dependabot-common 0.238.0 → 0.239.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77312fe42bc6241de9c474fa2a1bab0dd3955bff4c2846bc057e52684f1b48bf
-  data.tar.gz: 72fbe948d041e0d1e2fd717fa98a2358e32413408ed2d147d6cbd58107d8d5ba
+  metadata.gz: 05ce845694a06ef06ec108aada0ff902b7b08a7a8fc41c23531e00b2252436ae
+  data.tar.gz: 72cc39025cf3a411bed2f82d113474dae965e57c06b15d1abe78f93794562c8c
 SHA512:
-  metadata.gz: f108dbeb6f04a42d5b5b4e30baecad3d376bd82615e067b3ca2696bbdcefd875c55c4dd18da926b597641691e47edb034244d4d170030cbf8055d3c29e9de3cf
-  data.tar.gz: e14a429b7dadcd27eccd9e049fb6ebd4a405e8e86229eb683c47d1cb72e911a0da4ae3cab50a3a883000f49ef19e33716cfc2a1fd17181d89858da9644ff80e2
+  metadata.gz: ee1859d83b60cf7ddeab1b98c04666198da262a86c5875ed6ff586c9637c877075d9687b3657f38e0bcbf5669584d545a790a2c68e82e9499e5c30b4353d9890
+  data.tar.gz: c4f99509fbd5846a9d07caa227cc67152933da70bea50246c1d6fe20ab9fc67cbb6d141753b89a4b7ed08bf9a73e4520a3c738fa33f4169ea5a19225db9698c6

data/lib/dependabot/config/file.rb

@@ -13,19 +13,19 @@ module Dependabot
       sig { returns(T::Array[T::Hash[Symbol, String]]) }
       attr_reader :updates
 
-      sig { returns T::Array[T.untyped] }
+      sig { returns(T::Hash[Symbol, T::Hash[Symbol, String]]) }
       attr_reader :registries
 
       sig do
         params(
           updates: T.nilable(T::Array[T::Hash[Symbol, String]]),
-          registries: T.nilable(T::Array[T.untyped])
+          registries: T.nilable(T::Hash[Symbol, T::Hash[Symbol, String]])
         )
           .void
       end
       def initialize(updates:, registries: nil)
         @updates = T.let(updates || [], T::Array[T::Hash[Symbol, String]])
-        @registries = T.let(registries || [], T::Array[T.untyped])
+        @registries = T.let(registries || {}, T::Hash[Symbol, T::Hash[Symbol, String]])
       end
 
       sig do

data/lib/dependabot/errors.rb

@@ -1,11 +1,14 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
 require "dependabot/utils"
 
 module Dependabot
+  extend T::Sig
+
   # rubocop:disable Metrics/MethodLength
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.fetcher_error_details(error)
     case error
     when Dependabot::ToolVersionNotSupported
@@ -70,12 +73,13 @@ module Dependabot
       {
         "error-type": "octokit_rate_limited",
         "error-detail": {
-          "rate-limit-reset": error.response_headers["X-RateLimit-Reset"]
+          "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
     end
   end
 
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.parser_error_details(error)
     case error
     when Dependabot::DependencyFileNotEvaluatable
@@ -136,6 +140,7 @@ module Dependabot
     end
   end
 
+  sig { params(error: StandardError).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
   def self.updater_error_details(error)
     case error
     when Dependabot::DependencyFileNotResolvable
@@ -207,7 +212,7 @@ module Dependabot
       {
         "error-type": "octokit_rate_limited",
         "error-detail": {
-          "rate-limit-reset": error.response_headers["X-RateLimit-Reset"]
+          "rate-limit-reset": T.cast(error, Octokit::Error).response_headers["X-RateLimit-Reset"]
         }
       }
     end
@@ -376,23 +381,28 @@ module Dependabot
   class DependencyFileNotFound < DependabotError
     extend T::Sig
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     attr_reader :file_path
 
+    sig { params(file_path: T.nilable(String), msg: T.nilable(String)).void }
     def initialize(file_path, msg = nil)
       @file_path = file_path
       super(msg || "#{file_path} not found")
     end
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     def file_name
-      T.must(file_path.split("/").last)
+      return unless file_path
+
+      T.must(file_path).split("/").last
     end
 
-    sig { returns(String) }
+    sig { returns(T.nilable(String)) }
     def directory
       # Directory should always start with a `/`
-      T.must(file_path.split("/")[0..-2]).join("/").sub(%r{^/*}, "/")
+      return unless file_path
+
+      T.must(T.must(file_path).split("/")[0..-2]).join("/").sub(%r{^/*}, "/")
     end
   end
 
@@ -434,8 +444,9 @@ module Dependabot
     sig { returns(String) }
     attr_reader :source
 
+    sig { params(source: T.nilable(String)).void }
     def initialize(source)
-      @source = T.let(sanitize_source(source), String)
+      @source = T.let(sanitize_source(T.must(source)), String)
       msg = "The following source could not be reached as it requires " \
             "authentication (and any provided details were invalid or lacked " \
             "the required permissions): #{@source}"

data/lib/dependabot/experiments.rb

@@ -1,18 +1,25 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Experiments
-    @experiments = {}
+    extend T::Sig
+
+    @experiments = T.let({}, T::Hash[T.any(String, Symbol), T.untyped])
 
+    sig { returns(T::Hash[T.any(String, Symbol), T.untyped]) }
     def self.reset!
       @experiments = {}
     end
 
+    sig { params(name: T.any(String, Symbol), value: T.untyped).void }
     def self.register(name, value)
       @experiments[name.to_sym] = value
     end
 
+    sig { params(name: T.any(String, Symbol)).returns(T::Boolean) }
     def self.enabled?(name)
       !!@experiments[name.to_sym]
     end

data/lib/dependabot/metadata_finders.rb

@@ -1,10 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+require "dependabot/metadata_finders/base"
+
 module Dependabot
   module MetadataFinders
-    @metadata_finders = {}
+    extend T::Sig
+
+    @metadata_finders = T.let({}, T::Hash[String, T.class_of(Dependabot::MetadataFinders::Base)])
 
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::MetadataFinders::Base)) }
     def self.for_package_manager(package_manager)
       metadata_finder = @metadata_finders[package_manager]
       return metadata_finder if metadata_finder
@@ -12,6 +18,7 @@ module Dependabot
       raise "Unsupported package_manager #{package_manager}"
     end
 
+    sig { params(package_manager: String, metadata_finder: T.class_of(Dependabot::MetadataFinders::Base)).void }
     def self.register(package_manager, metadata_finder)
       @metadata_finders[package_manager] = metadata_finder
     end

data/lib/dependabot/pull_request_creator/branch_namer/base.rb

@@ -1,12 +1,43 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   class PullRequestCreator
     class BranchNamer
       class Base
-        attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length
+        extend T::Sig
+
+        sig { returns(T::Array[Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[DependencyFile]) }
+        attr_reader :files
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_branch
 
+        sig { returns(String) }
+        attr_reader :separator
+
+        sig { returns(String) }
+        attr_reader :prefix
+
+        sig { returns(T.nilable(Integer)) }
+        attr_reader :max_length
+
+        sig do
+          params(
+            dependencies: T::Array[Dependency],
+            files: T::Array[DependencyFile],
+            target_branch: T.nilable(String),
+            separator: String,
+            prefix: String,
+            max_length: T.nilable(Integer)
+          )
+            .void
+        end
         def initialize(dependencies:, files:, target_branch:, separator: "/",
                        prefix: "dependabot", max_length: nil)
           @dependencies  = dependencies
@@ -19,6 +50,7 @@ module Dependabot
 
         private
 
+        sig { params(ref_name: String).returns(String) }
         def sanitize_branch_name(ref_name)
           # General git ref validation
           sanitized_name = sanitize_ref(ref_name)
@@ -27,14 +59,15 @@ module Dependabot
           sanitized_name = sanitized_name.gsub("/", separator)
 
           # Shorten the ref in case users refs have length limits
-          if max_length && (sanitized_name.length > max_length)
-            sha = Digest::SHA1.hexdigest(sanitized_name)[0, max_length]
-            sanitized_name[[max_length - sha.size, 0].max..] = sha
+          if max_length && (sanitized_name.length > T.must(max_length))
+            sha = T.must(Digest::SHA1.hexdigest(sanitized_name)[0, T.must(max_length)])
+            sanitized_name[[T.must(max_length) - sha.size, 0].max..] = sha
           end
 
           sanitized_name
         end
 
+        sig { params(ref: String).returns(String) }
         def sanitize_ref(ref)
           # This isn't a complete implementation of git's ref validation, but it
           # covers most cases that crop up. Its list of allowed characters is a

data/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb

@@ -8,17 +8,18 @@ module Dependabot
     class BranchNamer
       class DependencyGroupStrategy < Base
         def initialize(dependencies:, files:, target_branch:, dependency_group:,
-                       separator: "/", prefix: "dependabot", max_length: nil)
+                       separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes:)
           super(
             dependencies: dependencies,
             files: files,
             target_branch: target_branch,
             separator: separator,
             prefix: prefix,
-            max_length: max_length
+            max_length: max_length,
           )
 
           @dependency_group = dependency_group
+          @includes_security_fixes = includes_security_fixes
         end
 
         def new_branch_name
@@ -45,7 +46,11 @@ module Dependabot
         # Let's append a short hash digest of the dependency changes so that we can
         # meet this guarantee.
         def group_name_with_dependency_digest
-          "#{dependency_group.name}-#{dependency_digest}"
+          if @includes_security_fixes
+            "group-security-#{package_manager}-#{dependency_digest}"
+          else
+            "#{dependency_group.name}-#{dependency_digest}"
+          end
         end
 
         def dependency_digest
@@ -55,11 +60,11 @@ module Dependabot
         end
 
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
         def directory
-          files.first.directory.tr(" ", "-")
+          T.must(files.first).directory.tr(" ", "-")
         end
       end
     end

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -38,31 +38,31 @@ module Dependabot
           [
             prefix,
             package_manager,
-            files.first.directory.tr(" ", "-"),
+            T.must(files.first).directory.tr(" ", "-"),
             target_branch
           ].compact
         end
 
         def package_manager
-          dependencies.first.package_manager
+          T.must(dependencies.first).package_manager
         end
 
         def updating_a_property?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :property_name) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :property_name) }
         end
 
         def updating_a_dependency_set?
-          dependencies.first
-                      .requirements
-                      .any? { |r| r.dig(:metadata, :dependency_set) }
+          T.must(dependencies.first)
+           .requirements
+           .any? { |r| r.dig(:metadata, :dependency_set) }
         end
 
         def property_name
-          @property_name ||= dependencies.first.requirements
-                                         .find { |r| r.dig(:metadata, :property_name) }
-                                         &.dig(:metadata, :property_name)
+          @property_name ||= T.must(dependencies.first).requirements
+                              .find { |r| r.dig(:metadata, :property_name) }
+                              &.dig(:metadata, :property_name)
 
           raise "No property name!" unless @property_name
 
@@ -70,9 +70,9 @@ module Dependabot
         end
 
         def dependency_set
-          @dependency_set ||= dependencies.first.requirements
-                                          .find { |r| r.dig(:metadata, :dependency_set) }
-                                          &.dig(:metadata, :dependency_set)
+          @dependency_set ||= T.must(dependencies.first).requirements
+                               .find { |r| r.dig(:metadata, :dependency_set) }
+                               &.dig(:metadata, :dependency_set)
 
           raise "No dependency set!" unless @dependency_set
 
@@ -82,7 +82,7 @@ module Dependabot
         def branch_version_suffix
           dep = dependencies.first
 
-          if dep.removed?
+          if T.must(dep).removed?
             "-removed"
           elsif library? && ref_changed?(dep) && new_ref(dep)
             new_ref(dep)

data/lib/dependabot/pull_request_creator/branch_namer.rb

@@ -11,10 +11,11 @@ require "dependabot/pull_request_creator/branch_namer/dependency_group_strategy"
 module Dependabot
   class PullRequestCreator
     class BranchNamer
-      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group
+      attr_reader :dependencies, :files, :target_branch, :separator, :prefix, :max_length, :dependency_group,
+                  :includes_security_fixes
 
       def initialize(dependencies:, files:, target_branch:, dependency_group: nil,
-                     separator: "/", prefix: "dependabot", max_length: nil)
+                     separator: "/", prefix: "dependabot", max_length: nil, includes_security_fixes: false)
         @dependencies  = dependencies
         @files         = files
         @target_branch = target_branch
@@ -22,6 +23,7 @@ module Dependabot
         @separator     = separator
         @prefix        = prefix
         @max_length    = max_length
+        @includes_security_fixes = includes_security_fixes
       end
 
       def new_branch_name
@@ -49,7 +51,8 @@ module Dependabot
               dependency_group: dependency_group,
               separator: separator,
               prefix: prefix,
-              max_length: max_length
+              max_length: max_length,
+              includes_security_fixes: includes_security_fixes
             )
           end
       end

data/lib/dependabot/pull_request_creator/github.rb

@@ -210,7 +210,7 @@ module Dependabot
 
             {
               path: file.realpath,
-              mode: (file.mode || Dependabot::DependencyFile::Mode::FILE),
+              mode: file.mode || Dependabot::DependencyFile::Mode::FILE,
               type: "blob"
             }.merge(content)
           end

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -148,7 +148,6 @@ module Dependabot
         end
 
         def build_details_tag(summary:, body:)
-          # Azure DevOps does not support <details> tag (https://developercommunity.visualstudio.com/content/problem/608769/add-support-for-in-markdown.html)
           # Bitbucket does not support <details> tag (https://jira.atlassian.com/browse/BCLOUD-20231)
           # CodeCommit does not support the <details> tag (no url available)
           if source_provider_supports_html?
@@ -244,7 +243,7 @@ module Dependabot
         end
 
         def source_provider_supports_html?
-          !%w(azure bitbucket codecommit).include?(source.provider)
+          !%w(bitbucket codecommit).include?(source.provider)
         end
 
         def sanitize_links_and_mentions(text, unsafe: false)

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -492,7 +492,7 @@ module Dependabot
       end
 
       def metadata_links
-        return metadata_links_for_dep(dependencies.first) if dependencies.count == 1
+        return metadata_links_for_dep(dependencies.first) if dependencies.count == 1 && dependency_group.nil?
 
         dependencies.map do |dep|
           if dep.removed?

data/lib/dependabot/pull_request_creator.rb

@@ -266,7 +266,8 @@ module Dependabot
           dependency_group: dependency_group,
           separator: branch_name_separator,
           prefix: branch_name_prefix,
-          max_length: branch_name_max_length
+          max_length: branch_name_max_length,
+          includes_security_fixes: includes_security_fixes?
         )
     end
 

data/lib/dependabot/requirement.rb

@@ -0,0 +1,20 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  class Requirement < Gem::Requirement
+    extend T::Sig
+    extend T::Helpers
+
+    abstract!
+
+    sig do
+      abstract
+        .params(requirement_string: T.nilable(String))
+        .returns(T::Array[Requirement])
+    end
+    def self.requirements_array(requirement_string); end
+  end
+end

data/lib/dependabot/utils.rb

@@ -4,6 +4,8 @@
 require "tmpdir"
 require "set"
 require "sorbet-runtime"
+
+require "dependabot/requirement"
 require "dependabot/version"
 require "dependabot/config/file"
 
@@ -33,9 +35,9 @@ module Dependabot
       @version_classes[package_manager] = version_class
     end
 
-    @requirement_classes = T.let({}, T::Hash[String, T.class_of(Gem::Requirement)])
+    @requirement_classes = T.let({}, T::Hash[String, T.class_of(Dependabot::Requirement)])
 
-    sig { params(package_manager: String).returns(T.class_of(Gem::Requirement)) }
+    sig { params(package_manager: String).returns(T.class_of(Dependabot::Requirement)) }
     def self.requirement_class_for_package_manager(package_manager)
       requirement_class = @requirement_classes[package_manager]
       return requirement_class if requirement_class
@@ -43,7 +45,7 @@ module Dependabot
       raise "Unregistered package_manager #{package_manager}"
     end
 
-    sig { params(package_manager: String, requirement_class: T.class_of(Gem::Requirement)).void }
+    sig { params(package_manager: String, requirement_class: T.class_of(Dependabot::Requirement)).void }
     def self.register_requirement_class(package_manager, requirement_class)
       validate_package_manager!(package_manager)
 

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.238.0"
+  VERSION = "0.239.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.238.0
+  version: 0.239.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-07 00:00:00.000000000 Z
+date: 2023-12-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -374,14 +374,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.57.2
+        version: 1.58.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -537,6 +537,7 @@ files:
 - lib/dependabot/pull_request_updater/github.rb
 - lib/dependabot/pull_request_updater/gitlab.rb
 - lib/dependabot/registry_client.rb
+- lib/dependabot/requirement.rb
 - lib/dependabot/security_advisory.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/simple_instrumentor.rb
@@ -557,7 +558,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.238.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
 post_install_message: 
 rdoc_options: []
 require_paths: