dependabot-common 0.387.0 → 0.389.0

data/lib/dependabot/errors.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/error_details"
 require "dependabot/utils"
 
 # rubocop:disable Metrics/ModuleLength
@@ -23,7 +24,7 @@ module Dependabot
 
   # rubocop:disable Metrics/MethodLength
   # rubocop:disable Metrics/CyclomaticComplexity
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -138,11 +139,12 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
   # rubocop:enable Metrics/CyclomaticComplexity
 
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.parser_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -220,13 +222,14 @@ module Dependabot
       # and responsibility for fixing it is on them, not us. As a result we
       # quietly log these as errors
       { "error-type": "server_error" }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:disable Lint/RedundantCopDisableDirective
   # rubocop:disable Metrics/CyclomaticComplexity
   # rubocop:disable Metrics/AbcSize
-  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.anything])) }
+  sig { params(error: StandardError).returns(T.nilable(Dependabot::ErrorDetails)) }
   def self.updater_error_details(error)
     case error
     when Dependabot::ToolFeatureNotSupported
@@ -400,7 +403,8 @@ module Dependabot
           "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
-    end
+    end => details
+    Dependabot::ErrorDetails.from_hash(details) if details
   end
 
   # rubocop:enable Metrics/MethodLength

data/lib/dependabot/file_fetchers/base.rb

@@ -70,7 +70,7 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path
 
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(T::Hash[Symbol, Object]) }
       attr_reader :options
 
       CLIENT_NOT_FOUND_ERRORS = T.let(
@@ -135,7 +135,7 @@ module Dependabot
             source: Dependabot::Source,
             credentials: T::Array[Dependabot::Credential],
             repo_contents_path: T.nilable(String),
-            options: T::Hash[String, String],
+            options: T::Hash[Symbol, Object],
             update_config: T.nilable(Dependabot::Config::UpdateConfig)
           )
           .void

data/lib/dependabot/git_commit_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -14,6 +14,7 @@ require "dependabot/utils"
 require "dependabot/source"
 require "dependabot/dependency"
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker/source_details"
 require "dependabot/git_tag_details"
@@ -485,7 +486,9 @@ module Dependabot
     def handle_tag_prefix(tags)
       if dependency_source_details&.ref&.start_with?("tags/")
         tags = tags.map do |tag|
-          tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+          duplicated_tag = tag.dup
+          duplicated_tag.name = "tags/#{tag.name}"
+          duplicated_tag
         end
       end
 
@@ -524,8 +527,11 @@ module Dependabot
       client = Clients::GithubWithRetries
                .for_github_dot_com(credentials: credentials)
 
-      # TODO: create this method instead of relying on method_missing
-      T.unsafe(client.compare(T.must(listing_source_repo), ref1, ref2)).status
+      comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      status = T.cast(comparison[:status], Object)
+      raise TypeError, "GitHub comparison status must be a string" unless status.is_a?(String)
+
+      status
     end
 
     sig { params(ref1: String, ref2: String).returns(String) }
@@ -534,9 +540,11 @@ module Dependabot
                .for_gitlab_dot_com(credentials: credentials)
 
       comparison = client.compare(T.must(listing_source_repo), ref1, ref2)
+      commits = T.cast(comparison["commits"], Object)
+      raise TypeError, "GitLab comparison commits must be an array" unless commits.is_a?(Array)
 
-      if T.unsafe(comparison).commits.none? then "behind"
-      elsif T.unsafe(comparison).compare_same_ref then "identical"
+      if commits.empty? then "behind"
+      elsif T.cast(comparison["compare_same_ref"], Object) == true then "identical"
       else
         "ahead"
       end
@@ -555,7 +563,13 @@ module Dependabot
 
       # Conservatively assume that ref2 is ahead in the equality case, of
       # if we get an unexpected format (e.g., due to a 404)
-      if JSON.parse(response.body).fetch("values", ["x"]).none? then "behind"
+      comparison = T.cast(JSON.parse(response.body), Object)
+      raise TypeError, "Bitbucket comparison must be a hash" unless comparison.is_a?(Hash)
+
+      values = T.cast(comparison.fetch("values", ["x"]), Object)
+      raise TypeError, "Bitbucket comparison values must be an array" unless values.is_a?(Array)
+
+      if values.empty? then "behind"
       else
         "ahead"
       end
@@ -674,7 +688,9 @@ module Dependabot
 
           if dependency_source_details&.ref&.start_with?("tags/")
             tags = tags.map do |tag|
-              tag.dup.tap { |t| t.name = "tags/#{tag.name}" }
+              duplicated_tag = tag.dup
+              duplicated_tag.name = "tags/#{tag.name}"
+              duplicated_tag
             end
           end
 
@@ -737,7 +753,7 @@ module Dependabot
       false
     end
 
-    sig { returns(T::Array[T.untyped]) }
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def github_releases
       @github_releases ||= T.let(
         begin
@@ -752,11 +768,17 @@ module Dependabot
           )
           # The Octokit RBI types this as non-nil, but it can be nil at runtime
           # (e.g. an empty/unexpected registry response), so guard against it.
-          T.unsafe(client.releases(T.must(source).repo, per_page: 100)) || []
+          releases = T.let(
+            client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          (releases || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
         rescue Octokit::Error
           []
         end,
-        T.nilable(T::Array[T.untyped])
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
 

data/lib/dependabot/git_cooldown_date_resolver.rb

@@ -1,7 +1,8 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/shared_helpers"
 require "dependabot/source"
@@ -45,7 +46,8 @@ module Dependabot
       releases = cached_github_releases
       unless releases.empty?
         release = releases.find { |r| r.tag_name == tag_name }
-        return release.published_at if release&.published_at
+        published_at = release&.published_at
+        return published_at if published_at
       end
 
       tag_creation_date(tag_name, commit_sha)
@@ -88,7 +90,7 @@ module Dependabot
 
     # Fetches and caches GitHub releases for the dependency source.
     # Returns an empty array for non-GitHub sources.
-    sig { returns(T::Array[T.untyped]) } # rubocop:disable Sorbet/ForbidTUntyped
+    sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
     def cached_github_releases
       @cached_github_releases ||= T.let(
         begin
@@ -99,7 +101,13 @@ module Dependabot
               source: T.must(source),
               credentials: cooldown_credentials
             )
-            client.releases(T.must(source).repo, per_page: 100)
+            releases = T.let(
+              client.releases(T.must(source).repo, per_page: 100),
+              T.nilable(T::Array[Sawyer::Resource])
+            )
+            (releases || []).filter_map do |release|
+              Dependabot::Clients::GithubRelease.from_resource(release)
+            end
           else
             []
           end
@@ -107,7 +115,7 @@ module Dependabot
           Dependabot.logger.debug("Error fetching GitHub releases: #{e.message}")
           []
         end,
-        T.nilable(T::Array[T.untyped]) # rubocop:disable Sorbet/ForbidTUntyped
+        T.nilable(T::Array[Dependabot::Clients::GithubRelease])
       )
     end
   end

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -1,9 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "time"
 
 require "dependabot/credential"
+require "dependabot/clients/github_release"
 require "dependabot/clients/github_with_retries"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/metadata_finders/base"
@@ -12,40 +14,62 @@ require "dependabot/utils"
 module Dependabot
   module MetadataFinders
     class Base
-      class GitLabRelease
+      class GitLabRelease < T::ImmutableStruct
         extend T::Sig
 
-        sig { returns(String) }
-        attr_reader :name
-
-        sig { returns(String) }
-        attr_reader :tag_name
-
-        sig { returns(String) }
-        attr_reader :body
-
-        sig { returns(String) }
-        attr_reader :html_url
+        const :name, String
+        const :tag_name, String
+        const :body, T.nilable(String)
+        const :html_url, String
+        const :authored_at, Time
 
         sig do
           params(
-            name: String,
-            tag_name: String,
-            body: String,
-            html_url: String
-          ).void
-        end
-        def initialize(name:, tag_name:, body:, html_url:)
-          @name = name
-          @tag_name = tag_name
-          @body = body
-          @html_url = html_url
+            tag: Gitlab::ObjectifiedHash,
+            source_url: String
+          ).returns(T.nilable(GitLabRelease))
         end
+        def self.from_tag(tag, source_url:)
+          name = T.cast(tag["name"], Object)
+          release = T.cast(tag["release"], Object)
+          commit = T.cast(tag["commit"], Object)
+          return unless name.is_a?(String)
+          return unless release.is_a?(Gitlab::ObjectifiedHash)
+          return unless commit.is_a?(Gitlab::ObjectifiedHash)
+
+          tag_name = T.cast(release["tag_name"], Object)
+          return unless tag_name.is_a?(String)
+
+          authored_at = time_value(T.cast(commit["authored_date"], Object))
+          return unless authored_at
+
+          description = T.cast(release["description"], Object)
+          new(
+            name: name,
+            tag_name: tag_name,
+            body: description.is_a?(String) ? description : nil,
+            html_url: "#{source_url}/tags/#{name}",
+            authored_at: authored_at
+          )
+        end
+
+        sig { params(value: Object).returns(T.nilable(Time)) }
+        def self.time_value(value)
+          return value if value.is_a?(Time)
+          return unless value.is_a?(String)
+
+          Time.parse(value)
+        rescue ArgumentError
+          nil
+        end
+        private_class_method :time_value
       end
 
       class ReleaseFinder
         extend T::Sig
 
+        ReleaseType = T.type_alias { T.any(Dependabot::Clients::GithubRelease, GitLabRelease) }
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -98,14 +122,13 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_dep_releases
           releases = all_releases
           dep_prefix = dependency.name.downcase
 
           releases_with_dependency_name =
             releases
-            .reject { |r| r.tag_name.nil? }
             .select { |r| r.tag_name.start_with?(dep_prefix) }
 
           return releases unless releases_with_dependency_name.any?
@@ -113,12 +136,12 @@ module Dependabot
           releases_with_dependency_name
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def all_releases
-          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[T.untyped]))
+          @all_releases ||= T.let(fetch_dependency_releases, T.nilable(T::Array[ReleaseType]))
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def relevant_releases
           releases = releases_since_previous_version
 
@@ -139,7 +162,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T.nilable(T::Array[T.untyped])) }
+        sig { returns(T.nilable(T::Array[ReleaseType])) }
         def releases_since_previous_version
           return [updated_release].compact unless previous_version
 
@@ -158,21 +181,21 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_previous_release(releases)
           return releases if releases.index(previous_release).nil?
 
           releases.first(T.must(releases.index(previous_release)))
         end
 
-        sig { params(releases: T::Array[T.untyped]).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(releases: T::Array[ReleaseType]).returns(T.nilable(T::Array[ReleaseType])) }
         def filter_releases_using_updated_release(releases)
           return releases if releases.index(updated_release).nil?
 
           releases[releases.index(updated_release)..-1]
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
             cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
@@ -193,7 +216,7 @@ module Dependabot
           end
         end
 
-        sig { params(releases: T::Array[T.untyped], conservative: T::Boolean).returns(T::Array[T.untyped]) }
+        sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_updated_version(releases, conservative:)
           updated_version = version_class.new(new_version)
 
@@ -216,17 +239,17 @@ module Dependabot
           end
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def updated_release
           release_for_version(new_version)
         end
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(ReleaseType)) }
         def previous_release
           release_for_version(previous_version)
         end
 
-        sig { params(version: T.nilable(String)).returns(T.untyped) }
+        sig { params(version: T.nilable(String)).returns(T.nilable(ReleaseType)) }
         def release_for_version(version)
           return nil unless version
 
@@ -236,22 +259,23 @@ module Dependabot
             all_dep_releases.find { |r| release_regex.match?(r.name.to_s) }
         end
 
-        sig { params(release: T.untyped).returns(String) }
+        sig { params(release: ReleaseType).returns(String) }
         def serialize_release(release)
-          rel = release
-          title = "## #{rel.name.to_s == '' ? rel.tag_name : rel.name}\n"
-          body = if rel.body.to_s.gsub(/\n*\z/m, "") == ""
+          name = release.name
+          title = "## #{name.to_s == '' ? release.tag_name : name}\n"
+          body = if release.body.to_s.gsub(/\n*\z/m, "") == ""
                    "No release notes provided."
                  else
-                   rel.body.gsub(/\n*\z/m, "")
+                   T.must(release.body).gsub(/\n*\z/m, "")
                  end
 
-          release_body_includes_title?(rel) ? body : title + body
+          release_body_includes_title?(release) ? body : title + body
         end
 
-        sig { params(release: T.untyped).returns(T::Boolean) }
+        sig { params(release: ReleaseType).returns(T::Boolean) }
         def release_body_includes_title?(release)
-          title = release.name.to_s == "" ? release.tag_name : release.name
+          name = release.name
+          title = name.nil? || name.empty? ? release.tag_name : name
           release.body.to_s.match?(/\A\s*\#*\s*#{Regexp.quote(title)}/m)
         end
 
@@ -265,7 +289,7 @@ module Dependabot
           dependency.version_class
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[ReleaseType]) }
         def fetch_dependency_releases
           return [] unless source
 
@@ -279,47 +303,45 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
         def fetch_github_releases
-          releases = github_client.releases(T.must(source).repo, per_page: 100)
-
-          # Remove any releases without a tag name. These are draft releases and
-          # aren't yet associated with a tag, so shouldn't be used.
-          releases = releases.reject { |r| T.unsafe(r).tag_name.nil? }
+          releases = parsed_github_releases
 
           clean_release_names =
-            releases.map { |r| T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, "") }
+            releases.map { |release| release.tag_name.gsub(/^[^0-9\.]*/, "") }
 
           if clean_release_names.all? { |nm| version_class.correct?(nm) }
-            releases.sort_by do |r|
-              version_class.new(T.unsafe(r).tag_name.gsub(/^[^0-9\.]*/, ""))
+            releases.sort_by do |release|
+              version_class.new(release.tag_name.gsub(/^[^0-9\.]*/, ""))
             end.reverse
           else
-            releases.sort_by { |r| T.unsafe(r).id }.reverse
+            releases.sort_by { |release| release.id || 0 }.reverse
           end
         rescue Octokit::NotFound, Octokit::UnavailableForLegalReasons
           []
         end
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Clients::GithubRelease]) }
+        def parsed_github_releases
+          resources = T.let(
+            github_client.releases(T.must(source).repo, per_page: 100),
+            T.nilable(T::Array[Sawyer::Resource])
+          )
+          releases = (resources || []).filter_map do |release|
+            Dependabot::Clients::GithubRelease.from_resource(release)
+          end
+          releases
+        end
+
+        sig { returns(T::Array[GitLabRelease]) }
         def fetch_gitlab_releases
-          releases =
-            T.unsafe(
-              gitlab_client
-                           .tags(T.must(source).repo)
-            )
-             .select(&:release)
-             .sort_by { |r| T.unsafe(r).commit.authored_date }
-             .reverse
-
-          releases.map do |tag|
-            GitLabRelease.new(
-              name: T.unsafe(tag).name,
-              tag_name: T.unsafe(tag).release.tag_name,
-              body: T.unsafe(tag).release.description,
-              html_url: "#{T.must(source).url}/tags/#{T.unsafe(tag).name}"
-            )
+          tags = gitlab_client.tags(T.must(source).repo)
+          releases = tags.filter_map do |tag|
+            next unless tag.is_a?(Gitlab::ObjectifiedHash)
+
+            GitLabRelease.from_tag(tag, source_url: T.must(source).url)
           end
+          releases.sort_by(&:authored_at).reverse
         rescue Gitlab::Error::NotFound
           []
         end
@@ -359,20 +381,32 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def previous_ref
-          previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          previous_refs = T.must(dependency.previous_requirements).filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           previous_refs.first if previous_refs.one?
         end
 
         sig { returns(T.nilable(String)) }
         def new_ref
-          new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+          new_refs = dependency.requirements.filter_map do |requirement|
+            requirement_ref(requirement)
           end.uniq
           new_refs.first if new_refs.one?
         end
 
+        sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
+        def requirement_ref(requirement)
+          source = requirement.source
+          return unless source.is_a?(Hash)
+
+          symbol_ref = source[:ref]
+          return symbol_ref if symbol_ref.is_a?(String)
+
+          string_ref = source["ref"]
+          string_ref if string_ref.is_a?(String)
+        end
+
         sig { returns(T::Boolean) }
         def ref_changed?
           # We could go from multiple previous refs (nil) to a single new ref

data/lib/dependabot/package/release_cooldown_options.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -279,7 +279,7 @@ module Dependabot
       sig { returns(String) }
       def dependency_name_group_pr_name
         dep = T.must(dependencies.first)
-        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+        directories = dep.metadata_string_array(:updated_directories) || [dep.metadata_string(:directory)].compact
 
         if directories.count > 1
           "bump #{dep.name} across #{directories.count} directories"
@@ -571,7 +571,7 @@ module Dependabot
       sig { returns(String) }
       def dependency_name_group_intro
         dep = T.must(dependencies.first)
-        directories = dep.metadata[:updated_directories] || [dep.metadata[:directory]].compact
+        directories = dep.metadata_string_array(:updated_directories) || [dep.metadata_string(:directory)].compact
 
         msg = "Bumps #{dependency_links.first}"
 
@@ -801,6 +801,9 @@ module Dependabot
           vulnerabilities_fixed: vulnerabilities_fixed[dependency.name],
           github_redirection_service: github_redirection_service
         ).to_s
+      rescue StandardError => e
+        suppress_error("metadata cascades for #{dependency.name}", e)
+        ""
       end
 
       sig { returns(String) }

data/lib/dependabot/version.rb

@@ -24,6 +24,15 @@ module Dependabot
       T.cast(super, Dependabot::Version)
     end
 
+    sig do
+      overridable
+        .params(_from_version: String, _to_version: String)
+        .returns(T.nilable(String))
+    end
+    def self.update_type(_from_version, _to_version)
+      nil
+    end
+
     # Opt-in to Rubygems 4 behavior
     sig { override.overridable.params(version: VersionParameter).returns(T::Boolean) }
     def self.correct?(version)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.387.0"
+  VERSION = "0.389.0"
 end