dependabot-common 0.390.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9647e43655c1fb5b645ad6a5635c619fd681f12b926c6c2195492aba565b9401
-  data.tar.gz: b50b9ac87807039b87a1c2c34fe2620bf332ceb607cd0c1acfb32189e78e3705
+  metadata.gz: 6a574e02b5e7a33f7f245c56ae3df5942505a73cee3c1f32b8a07c1b36ba13a2
+  data.tar.gz: 4ee0767b57e78681464704b7e41557692d57cf240f40f2577d0313a87f78d371
 SHA512:
-  metadata.gz: '0749c51d303699690aa4e89b2f29084d4082a83f1e1f986c023ad4089284a4a1b145729be61d8759f267c8951878a8c36537eb87037c59278f0fbd249daf71bb'
-  data.tar.gz: 8de0c799f886104e9cd1bedd0fad7ca6e004dec5adb6f939ada8b496d37b41e324a89065542f9603b011d3ef60a9105d397f22e1c24440c029752ce94b52a56d
+  metadata.gz: b63a271847067f6adf096dcbbd9e97e0e986defc09125f55afa8be96cb820660c76551982b46d7c613e29ff93093d87bb1c1849d99c6e7bd75fab3f9abcc3a28
+  data.tar.gz: 28753fa5c276536d7cb8e16cc7bf183796bdd968e31c0efcb92ded66fd8b07a6e05304d0da3eba70a64fc1bd990f9167a073a072791655bdeb47cfb2f8c01d14

data/lib/dependabot/clients/azure.rb

@@ -473,7 +473,7 @@ module Dependabot
       private
 
       sig { params(blk: T.proc.void).void }
-      def retry_connection_failures(&blk) # rubocop:disable Lint/UnusedMethodArgument
+      def retry_connection_failures(&blk)
         retry_attempt = 0
 
         begin

data/lib/dependabot/command_helpers.rb

@@ -26,6 +26,7 @@ module Dependabot
     EnvCmdItem = T.type_alias do
       T.any(
         String,
+        T::Array[String],
         T::Hash[T.any(String, Symbol), T.anything]
       )
     end
@@ -35,7 +36,7 @@ module Dependabot
 
       sig { params(process_status: T.nilable(Process::Status), custom_exitstatus: T.nilable(Integer)).void }
       def initialize(process_status, custom_exitstatus = nil)
-        @process_status = T.let(process_status, T.nilable(Process::Status))
+        @process_status = process_status
         @custom_exitstatus = custom_exitstatus
       end
 
@@ -109,7 +110,7 @@ module Dependabot
                               else
                                 env_cmd
                               end
-          command_for_log = sanitized_env_cmd.join(" ")
+          command_for_log = sanitized_env_cmd.map { |item| item.is_a?(Array) ? item.first : item }.join(" ")
           Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
@@ -263,7 +264,14 @@ module Dependabot
 
     sig { params(env_cmd: T::Array[EnvCmdItem]).returns(T.nilable(String)) }
     def self.command_string_for_logging(env_cmd)
-      T.cast(env_cmd.find { |item| item.is_a?(String) }, T.nilable(String))
+      command_parts = env_cmd.filter_map do |item|
+        case item
+        when Array then item.first
+        when String then item
+        end
+      end
+
+      command_parts.join(" ") unless command_parts.empty?
     end
     private_class_method :command_string_for_logging
 

data/lib/dependabot/config/file_fetcher.rb

@@ -10,11 +10,11 @@ module Dependabot
     class FileFetcher < FileFetchers::Base
       extend T::Sig
 
-      CONFIG_FILE_PATHS = T.let(%w(.github/dependabot.yml .github/dependabot.yaml).freeze, T::Array[String])
+      CONFIG_FILE_PATHS = %w(.github/dependabot.yml .github/dependabot.yaml).freeze
 
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
-        CONFIG_FILE_PATHS.any? { |file| filenames.include?(file) }
+        CONFIG_FILE_PATHS.intersect?(filenames)
       end
 
       sig { override.returns(String) }

data/lib/dependabot/config/ignore_condition.rb

@@ -32,7 +32,7 @@ module Dependabot
         ).void
       end
       def initialize(dependency_name:, versions: nil, update_types: nil)
-        @dependency_name = T.let(dependency_name, String)
+        @dependency_name = dependency_name
         @versions = T.let(versions || [], T::Array[String])
         @update_types = T.let(update_types || [], T::Array[String])
       end

data/lib/dependabot/config/update_config.rb

@@ -52,7 +52,7 @@ module Dependabot
       sig { params(dependency: Dependency).returns(Dependency) }
       def extract_base_version_from_requirement(dependency)
         requirements = dependency.requirements
-        requirement = T.must(requirements.first)[:requirement]
+        requirement = T.must(requirements.first).requirement_string
         version = requirement&.match(/\d+\.\d+\.\d+/)&.to_s
         Dependabot::Dependency.new(
           name: dependency.name,

data/lib/dependabot/dependency_group.rb

@@ -87,6 +87,22 @@ module Dependabot
       }.to_yaml.delete_prefix("---\n")
     end
 
+    sig { params(parent_name: String, dependency_name: String).returns(String) }
+    def self.subgroup_name(parent_name:, dependency_name:)
+      "#{parent_name}/#{dependency_name}"
+    end
+
+    sig do
+      params(subgroup_name: String, dependency_name: String)
+        .returns(T.nilable(String))
+    end
+    def self.parent_name_from_subgroup(subgroup_name:, dependency_name:)
+      suffix = "/#{dependency_name}"
+      return unless subgroup_name.end_with?(suffix)
+
+      subgroup_name.delete_suffix(suffix)
+    end
+
     private
 
     sig { params(dependency_name: String).returns(T::Boolean) }

data/lib/dependabot/dependency_requirement.rb

@@ -16,7 +16,7 @@ module Dependabot
   #
   # Subclasses Hash so it is a drop-in replacement at call sites (and in
   # type annotations) that treat requirement entries as
-  # T::Hash[Symbol, T.untyped], while exposing typed readers for the
+  # T::Hash[Symbol, Object], while exposing typed readers for the
   # well-known keys. New code should prefer the typed readers; hash-style
   # access remains supported while call sites are migrated gradually.
   #
@@ -37,15 +37,11 @@ module Dependabot
     ObjectHash = T.type_alias { T::Hash[T.any(Symbol, String), Object] }
     Requirement = T.type_alias { T.any(String, Symbol) }
     Source = T.type_alias { T.any(String, ObjectHash) }
-    Input = T.type_alias { T.any(DependencyRequirement, ObjectHash) }
+    Input = T.type_alias { T::Hash[T.any(Symbol, String), T.anything] }
 
     K = type_member { { fixed: Symbol } }
-    # Hash-style access remains dynamic until ecosystem callers migrate to the
-    # typed readers. Keeping that compatibility here avoids a flag-day change.
-    # rubocop:disable Sorbet/ForbidTUntyped
-    V = type_member { { fixed: T.untyped } }
-    Elem = type_member { { fixed: [Symbol, T.untyped] } }
-    # rubocop:enable Sorbet/ForbidTUntyped
+    V = type_member { { fixed: Object } }
+    Elem = type_member { { fixed: [Symbol, Object] } }
 
     # Builds a DependencyRequirement from a requirement hash, symbolising
     # top-level keys. Accepts both plain hashes and existing
@@ -53,7 +49,12 @@ module Dependabot
     sig { params(hash: Input).returns(DependencyRequirement) }
     def self.create(hash)
       requirement = new
-      requirement.replace(hash.keys.to_h { |k| [k.to_sym, hash[k]] })
+      hash.each do |key, value|
+        case value
+        when Object then requirement[key.to_sym] = value
+        else raise TypeError, "requirement values must inherit Object"
+        end
+      end
       requirement
     end
 
@@ -62,7 +63,7 @@ module Dependabot
     # or :unfixable when no valid updated requirement can be generated.
     sig { returns(T.nilable(Requirement)) }
     def requirement
-      value = T.cast(self[:requirement], T.nilable(Object))
+      value = self[:requirement]
       return if value.nil?
       return value if value.is_a?(String) || value == :unfixable
 
@@ -82,7 +83,7 @@ module Dependabot
     # the underlying hash access under sorbet-runtime.
     sig { returns(T.nilable(T::Array[Group])) }
     def groups
-      value = T.cast(self[:groups], T.nilable(Object))
+      value = self[:groups]
       return if value.nil?
       raise TypeError, "groups must be an array of strings or symbols, or nil" unless value.is_a?(Array)
 
@@ -101,7 +102,7 @@ module Dependabot
     # parser or deserialised from a job definition.
     sig { returns(T.nilable(Source)) }
     def source
-      value = T.cast(self[:source], T.nilable(Object))
+      value = self[:source]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -153,11 +154,76 @@ module Dependabot
       raise TypeError, "requirement must be a string or nil"
     end
 
+    # Reads a known metadata field such as "property_name". Accepts either key
+    # style for the same reason as `source_string`. Returns nil when the
+    # requirement carries no metadata or the key is absent.
+    sig { params(key: String).returns(T.nilable(String)) }
+    def metadata_string(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "metadata #{key} must be a string or nil"
+    end
+
+    # Reads a known symbol-valued metadata field such as Helm's "type".
+    sig { params(key: String).returns(T.nilable(Symbol)) }
+    def metadata_symbol(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value.is_a?(Symbol)
+
+      raise TypeError, "metadata #{key} must be a symbol or nil"
+    end
+
+    # Reads a boolean metadata field such as "include_debug_script".
+    sig { params(key: String).returns(T.nilable(T::Boolean)) }
+    def metadata_boolean(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value == true || value == false
+
+      raise TypeError, "metadata #{key} must be a boolean or nil"
+    end
+
+    # Reads a nested metadata hash whose values are all strings, such as
+    # "dependency_set" (`{ group: "my.group", version: "1.4.0" }`). Keys are
+    # symbolised so callers can read them with symbols regardless of how the
+    # requirement was built.
+    sig { params(key: String).returns(T.nilable(T::Hash[Symbol, String])) }
+    def metadata_string_hash(key)
+      value = metadata_value(key)
+      return if value.nil?
+      raise TypeError, "metadata #{key} must be a hash of strings or nil" unless value.is_a?(Hash)
+
+      value.to_h do |raw_entry_key, raw_entry_value|
+        entry_key = T.cast(raw_entry_key, Object)
+        entry_value = T.cast(raw_entry_value, Object)
+        unless (entry_key.is_a?(Symbol) || entry_key.is_a?(String)) && entry_value.is_a?(String)
+          raise TypeError, "metadata #{key} must be a hash of strings or nil"
+        end
+
+        [entry_key.to_sym, entry_value]
+      end
+    end
+
     private
 
+    # Reads a raw metadata field, accepting either key style. Nil when the
+    # requirement carries no metadata or the key is absent.
+    sig { params(key: String).returns(T.nilable(Object)) }
+    def metadata_value(key)
+      details = metadata
+      return if details.nil?
+
+      return details[key.to_sym] if details.key?(key.to_sym)
+
+      details[key]
+    end
+
     sig { params(key: Symbol).returns(T.nilable(String)) }
     def optional_string(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
       return value if value.is_a?(String)
 
@@ -166,7 +232,7 @@ module Dependabot
 
     sig { params(key: Symbol).returns(T.nilable(ObjectHash)) }
     def optional_object_hash(key)
-      value = T.cast(self[key], T.nilable(Object))
+      value = self[key]
       return if value.nil?
 
       object_hash(value, key)

data/lib/dependabot/ecosystem.rb

@@ -46,12 +46,12 @@ module Dependabot
         supported_versions: [],
         requirement: nil
       )
-        @name = T.let(name, String)
+        @name = name
         @detected_version = T.let(detected_version || version, T.nilable(Dependabot::Version))
-        @version = T.let(version, T.nilable(Dependabot::Version))
-        @deprecated_versions = T.let(deprecated_versions, T::Array[Dependabot::Version])
-        @supported_versions = T.let(supported_versions, T::Array[Dependabot::Version])
-        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
+        @version = version
+        @deprecated_versions = deprecated_versions
+        @supported_versions = supported_versions
+        @requirement = requirement
       end
 
       # The name of the package manager (e.g., "bundler", "npm").
@@ -177,9 +177,9 @@ module Dependabot
       package_manager:,
       language: nil
     )
-      @name = T.let(name, String)
-      @package_manager = T.let(package_manager, VersionManager)
-      @language = T.let(language, T.nilable(VersionManager))
+      @name = name
+      @package_manager = package_manager
+      @language = language
     end
 
     # The name of the ecosystem (mandatory).

data/lib/dependabot/errors.rb

@@ -246,6 +246,11 @@ module Dependabot
         "error-type": "dependency_file_not_resolvable",
         "error-detail": { message: error.message }
       }
+    when Dependabot::BranchNameFormattingError
+      {
+        "error-type": "branch_name_formatting_error",
+        "error-detail": { message: error.message }
+      }
     when Dependabot::BlockedDependencyVersion
       {
         "error-type": "blocked_dependency_version",
@@ -483,7 +488,7 @@ module Dependabot
 
     sig { params(error_type: String, message: T.any(T.nilable(String), MatchData)).void }
     def initialize(error_type, message = nil)
-      @error_type = T.let(error_type, String)
+      @error_type = error_type
 
       super(message || error_type)
     end
@@ -509,6 +514,8 @@ module Dependabot
 
   class RefNamespaceConflictError < DependabotError; end
 
+  class BranchNameFormattingError < DependabotError; end
+
   #####################
   # Repo level errors #
   #####################

data/lib/dependabot/file_fetchers/base.rb

@@ -325,7 +325,7 @@ module Dependabot
 
       sig { params(path: String).returns(T::Boolean) }
       def in_submodule?(path)
-        subpaths(path.delete_prefix("/")).any? { |subpath| @submodules.include?(subpath) }
+        subpaths(path.delete_prefix("/")).intersect?(@submodules)
       end
 
       # Given a "foo/bar/baz" path, returns ["foo", "foo/bar", "foo/bar/baz"]

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -78,7 +78,7 @@ module Dependabot
 
       private
 
-      TEXT_ENCODINGS = T.let(%w(us-ascii utf-8).freeze, T::Array[String])
+      TEXT_ENCODINGS = %w(us-ascii utf-8).freeze
 
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path

data/lib/dependabot/file_updaters/base.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -79,7 +79,7 @@ module Dependabot
       def requirement_changed?(file, dependency)
         changed_requirements = dependency.requirements - T.must(dependency.previous_requirements)
 
-        changed_requirements.any? { |f| f[:file] == file.name }
+        changed_requirements.any? { |f| f.file == file.name }
       end
 
       sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -62,10 +62,7 @@ module Dependabot
         require_relative "commits_finder"
 
         # Earlier entries are preferred
-        CHANGELOG_NAMES = T.let(
-          %w(changelog news changes history release whatsnew releases).freeze,
-          T::Array[String]
-        )
+        CHANGELOG_NAMES = %w(changelog news changes history release whatsnew releases).freeze
 
         sig { returns(T.nilable(Dependabot::Source)) }
         attr_reader :source
@@ -452,7 +449,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def previous_ref
           previous_refs = dependency.previous_requirements&.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end&.uniq
           previous_refs.first if previous_refs&.one?
         end
@@ -460,7 +457,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def new_ref
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -479,7 +476,7 @@ module Dependabot
           return false if dependency.package_manager == "composer"
 
           requirements = dependency.requirements
-          sources = requirements.map { |r| r.fetch(:source) }.uniq.compact
+          sources = requirements.map(&:source_hash).uniq.compact
           return false if sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }

data/lib/dependabot/metadata_finders/base/changelog_pruner.rb

@@ -169,7 +169,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def previous_ref
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -177,7 +177,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def new_ref
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -190,7 +190,7 @@ module Dependabot
           return false if dependency.package_manager == "composer"
 
           requirements = dependency.requirements
-          sources = requirements.map { |r| r.fetch(:source) }.uniq.compact
+          sources = requirements.map(&:source_hash).uniq.compact
           return false if sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -136,10 +136,11 @@ module Dependabot
         sig { params(version: T.nilable(Dependabot::Version)).returns(T::Boolean) }
         def satisfies_previous_reqs?(version)
           T.must(dependency.previous_requirements).all? do |req|
-            next true unless req.fetch(:requirement)
+            requirement = req.requirement_string
+            next true unless requirement
 
             requirement_class
-              .requirements_array(req.fetch(:requirement))
+              .requirements_array(requirement)
               .all? { |r| r.satisfied_by?(version) }
           end
         end
@@ -151,7 +152,7 @@ module Dependabot
           # internally
           return false if dependency.package_manager == "composer"
 
-          sources = requirements&.map { |r| r.fetch(:source) }&.uniq&.compact
+          sources = requirements&.map(&:source_hash)&.uniq&.compact
           return false if sources.nil? || sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }
@@ -168,7 +169,7 @@ module Dependabot
           return unless git_source?(dependency.previous_requirements)
 
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -178,7 +179,7 @@ module Dependabot
           return unless git_source?(dependency.previous_requirements)
 
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -198,15 +198,9 @@ module Dependabot
         sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
-            cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
-            cleaned_name = release.name&.gsub(/^[^0-9]*/, "")
-            dot_count = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                   .map { |nm| nm.chars.count(".") }.max
+            next false if release_tag_matches_version?(release, new_version)
 
-            tag_version = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                     .select { |nm| version_class.correct?(nm) }
-                                                     .select { |nm| nm.chars.count(".") == dot_count }
-                                                     .map { |nm| version_class.new(nm) }.max
+            tag_version = possible_versions(release).max
 
             next conservative unless tag_version
 
@@ -221,15 +215,9 @@ module Dependabot
           updated_version = version_class.new(new_version)
 
           releases.reject do |release|
-            cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
-            cleaned_name = release.name&.gsub(/^[^0-9]*/, "")
-            dot_count = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                   .map { |nm| nm.chars.count(".") }.max
+            next false if release_tag_matches_version?(release, new_version)
 
-            tag_version = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                     .select { |nm| version_class.correct?(nm) }
-                                                     .select { |nm| nm.chars.count(".") == dot_count }
-                                                     .map { |nm| version_class.new(nm) }.min
+            tag_version = possible_versions(release).min
 
             next conservative unless tag_version
 
@@ -239,6 +227,26 @@ module Dependabot
           end
         end
 
+        sig { params(release: ReleaseType).returns(T::Array[Dependabot::Version]) }
+        def possible_versions(release)
+          candidates = [release.tag_name, release.name].compact
+                                                       .map { |name| name.gsub(/^[^0-9]*/, "") }
+                                                       .reject(&:empty?)
+                                                       .select { |name| version_class.correct?(name) }
+          dot_count = candidates.map { |name| name.chars.count(".") }.max
+          return [] unless dot_count
+
+          candidates.select { |name| name.chars.count(".") == dot_count }
+                    .map { |name| version_class.new(name) }
+        end
+
+        sig { params(release: ReleaseType, version: T.nilable(String)).returns(T::Boolean) }
+        def release_tag_matches_version?(release, version)
+          return false unless version
+
+          release.tag_name.gsub(/^[^0-9]*/, "") == version.gsub(/^[^0-9]*/, "")
+        end
+
         sig { returns(T.nilable(ReleaseType)) }
         def updated_release
           release_for_version(new_version)

data/lib/dependabot/metadata_finders/base.rb

@@ -15,7 +15,7 @@ module Dependabot
       require "dependabot/metadata_finders/base/release_finder"
       require "dependabot/metadata_finders/base/commits_finder"
 
-      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = T.let(%w(bun npm_and_yarn pub).freeze, T::Array[String])
+      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = %w(bun npm_and_yarn pub).freeze
 
       sig { returns(Dependabot::Dependency) }
       attr_reader :dependency

data/lib/dependabot/package/package_details.rb

@@ -20,12 +20,12 @@ module Dependabot
         ).void
       end
       def initialize(dependency:, releases: [], dist_tags: nil)
-        @dependency = T.let(dependency, Dependabot::Dependency)
+        @dependency = dependency
         @releases = T.let(
           releases.sort_by(&:version).reverse,
           T::Array[Dependabot::Package::PackageRelease]
         )
-        @dist_tags = T.let(dist_tags, T.nilable(T::Hash[String, String]))
+        @dist_tags = dist_tags
       end
 
       sig { returns(Dependabot::Dependency) }

data/lib/dependabot/package/package_language.rb

@@ -15,9 +15,9 @@ module Dependabot
         ).void
       end
       def initialize(name:, version: nil, requirement: nil)
-        @name = T.let(name, String)
-        @version = T.let(version, T.nilable(Dependabot::Version))
-        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
+        @name = name
+        @version = version
+        @requirement = requirement
       end
 
       sig { returns(String) }

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -290,9 +290,10 @@ module Dependabot
       end
       def filter_out_of_range_versions(releases)
         reqs = dependency.requirements.filter_map do |r|
-          next if r.fetch(:requirement).nil?
+          requirement = r.requirement_string
+          next if requirement.nil?
 
-          requirement_class.requirements_array(r.fetch(:requirement))
+          requirement_class.requirements_array(requirement)
         end
 
         releases
@@ -325,7 +326,7 @@ module Dependabot
         return true if dependency.numeric_version&.prerelease?
 
         dependency.requirements.any? do |req|
-          req_string = req.fetch(:requirement) || ""
+          req_string = req.requirement_string || ""
           req_string.split(",").map(&:strip).any? do |r|
             version_str = r.gsub(/^\s*[!<>=~^]+\s*/, "").strip
             next false unless version_class.correct?(version_str)

data/lib/dependabot/package/package_release.rb

@@ -40,17 +40,17 @@ module Dependabot
         tag: nil,
         details: {}
       )
-        @version = T.let(version, Dependabot::Version)
-        @released_at = T.let(released_at, T.nilable(Time))
-        @latest = T.let(latest, T::Boolean)
-        @yanked = T.let(yanked, T::Boolean)
-        @yanked_reason = T.let(yanked_reason, T.nilable(String))
-        @downloads = T.let(downloads, T.nilable(Integer))
-        @url = T.let(url, T.nilable(String))
-        @package_type = T.let(package_type, T.nilable(String))
-        @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
-        @tag = T.let(tag, T.nilable(String))
-        @details = T.let(details, T::Hash[String, T.anything])
+        @version = version
+        @released_at = released_at
+        @latest = latest
+        @yanked = yanked
+        @yanked_reason = yanked_reason
+        @downloads = downloads
+        @url = url
+        @package_type = package_type
+        @language = language
+        @tag = tag
+        @details = details
       end
 
       sig { returns(Dependabot::Version) }