dependabot-common 0.392.0 → 0.393.0

data/lib/dependabot/update_checkers/vulnerability_audit.rb

@@ -0,0 +1,282 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module UpdateCheckers
+    Conflict = T.type_alias { T::Hash[String, Object] }
+
+    class VulnerabilityAudit < T::ImmutableStruct
+      extend T::Sig
+
+      module ValueParser
+        extend T::Sig
+
+        sig { params(value: Object, context: String).returns(T::Hash[String, Object]) }
+        def self.object_hash(value, context)
+          raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+          result = T.let({}, T::Hash[String, Object])
+          value.each do |raw_key, raw_value|
+            key = T.cast(raw_key, Object)
+            raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+            result[key] = T.cast(raw_value, Object)
+          end
+          result
+        end
+
+        sig { params(hash: T::Hash[String, Object], key: String, context: T.nilable(String)).returns(String) }
+        def self.string(hash, key, context: nil)
+          value = hash[key]
+          return value if value.is_a?(String)
+
+          raise TypeError, "#{field_name(context, key)} must be a string"
+        end
+
+        sig do
+          params(
+            hash: T::Hash[String, Object],
+            key: String,
+            context: T.nilable(String)
+          ).returns(T.nilable(String))
+        end
+        def self.optional_string(hash, key, context: nil)
+          value = hash[key]
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          raise TypeError, "#{field_name(context, key)} must be a string or nil"
+        end
+
+        sig { params(hash: T::Hash[String, Object], key: String, context: T.nilable(String)).returns(T::Boolean) }
+        def self.boolean(hash, key, context: nil)
+          value = hash[key]
+          return value if value == true || value == false
+
+          raise TypeError, "#{field_name(context, key)} must be a boolean"
+        end
+
+        sig { params(value: Object, context: String).returns(T::Array[String]) }
+        def self.string_array(value, context)
+          raise TypeError, "#{context} must be an array" unless value.is_a?(Array)
+
+          value.map do |item|
+            item = T.cast(item, Object)
+            raise TypeError, "#{context} must contain only strings" unless item.is_a?(String)
+
+            item
+          end
+        end
+
+        sig { params(context: T.nilable(String), key: String).returns(String) }
+        def self.field_name(context, key)
+          [context, key].compact.join(" ")
+        end
+        private_class_method :field_name
+      end
+      private_constant :ValueParser
+
+      class FixUpdate < T::ImmutableStruct
+        extend T::Sig
+
+        const :dependency_name, String
+        const :current_version, String
+        const :target_version, T.nilable(String), default: nil
+        const :target_version_provided, T::Boolean, default: false
+        const :top_level_ancestors, T::Array[String], default: []
+        const :top_level_ancestors_provided, T::Boolean, default: false
+
+        sig { params(value: Object).returns(FixUpdate) }
+        def self.from_object(value)
+          hash = ValueParser.object_hash(value, "fix update")
+          target_version_provided = hash.key?("target_version")
+          top_level_ancestors_provided = hash.key?("top_level_ancestors")
+          top_level_ancestors =
+            if top_level_ancestors_provided
+              ValueParser.string_array(hash["top_level_ancestors"], "fix update top_level_ancestors")
+            else
+              []
+            end
+
+          new(
+            dependency_name: ValueParser.string(hash, "dependency_name", context: "fix update"),
+            current_version: ValueParser.string(hash, "current_version", context: "fix update"),
+            target_version: ValueParser.optional_string(hash, "target_version", context: "fix update"),
+            target_version_provided: target_version_provided,
+            top_level_ancestors: top_level_ancestors,
+            top_level_ancestors_provided: top_level_ancestors_provided
+          )
+        end
+
+        sig { returns(T::Boolean) }
+        def target_version_provided?
+          target_version_provided
+        end
+
+        sig { returns(Conflict) }
+        def to_h
+          result = T.let(
+            {
+              "dependency_name" => dependency_name,
+              "current_version" => current_version
+            },
+            Conflict
+          )
+          result["target_version"] = target_version if target_version_provided?
+          result["top_level_ancestors"] = top_level_ancestors if top_level_ancestors_provided
+          result
+        end
+      end
+
+      class BlockingDependency < T::ImmutableStruct
+        extend T::Sig
+
+        const :name, String
+        const :version, String
+        const :requirement, String
+        const :top_level_ancestor, String
+
+        sig { params(value: Object).returns(BlockingDependency) }
+        def self.from_object(value)
+          hash = ValueParser.object_hash(value, "blocking dependency")
+          new(
+            name: ValueParser.string(hash, "name", context: "blocking dependency"),
+            version: ValueParser.string(hash, "version", context: "blocking dependency"),
+            requirement: ValueParser.string(hash, "requirement", context: "blocking dependency"),
+            top_level_ancestor: ValueParser.string(hash, "top_level_ancestor", context: "blocking dependency")
+          )
+        end
+
+        sig { returns(Conflict) }
+        def to_h
+          {
+            "name" => name,
+            "version" => version,
+            "requirement" => requirement,
+            "top_level_ancestor" => top_level_ancestor
+          }
+        end
+      end
+
+      const :dependency_name, String
+      const :current_version, T.nilable(String), default: nil
+      const :current_version_provided, T::Boolean, default: false
+      const :target_version, T.nilable(String), default: nil
+      const :target_version_provided, T::Boolean, default: false
+      const :fix_available, T::Boolean
+      const :fix_updates, T::Array[FixUpdate]
+      const :top_level_ancestors, T::Array[String]
+      const :blocking_dependencies, T.nilable(T::Array[BlockingDependency]), default: nil
+      const :blocking_dependencies_provided, T::Boolean, default: false
+      const :explanation, T.nilable(String), default: nil
+
+      sig { params(value: Object).returns(VulnerabilityAudit) }
+      def self.from_object(value)
+        hash = ValueParser.object_hash(value, "audit result")
+        current_version_provided = hash.key?("current_version")
+        target_version_provided = hash.key?("target_version")
+        blocking_dependencies_provided = hash.key?("blocking_dependencies")
+
+        new(
+          dependency_name: ValueParser.string(hash, "dependency_name"),
+          current_version: ValueParser.optional_string(hash, "current_version"),
+          current_version_provided: current_version_provided,
+          target_version: ValueParser.optional_string(hash, "target_version"),
+          target_version_provided: target_version_provided,
+          fix_available: ValueParser.boolean(hash, "fix_available"),
+          fix_updates: parse_fix_updates(hash["fix_updates"]),
+          top_level_ancestors: ValueParser.string_array(hash["top_level_ancestors"], "top_level_ancestors"),
+          blocking_dependencies: parse_blocking_dependencies(hash["blocking_dependencies"]),
+          blocking_dependencies_provided: blocking_dependencies_provided
+        )
+      end
+
+      sig do
+        params(
+          dependency_name: String,
+          explanation: T.nilable(String),
+          blocking_dependencies: T.nilable(T::Array[BlockingDependency]),
+          blocking_dependencies_provided: T::Boolean
+        ).returns(VulnerabilityAudit)
+      end
+      def self.unavailable(
+        dependency_name:,
+        explanation: nil,
+        blocking_dependencies: nil,
+        blocking_dependencies_provided: false
+      )
+        new(
+          dependency_name: dependency_name,
+          fix_available: false,
+          fix_updates: [],
+          top_level_ancestors: [],
+          blocking_dependencies: blocking_dependencies,
+          blocking_dependencies_provided: blocking_dependencies_provided,
+          explanation: explanation
+        )
+      end
+
+      sig { returns(T::Boolean) }
+      def current_version_provided?
+        current_version_provided
+      end
+
+      sig { returns(T::Boolean) }
+      def target_version_provided?
+        target_version_provided
+      end
+
+      sig { returns(T::Boolean) }
+      def blocking_dependencies_provided?
+        blocking_dependencies_provided
+      end
+
+      sig { params(message: String).returns(VulnerabilityAudit) }
+      def unavailable_with_explanation(message)
+        VulnerabilityAudit.unavailable(
+          dependency_name: dependency_name,
+          explanation: message,
+          blocking_dependencies: blocking_dependencies,
+          blocking_dependencies_provided: blocking_dependencies_provided?
+        )
+      end
+
+      sig { returns(Conflict) }
+      def to_h
+        result = T.let(
+          {
+            "dependency_name" => dependency_name,
+            "fix_available" => fix_available,
+            "fix_updates" => fix_updates.map(&:to_h),
+            "top_level_ancestors" => top_level_ancestors
+          },
+          Conflict
+        )
+        result["current_version"] = current_version if current_version_provided?
+        result["target_version"] = target_version if target_version_provided?
+        result["blocking_dependencies"] = blocking_dependencies&.map(&:to_h) if blocking_dependencies_provided?
+        result["explanation"] = explanation if explanation
+        result
+      end
+
+      sig { params(value: Object).returns(T::Array[FixUpdate]) }
+      def self.parse_fix_updates(value)
+        raise TypeError, "fix_updates must be an array" unless value.is_a?(Array)
+
+        value.map { |update| FixUpdate.from_object(T.cast(update, Object)) }
+      end
+      private_class_method :parse_fix_updates
+
+      sig { params(value: Object).returns(T.nilable(T::Array[BlockingDependency])) }
+      def self.parse_blocking_dependencies(value)
+        return if value.nil?
+        raise TypeError, "blocking_dependencies must be an array or nil" unless value.is_a?(Array)
+
+        value.map { |dependency| BlockingDependency.from_object(T.cast(dependency, Object)) }
+      end
+      private_class_method :parse_blocking_dependencies
+    end
+  end
+end

data/lib/dependabot/workspace/git.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -152,9 +152,40 @@ module Dependabot
         run_shell_command("git clean -fx .")
       end
 
-      sig { params(args: SharedHelpers::Command, kwargs: T.any(T::Boolean, String)).returns(String) }
-      def run_shell_command(*args, **kwargs)
-        Dir.chdir(path) { T.unsafe(SharedHelpers).run_shell_command(*args, **kwargs) }
+      sig do
+        params(
+          command: SharedHelpers::Command,
+          allow_unsafe_shell_command: T::Boolean,
+          cwd: T.nilable(String),
+          env: T.nilable(T::Hash[String, String]),
+          fingerprint: T.nilable(String),
+          stderr_to_stdout: T::Boolean,
+          timeout: Integer,
+          output_observer: CommandHelpers::OutputObserver
+        ).returns(String)
+      end
+      def run_shell_command(
+        command,
+        allow_unsafe_shell_command: false,
+        cwd: nil,
+        env: {},
+        fingerprint: nil,
+        stderr_to_stdout: true,
+        timeout: CommandHelpers::TIMEOUTS::DEFAULT,
+        output_observer: nil
+      )
+        Dir.chdir(path) do
+          SharedHelpers.run_shell_command(
+            command,
+            allow_unsafe_shell_command: allow_unsafe_shell_command,
+            cwd: cwd,
+            env: env,
+            fingerprint: fingerprint,
+            stderr_to_stdout: stderr_to_stdout,
+            timeout: timeout,
+            output_observer: output_observer
+          )
+        end
       end
 
       sig { params(message: String).void }

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.392.0"
+  VERSION = "0.393.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -519,8 +519,10 @@ files:
 - lib/dependabot/clients/bitbucket_with_retries.rb
 - lib/dependabot/clients/codecommit.rb
 - lib/dependabot/clients/github_release.rb
+- lib/dependabot/clients/github_resource_parser.rb
 - lib/dependabot/clients/github_with_retries.rb
 - lib/dependabot/clients/gitlab_with_retries.rb
+- lib/dependabot/clients/json_response_parser.rb
 - lib/dependabot/command_helpers.rb
 - lib/dependabot/config.rb
 - lib/dependabot/config/file.rb
@@ -566,6 +568,7 @@ files:
 - lib/dependabot/metadata_finders/base.rb
 - lib/dependabot/metadata_finders/base/changelog_finder.rb
 - lib/dependabot/metadata_finders/base/changelog_pruner.rb
+- lib/dependabot/metadata_finders/base/commit_response_parser.rb
 - lib/dependabot/metadata_finders/base/commits_finder.rb
 - lib/dependabot/metadata_finders/base/release_finder.rb
 - lib/dependabot/notices.rb
@@ -613,6 +616,7 @@ files:
 - lib/dependabot/update_checkers/base.rb
 - lib/dependabot/update_checkers/cooldown_calculation.rb
 - lib/dependabot/update_checkers/version_filters.rb
+- lib/dependabot/update_checkers/vulnerability_audit.rb
 - lib/dependabot/utils.rb
 - lib/dependabot/version.rb
 - lib/dependabot/workspace.rb
@@ -625,7 +629,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib