dependabot-common 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9647e43655c1fb5b645ad6a5635c619fd681f12b926c6c2195492aba565b9401
-  data.tar.gz: b50b9ac87807039b87a1c2c34fe2620bf332ceb607cd0c1acfb32189e78e3705
+  metadata.gz: 17a33f7a58c72db0519e97a6cafbcc82635b05e63990cc99ce0bef74aab095a5
+  data.tar.gz: 1cc7c71d06814db8fd53594b566e4f3b52ca89ec2429d8c7d6ba9824097865e6
 SHA512:
-  metadata.gz: '0749c51d303699690aa4e89b2f29084d4082a83f1e1f986c023ad4089284a4a1b145729be61d8759f267c8951878a8c36537eb87037c59278f0fbd249daf71bb'
-  data.tar.gz: 8de0c799f886104e9cd1bedd0fad7ca6e004dec5adb6f939ada8b496d37b41e324a89065542f9603b011d3ef60a9105d397f22e1c24440c029752ce94b52a56d
+  metadata.gz: d6fca56d5653cdbe70271dec38e5d43d225fe637ddd22c33afd015da340502bac20a41b69d244943c6dc05a6ecfc3ad0cad61220c1abf7c33dbafb4ebbd387fe
+  data.tar.gz: 6de41d80907590ec688ef8e178a5efb1575af696a7a88e8cf1ec482b5763c8846c792a6f88c78e45a00f574a987f1d3df13755e370edebdf043c008204fe3918

data/lib/dependabot/clients/azure.rb

@@ -473,7 +473,7 @@ module Dependabot
       private
 
       sig { params(blk: T.proc.void).void }
-      def retry_connection_failures(&blk) # rubocop:disable Lint/UnusedMethodArgument
+      def retry_connection_failures(&blk)
         retry_attempt = 0
 
         begin

data/lib/dependabot/command_helpers.rb

@@ -35,7 +35,7 @@ module Dependabot
 
       sig { params(process_status: T.nilable(Process::Status), custom_exitstatus: T.nilable(Integer)).void }
       def initialize(process_status, custom_exitstatus = nil)
-        @process_status = T.let(process_status, T.nilable(Process::Status))
+        @process_status = process_status
         @custom_exitstatus = custom_exitstatus
       end
 

data/lib/dependabot/config/file_fetcher.rb

@@ -10,11 +10,11 @@ module Dependabot
     class FileFetcher < FileFetchers::Base
       extend T::Sig
 
-      CONFIG_FILE_PATHS = T.let(%w(.github/dependabot.yml .github/dependabot.yaml).freeze, T::Array[String])
+      CONFIG_FILE_PATHS = %w(.github/dependabot.yml .github/dependabot.yaml).freeze
 
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
-        CONFIG_FILE_PATHS.any? { |file| filenames.include?(file) }
+        CONFIG_FILE_PATHS.intersect?(filenames)
       end
 
       sig { override.returns(String) }

data/lib/dependabot/config/ignore_condition.rb

@@ -32,7 +32,7 @@ module Dependabot
         ).void
       end
       def initialize(dependency_name:, versions: nil, update_types: nil)
-        @dependency_name = T.let(dependency_name, String)
+        @dependency_name = dependency_name
         @versions = T.let(versions || [], T::Array[String])
         @update_types = T.let(update_types || [], T::Array[String])
       end

data/lib/dependabot/config/update_config.rb

@@ -52,7 +52,7 @@ module Dependabot
       sig { params(dependency: Dependency).returns(Dependency) }
       def extract_base_version_from_requirement(dependency)
         requirements = dependency.requirements
-        requirement = T.must(requirements.first)[:requirement]
+        requirement = T.must(requirements.first).requirement_string
         version = requirement&.match(/\d+\.\d+\.\d+/)&.to_s
         Dependabot::Dependency.new(
           name: dependency.name,

data/lib/dependabot/dependency_group.rb

@@ -87,6 +87,22 @@ module Dependabot
       }.to_yaml.delete_prefix("---\n")
     end
 
+    sig { params(parent_name: String, dependency_name: String).returns(String) }
+    def self.subgroup_name(parent_name:, dependency_name:)
+      "#{parent_name}/#{dependency_name}"
+    end
+
+    sig do
+      params(subgroup_name: String, dependency_name: String)
+        .returns(T.nilable(String))
+    end
+    def self.parent_name_from_subgroup(subgroup_name:, dependency_name:)
+      suffix = "/#{dependency_name}"
+      return unless subgroup_name.end_with?(suffix)
+
+      subgroup_name.delete_suffix(suffix)
+    end
+
     private
 
     sig { params(dependency_name: String).returns(T::Boolean) }

data/lib/dependabot/dependency_requirement.rb

@@ -153,8 +153,61 @@ module Dependabot
       raise TypeError, "requirement must be a string or nil"
     end
 
+    # Reads a known metadata field such as "property_name". Accepts either key
+    # style for the same reason as `source_string`. Returns nil when the
+    # requirement carries no metadata or the key is absent.
+    sig { params(key: String).returns(T.nilable(String)) }
+    def metadata_string(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value.is_a?(String)
+
+      raise TypeError, "metadata #{key} must be a string or nil"
+    end
+
+    # Reads a known symbol-valued metadata field such as Helm's "type".
+    sig { params(key: String).returns(T.nilable(Symbol)) }
+    def metadata_symbol(key)
+      value = metadata_value(key)
+      return if value.nil?
+      return value if value.is_a?(Symbol)
+
+      raise TypeError, "metadata #{key} must be a symbol or nil"
+    end
+
+    # Reads a nested metadata hash whose values are all strings, such as
+    # "dependency_set" (`{ group: "my.group", version: "1.4.0" }`). Keys are
+    # symbolised so callers can read them with symbols regardless of how the
+    # requirement was built.
+    sig { params(key: String).returns(T.nilable(T::Hash[Symbol, String])) }
+    def metadata_string_hash(key)
+      value = metadata_value(key)
+      return if value.nil?
+      raise TypeError, "metadata #{key} must be a hash of strings or nil" unless value.is_a?(Hash)
+
+      value.to_h do |raw_entry_key, raw_entry_value|
+        entry_key = T.cast(raw_entry_key, Object)
+        entry_value = T.cast(raw_entry_value, Object)
+        unless (entry_key.is_a?(Symbol) || entry_key.is_a?(String)) && entry_value.is_a?(String)
+          raise TypeError, "metadata #{key} must be a hash of strings or nil"
+        end
+
+        [entry_key.to_sym, entry_value]
+      end
+    end
+
     private
 
+    # Reads a raw metadata field, accepting either key style. Nil when the
+    # requirement carries no metadata or the key is absent.
+    sig { params(key: String).returns(T.nilable(Object)) }
+    def metadata_value(key)
+      details = metadata
+      return if details.nil?
+
+      details[key.to_sym] || details[key]
+    end
+
     sig { params(key: Symbol).returns(T.nilable(String)) }
     def optional_string(key)
       value = T.cast(self[key], T.nilable(Object))

data/lib/dependabot/ecosystem.rb

@@ -46,12 +46,12 @@ module Dependabot
         supported_versions: [],
         requirement: nil
       )
-        @name = T.let(name, String)
+        @name = name
         @detected_version = T.let(detected_version || version, T.nilable(Dependabot::Version))
-        @version = T.let(version, T.nilable(Dependabot::Version))
-        @deprecated_versions = T.let(deprecated_versions, T::Array[Dependabot::Version])
-        @supported_versions = T.let(supported_versions, T::Array[Dependabot::Version])
-        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
+        @version = version
+        @deprecated_versions = deprecated_versions
+        @supported_versions = supported_versions
+        @requirement = requirement
       end
 
       # The name of the package manager (e.g., "bundler", "npm").
@@ -177,9 +177,9 @@ module Dependabot
       package_manager:,
       language: nil
     )
-      @name = T.let(name, String)
-      @package_manager = T.let(package_manager, VersionManager)
-      @language = T.let(language, T.nilable(VersionManager))
+      @name = name
+      @package_manager = package_manager
+      @language = language
     end
 
     # The name of the ecosystem (mandatory).

data/lib/dependabot/errors.rb

@@ -483,7 +483,7 @@ module Dependabot
 
     sig { params(error_type: String, message: T.any(T.nilable(String), MatchData)).void }
     def initialize(error_type, message = nil)
-      @error_type = T.let(error_type, String)
+      @error_type = error_type
 
       super(message || error_type)
     end

data/lib/dependabot/file_fetchers/base.rb

@@ -325,7 +325,7 @@ module Dependabot
 
       sig { params(path: String).returns(T::Boolean) }
       def in_submodule?(path)
-        subpaths(path.delete_prefix("/")).any? { |subpath| @submodules.include?(subpath) }
+        subpaths(path.delete_prefix("/")).intersect?(@submodules)
       end
 
       # Given a "foo/bar/baz" path, returns ["foo", "foo/bar", "foo/bar/baz"]

data/lib/dependabot/file_updaters/artifact_updater.rb

@@ -78,7 +78,7 @@ module Dependabot
 
       private
 
-      TEXT_ENCODINGS = T.let(%w(us-ascii utf-8).freeze, T::Array[String])
+      TEXT_ENCODINGS = %w(us-ascii utf-8).freeze
 
       sig { returns(T.nilable(String)) }
       attr_reader :repo_contents_path

data/lib/dependabot/file_updaters/base.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -79,7 +79,7 @@ module Dependabot
       def requirement_changed?(file, dependency)
         changed_requirements = dependency.requirements - T.must(dependency.previous_requirements)
 
-        changed_requirements.any? { |f| f[:file] == file.name }
+        changed_requirements.any? { |f| f.file == file.name }
       end
 
       sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }

data/lib/dependabot/metadata_finders/base/changelog_finder.rb

@@ -62,10 +62,7 @@ module Dependabot
         require_relative "commits_finder"
 
         # Earlier entries are preferred
-        CHANGELOG_NAMES = T.let(
-          %w(changelog news changes history release whatsnew releases).freeze,
-          T::Array[String]
-        )
+        CHANGELOG_NAMES = %w(changelog news changes history release whatsnew releases).freeze
 
         sig { returns(T.nilable(Dependabot::Source)) }
         attr_reader :source
@@ -452,7 +449,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def previous_ref
           previous_refs = dependency.previous_requirements&.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end&.uniq
           previous_refs.first if previous_refs&.one?
         end
@@ -460,7 +457,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def new_ref
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -479,7 +476,7 @@ module Dependabot
           return false if dependency.package_manager == "composer"
 
           requirements = dependency.requirements
-          sources = requirements.map { |r| r.fetch(:source) }.uniq.compact
+          sources = requirements.map(&:source_hash).uniq.compact
           return false if sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }

data/lib/dependabot/metadata_finders/base/changelog_pruner.rb

@@ -169,7 +169,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def previous_ref
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -177,7 +177,7 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def new_ref
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -190,7 +190,7 @@ module Dependabot
           return false if dependency.package_manager == "composer"
 
           requirements = dependency.requirements
-          sources = requirements.map { |r| r.fetch(:source) }.uniq.compact
+          sources = requirements.map(&:source_hash).uniq.compact
           return false if sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }

data/lib/dependabot/metadata_finders/base/commits_finder.rb

@@ -136,10 +136,11 @@ module Dependabot
         sig { params(version: T.nilable(Dependabot::Version)).returns(T::Boolean) }
         def satisfies_previous_reqs?(version)
           T.must(dependency.previous_requirements).all? do |req|
-            next true unless req.fetch(:requirement)
+            requirement = req.requirement_string
+            next true unless requirement
 
             requirement_class
-              .requirements_array(req.fetch(:requirement))
+              .requirements_array(requirement)
               .all? { |r| r.satisfied_by?(version) }
           end
         end
@@ -151,7 +152,7 @@ module Dependabot
           # internally
           return false if dependency.package_manager == "composer"
 
-          sources = requirements&.map { |r| r.fetch(:source) }&.uniq&.compact
+          sources = requirements&.map(&:source_hash)&.uniq&.compact
           return false if sources.nil? || sources.empty?
 
           sources.all? { |s| s[:type] == "git" || s["type"] == "git" }
@@ -168,7 +169,7 @@ module Dependabot
           return unless git_source?(dependency.previous_requirements)
 
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -178,7 +179,7 @@ module Dependabot
           return unless git_source?(dependency.previous_requirements)
 
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end

data/lib/dependabot/metadata_finders/base/release_finder.rb

@@ -198,15 +198,9 @@ module Dependabot
         sig { params(releases: T::Array[ReleaseType], conservative: T::Boolean).returns(T::Array[ReleaseType]) }
         def filter_releases_using_previous_version(releases, conservative:)
           releases.reject do |release|
-            cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
-            cleaned_name = release.name&.gsub(/^[^0-9]*/, "")
-            dot_count = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                   .map { |nm| nm.chars.count(".") }.max
+            next false if release_tag_matches_version?(release, new_version)
 
-            tag_version = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                     .select { |nm| version_class.correct?(nm) }
-                                                     .select { |nm| nm.chars.count(".") == dot_count }
-                                                     .map { |nm| version_class.new(nm) }.max
+            tag_version = possible_versions(release).max
 
             next conservative unless tag_version
 
@@ -221,15 +215,9 @@ module Dependabot
           updated_version = version_class.new(new_version)
 
           releases.reject do |release|
-            cleaned_tag = release.tag_name.gsub(/^[^0-9]*/, "")
-            cleaned_name = release.name&.gsub(/^[^0-9]*/, "")
-            dot_count = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                   .map { |nm| nm.chars.count(".") }.max
+            next false if release_tag_matches_version?(release, new_version)
 
-            tag_version = [cleaned_tag, cleaned_name].compact.reject(&:empty?)
-                                                     .select { |nm| version_class.correct?(nm) }
-                                                     .select { |nm| nm.chars.count(".") == dot_count }
-                                                     .map { |nm| version_class.new(nm) }.min
+            tag_version = possible_versions(release).min
 
             next conservative unless tag_version
 
@@ -239,6 +227,26 @@ module Dependabot
           end
         end
 
+        sig { params(release: ReleaseType).returns(T::Array[Dependabot::Version]) }
+        def possible_versions(release)
+          candidates = [release.tag_name, release.name].compact
+                                                       .map { |name| name.gsub(/^[^0-9]*/, "") }
+                                                       .reject(&:empty?)
+                                                       .select { |name| version_class.correct?(name) }
+          dot_count = candidates.map { |name| name.chars.count(".") }.max
+          return [] unless dot_count
+
+          candidates.select { |name| name.chars.count(".") == dot_count }
+                    .map { |name| version_class.new(name) }
+        end
+
+        sig { params(release: ReleaseType, version: T.nilable(String)).returns(T::Boolean) }
+        def release_tag_matches_version?(release, version)
+          return false unless version
+
+          release.tag_name.gsub(/^[^0-9]*/, "") == version.gsub(/^[^0-9]*/, "")
+        end
+
         sig { returns(T.nilable(ReleaseType)) }
         def updated_release
           release_for_version(new_version)

data/lib/dependabot/metadata_finders/base.rb

@@ -15,7 +15,7 @@ module Dependabot
       require "dependabot/metadata_finders/base/release_finder"
       require "dependabot/metadata_finders/base/commits_finder"
 
-      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = T.let(%w(bun npm_and_yarn pub).freeze, T::Array[String])
+      PACKAGE_MANAGERS_WITH_RELIABLE_DIRECTORIES = %w(bun npm_and_yarn pub).freeze
 
       sig { returns(Dependabot::Dependency) }
       attr_reader :dependency

data/lib/dependabot/package/package_details.rb

@@ -20,12 +20,12 @@ module Dependabot
         ).void
       end
       def initialize(dependency:, releases: [], dist_tags: nil)
-        @dependency = T.let(dependency, Dependabot::Dependency)
+        @dependency = dependency
         @releases = T.let(
           releases.sort_by(&:version).reverse,
           T::Array[Dependabot::Package::PackageRelease]
         )
-        @dist_tags = T.let(dist_tags, T.nilable(T::Hash[String, String]))
+        @dist_tags = dist_tags
       end
 
       sig { returns(Dependabot::Dependency) }

data/lib/dependabot/package/package_language.rb

@@ -15,9 +15,9 @@ module Dependabot
         ).void
       end
       def initialize(name:, version: nil, requirement: nil)
-        @name = T.let(name, String)
-        @version = T.let(version, T.nilable(Dependabot::Version))
-        @requirement = T.let(requirement, T.nilable(Dependabot::Requirement))
+        @name = name
+        @version = version
+        @requirement = requirement
       end
 
       sig { returns(String) }

data/lib/dependabot/package/package_latest_version_finder.rb

@@ -290,9 +290,10 @@ module Dependabot
       end
       def filter_out_of_range_versions(releases)
         reqs = dependency.requirements.filter_map do |r|
-          next if r.fetch(:requirement).nil?
+          requirement = r.requirement_string
+          next if requirement.nil?
 
-          requirement_class.requirements_array(r.fetch(:requirement))
+          requirement_class.requirements_array(requirement)
         end
 
         releases
@@ -325,7 +326,7 @@ module Dependabot
         return true if dependency.numeric_version&.prerelease?
 
         dependency.requirements.any? do |req|
-          req_string = req.fetch(:requirement) || ""
+          req_string = req.requirement_string || ""
           req_string.split(",").map(&:strip).any? do |r|
             version_str = r.gsub(/^\s*[!<>=~^]+\s*/, "").strip
             next false unless version_class.correct?(version_str)

data/lib/dependabot/package/package_release.rb

@@ -40,17 +40,17 @@ module Dependabot
         tag: nil,
         details: {}
       )
-        @version = T.let(version, Dependabot::Version)
-        @released_at = T.let(released_at, T.nilable(Time))
-        @latest = T.let(latest, T::Boolean)
-        @yanked = T.let(yanked, T::Boolean)
-        @yanked_reason = T.let(yanked_reason, T.nilable(String))
-        @downloads = T.let(downloads, T.nilable(Integer))
-        @url = T.let(url, T.nilable(String))
-        @package_type = T.let(package_type, T.nilable(String))
-        @language = T.let(language, T.nilable(Dependabot::Package::PackageLanguage))
-        @tag = T.let(tag, T.nilable(String))
-        @details = T.let(details, T::Hash[String, T.anything])
+        @version = version
+        @released_at = released_at
+        @latest = latest
+        @yanked = yanked
+        @yanked_reason = yanked_reason
+        @downloads = downloads
+        @url = url
+        @package_type = package_type
+        @language = language
+        @tag = tag
+        @details = details
       end
 
       sig { returns(Dependabot::Version) }

data/lib/dependabot/pull_request_creator/branch_name_template.rb

@@ -13,18 +13,9 @@ module Dependabot
 
       class Error < Dependabot::DependabotError; end
 
-      SOLO_PLACEHOLDERS = T.let(
-        %w(prefix package_manager directory target_branch dependency version name).freeze,
-        T::Array[String]
-      )
-      GROUP_PLACEHOLDERS = T.let(
-        %w(prefix package_manager directory target_branch group_name name).freeze,
-        T::Array[String]
-      )
-      MULTI_ECO_PLACEHOLDERS = T.let(
-        %w(prefix target_branch group_name name).freeze,
-        T::Array[String]
-      )
+      SOLO_PLACEHOLDERS = %w(prefix package_manager directory target_branch dependency version name).freeze
+      GROUP_PLACEHOLDERS = %w(prefix package_manager directory target_branch group_name name).freeze
+      MULTI_ECO_PLACEHOLDERS = %w(prefix target_branch group_name name).freeze
 
       # ---------------------------------------------------------------
       # 1. validate_template(template, strategy:)

data/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
@@ -88,14 +88,14 @@ module Dependabot
         def updating_a_property?
           T.must(dependencies.first)
            .requirements
-           .any? { |r| r.dig(:metadata, :property_name) }
+           .any? { |r| r.metadata_string("property_name") }
         end
 
         sig { returns(T::Boolean) }
         def updating_a_dependency_set?
           T.must(dependencies.first)
            .requirements
-           .any? { |r| r.dig(:metadata, :dependency_set) }
+           .any? { |r| r.metadata_string_hash("dependency_set") }
         end
 
         sig { returns(String) }
@@ -103,8 +103,8 @@ module Dependabot
           @property_name ||=
             T.let(
               T.must(dependencies.first).requirements
-                                              .find { |r| r.dig(:metadata, :property_name) }
-                                              &.dig(:metadata, :property_name),
+                                              .find { |r| r.metadata_string("property_name") }
+                                              &.metadata_string("property_name"),
               T.nilable(String)
             )
 
@@ -118,9 +118,9 @@ module Dependabot
           @dependency_set ||=
             T.let(
               T.must(dependencies.first).requirements
-                                 .find { |r| r.dig(:metadata, :dependency_set) }
-                                 &.dig(:metadata, :dependency_set),
-              T.nilable(T::Hash[String, String])
+                                 .find { |r| r.metadata_string_hash("dependency_set") }
+                                 &.metadata_string_hash("dependency_set"),
+              T.nilable(T::Hash[Symbol, String])
             )
 
           raise "No dependency set!" unless @dependency_set
@@ -172,9 +172,11 @@ module Dependabot
             T.must(dependency.version)[0..6]
           elsif dependency.version == dependency.previous_version &&
                 package_manager == "docker"
-            dependency.requirements
-                      .filter_map { |r| r.dig(:source, "digest") || r.dig(:source, :digest) }
-                      .first.split(":").last[0..6]
+            T.must(
+              dependency.requirements
+                                    .filter_map { |r| r.source_string("digest") }
+                                    .first
+            ).split(":").last&.[](0..6)
           else
             dependency.version
           end
@@ -183,7 +185,7 @@ module Dependabot
         sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def previous_ref(dependency)
           previous_refs = T.must(dependency.previous_requirements).filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           previous_refs.first if previous_refs.one?
         end
@@ -191,7 +193,7 @@ module Dependabot
         sig { params(dependency: Dependabot::Dependency).returns(T.nilable(String)) }
         def new_ref(dependency)
           new_refs = dependency.requirements.filter_map do |r|
-            r.dig(:source, "ref") || r.dig(:source, :ref)
+            r.source_string("ref")
           end.uniq
           new_refs.first if new_refs.one?
         end
@@ -208,10 +210,10 @@ module Dependabot
             dependency.requirements - T.must(dependency.previous_requirements)
 
           gemspec =
-            updated_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-          return gemspec[:requirement] if gemspec
+            updated_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+          return gemspec.requirement_string if gemspec
 
-          updated_reqs.first&.fetch(:requirement)
+          updated_reqs.first&.requirement_string
         end
 
         # TODO: Bring this in line with existing library checks that we do in the

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -165,43 +165,36 @@ module Dependabot
         )
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { params(dep: Dependabot::Dependency).returns(T.nilable(String)) }
       def version(dep)
         return dep.version if version_class.correct?(dep.version)
 
-        source = dep.requirements.find { |r| r.fetch(:source) }&.fetch(:source)
-        type = source&.fetch("type", nil) || source&.fetch(:type)
-        return dep.version unless type == "git"
+        source = dep.requirements.find(&:source)
+        return dep.version if source.nil?
+        return dep.version unless source.source_string("type") == "git"
 
-        ref = source.fetch("ref", nil) || source.fetch(:ref)
-        version_from_ref = ref&.gsub(/^v/, "")
+        version_from_ref = source.source_string("ref")&.gsub(/^v/, "")
         return dep.version unless version_from_ref
         return dep.version unless version_class.correct?(version_from_ref)
 
         version_from_ref
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
-      # rubocop:disable Metrics/PerceivedComplexity
       sig { params(dep: Dependabot::Dependency).returns(T.nilable(String)) }
       def previous_version(dep)
         version_str = dep.previous_version
         return version_str if version_class.correct?(version_str)
 
-        source = T.must(dep.previous_requirements)
-                  .find { |r| r.fetch(:source) }&.fetch(:source)
-        type = source&.fetch("type", nil) || source&.fetch(:type)
-        return version_str unless type == "git"
+        source = T.must(dep.previous_requirements).find(&:source)
+        return version_str if source.nil?
+        return version_str unless source.source_string("type") == "git"
 
-        ref = source.fetch("ref", nil) || source.fetch(:ref)
-        version_from_ref = ref&.gsub(/^v/, "")
+        version_from_ref = source.source_string("ref")&.gsub(/^v/, "")
         return version_str unless version_from_ref
         return version_str unless version_class.correct?(version_from_ref)
 
         version_from_ref
       end
-      # rubocop:enable Metrics/PerceivedComplexity
 
       sig { returns(T.nilable(T::Array[String])) }
       def create_default_dependencies_label_if_required

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -636,14 +636,14 @@ module Dependabot
       def updating_a_property?
         T.must(dependencies.first)
          .requirements
-         .any? { |r| r.dig(:metadata, :property_name) }
+         .any? { |r| r.metadata_string("property_name") }
       end
 
       sig { returns(T::Boolean) }
       def updating_a_dependency_set?
         T.must(dependencies.first)
          .requirements
-         .any? { |r| r.dig(:metadata, :dependency_set) }
+         .any? { |r| r.metadata_string_hash("dependency_set") }
       end
 
       sig { returns(T::Boolean) }
@@ -663,8 +663,8 @@ module Dependabot
           T.let(
             dependencies.first
               &.requirements
-              &.find { |r| r.dig(:metadata, :property_name) }
-              &.dig(:metadata, :property_name),
+              &.find { |r| r.metadata_string("property_name") }
+              &.metadata_string("property_name"),
             T.nilable(String)
           )
 
@@ -679,9 +679,9 @@ module Dependabot
           T.let(
             dependencies.first
               &.requirements
-              &.find { |r| r.dig(:metadata, :dependency_set) }
-              &.dig(:metadata, :dependency_set),
-            T.nilable(T.nilable(T::Hash[Symbol, String]))
+              &.find { |r| r.metadata_string_hash("dependency_set") }
+              &.metadata_string_hash("dependency_set"),
+            T.nilable(T::Hash[Symbol, String])
           )
 
         raise "No dependency set!" unless @dependency_set
@@ -910,10 +910,10 @@ module Dependabot
           T.must(dependency.previous_requirements) - dependency.requirements
 
         gemspec =
-          old_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-        return gemspec.fetch(:requirement) if gemspec
+          old_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+        return gemspec.requirement_string if gemspec
 
-        req = T.must(old_reqs.first).fetch(:requirement)
+        req = T.must(old_reqs.first).requirement_string
         return req if req
 
         dependency.previous_ref if dependency.ref_changed?
@@ -925,10 +925,10 @@ module Dependabot
           dependency.requirements - T.must(dependency.previous_requirements)
 
         gemspec =
-          updated_reqs.find { |r| r[:file].match?(%r{^[^/]*\.gemspec$}) }
-        return gemspec.fetch(:requirement) if gemspec
+          updated_reqs.find { |r| T.must(r.file).match?(%r{^[^/]*\.gemspec$}) }
+        return T.must(gemspec.requirement_string) if gemspec
 
-        req = T.must(updated_reqs.first).fetch(:requirement)
+        req = T.must(updated_reqs.first).requirement_string
         return req if req
         return T.must(dependency.new_ref) if dependency.ref_changed? && dependency.new_ref
 

data/lib/dependabot/pull_request_creator/pr_name_prefixer.rb

@@ -16,23 +16,16 @@ module Dependabot
     class PrNamePrefixer # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
-      ANGULAR_PREFIXES = T.let(
-        %w(build chore ci docs feat fix perf refactor style test).freeze,
-        T::Array[String]
-      )
-      ESLINT_PREFIXES = T.let(
-        %w(Breaking Build Chore Docs Fix New Update Upgrade).freeze,
-        T::Array[String]
-      )
-      GITMOJI_PREFIXES = T.let(
-        %w(alien ambulance apple arrow_down arrow_up art beers bento bookmark boom bug building_construction bulb
-           busts_in_silhouette camera_flash card_file_box chart_with_upwards_trend checkered_flag children_crossing
-           clown_face construction construction_worker egg fire globe_with_meridians green_apple green_heart hankey
-           heavy_minus_sign heavy_plus_sign iphone lipstick lock loud_sound memo mute ok_hand package page_facing_up
-           pencil2 penguin pushpin recycle rewind robot rocket rotating_light see_no_evil sparkles speech_balloon tada
-           truck twisted_rightwards_arrows whale wheelchair white_check_mark wrench zap).freeze,
-        T::Array[String]
-      )
+      ANGULAR_PREFIXES = %w(build chore ci docs feat fix perf refactor style test).freeze
+      ESLINT_PREFIXES = %w(Breaking Build Chore Docs Fix New Update Upgrade).freeze
+      GITMOJI_PREFIXES = %w(
+        alien ambulance apple arrow_down arrow_up art beers bento bookmark boom bug building_construction
+        bulb busts_in_silhouette camera_flash card_file_box chart_with_upwards_trend checkered_flag children_crossing
+        clown_face construction construction_worker egg fire globe_with_meridians green_apple green_heart hankey
+        heavy_minus_sign heavy_plus_sign iphone lipstick lock loud_sound memo mute ok_hand package page_facing_up
+        pencil2 penguin pushpin recycle rewind robot rocket rotating_light see_no_evil sparkles speech_balloon tada
+        truck twisted_rightwards_arrows whale wheelchair white_check_mark wrench zap
+      ).freeze
 
       sig do
         params(

data/lib/dependabot/pull_request_updater/github.rb

@@ -70,7 +70,7 @@ module Dependabot
         @pull_request_number = pull_request_number
         @author_details      = author_details
         @signature_key       = signature_key
-        @commit_message      = T.let(commit_message, T.nilable(String))
+        @commit_message      = commit_message
       end
 
       sig { returns(T.nilable(Sawyer::Resource)) }

data/lib/dependabot/source.rb

@@ -63,10 +63,7 @@ module Dependabot
       (?:#{CODECOMMIT_SOURCE})
     /x
 
-    IGNORED_PROVIDER_HOSTS = T.let(
-      %w(gitbox.apache.org svn.apache.org fuchsia.googlesource.com).freeze,
-      T::Array[String]
-    )
+    IGNORED_PROVIDER_HOSTS = %w(gitbox.apache.org svn.apache.org fuchsia.googlesource.com).freeze
 
     sig { returns(String) }
     attr_accessor :provider

data/lib/dependabot/update_checkers/base.rb

@@ -379,7 +379,7 @@ module Dependabot
           return false
         end
 
-        updated_requirements.none? { |r| r[:requirement] == :unfixable }
+        updated_requirements.none? { |r| r.requirement == :unfixable }
       end
 
       sig { returns(T::Boolean) }
@@ -415,7 +415,7 @@ module Dependabot
       def version_from_requirements
         @version_from_requirements ||=
           T.let(
-            dependency.requirements.filter_map { |r| r.fetch(:requirement) }
+            dependency.requirements.filter_map(&:requirement_string)
                       .flat_map { |req_str| requirement_class.requirements_array(req_str) }
                       .flat_map(&:requirements)
                       .reject { |req_array| req_array.first.start_with?("<") }
@@ -429,7 +429,7 @@ module Dependabot
       def requirements_can_update?
         return false if changed_requirements.none?
 
-        changed_requirements.none? { |r| r[:requirement] == :unfixable }
+        changed_requirements.none? { |r| r.requirement == :unfixable }
       end
     end
   end

data/lib/dependabot/version.rb

@@ -97,8 +97,7 @@ module Dependabot
     end
 
     # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
-    SEMVER_REGEX = T.let(
-      /
+    SEMVER_REGEX = /
             # major.minor.patch
             ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)
             # pre-release
@@ -109,9 +108,7 @@ module Dependabot
             # build metadata
             (?:\+(
               [0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*
-            ))?$/x,
-      Regexp
-    )
+            ))?$/x
 
     sig { params(version: String).returns(T::Boolean) }
     def self.valid_semver?(version)

data/lib/dependabot.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.390.0"
+  VERSION = "0.391.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -625,7 +625,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib