dependabot-common 0.390.0 → 0.392.0

data/lib/dependabot/pull_request_creator/branch_name_template.rb

@@ -11,20 +11,11 @@ module Dependabot
     class BranchNameTemplate
       extend T::Sig
 
-      class Error < Dependabot::DependabotError; end
-
-      SOLO_PLACEHOLDERS = T.let(
-        %w(prefix package_manager directory target_branch dependency version name).freeze,
-        T::Array[String]
-      )
-      GROUP_PLACEHOLDERS = T.let(
-        %w(prefix package_manager directory target_branch group_name name).freeze,
-        T::Array[String]
-      )
-      MULTI_ECO_PLACEHOLDERS = T.let(
-        %w(prefix target_branch group_name name).freeze,
-        T::Array[String]
-      )
+      class Error < Dependabot::BranchNameFormattingError; end
+
+      SOLO_PLACEHOLDERS = %w(prefix package_manager directory target_branch dependency version name).freeze
+      GROUP_PLACEHOLDERS = %w(prefix package_manager directory target_branch group_name name).freeze
+      MULTI_ECO_PLACEHOLDERS = %w(prefix target_branch group_name name).freeze
 
       # ---------------------------------------------------------------
       # 1. validate_template(template, strategy:)

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
@@ -88,14 +88,14 @@ module Dependabot
         def updating_a_property?
           T.must(dependencies.first)
            .requirements
-           .any? { |r| r.dig(:metadata, :property_name) }
+           .any? { |r| r.metadata_string("property_name") }
         end
 
         sig { returns(T::Boolean) }
         def updating_a_dependency_set?
           T.must(dependencies.first)
            .requirements
-           .any? { |r| r.dig(:metadata, :dependency_set) }
+           .any? { |r| r.metadata_string_hash("dependency_set") }
         end
 
         sig { returns(String) }
@@ -103,8 +103,8 @@ module Dependabot
           @property_name ||=
             T.let(
               T.must(dependencies.first).requirements
-                                              .find { |r| r.dig(:metadata, :property_name) }
-                                              &.dig(:metadata, :property_name),
+                                              .find { |r| r.metadata_string("property_name") }
+                                              &.metadata_string("property_name"),
               T.nilable(String)
             )
 
@@ -118,9 +118,9 @@ module Dependabot
           @dependency_set ||=
             T.let(
               T.must(dependencies.first).requirements
-                                 .find { |r| r.dig(:metadata, :dependency_set) }
-                                 &.dig(:metadata, :dependency_set),
-              T.nilable(T::Hash[String, String])
+                                 .find { |r| r.metadata_string_hash("dependency_set") }
+                                 &.metadata_string_hash("dependency_set"),
+              T.nilable(T::Hash[Symbol, String])
             )
 
           raise "No dependency set!" unless @dependency_set
@@ -172,9 +172,11 @@ module Dependabot
             T.must(dependency.version)[0..6]
           elsif dependency.version == dependency.previous_version &&
                 package_manager == "docker"
-            dependency.requirements
-                      .filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }
-                      .first.split(":").last[0..6]
+            T.must(
+              dependency.requirements
+                                    .filter_map { |r| r.source_string("digest") }
+                                    .first
+            ).split(":").last&.[](0..6)
           else
             dependency.version
           end
@@ -183,7 +185,7 @@ module Dependabot
         sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def previous_ref(dependency)
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -191,7 +193,7 @@ module Dependabot
         sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def new_ref(dependency)
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -208,10 +210,10 @@ module Dependabot
             dependency.requirements - T.must(dependency.previous_requirements)
 
           gemspec =
-            updated_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-          return gemspec[:requirement] if gemspec
+            updated_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+          return gemspec.requirement_string if gemspec
 
-          updated_reqs.first&.fetch(:requirement)
+          updated_reqs.first&.requirement_string
         end
 
         # TODO: Bring this in line with existing library checks that we do in the

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -165,43 +165,36 @@ module Dependabot
         )
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { params(dep: Dependabot::Dependency).returns(T.nilable(String)) }
       def version(dep)
         return dep.version if version_class.correct?(dep.version)
 
-        source = dep.requirements.find { |r| r.fetch(:source) }&.fetch(:source)
-        type = source&.fetch("type", nil) || source&.fetch(:type)
-        return dep.version unless type == "git"
+        source = dep.requirements.find(&:source)
+        return dep.version if source.nil?
+        return dep.version unless source.source_string("type") == "git"
 
-        ref = source.fetch("ref", nil) || source.fetch(:ref)
-        version_from_ref = ref&.gsub(/^v/, "")
+        version_from_ref = source.source_string("ref")&.gsub(/^v/, "")
         return dep.version unless version_from_ref
         return dep.version unless version_class.correct?(version_from_ref)
 
         version_from_ref
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { params(dep: Dependabot::Dependency).returns(T.nilable(String)) }
       def previous_version(dep)
         version_str = dep.previous_version
         return version_str if version_class.correct?(version_str)
 
-        source = T.must(dep.previous_requirements)
-                  .find { |r| r.fetch(:source) }&.fetch(:source)
-        type = source&.fetch("type", nil) || source&.fetch(:type)
-        return version_str unless type == "git"
+        source = T.must(dep.previous_requirements).find(&:source)
+        return version_str if source.nil?
+        return version_str unless source.source_string("type") == "git"
 
-        ref = source.fetch("ref", nil) || source.fetch(:ref)
-        version_from_ref = ref&.gsub(/^v/, "")
+        version_from_ref = source.source_string("ref")&.gsub(/^v/, "")
         return version_str unless version_from_ref
         return version_str unless version_class.correct?(version_from_ref)
 
         version_from_ref
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
       sig { returns(T.nilable(T::Array[String])) }
       def create_default_dependencies_label_if_required

data/lib/dependabot/pull_request_creator/message_builder/issue_linker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -53,19 +54,37 @@ module Dependabot
                      &.fetch("repo", nil)
 
               source = if repo
-                         "https://github.com/#{repo}"
+                         "#{qualified_reference_base_url}/#{repo}"
                        elsif source_url
                          source_url
                        end
 
               if source
-                "[#{repo ? (repo + tag) : tag}](#{source}/issues/#{number})"
+                "[#{repo ? (repo + tag) : tag}](#{source}#{issue_path(source)}/#{number})"
               else
                 issue_link
               end
             end
           end
         end
+
+        private
+
+        sig { params(source: String).returns(String) }
+        def issue_path(source)
+          URI.parse(source).host&.downcase == "gitlab.com" ? "/-/work_items" : "/issues"
+        rescue URI::InvalidURIError
+          "/issues"
+        end
+
+        sig { returns(String) }
+        def qualified_reference_base_url
+          return "https://github.com" unless source_url
+
+          URI.parse(T.must(source_url)).host&.downcase == "gitlab.com" ? "https://gitlab.com" : "https://github.com"
+        rescue URI::InvalidURIError
+          "https://github.com"
+        end
       end
     end
   end

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -4,6 +4,7 @@
 require "commonmarker"
 require "sorbet-runtime"
 require "strscan"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -13,6 +14,9 @@ module Dependabot
         extend T::Sig
 
         GITHUB_USERNAME = /[a-z0-9]+(-[a-z0-9]+)*/i
+        GITLAB_USERNAME = /[a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?/i
+        GITHUB_HOST = "github.com"
+        GITLAB_HOST = "gitlab.com"
         GITHUB_REF_REGEX = %r{
           (?:https?://)?
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
@@ -20,9 +24,6 @@ module Dependabot
         }x
         # [^/\s#]+ means one or more characters not matching (^) the class /, whitespace (\s), or #
         GITHUB_NWO_REGEX = %r{(?<repo>#{GITHUB_USERNAME}/[^/\s#]+)#(?<number>\d+)}
-        MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}
-        # regex to match a team mention on github
-        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}
         # End of string
         EOS_REGEX = /\z/
 
@@ -49,9 +50,18 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :github_redirection_service
 
-        sig { params(github_redirection_service: T.nilable(String)).void }
-        def initialize(github_redirection_service:)
+        sig { returns(T.nilable(String)) }
+        attr_reader :metadata_source_url
+
+        sig do
+          params(
+            github_redirection_service: T.nilable(String),
+            metadata_source_url: T.nilable(String)
+          ).void
+        end
+        def initialize(github_redirection_service:, metadata_source_url: nil)
           @github_redirection_service = github_redirection_service
+          @metadata_source_url = metadata_source_url
         end
 
         sig { params(text: String, unsafe: T::Boolean, format_html: T::Boolean).returns(String) }
@@ -90,7 +100,7 @@ module Dependabot
         def sanitize_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(MENTION_REGEX)
+               node.string_content.match?(mention_regex)
               nodes = if parent_node_link?(node)
                         build_mention_link_text_nodes(node.string_content)
                       else
@@ -111,10 +121,10 @@ module Dependabot
         def sanitize_team_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(TEAM_MENTION_REGEX)
+               node.string_content.match?(team_mention_regex)
               if parent_node_link?(node)
                 # Preserve text node formatting while preventing notifications with zero-width space
-                node.string_content = node.string_content.gsub(TEAM_MENTION_REGEX) do |match|
+                node.string_content = node.string_content.gsub(team_mention_regex) do |match|
                   insert_zero_width_space_in_mention(match)
                 end
               else
@@ -189,9 +199,9 @@ module Dependabot
           scan = StringScanner.new(text)
 
           until scan.eos?
-            line = scan.scan_until(MENTION_REGEX) ||
+            line = scan.scan_until(mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(MENTION_REGEX)
+            line_match = T.must(line).match(mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -199,7 +209,7 @@ module Dependabot
               text_node.string_content = line_match.pre_match
               nodes << text_node
               nodes << create_link_node(
-                "https://github.com/#{mention.tr('@', '')}", mention.to_s
+                "#{mention_profile_base_url}/#{mention.delete_prefix('@')}", mention.to_s
               )
             else
               text_node.string_content = line
@@ -216,9 +226,9 @@ module Dependabot
 
           scan = StringScanner.new(text)
           until scan.eos?
-            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+            line = scan.scan_until(team_mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(TEAM_MENTION_REGEX)
+            line_match = T.must(line).match(team_mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -235,6 +245,36 @@ module Dependabot
           nodes
         end
 
+        sig { returns(Regexp) }
+        def mention_regex
+          %r{(?<![A-Za-z0-9`~])@#{mention_username_regex}/?}
+        end
+
+        sig { returns(Regexp) }
+        def team_mention_regex
+          username_regex = mention_username_regex
+          %r{(?<![A-Za-z0-9`~])@(?<org>#{username_regex})/(?<team>#{username_regex})/?}
+        end
+
+        sig { returns(Regexp) }
+        def mention_username_regex
+          metadata_source_host == GITLAB_HOST ? GITLAB_USERNAME : GITHUB_USERNAME
+        end
+
+        sig { returns(String) }
+        def mention_profile_base_url
+          "https://#{metadata_source_host == GITLAB_HOST ? GITLAB_HOST : GITHUB_HOST}"
+        end
+
+        sig { returns(T.nilable(String)) }
+        def metadata_source_host
+          return unless metadata_source_url
+
+          URI.parse(T.must(metadata_source_url)).host&.downcase
+        rescue URI::InvalidURIError
+          nil
+        end
+
         sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_mention_link_text_nodes(text)
           code_node = Commonmarker::Node.new(:code)

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -85,13 +85,11 @@ module Dependabot
         def vulnerabilities_cascade
           return "" unless vulnerabilities_fixed&.any?
 
-          msg = ""
-          T.must(vulnerabilities_fixed).each do |v|
-            msg += serialized_vulnerability_details(v)
+          msg = T.must(vulnerabilities_fixed).map do |vulnerability|
+            details = sanitize_template_tags(serialized_vulnerability_details(vulnerability))
+            sanitize_links_and_mentions(details, metadata_source_url: vulnerability["source_url"])
           end
-
-          msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = msg.join
 
           build_details_tag(summary: "Vulnerabilities fixed", body: msg)
         end
@@ -109,7 +107,7 @@ module Dependabot
             base_url: source_url + "/blob/HEAD/"
           )
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: releases_url)
 
           build_details_tag(summary: "Release notes", body: msg)
         end
@@ -125,7 +123,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: changelog_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: changelog_url)
 
           build_details_tag(summary: "Changelog", body: msg)
         end
@@ -141,7 +139,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: upgrade_guide_url)
 
           build_details_tag(summary: "Upgrade guide", body: msg)
         end
@@ -170,7 +168,7 @@ module Dependabot
               "- See full diff in [compare view](#{commits_url})\n"
             end
           msg = link_issues(text: msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: commits_url)
 
           build_details_tag(summary: "Commits", body: msg)
         end
@@ -317,10 +315,19 @@ module Dependabot
           !%w(bitbucket codecommit).include?(source.provider)
         end
 
-        sig { params(text: String, unsafe: T::Boolean).returns(String) }
-        def sanitize_links_and_mentions(text, unsafe: false)
+        sig do
+          params(
+            text: String,
+            unsafe: T::Boolean,
+            metadata_source_url: T.nilable(String)
+          ).returns(String)
+        end
+        def sanitize_links_and_mentions(text, unsafe: false, metadata_source_url: source_url)
           LinkAndMentionSanitizer
-            .new(github_redirection_service: github_redirection_service)
+            .new(
+              github_redirection_service: github_redirection_service,
+              metadata_source_url: metadata_source_url
+            )
             .sanitize_links_and_mentions(text: text, unsafe: unsafe, format_html: source_provider_supports_html?)
         end
 

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -636,14 +636,14 @@ module Dependabot
       def updating_a_property?
         T.must(dependencies.first)
          .requirements
-         .any? { |r| r.dig(:metadata, :property_name) }
+         .any? { |r| r.metadata_string("property_name") }
       end
 
       sig { returns(T::Boolean) }
       def updating_a_dependency_set?
         T.must(dependencies.first)
          .requirements
-         .any? { |r| r.dig(:metadata, :dependency_set) }
+         .any? { |r| r.metadata_string_hash("dependency_set") }
       end
 
       sig { returns(T::Boolean) }
@@ -663,8 +663,8 @@ module Dependabot
           T.let(
             dependencies.first
               &.requirements
-              &.find { |r| r.dig(:metadata, :property_name) }
-              &.dig(:metadata, :property_name),
+              &.find { |r| r.metadata_string("property_name") }
+              &.metadata_string("property_name"),
             T.nilable(String)
           )
 
@@ -679,9 +679,9 @@ module Dependabot
           T.let(
             dependencies.first
               &.requirements
-              &.find { |r| r.dig(:metadata, :dependency_set) }
-              &.dig(:metadata, :dependency_set),
-            T.nilable(T.nilable(T::Hash[Symbol, String]))
+              &.find { |r| r.metadata_string_hash("dependency_set") }
+              &.metadata_string_hash("dependency_set"),
+            T.nilable(T::Hash[Symbol, String])
           )
 
         raise "No dependency set!" unless @dependency_set
@@ -910,10 +910,10 @@ module Dependabot
           T.must(dependency.previous_requirements) - dependency.requirements
 
         gemspec =
-          old_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-        return gemspec.fetch(:requirement) if gemspec
+          old_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+        return gemspec.requirement_string if gemspec
 
-        req = T.must(old_reqs.first).fetch(:requirement)
+        req = T.must(old_reqs.first).requirement_string
         return req if req
 
         dependency.previous_ref if dependency.ref_changed?
@@ -925,10 +925,10 @@ module Dependabot
           dependency.requirements - T.must(dependency.previous_requirements)
 
         gemspec =
-          updated_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-        return gemspec.fetch(:requirement) if gemspec
+          updated_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+        return T.must(gemspec.requirement_string) if gemspec
 
-        req = T.must(updated_reqs.first).fetch(:requirement)
+        req = T.must(updated_reqs.first).requirement_string
         return req if req
         return T.must(dependency.new_ref) if dependency.ref_changed? && dependency.new_ref
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -16,23 +16,16 @@ module Dependabot
     class PrNamePrefixer # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
-      ANGULAR_PREFIXES = T.let(
-        %w(build chore ci docs feat fix perf refactor style test).freeze,
-        T::Array[String]
-      )
-      ESLINT_PREFIXES = T.let(
-        %w(Breaking Build Chore Docs Fix New Update Upgrade).freeze,
-        T::Array[String]
-      )
-      GITMOJI_PREFIXES = T.let(
-        %w(alien ambulance apple arrow_down arrow_up art beers bento bookmark boom bug building_construction bulb
-           busts_in_silhouette camera_flash card_file_box chart_with_upwards_trend checkered_flag children_crossing
-           clown_face construction construction_worker egg fire globe_with_meridians green_apple green_heart hankey
-           heavy_minus_sign heavy_plus_sign iphone lipstick lock loud_sound memo mute ok_hand package page_facing_up
-           pencil2 penguin pushpin recycle rewind robot rocket rotating_light see_no_evil sparkles speech_balloon tada
-           truck twisted_rightwards_arrows whale wheelchair white_check_mark wrench zap).freeze,
-        T::Array[String]
-      )
+      ANGULAR_PREFIXES = %w(build chore ci docs feat fix perf refactor style test).freeze
+      ESLINT_PREFIXES = %w(Breaking Build Chore Docs Fix New Update Upgrade).freeze
+      GITMOJI_PREFIXES = %w(
+        alien ambulance apple arrow_down arrow_up art beers bento bookmark boom bug building_construction
+        bulb busts_in_silhouette camera_flash card_file_box chart_with_upwards_trend checkered_flag children_crossing
+        clown_face construction construction_worker egg fire globe_with_meridians green_apple green_heart hankey
+        heavy_minus_sign heavy_plus_sign iphone lipstick lock loud_sound memo mute ok_hand package page_facing_up
+        pencil2 penguin pushpin recycle rewind robot rocket rotating_light see_no_evil sparkles speech_balloon tada
+        truck twisted_rightwards_arrows whale wheelchair white_check_mark wrench zap
+      ).freeze
 
       sig do
         params(

data/lib/dependabot/pull_request_updater/github.rb

@@ -70,7 +70,7 @@ module Dependabot
         @pull_request_number = pull_request_number
         @author_details      = author_details
         @signature_key       = signature_key
-        @commit_message      = T.let(commit_message, T.nilable(String))
+        @commit_message      = commit_message
       end
 
       sig { returns(T.nilable(Sawyer::Resource)) }

data/lib/dependabot/shared_helpers.rb

@@ -23,6 +23,8 @@ module Dependabot
   module SharedHelpers # rubocop:disable Metrics/ModuleLength
     extend T::Sig
 
+    Command = T.type_alias { T.any(String, T::Array[String]) }
+    CommandArguments = T.type_alias { T::Array[T.any(String, T::Array[String])] }
     USER_AGENT = T.let(
       "dependabot-core/#{Dependabot::VERSION} " \
       "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} " \
@@ -125,6 +127,26 @@ module Dependabot
       CommandHelpers.escape_command(command)
     end
 
+    sig do
+      params(command: Command, allow_unsafe_shell_command: T::Boolean)
+        .returns([CommandArguments, String])
+    end
+    def self.prepare_command(command, allow_unsafe_shell_command:)
+      unless command.is_a?(Array)
+        prepared_command = allow_unsafe_shell_command ? command : escape_command(command)
+        return [[prepared_command], prepared_command]
+      end
+
+      raise ArgumentError, "command must not be empty" if command.empty?
+      if allow_unsafe_shell_command
+        raise ArgumentError, "allow_unsafe_shell_command cannot be used with an argument vector"
+      end
+
+      executable = T.must(command.first)
+      [[[executable, executable], *command.drop(1)], Shellwords.join(command)]
+    end
+    private_class_method :prepare_command
+
     # rubocop:disable Metrics/MethodLength
     # rubocop:disable Metrics/AbcSize
     sig do
@@ -461,10 +483,9 @@ module Dependabot
       safe_directories
     end
 
-    # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
-        command: String,
+        command: Command,
         allow_unsafe_shell_command: T::Boolean,
         cwd: T.nilable(String),
         env: T.nilable(T::Hash[String, String]),
@@ -485,14 +506,17 @@ module Dependabot
       output_observer: nil
     )
       start = Time.now
-      cmd = allow_unsafe_shell_command ? command : escape_command(command)
+      command_args, command_for_output = prepare_command(
+        command,
+        allow_unsafe_shell_command: allow_unsafe_shell_command
+      )
 
-      puts cmd if ENV["DEBUG_HELPERS"] == "true"
+      puts command_for_output if ENV["DEBUG_HELPERS"] == "true"
 
       opts = {}
       opts[:chdir] = cwd if cwd
 
-      env_cmd = [env || {}, cmd, opts].compact
+      env_cmd = [env || {}, *command_args, opts].compact
       kwargs = {
         stderr_to_stdout: stderr_to_stdout,
         timeout: timeout
@@ -511,7 +535,7 @@ module Dependabot
       return stdout || "" if process&.success?
 
       error_context = {
-        command: cmd,
+        command: command_for_output,
         fingerprint: fingerprint,
         time_taken: time_taken,
         process_exit_value: process.to_s
@@ -524,7 +548,6 @@ module Dependabot
         error_context: error_context
       )
     end
-    # rubocop:enable Metrics/PerceivedComplexity
 
     sig { params(stderr: T.nilable(String), error_context: T::Hash[Symbol, String]).void }
     def self.check_out_of_disk_memory_error(stderr, error_context)

data/lib/dependabot/source.rb

@@ -63,10 +63,7 @@ module Dependabot
       (?:#{CODECOMMIT_SOURCE})
     /x
 
-    IGNORED_PROVIDER_HOSTS = T.let(
-      %w(gitbox.apache.org svn.apache.org fuchsia.googlesource.com).freeze,
-      T::Array[String]
-    )
+    IGNORED_PROVIDER_HOSTS = %w(gitbox.apache.org svn.apache.org fuchsia.googlesource.com).freeze
 
     sig { returns(String) }
     attr_accessor :provider