))
+      return if value.nil?
+      return value if value.is_a?(String) || value == :unfixable
+
+      raise TypeError, "requirement must be a string, :unfixable, or nil"
     end
 
     # The manifest file this requirement was declared in, e.g. "Gemfile".
     sig { returns(T.nilable(String)) }
     def file
-      self[:file]
+      optional_string(:file)
     end
 
     # The dependency groups this requirement belongs to, e.g. ["dev"] or
@@ -69,26 +79,61 @@ module Dependabot
     # Nilable because some requirement entries are constructed with
     # groups: nil, and the reader must reflect that to stay a drop-in for
     # the underlying hash access under sorbet-runtime.
-    sig { returns(T.nilable(T::Array[T.untyped])) }
+    sig { returns(T.nilable(T::Array[Group])) }
     def groups
-      self[:groups]
+      value = T.cast(self[:groups], T.nilable(Object))
+      return if value.nil?
+      raise TypeError, "groups must be an array of strings or symbols, or nil" unless value.is_a?(Array)
+
+      value.each do |raw_group|
+        group = T.cast(raw_group, Object)
+        next if group.is_a?(String) || group.is_a?(Symbol)
+
+        raise TypeError, "groups must be an array of strings or symbols, or nil"
+      end
+      value
     end
 
     # The source details for the dependency, e.g.
     # { type: "git", url: "https://github.com/..." }. Keys may be symbols
     # or strings depending on whether the requirement was built by a file
     # parser or deserialised from a job definition.
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(ObjectHash)) }
     def source
-      self[:source]
+      optional_object_hash(:source)
     end
 
     # Optional ecosystem-specific metadata about the requirement, e.g.
     # { property_name: "rails.version" }.
-    sig { returns(T.nilable(T::Hash[T.any(Symbol, String), T.untyped])) }
+    sig { returns(T.nilable(ObjectHash)) }
     def metadata
-      self[:metadata]
+      optional_object_hash(:metadata)
+    end
+
+    private
+
+    sig { params(key: Symbol).returns(T.nilable(String)) }
+    def optional_string(key)
+      value = T.cast(self[key], T.nilable(Object))
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "#{key} must be a string or nil"
+    end
+
+    sig { params(key: Symbol).returns(T.nilable(ObjectHash)) }
+    def optional_object_hash(key)
+      value = T.cast(self[key], T.nilable(Object))
+      return if value.nil?
+      raise TypeError, "#{key} must be a hash with string or symbol keys, or nil" unless value.is_a?(Hash)
+
+      value.each_key do |raw_nested_key|
+        nested_key = T.cast(raw_nested_key, Object)
+        next if nested_key.is_a?(String) || nested_key.is_a?(Symbol)
+
+        raise TypeError, "#{key} must be a hash with string or symbol keys, or nil"
+      end
+      value
     end
-    # rubocop:enable Sorbet/ForbidTUntyped
   end
 end

data/lib/dependabot/error_details.rb

@@ -0,0 +1,51 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class ErrorDetails < T::ImmutableStruct
+    extend T::Sig
+
+    DetailHash = T.type_alias { T::Hash[T.any(String, Symbol), T.anything] }
+    Detail = T.type_alias { T.any(String, DetailHash) }
+
+    const :error_type, String
+    const :error_detail, T.nilable(Detail)
+
+    sig { params(hash: T::Hash[Symbol, T.anything]).returns(ErrorDetails) }
+    def self.from_hash(hash)
+      raw_type = T.cast(hash[:"error-type"], Object)
+      raise TypeError, "error-type must be a string" unless raw_type.is_a?(String)
+
+      new(
+        error_type: raw_type,
+        error_detail: parse_detail(T.cast(hash[:"error-detail"], T.nilable(Object)))
+      )
+    end
+
+    sig { returns(T::Hash[Symbol, Object]) }
+    def to_h
+      result = T.let({ "error-type": error_type }, T::Hash[Symbol, Object])
+      result[:"error-detail"] = error_detail if error_detail
+      result
+    end
+
+    sig { params(value: T.nilable(Object)).returns(T.nilable(Detail)) }
+    def self.parse_detail(value)
+      return if value.nil?
+      return value if value.is_a?(String)
+      raise TypeError, "error-detail must be a string or hash" unless value.is_a?(Hash)
+
+      result = T.let({}, DetailHash)
+      value.each do |raw_key, raw_value|
+        key = T.cast(raw_key, Object)
+        raise TypeError, "error-detail keys must be strings or symbols" unless key.is_a?(String) || key.is_a?(Symbol)
+
+        result[key] = T.cast(raw_value, Object)
+      end
+      result
+    end
+    private_class_method :parse_detail
+  end
+end

data/lib/dependabot/errors.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/error_details"
 require "dependabot/utils"
 
 # rubocop:disable Metrics/ModuleLength
@@ -23,7 +24,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -138,11 +139,12 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -220,13 +222,14 @@ module Dependabot
       # and responsibility for fixing it is on them, not us. As a result we
       # quietly log these as errors
       { "error-type": "server_error" }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -400,7 +403,8 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:enable Metrics/MethodLength

data/lib/dependabot/file_fetchers/base.rb

@@ -70,7 +70,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path
 
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(T::Hash[Symbol, Object]) }
       attr_reader :options
 
       CLIENT_NOT_FOUND_ERRORS = T.let(
@@ -135,7 +135,7 @@ module Dependabot
             source: Dependabot::Source,
             credentials: T::Array[Dependabot::Credential],
             repo_contents_path: T.nilable(String),
-            options: T::Hash[String, String],
+            options: T::Hash[Symbol, Object],
             update_config: T.nilable(Dependabot::Config::UpdateConfig)
           )
           .void

data/lib/dependabot/git_commit_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -14,6 +14,7 @@ require "dependabot/utils"
 require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker/source_details"
 require "dependabot/git_tag_details"
@@ -485,7 +486,9 @@ module Dependabot
     def handle_tag_prefix(tags)
       if dependency_source_details&.ref&.start_with?("tags/")
         tags = tags.map do |tag|
-          tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+          duplicated_tag = tag.dup
+          duplicated_tag.name = "tags/#{tag.name}"
+          duplicated_tag
         end
       end
 
@@ -524,8 +527,11 @@ module Dependabot
       client = Clients::GithubWithRetries
                .for_github_dot_com(credentials: credentials)
 
-      # TODO: create this method instead of relying on method_missing
-      T.unsafe(client.compare(T.must(listing_source_repo), ref1, ref2)).status
+      comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      status = T.cast(comparison[:status], Object)
+      raise TypeError, "GitHub comparison status must be a string" unless status.is_a?(String)
+
+      status
     end
 
     sig { params(ref1: String, ref2: String).returns(String) }
@@ -534,9 +540,11 @@ module Dependabot
                .for_gitlab_dot_com(credentials: credentials)
 
       comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      commits = T.cast(comparison["commits"], Object)
+      raise TypeError, "GitLab comparison commits must be an array" unless commits.is_a?(Array)
 
-      if T.unsafe(comparison).commits.none? then "behind"
-      elsif T.unsafe(comparison).compare_same_ref then "identical"
+      if commits.empty? then "behind"
+      elsif T.cast(comparison["compare_same_ref"], Object) == true then "identical"
       else
         "ahead"
       end
@@ -555,7 +563,13 @@ module Dependabot
 
       # Conservatively assume that ref2 is ahead in the equality case, of
       # if we get an unexpected format (e.g., due to a 404)
-      if JSON.parse(response.body).fetch("values", ["x"]).none? then "behind"
+      comparison = T.cast(JSON.parse(response.body), Object)
+      raise TypeError, "Bitbucket comparison must be a hash" unless comparison.is_a?(Hash)
+
+      values = T.cast(comparison.fetch("values", ["x"]), Object)
+      raise TypeError, "Bitbucket comparison values must be an array" unless values.is_a?(Array)
+
+      if values.empty? then "behind"
       else
         "ahead"
       end
@@ -674,7 +688,9 @@ module Dependabot
 
           if dependency_source_details&.ref&.start_with?("tags/")
             tags = tags.map do |tag|
-              tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+              duplicated_tag = tag.dup
+              duplicated_tag.name = "tags/#{tag.name}"
+              duplicated_tag
             end
           end
 
@@ -737,7 +753,7 @@ module Dependabot
       false
     end
 
-    sig { returns(T::Array[T.untyped]) }
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def github_releases
       @github_releases ||= T.let(
         begin
@@ -752,11 +768,17 @@ module Dependabot
           )
           # The Octokit RBI types this as non-nil, but it can be nil at runtime
           # (e.g. an empty/unexpected registry response), so guard against it.
-          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
+          releases = T.let(
+            client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          (releases || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
         rescue Octokit::Error
           []
         end,
-        T.nilable(T::Array[T.untyped])
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
 

data/lib/dependabot/git_cooldown_date_resolver.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/shared_helpers"
 require "dependabot/source"
@@ -45,7 +46,8 @@ module Dependabot
       releases = cached_github_releases
       unless releases.empty?
         release = releases.find { |r| r.tag_name == tag_name }
-        return release.published_at if release&.published_at
+        published_at = release&.published_at
+        return published_at if published_at
       end
 
       tag_creation_date(tag_name, commit_sha)
@@ -88,7 +90,7 @@ module Dependabot
 
     # Fetches and caches GitHub releases for the dependency source.
     # Returns an empty array for non-GitHub sources.
-    sig { returns(T::Array[T.untyped]) } # rubocop:disable Sorbet/ForbidTUntyped
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def cached_github_releases
       @cached_github_releases ||= T.let(
         begin
@@ -99,7 +101,13 @@ module Dependabot
               source: T.must(source),
               credentials: cooldown_credentials
             )
-            client.releases(T.must(source).repo, per_page: 100)
+            releases = T.let(
+              client.releases(T.must(source).repo, per_page: 100),
+              T.nilable(T::Array[Sawyer::Resource])
+            )
+            (releases || []).filter_map do |release|
+              Dependabot::Clients::GithubRelease.from_resource(release)
+            end
           else
             []
           end
@@ -107,7 +115,7 @@ module Dependabot
           Dependabot.logger.debug("Error fetching GitHub releases: #{e.message}")
           []
         end,
-        T.nilable(T::Array[T.untyped]) # rubocop:disable Sorbet/ForbidTUntyped
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
   end

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -1,9 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "time"
 
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/metadata_finders/base"
@@ -12,40 +14,62 @@ require "dependabot/utils"
 module Dependabot
   module MetadataFinders
     class Base
-      class GitLabRelease
+      class GitLabRelease < T::ImmutableStruct
         extend T::Sig
 
-        sig { returns(String) }
-        attr_reader :name
-
-        sig { returns(String) }
-        attr_reader :tag_name
-
-        sig { returns(String) }
-        attr_reader :body
-
-        sig { returns(String) }
-        attr_reader :html_url
+        const :name, String
+        const :tag_name, String
+        const :body, T.nilable(String)
+        const :html_url, String
+        const :authored_at, Time
 
         sig do
           params(
-            name: String,
-            tag_name: String,
-            body: String,
-            html_url: String
-          ).void
-        end
-        def initialize(name:, tag_name:, body:, html_url:)
-          @name = name
-          @tag_name = tag_name
-          @body = body
-          @html_url = html_url
+            tag: Gitlab::ObjectifiedHash,
+            source_url: String
+          ).returns(T.nilable(GitLabRelease))
         end
+        def self.from_tag(tag, source_url:)
+          name = T.cast(tag["name"], Object)
+          release = T.cast(tag["release"], Object)
+          commit = T.cast(tag["commit"], Object)
+          return unless name.is_a?(String)
+          return unless release.is_a?(Gitlab::ObjectifiedHash)
+          return unless commit.is_a?(Gitlab::ObjectifiedHash)
+
+          tag_name = T.cast(release["tag_name"], Object)
+          return unless tag_name.is_a?(String)
+
+          authored_at = time_value(T.cast(commit["authored_date"], Object))
+          return unless authored_at
+
+          description = T.cast(release["description"], Object)
+          new(
+            name: name,
+            tag_name: tag_name,
+            body: description.is_a?(String) ? description : nil,
+            html_url: "#{source_url}/tags/#{name}",
+            authored_at: authored_at
+          )
+        end
+
+        sig { params(value: Object).returns(T.nilable(Time)) }
+        def self.time_value(value)
+          return value if value.is_a?(Time)
+          return unless value.is_a?(String)
+
+          Time.parse(value)
+        rescue ArgumentError
+          nil
+        end
+        private_class_method :time_value
       end
 
       class ReleaseFinder
         extend T::Sig
 
+        ReleaseType = T.type_alias { T.any(Dependabot::Clients::GithubRelease, GitLabRelease) }
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -98,14 +122,13 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_dep_releases
           releases = all_releases
           dep_prefix = dependency.name.downcase
 
           releases_with_dependency_name =
             releases
-            .reject { |r| r.tag_name.nil? }
             .select { |r| r.tag_name.start_with?(dep_prefix) }
 
           return releases unless releases_with_dependency_name.any?
@@ -113,12 +136,12 @@ module Dependabot
           releases_with_dependency_name
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_releases
-          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[T.untyped]))
+          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[ReleaseType]))
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def relevant_releases
           releases = releases_since_previous_version
 
@@ -139,7 +162,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def releases_since_previous_version
           return [updated_release].compact unless previous_version
 
@@ -158,21 +181,21 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_previous_release(releases)
           return releases if releases.index(previous_release).nil?
 
           releases.first(T.must(releases.index(previous_release)))
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_updated_release(releases)
           return releases if releases.index(updated_release).nil?
 
           releases[releases.index(updated_release)..-1]
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
@@ -193,7 +216,7 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_updated_version(releases, conservative:)
           updated_version = version_class.new(new_version)
 
@@ -216,17 +239,17 @@ module Dependabot
           end
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def updated_release
           release_for_version(new_version)
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def previous_release
           release_for_version(previous_version)
         end
 
-        sig { params(version: T.nilable(String)).returns(T.untyped) }
+        sig { params(version: T.nilable(String)).returns(T.nilable(ReleaseType)) }
         def release_for_version(version)
           return nil unless version
 
@@ -236,22 +259,23 @@ module Dependabot
             all_dep_releases.find { |r| release_regex.match?(r.name.to_s) }
         end
 
-        sig { params(release: T.untyped).returns(String) }
+        sig { params(release: ReleaseType).returns(String) }
         def serialize_release(release)
-          rel = release
-          title = "## #{rel.name.to_s == '' ? rel.tag_name : rel.name}\n"
-          body = if rel.body.to_s.gsub(/\n*\z/m, "") == ""
+          name = release.name
+          title = "## #{name.to_s == '' ? release.tag_name : name}\n"
+          body = if release.body.to_s.gsub(/\n*\z/m, "") == ""
                    "No release notes provided."
                  else
-                   rel.body.gsub(/\n*\z/m, "")
+                   T.must(release.body).gsub(/\n*\z/m, "")
                  end
 
-          release_body_includes_title?(rel) ? body : title + body
+          release_body_includes_title?(release) ? body : title + body
         end
 
-        sig { params(release: T.untyped).returns(T::Boolean) }
+        sig { params(release: ReleaseType).returns(T::Boolean) }
         def release_body_includes_title?(release)
-          title = release.name.to_s == "" ? release.tag_name : release.name
+          name = release.name
+          title = name.nil? || name.empty? ? release.tag_name : name
           release.body.to_s.match?(/\A\s*\#*\s*#{Regexp.quote(title)}/m)
         end
 
@@ -265,7 +289,7 @@ module Dependabot
           dependency.version_class
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def fetch_dependency_releases
           return [] unless source
 
@@ -279,47 +303,45 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
         def fetch_github_releases
-          releases = github_client.releases(T.must(source).repo, per_page: 100)
-
-          # Remove any releases without a tag name. These are draft releases and
-          # aren't yet associated with a tag, so shouldn't be used.
-          releases = releases.reject { |r| T.unsafe(r).tag_name.nil? }
+          releases = parsed_github_releases
 
           clean_release_names =
-            releases.map { |r| T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, "") }
+            releases.map { |release| release.tag_name.gsub(/^[^0-9\.]*/, "") }
 
           if clean_release_names.all? { |nm| version_class.correct?(nm) }
-            releases.sort_by do |r|
-              version_class.new(T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, ""))
+            releases.sort_by do |release|
+              version_class.new(release.tag_name.gsub(/^[^0-9\.]*/, ""))
             end.reverse
           else
-            releases.sort_by { |r| T.unsafe(r).id }.reverse
+            releases.sort_by { |release| release.id || 0 }.reverse
           end
         rescue Octokit::NotFound, Octokit::UnavailableForLegalReasons
           []
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
+        def parsed_github_releases
+          resources = T.let(
+            github_client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          releases = (resources || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
+          releases
+        end
+
+        sig { returns(T::Array[GitLabRelease]) }
         def fetch_gitlab_releases
-          releases =
-            T.unsafe(
-              gitlab_client
-                           .tags(T.must(source).repo)
-            )
-             .select(&:release)
-             .sort_by { |r| T.unsafe(r).commit.authored_date }
-             .reverse
-
-          releases.map do |tag|
-            GitLabRelease.new(
-              name: T.unsafe(tag).name,
-              tag_name: T.unsafe(tag).release.tag_name,
-              body: T.unsafe(tag).release.description,
-              html_url: "#{T.must(source).url}/tags/#{T.unsafe(tag).name}"
-            )
+          tags = gitlab_client.tags(T.must(source).repo)
+          releases = tags.filter_map do |tag|
+            next unless tag.is_a?(Gitlab::ObjectifiedHash)
+
+            GitLabRelease.from_tag(tag, source_url: T.must(source).url)
           end
+          releases.sort_by(&:authored_at).reverse
         rescue Gitlab::Error::NotFound
           []
         end
@@ -359,20 +381,32 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def previous_ref
-          previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          previous_refs = T.must(dependency.previous_requirements).filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           previous_refs.first if previous_refs.one?
         end
 
         sig { returns(T.nilable(String)) }
         def new_ref
-          new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          new_refs = dependency.requirements.filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           new_refs.first if new_refs.one?
         end
 
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
+        def requirement_ref(requirement)
+          source = requirement.source
+          return unless source
+
+          symbol_ref = source[:ref]
+          return symbol_ref if symbol_ref.is_a?(String)
+
+          string_ref = source["ref"]
+          string_ref if string_ref.is_a?(String)
+        end
+
         sig { returns(T::Boolean) }
         def ref_changed?
           # We could go from multiple previous refs (nil) to a single new ref

data/lib/dependabot/package/release_cooldown_options.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/version.rb

@@ -24,6 +24,15 @@ module Dependabot
       T.cast(super, Dependabot::Version)
     end
 
+    sig do
+      overridable
+        .params(_from_version: String, _to_version: String)
+        .returns(T.nilable(String))
+    end
+    def self.update_type(_from_version, _to_version)
+      nil
+    end
+
     # Opt-in to Rubygems 4 behavior
     sig { override.overridable.params(version: VersionParameter).returns(T::Boolean) }
     def self.correct?(version)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.387.0"
+  VERSION = "0.388.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.387.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -518,6 +518,7 @@ files:
 - lib/dependabot/clients/bitbucket.rb
 - lib/dependabot/clients/bitbucket_with_retries.rb
 - lib/dependabot/clients/codecommit.rb
+- lib/dependabot/clients/github_release.rb
 - lib/dependabot/clients/github_with_retries.rb
 - lib/dependabot/clients/gitlab_with_retries.rb
 - lib/dependabot/command_helpers.rb
@@ -536,6 +537,7 @@ files:
 - lib/dependabot/dependency_group.rb
 - lib/dependabot/dependency_requirement.rb
 - lib/dependabot/ecosystem.rb
+- lib/dependabot/error_details.rb
 - lib/dependabot/errors.rb
 - lib/dependabot/experiments.rb
 - lib/dependabot/file_fetchers.rb
@@ -623,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib