dependabot-common 0.241.0 → 0.242.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b381e33a32a95b7956fbcff6abec4736f2f190b4c8ab0eece99a2181037f52e
-  data.tar.gz: 5006821762970d60de1f3682cd1931f9e86cd0d44d8b9d5ec6eb7778a3bf329a
+  metadata.gz: 8b85f6eea900488026cdee04e04dd5b51df99f8bafcff4c83ae83c5dfeb54c63
+  data.tar.gz: 30a4355a110f4be117fd9ece16d437f8a28704e75a7e0a62e4a5a5055c63e0cd
 SHA512:
-  metadata.gz: 4d8272f9614610836187d6a34fc20acd78b0326d8759d633afc7879492f9edffc3189d148e643750f0f47c1fec54071545ff7d2981499f82c8273addb527fc36
-  data.tar.gz: 4248ef1d9c5dce4afad397af2b557e8414a673d48351924255be59d211a0538b6f98ac73ce4f75458168379301be42c0b9a03517266ac6de8d2205346e95a8d3
+  metadata.gz: c928acaa28bf821c081dd80afda5aa16551a09ab031a28ea60241742d23ffeb54186087fca915317d811b88881bbe6ce99f3b343f45d8efd538aee1c9b7524cd
+  data.tar.gz: a2a4d975f4010b24077d4b558f8d1e4806230411b0d98983c58c7df5be2dd41a2e39868c1a346132743de560fdf28a059cbbb5800bae3ac19333008db3504591

data/lib/dependabot/config/file.rb

@@ -61,6 +61,7 @@ module Dependabot
         "bundler" => "bundler",
         "cargo" => "cargo",
         "composer" => "composer",
+        "devcontainer" => "devcontainers",
         "docker" => "docker",
         "elm" => "elm",
         "github-actions" => "github_actions",

data/lib/dependabot/pull_request_creator.rb

@@ -103,7 +103,7 @@ module Dependabot
     sig { returns(T.nilable(T.any(T::Array[String], T::Hash[Symbol, T::Array[Integer]]))) }
     attr_reader :reviewers
 
-    sig { returns(T.nilable(T::Array[String])) }
+    sig { returns(T.nilable(T.any(T::Array[String], T::Array[Integer]))) }
     attr_reader :assignees
 
     sig { returns(T.nilable(String)) }
@@ -150,8 +150,8 @@ module Dependabot
         signature_key: T.nilable(String),
         commit_message_options: T::Hash[Symbol, T.untyped],
         vulnerabilities_fixed: T::Hash[String, String],
-        reviewers: T.nilable(T::Array[String]),
-        assignees: T.nilable(T::Array[String]),
+        reviewers: T.nilable(T.any(T::Array[String], T::Hash[Symbol, T::Array[Integer]])),
+        assignees: T.nilable(T.any(T::Array[String], T::Array[Integer])),
         milestone: T.nilable(String),
         branch_name_separator: String,
         branch_name_prefix: String,

data/lib/dependabot/security_advisory.rb

@@ -1,31 +1,51 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/version"
 
 module Dependabot
   class SecurityAdvisory
-    attr_reader :dependency_name, :package_manager,
-                :vulnerable_versions, :safe_versions,
-                :vulnerable_version_strings
+    extend T::Sig
 
+    sig { returns(String) }
+    attr_reader :dependency_name
+
+    sig { returns(String) }
+    attr_reader :package_manager
+
+    sig { returns(T::Array[Dependabot::Requirement]) }
+    attr_reader :vulnerable_versions
+
+    sig { returns(T::Array[Dependabot::Requirement]) }
+    attr_reader :safe_versions
+
+    sig { returns(T::Array[T.any(String, Dependabot::Requirement)]) }
+    attr_reader :vulnerable_version_strings
+
+    sig do
+      params(
+        dependency_name: String,
+        package_manager: String,
+        vulnerable_versions: T.nilable(T::Array[Dependabot::Requirement]),
+        safe_versions: T.nilable(T::Array[T.any(String, Dependabot::Requirement)])
+      )
+        .void
+    end
     def initialize(dependency_name:, package_manager:,
                    vulnerable_versions: [], safe_versions: [])
       @dependency_name = dependency_name
       @package_manager = package_manager
-      @vulnerable_version_strings = vulnerable_versions || []
-      @vulnerable_versions = []
-      @safe_versions = safe_versions || []
+      @vulnerable_version_strings = T.let(vulnerable_versions || [], T::Array[T.any(String, Dependabot::Requirement)])
+      @vulnerable_versions = T.let([], T::Array[Dependabot::Requirement])
+      @safe_versions = T.let([], T::Array[Dependabot::Requirement])
 
-      convert_string_version_requirements
+      convert_string_version_requirements(vulnerable_version_strings, safe_versions || [])
       check_version_requirements
     end
 
+    sig { params(version: Gem::Version).returns(T::Boolean) }
     def vulnerable?(version)
-      unless version.is_a?(version_class) || version.instance_of?(Gem::Version)
-        raise ArgumentError, "must be a #{version_class}"
-      end
-
       in_safe_range = safe_versions
                       .any? { |r| r.satisfied_by?(version) }
 
@@ -50,9 +70,10 @@ module Dependabot
     #
     # @param dependency [Dependabot::Dependency] Updated dependency
     # @return [Boolean]
+    sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
     def fixed_by?(dependency)
       # Handle case mismatch between the security advisory and parsed name
-      return false unless dependency_name.casecmp(dependency.name).zero?
+      return false unless dependency_name.casecmp(dependency.name)&.zero?
       return false unless package_manager == dependency.package_manager
       # TODO: Support no previous version to the same level as dependency graph
       # and security alerts. We currently ignore dependency updates without a
@@ -61,19 +82,20 @@ module Dependabot
       return false unless version_class.correct?(dependency.previous_version)
 
       # Ignore deps that weren't previously vulnerable
-      return false unless affects_version?(dependency.previous_version)
+      return false unless affects_version?(T.must(dependency.previous_version))
 
       # Removing a dependency is a way to fix the vulnerability
       return true if dependency.removed?
 
       # Select deps that are now fixed
-      !affects_version?(dependency.version)
+      !affects_version?(T.must(dependency.version))
     end
 
     # Check if the version is affected by the advisory
     #
     # @param version [Dependabot::<Package Manager>::Version] version class
     # @return [Boolean]
+    sig { params(version: T.any(String, Gem::Version)).returns(T::Boolean) }
     def affects_version?(version)
       return false unless version_class.correct?(version)
       return false unless [*safe_versions, *vulnerable_versions].any?
@@ -96,7 +118,14 @@ module Dependabot
 
     private
 
-    def convert_string_version_requirements
+    sig do
+      params(
+        vulnerable_version_strings: T::Array[T.any(String, Dependabot::Requirement)],
+        safe_versions: T::Array[T.any(String, Dependabot::Requirement)]
+      )
+        .void
+    end
+    def convert_string_version_requirements(vulnerable_version_strings, safe_versions)
       @vulnerable_versions = vulnerable_version_strings.flat_map do |vuln_str|
         next vuln_str unless vuln_str.is_a?(String)
 
@@ -110,6 +139,7 @@ module Dependabot
       end
     end
 
+    sig { void }
     def check_version_requirements
       unless vulnerable_versions.is_a?(Array) &&
              vulnerable_versions.all? { |i| requirement_class <= i.class }
@@ -124,10 +154,12 @@ module Dependabot
       end
     end
 
+    sig { returns(T.class_of(Gem::Version)) }
     def version_class
       Utils.version_class_for_package_manager(package_manager)
     end
 
+    sig { returns(T.class_of(Dependabot::Requirement)) }
     def requirement_class
       Utils.requirement_class_for_package_manager(package_manager)
     end

data/lib/dependabot/update_checkers/version_filters.rb

@@ -10,10 +10,10 @@ module Dependabot
 
       sig do
         params(
-          versions_array: T::Array[T.any(Gem::Version, T::Hash[Symbol, String])],
+          versions_array: T::Array[T.any(Gem::Version, T::Hash[Symbol, Gem::Version])],
           security_advisories: T::Array[SecurityAdvisory]
         )
-          .returns(T::Array[T.any(Gem::Version, T::Hash[Symbol, String])])
+          .returns(T::Array[T.any(Gem::Version, T::Hash[Symbol, Gem::Version])])
       end
       def self.filter_vulnerable_versions(versions_array, security_advisories)
         versions_array.reject do |v|

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.241.0"
+  VERSION = "0.242.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.241.0
+  version: 0.242.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-18 00:00:00.000000000 Z
+date: 2024-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -572,7 +572,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.241.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.0
 post_install_message: 
 rdoc_options: []
 require_paths: