dependabot-common 0.391.0 → 0.393.0

data/lib/dependabot/pull_request_updater/github.rb

@@ -1,10 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "octokit"
 require "sorbet-runtime"
 
 require "dependabot/clients/github_with_retries"
+require "dependabot/clients/github_resource_parser"
 require "dependabot/pull_request_creator/commit_signer"
 require "dependabot/pull_request_updater"
 
@@ -12,6 +13,7 @@ module Dependabot
   class PullRequestUpdater
     class Github
       extend T::Sig
+      include Dependabot::Clients::GithubResourceParser
 
       sig { returns(Dependabot::Source) }
       attr_reader :source
@@ -31,7 +33,7 @@ module Dependabot
       sig { returns(Integer) }
       attr_reader :pull_request_number
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, String])) }
       attr_reader :author_details
 
       sig { returns(T.nilable(String)) }
@@ -45,7 +47,7 @@ module Dependabot
           files: T::Array[Dependabot::DependencyFile],
           credentials: T::Array[Dependabot::Credential],
           pull_request_number: Integer,
-          author_details: T.nilable(T::Hash[Symbol, T.untyped]),
+          author_details: T.nilable(T::Hash[Symbol, String]),
           signature_key: T.nilable(String),
           commit_message: T.nilable(String)
         )
@@ -76,7 +78,7 @@ module Dependabot
       sig { returns(T.nilable(Sawyer::Resource)) }
       def update
         return unless pull_request_exists?
-        return unless branch_exists?(pull_request.head.ref)
+        return unless branch_exists?(github_string(github_resource(pull_request, :head, "pull request"), :ref, "head"))
 
         commit = create_commit
         branch = update_branch(commit)
@@ -88,8 +90,10 @@ module Dependabot
 
       sig { void }
       def update_pull_request_target_branch
-        target_branch = source.branch || pull_request.base.repo.default_branch
-        return if target_branch == pull_request.base.ref
+        base = github_resource(pull_request, :base, "pull request")
+        base_repo = github_resource(base, :repo, "pull request base")
+        target_branch = source.branch || github_string(base_repo, :default_branch, "base repository")
+        return if target_branch == github_string(base, :ref, "pull request base")
 
         github_client_for_source.update_pull_request(
           source.repo,
@@ -125,6 +129,11 @@ module Dependabot
           )
       end
 
+      sig { returns(String) }
+      def github_response_source
+        source.url
+      end
+
       sig { returns(T::Boolean) }
       def pull_request_exists?
         pull_request
@@ -133,7 +142,7 @@ module Dependabot
         false
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def pull_request
         @pull_request ||=
           T.let(
@@ -141,7 +150,7 @@ module Dependabot
               source.repo,
               pull_request_number
             ),
-            T.untyped
+            T.nilable(Sawyer::Resource)
           )
       end
 
@@ -153,22 +162,24 @@ module Dependabot
         false
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_commit
         tree = create_tree
 
-        options = author_details&.any? ? { author: author_details } : {}
+        options = T.let({}, T::Hash[Symbol, Object])
+        author = author_details&.dup
+        options[:author] = author if author&.any?
 
-        if options[:author]&.any? && signature_key
-          options[:author][:date] = Time.now.utc.iso8601
-          options[:signature] = commit_signature(tree, options[:author])
+        if author&.any? && signature_key
+          author[:date] = Time.now.utc.iso8601
+          options[:signature] = commit_signature(tree, author)
         end
 
         begin
           github_client_for_source.create_commit(
             source.repo,
             commit_message,
-            tree.sha,
+            github_string(tree, :sha, "tree"),
             base_commit,
             options
           )
@@ -186,7 +197,7 @@ module Dependabot
         end
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(Sawyer::Resource) }
       def create_tree
         file_trees = files.map do |file|
           if file.type == "submodule"
@@ -238,12 +249,13 @@ module Dependabot
         T::Array[Regexp]
       )
 
-      sig { params(commit: T.untyped).returns(T.untyped) }
+      sig { params(commit: Sawyer::Resource).returns(T.nilable(Sawyer::Resource)) }
       def update_branch(commit)
+        head = github_resource(pull_request, :head, "pull request")
         github_client_for_source.update_ref(
           source.repo,
-          "heads/" + pull_request.head.ref,
-          commit.sha,
+          "heads/" + github_string(head, :ref, "pull request head"),
+          github_string(commit, :sha, "commit"),
           true
         )
       rescue Octokit::UnprocessableEntity => e
@@ -262,45 +274,43 @@ module Dependabot
         return msg unless msg.nil? || msg.empty?
 
         fallback_message =
-          "#{pull_request.title}" \
+          "#{github_string(pull_request, :title, 'pull request')}" \
           "\n\n" \
           "Dependabot couldn't find the original pull request head commit, " \
           "#{old_commit}."
 
         # Take the commit message from the old commit. If the old commit can't
         # be found, use the PR title as the commit message.
-        commit_being_updated&.message || fallback_message
+        commit = commit_being_updated
+        (commit && github_optional_string(commit, :message, "commit")) || fallback_message
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T.nilable(Sawyer::Resource)) }
       def commit_being_updated
         return @commit_being_updated if defined?(@commit_being_updated)
 
         @commit_being_updated =
           T.let(
-            if pull_request.commits == 1
+            if github_integer(pull_request, :commits, "pull request") == 1
+              head = github_resource(pull_request, :head, "pull request")
               github_client_for_source
-               .git_commit(source.repo, pull_request.head.sha)
+               .git_commit(source.repo, github_string(head, :sha, "pull request head"))
             else
-              commits =
-                T.unsafe(
-                  github_client_for_source
-                                   .pull_request_commits(source.repo, pull_request_number)
-                )
-
-              commit = commits.find { |c| c.sha == old_commit }
-              commit&.commit
+              commits = github_client_for_source.pull_request_commits(source.repo, pull_request_number)
+
+              commit = commits.find { |candidate| github_string(candidate, :sha, "pull request commit") == old_commit }
+              commit && github_resource(commit, :commit, "pull request commit")
             end,
-            T.untyped
+            T.nilable(Sawyer::Resource)
           )
       end
 
-      sig { params(tree: T.untyped, author_details_with_date: T::Hash[Symbol, T.untyped]).returns(String) }
+      sig { params(tree: Sawyer::Resource, author_details_with_date: T::Hash[Symbol, String]).returns(String) }
       def commit_signature(tree, author_details_with_date)
         PullRequestCreator::CommitSigner.new(
           author_details: author_details_with_date,
           commit_message: commit_message,
-          tree_sha: tree.sha,
+          tree_sha: github_string(tree, :sha, "tree"),
           parent_sha: base_commit,
           signature_key: T.must(signature_key)
         ).signature

data/lib/dependabot/pull_request_updater/gitlab.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "gitlab"
@@ -7,6 +7,7 @@ require "sorbet-runtime"
 require "dependabot/clients/gitlab_with_retries"
 require "dependabot/credential"
 require "dependabot/pull_request_creator"
+require "dependabot/errors"
 
 module Dependabot
   class PullRequestUpdater
@@ -67,10 +68,10 @@ module Dependabot
       sig { returns(T.nilable(String)) }
       def update
         return unless merge_request_exists?
-        return unless branch_exists?(merge_request.source_branch)
+        return unless branch_exists?(gitlab_string(merge_request, "source_branch", "merge request"))
 
         create_commit
-        merge_request.source_branch
+        gitlab_string(merge_request, "source_branch", "merge request")
       end
 
       private
@@ -83,14 +84,14 @@ module Dependabot
         false
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(::Gitlab::ObjectifiedHash) }
       def merge_request
         @merge_request ||= T.let(
-          T.unsafe(gitlab_client_for_source).merge_request(
-            target_project_id || source.repo,
+          gitlab_client_for_source.merge_request(
+            (target_project_id || source.repo).to_s,
             pull_request_number
           ),
-          T.untyped
+          T.nilable(::Gitlab::ObjectifiedHash)
         )
       end
 
@@ -113,8 +114,7 @@ module Dependabot
         false
       end
 
-      # TODO: This needs to be typed when the underlying client is
-      sig { returns(T.untyped) }
+      sig { returns(::Gitlab::ObjectifiedHash) }
       def commit_being_updated
         gitlab_client_for_source.commit(source.repo, old_commit)
       end
@@ -123,11 +123,22 @@ module Dependabot
       def create_commit
         gitlab_client_for_source.create_commit(
           source.repo,
-          merge_request.source_branch,
-          commit_being_updated.title,
+          gitlab_string(merge_request, "source_branch", "merge request"),
+          gitlab_string(commit_being_updated, "title", "commit"),
           files,
           force: true,
-          start_branch: merge_request.target_branch
+          start_branch: gitlab_string(merge_request, "target_branch", "merge request")
+        )
+      end
+
+      sig { params(resource: ::Gitlab::ObjectifiedHash, key: String, context: String).returns(String) }
+      def gitlab_string(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(String)
+
+        raise Dependabot::PrivateSourceBadResponse.new(
+          source.url,
+          "Malformed GitLab response: #{context} #{key} must be a string"
         )
       end
     end

data/lib/dependabot/pull_request_updater.rb

@@ -11,6 +11,8 @@ module Dependabot
   class PullRequestUpdater
     extend T::Sig
 
+    UpdateResult = T.type_alias { T.nilable(T.any(Sawyer::Resource, String)) }
+
     class BranchProtected < StandardError; end
 
     sig { returns(Dependabot::Source) }
@@ -82,9 +84,7 @@ module Dependabot
       @provider_metadata   = provider_metadata
     end
 
-    # TODO: Each implementation returns a client-specific type.
-    #       We should standardise this to return a `Dependabot::Branch` type instead.
-    sig { returns(T.untyped) } # rubocop:disable Sorbet/ForbidTUntyped
+    sig { returns(UpdateResult) }
     def update
       case source.provider
       when "github" then github_updater.update

data/lib/dependabot/shared_helpers.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
@@ -23,6 +23,11 @@ module Dependabot
   module SharedHelpers # rubocop:disable Metrics/ModuleLength
     extend T::Sig
 
+    Command = T.type_alias { T.any(String, T::Array[String]) }
+    CommandArguments = T.type_alias { T::Array[T.any(String, T::Array[String])] }
+    ErrorContext = T.type_alias { T::Hash[Symbol, Object] }
+    ExconOptions = T.type_alias { T::Hash[Symbol, Object] }
+    HelperResponse = T.type_alias { T::Hash[String, Object] }
     USER_AGENT = T.let(
       "dependabot-core/#{Dependabot::VERSION} " \
       "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} " \
@@ -91,7 +96,7 @@ module Dependabot
       sig { returns(String) }
       attr_reader :error_class
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
+      sig { returns(ErrorContext) }
       attr_reader :error_context
 
       sig { returns(T.nilable(T::Array[String])) }
@@ -100,7 +105,7 @@ module Dependabot
       sig do
         params(
           message: String,
-          error_context: T::Hash[Symbol, String],
+          error_context: ErrorContext,
           error_class: T.nilable(String),
           trace: T.nilable(T::Array[String])
         ).void
@@ -109,11 +114,12 @@ module Dependabot
         super(message)
         @error_class = T.let(error_class || "HelperSubprocessFailed", String)
         @error_context = error_context
-        @fingerprint = T.let(error_context[:fingerprint] || error_context[:command], T.nilable(String))
+        fingerprint = error_context[:fingerprint] || error_context[:command]
+        @fingerprint = T.let(fingerprint.is_a?(String) ? fingerprint : nil, T.nilable(String))
         @trace = trace
       end
 
-      sig { override.returns(T::Hash[Symbol, T.untyped]) }
+      sig { override.returns(ErrorContext) }
       def sentry_context
         { fingerprint: [@fingerprint], extra: @error_context.except(:stderr_output, :fingerprint) }
       end
@@ -125,20 +131,40 @@ module Dependabot
       CommandHelpers.escape_command(command)
     end
 
+    sig do
+      params(command: Command, allow_unsafe_shell_command: T::Boolean)
+        .returns([CommandArguments, String])
+    end
+    def self.prepare_command(command, allow_unsafe_shell_command:)
+      unless command.is_a?(Array)
+        prepared_command = allow_unsafe_shell_command ? command : escape_command(command)
+        return [[prepared_command], prepared_command]
+      end
+
+      raise ArgumentError, "command must not be empty" if command.empty?
+      if allow_unsafe_shell_command
+        raise ArgumentError, "allow_unsafe_shell_command cannot be used with an argument vector"
+      end
+
+      executable = T.must(command.first)
+      [[[executable, executable], *command.drop(1)], Shellwords.join(command)]
+    end
+    private_class_method :prepare_command
+
     # rubocop:disable Metrics/MethodLength
     # rubocop:disable Metrics/AbcSize
     sig do
       params(
         command: String,
         function: String,
-        args: T.untyped,
+        args: Object,
         env: T.nilable(T::Hash[String, String]),
         stderr_to_stdout: T::Boolean,
         allow_unsafe_shell_command: T::Boolean,
         error_class: T.class_of(HelperSubprocessFailed),
         timeout: Integer
       )
-        .returns(T.untyped)
+        .returns(Object)
     end
     def self.run_helper_subprocess(
       command:,
@@ -151,7 +177,7 @@ module Dependabot
       timeout: CommandHelpers::TIMEOUTS::DEFAULT
     )
       start = Time.now
-      stdin_data = JSON.dump(function: function, args: args)
+      stdin_data = T.cast(JSON.dump(function: function, args: args), String)
       cmd = allow_unsafe_shell_command ? command : escape_command(command)
 
       # NOTE: For debugging native helpers in specs and dry-run: outputs the
@@ -160,7 +186,8 @@ module Dependabot
       if ENV["DEBUG_FUNCTION"] == function
         puts helper_subprocess_bash_command(stdin_data: stdin_data, command: cmd, env: env)
         # Pause execution so we can run helpers inside the temporary directory
-        T.unsafe(self).debugger
+        require "debug"
+        binding.break # rubocop:disable Lint/Debugger
       end
 
       env_cmd = [env, cmd].compact
@@ -199,25 +226,58 @@ module Dependabot
       check_out_of_memory_error(stderr, error_context, error_class)
 
       begin
-        response = JSON.parse(stdout)
+        response = parse_helper_response(stdout)
         return response["result"] if process&.success?
 
+        message, helper_error_class, trace = parse_helper_error(response)
+
         raise error_class.new(
-          message: response["error"],
-          error_class: response["error_class"],
+          message: message,
+          error_class: helper_error_class,
           error_context: error_context,
-          trace: response["trace"]
+          trace: trace
         )
       rescue JSON::ParserError
         raise handle_json_parse_error(stdout, stderr, error_context, error_class)
+      rescue TypeError => e
+        raise error_class.new(
+          message: e.message,
+          error_class: e.class.name,
+          error_context: error_context
+        )
       end
     end
 
+    sig { params(stdout: String).returns(HelperResponse) }
+    def self.parse_helper_response(stdout)
+      T.cast(JSON.parse(stdout), HelperResponse)
+    end
+    private_class_method :parse_helper_response
+
+    sig { params(response: HelperResponse).returns([String, T.nilable(String), T.nilable(T::Array[String])]) }
+    def self.parse_helper_error(response)
+      message = response["error"]
+      raise TypeError, "helper error must be a string" unless message.is_a?(String)
+
+      helper_error_class = response["error_class"]
+      unless helper_error_class.nil? || helper_error_class.is_a?(String)
+        raise TypeError, "helper error class must be a string or nil"
+      end
+
+      trace = response["trace"]
+      unless trace.nil? || (trace.is_a?(Array) && trace.all?(String))
+        raise TypeError, "helper trace must be an array of strings or nil"
+      end
+
+      [message, helper_error_class, T.cast(response["trace"], T.nilable(T::Array[String]))]
+    end
+    private_class_method :parse_helper_error
+
     sig do
       params(
         stdout: String,
         stderr: String,
-        error_context: T::Hash[Symbol, T.untyped],
+        error_context: ErrorContext,
         error_class: T.class_of(HelperSubprocessFailed)
       )
         .returns(HelperSubprocessFailed)
@@ -243,7 +303,7 @@ module Dependabot
     sig do
       params(
         stderr: T.nilable(String),
-        error_context: T::Hash[Symbol, String],
+        error_context: ErrorContext,
         error_class: T.class_of(HelperSubprocessFailed)
       ).void
     end
@@ -272,7 +332,7 @@ module Dependabot
       }.merge(headers)
     end
 
-    sig { params(options: T.nilable(T::Hash[Symbol, T.untyped])).returns(T::Hash[Symbol, T.untyped]) }
+    sig { params(options: T.nilable(ExconOptions)).returns(ExconOptions) }
     def self.excon_defaults(options = nil)
       options ||= {}
       headers = T.cast(options.delete(:headers), T.nilable(T::Hash[String, String]))
@@ -343,7 +403,6 @@ module Dependabot
       File.join(__dir__, "../../bin/git-credential-store-immutable")
     end
 
-    # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
         credentials: T::Array[Dependabot::Credential],
@@ -396,27 +455,35 @@ module Dependabot
                             github_credentials +
                             [github_credential].compact
 
-      # Build the content for our credentials file
-      git_store_content = ""
-      deduped_credentials.each do |cred|
-        next unless cred["type"] == "git_source"
-        next unless cred["host"]
+      File.write(git_store_path, git_store_content(deduped_credentials))
+    end
+    # rubocop:enable Metrics/AbcSize
 
-        has_creds = cred["username"] && cred["password"]
+    sig { params(credentials: T::Array[Credential]).returns(String) }
+    def self.git_store_content(credentials)
+      credentials.each_with_object(+"") do |credential, content|
+        next unless credential["type"] == "git_source"
 
-        # Build authenticated URL with credentials if available
-        creds = has_creds ? "#{cred.fetch('username')}:#{cred.fetch('password')}@" : ""
-        authenticated_url = "https://#{creds}#{cred.fetch('host')}"
+        host = credential["host"]
+        next unless host
 
-        git_store_content += authenticated_url + "\n"
-        configure_git_to_use_https(cred.fetch("host"))
+        content << authenticated_git_url(
+          username: credential["username"],
+          password: credential["password"],
+          host: host
+        ) << "\n"
+        configure_git_to_use_https(host)
       end
+    end
+    private_class_method :git_store_content
 
-      # Save the file
-      File.write(git_store_path, git_store_content)
+    sig { params(username: T.nilable(String), password: T.nilable(String), host: String).returns(String) }
+    def self.authenticated_git_url(username:, password:, host:)
+      credentials = username && password ? "#{username}:#{password}@" : ""
+
+      "https://#{credentials}#{host}"
     end
-    # rubocop:enable Metrics/AbcSize
-    # rubocop:enable Metrics/PerceivedComplexity
+    private_class_method :authenticated_git_url
 
     sig { params(host: String).void }
     def self.configure_git_to_use_https(host)
@@ -461,10 +528,9 @@ module Dependabot
       safe_directories
     end
 
-    # rubocop:disable Metrics/PerceivedComplexity
     sig do
       params(
-        command: String,
+        command: Command,
         allow_unsafe_shell_command: T::Boolean,
         cwd: T.nilable(String),
         env: T.nilable(T::Hash[String, String]),
@@ -485,14 +551,17 @@ module Dependabot
       output_observer: nil
     )
       start = Time.now
-      cmd = allow_unsafe_shell_command ? command : escape_command(command)
+      command_args, command_for_output = prepare_command(
+        command,
+        allow_unsafe_shell_command: allow_unsafe_shell_command
+      )
 
-      puts cmd if ENV["DEBUG_HELPERS"] == "true"
+      puts command_for_output if ENV["DEBUG_HELPERS"] == "true"
 
       opts = {}
       opts[:chdir] = cwd if cwd
 
-      env_cmd = [env || {}, cmd, opts].compact
+      env_cmd = [env || {}, *command_args, opts].compact
       kwargs = {
         stderr_to_stdout: stderr_to_stdout,
         timeout: timeout
@@ -511,7 +580,7 @@ module Dependabot
       return stdout || "" if process&.success?
 
       error_context = {
-        command: cmd,
+        command: command_for_output,
         fingerprint: fingerprint,
         time_taken: time_taken,
         process_exit_value: process.to_s
@@ -524,7 +593,6 @@ module Dependabot
         error_context: error_context
       )
     end
-    # rubocop:enable Metrics/PerceivedComplexity
 
     sig { params(stderr: T.nilable(String), error_context: T::Hash[Symbol, String]).void }
     def self.check_out_of_disk_memory_error(stderr, error_context)

data/lib/dependabot/update_checkers/base.rb

@@ -9,6 +9,7 @@ require "dependabot/security_advisory"
 require "dependabot/utils"
 require "dependabot/package/release_cooldown_options"
 require "dependabot/file_filtering"
+require "dependabot/update_checkers/vulnerability_audit"
 
 module Dependabot
   module UpdateCheckers
@@ -168,16 +169,19 @@ module Dependabot
 
       # Finds any dependencies in the lockfile that have a subdependency on the
       # given dependency that do not satisfy the target_version.
-      # @return [Array<Hash{String => String}]
+      # @return [Array<Hash{String => Object}]
       #   name [String] the blocking dependencies name
       #   version [String] the version of the blocking dependency
       #   requirement [String] the requirement on the target_dependency
-      sig { overridable.returns(T::Array[T::Hash[String, String]]) }
+      sig { overridable.returns(T::Array[Dependabot::UpdateCheckers::Conflict]) }
       def conflicting_dependencies
         [] # return an empty array for ecosystems that don't support this yet
       end
 
-      sig { params(_updated_version: String).returns(T.nilable(String)) }
+      sig do
+        params(_updated_version: T.any(String, Gem::Version))
+          .returns(T.nilable(T.any(String, Gem::Version)))
+      end
       def latest_resolvable_previous_version(_updated_version)
         dependency.version
       end
@@ -253,7 +257,7 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       def updated_dependency_without_unlock
         version = latest_resolvable_version_with_no_unlock.to_s
-        previous_version = latest_resolvable_previous_version(version)
+        previous_version = latest_resolvable_previous_version(version)&.to_s
 
         Dependency.new(
           name: dependency.name,
@@ -270,7 +274,7 @@ module Dependabot
       sig { returns(Dependabot::Dependency) }
       def updated_dependency_with_own_req_unlock
         version = preferred_resolvable_version.to_s
-        previous_version = latest_resolvable_previous_version(version)
+        previous_version = latest_resolvable_previous_version(version)&.to_s
 
         Dependency.new(
           name: dependency.name,

data/lib/dependabot/update_checkers/version_filters.rb

@@ -3,6 +3,7 @@
 
 require "dependabot/security_advisory"
 require "dependabot/package/package_release"
+require "dependabot/git_tag_details"
 require "sorbet-runtime"
 
 module Dependabot
@@ -22,6 +23,7 @@ module Dependabot
               T.any(
                 T.all(T.type_parameter(:T), Gem::Version),
                 T.all(T.type_parameter(:T), T::Hash[Symbol, Gem::Version]),
+                T.all(T.type_parameter(:T), Dependabot::GitTagDetails),
                 T.all(T.type_parameter(:T), Dependabot::Package::PackageRelease)
               )],
             security_advisories: T::Array[SecurityAdvisory]
@@ -35,6 +37,9 @@ module Dependabot
               a.vulnerable?(v)
             elsif v.is_a?(Dependabot::Package::PackageRelease)
               a.vulnerable?(v.version)
+            elsif v.is_a?(Dependabot::GitTagDetails)
+              version = v.version
+              version ? a.vulnerable?(version) : false
             else
               a.vulnerable?(v.fetch(:version))
             end