dependabot-composer 0.310.0 → 0.312.0

data/lib/dependabot/composer/file_updater/manifest_updater.rb

@@ -1,22 +1,28 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/composer/file_updater"
 
 module Dependabot
   module Composer
     class FileUpdater
       class ManifestUpdater
+        extend T::Sig
+
+        sig { params(dependencies: T::Array[Dependabot::Dependency], manifest: Dependabot::DependencyFile).void }
         def initialize(dependencies:, manifest:)
           @dependencies = dependencies
           @manifest = manifest
         end
 
+        sig { returns(String) }
         def updated_manifest_content
-          dependencies.reduce(manifest.content.dup) do |content, dep|
+          T.must(dependencies.reduce(manifest.content.dup) do |content, dep|
             updated_content = content
             updated_requirements(dep).each do |new_req|
-              old_req = old_requirement(dep, new_req).fetch(:requirement)
+              old_req = old_requirement(dep, new_req)&.fetch(:requirement)
               updated_req = new_req.fetch(:requirement)
 
               regex =
@@ -25,7 +31,7 @@ module Dependabot
                   "#{Regexp.escape(old_req)}"
                 /x
 
-              updated_content = content.gsub(regex) do |declaration|
+              updated_content = content&.gsub(regex) do |declaration|
                 declaration.gsub(%("#{old_req}"), %("#{updated_req}"))
               end
 
@@ -33,32 +39,45 @@ module Dependabot
             end
 
             updated_content
-          end
+          end)
         end
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :manifest
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def new_requirements(dependency)
           dependency.requirements.select { |r| r[:file] == manifest.name }
         end
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            new_requirement: T::Hash[Symbol, T.untyped]
+          )
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def old_requirement(dependency, new_requirement)
-          dependency.previous_requirements
-                    .select { |r| r[:file] == manifest.name }
-                    .find { |r| r[:groups] == new_requirement[:groups] }
+          T.must(dependency.previous_requirements)
+           .select { |r| r[:file] == manifest.name }
+           .find { |r| r[:groups] == new_requirement[:groups] }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements(dependency)
           new_requirements(dependency)
-            .reject { |r| dependency.previous_requirements.include?(r) }
+            .reject { |r| T.must(dependency.previous_requirements).include?(r) }
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end

data/lib/dependabot/composer/file_updater.rb

@@ -56,7 +56,7 @@ module Dependabot
       def updated_composer_json_content
         ManifestUpdater.new(
           dependencies: dependencies,
-          manifest: composer_json
+          manifest: T.must(composer_json)
         ).updated_manifest_content
       end
 

data/lib/dependabot/composer/helpers.rb

@@ -174,7 +174,7 @@ module Dependabot
 
       sig { params(dependency_url: String).returns(String) }
       def self.clean_dependency_url(dependency_url)
-        return dependency_url unless URI::DEFAULT_PARSER.regexp[:ABS_URI].match?(dependency_url)
+        return dependency_url unless URI::RFC2396_PARSER.regexp[:ABS_URI].match?(dependency_url)
 
         url = URI.parse(dependency_url)
         url.user = nil

data/lib/dependabot/composer/metadata_finder.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
+
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
@@ -10,6 +12,21 @@ require "dependabot/composer/version"
 module Dependabot
   module Composer
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      sig do
+        override
+          .params(
+            dependency: Dependabot::Dependency,
+            credentials: T::Array[Dependabot::Credential]
+          )
+          .void
+      end
+      def initialize(dependency:, credentials:)
+        @packagist_listing = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+        super
+      end
+
       private
 
       sig { override.returns(T.nilable(Source)) }

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "json"
+require "sorbet-runtime"
 
 require "dependabot/composer/update_checker"
 require "dependabot/update_checkers/version_filters"
@@ -13,9 +14,20 @@ module Dependabot
   module Composer
     class UpdateChecker
       class LatestVersionFinder
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
-                       security_advisories:)
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, ignored_versions:, security_advisories:,
+                       raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
@@ -24,22 +36,40 @@ module Dependabot
           @security_advisories = security_advisories
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_version
-          @latest_version ||= fetch_latest_version
+          @latest_version ||= T.let(
+            fetch_latest_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def lowest_security_fix_version
-          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+          @lowest_security_fix_version ||= T.let(
+            fetch_lowest_security_fix_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_latest_version
           versions = available_versions
           versions = filter_prerelease_versions(versions)
@@ -47,6 +77,7 @@ module Dependabot
           versions.max
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_lowest_security_fix_version
           versions = available_versions
           versions = filter_prerelease_versions(versions)
@@ -58,12 +89,14 @@ module Dependabot
           versions.min
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
           versions_array.reject(&:prerelease?)
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_ignored_versions(versions_array)
           filtered =
             versions_array
@@ -76,6 +109,7 @@ module Dependabot
           filtered
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.numeric_version
 
@@ -83,6 +117,7 @@ module Dependabot
             .select { |version| version > dependency.numeric_version }
         end
 
+        sig { returns(T::Boolean) }
         def wants_prerelease?
           current_version = dependency.numeric_version
           return true if current_version&.prerelease?
@@ -92,17 +127,19 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::Version]) }
         def available_versions
           registry_version_details
             .select { |version| version_class.correct?(version.gsub(/^v/, "")) }
             .map { |version| version_class.new(version.gsub(/^v/, "")) }
         end
 
+        sig { returns(T::Array[String]) }
         def registry_version_details
           return @registry_version_details unless @registry_version_details.nil?
 
           repositories =
-            JSON.parse(composer_file.content)
+            JSON.parse(T.must(composer_file.content))
                 .fetch("repositories", [])
                 .select { |r| r.is_a?(Hash) }
 
@@ -115,16 +152,19 @@ module Dependabot
             urls << "https://repo.packagist.org/p2/#{dependency.name.downcase}.json"
           end
 
-          @registry_version_details = []
+          @registry_version_details ||= T.let([], T.nilable(T::Array[String]))
           urls.each do |url|
             @registry_version_details += fetch_registry_versions_from_url(url)
           end
           @registry_version_details.uniq
         end
 
+        sig { params(url: String).returns(T::Array[String]) }
         def fetch_registry_versions_from_url(url)
           url_host = URI(url).host
-          cred = registry_credentials.find { |c| url_host == c["registry"] || url_host == URI(c["registry"]).host }
+          cred = registry_credentials.find do |c|
+            url_host == c["registry"] || url_host == URI(T.must(c["registry"])).host
+          end
 
           response = Dependabot::RegistryClient.get(
             url: url,
@@ -139,6 +179,7 @@ module Dependabot
           []
         end
 
+        sig { params(response: T.untyped, url: String).returns(T::Array[String]) }
         def parse_registry_response(response, url)
           return [] unless response.status == 200
 
@@ -154,6 +195,7 @@ module Dependabot
           raise DependencyFileNotResolvable, msg
         end
 
+        sig { params(listing: T::Hash[String, T.untyped]).returns(T::Array[String]) }
         def extract_versions(listing)
           # Packagist's Metadata API format:
           # v1: "packages": {<package name>: {<version_number>: {hash of metadata for a particular release version}}}
@@ -174,26 +216,32 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials.select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY } +
             auth_json_credentials
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def auth_json_credentials
-          return [] unless auth_json
+          json = auth_json
+          return [] unless json
 
-          parsed_auth_json = JSON.parse(auth_json.content)
+          parsed_auth_json = JSON.parse(T.must(json.content))
           parsed_auth_json.fetch("http-basic", {}).map do |reg, details|
-            {
+            Dependabot::Credential.new({
               "registry" => reg,
               "username" => details["username"],
               "password" => details["password"]
-            }
+            })
           end
         rescue JSON::ParserError
-          raise Dependabot::DependencyFileNotParseable, auth_json.path
+          raise Dependabot::DependencyFileNotParseable, json.path if json
+
+          raise Dependabot::DependencyFileNotParseable, "Unknown path"
         end
 
+        sig { returns(Dependabot::DependencyFile) }
         def composer_file
           composer_file =
             dependency_files.find do |f|
@@ -204,18 +252,22 @@ module Dependabot
           composer_file
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def auth_json
           dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
         end
 
+        sig { returns(T::Array[Dependabot::Requirement]) }
         def ignore_requirements
           ignored_versions.map { |req| requirement_class.new(req.split(",")) }
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T.class_of(Dependabot::Requirement)) }
         def requirement_class
           dependency.requirement_class
         end

data/lib/dependabot/composer/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 ################################################################################
@@ -34,6 +34,13 @@ module Dependabot
           T::Array[Dependabot::RequirementsUpdateStrategy]
         )
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, String]],
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            latest_resolvable_version: T.nilable(T.any(String, Composer::Version))
+          ).void
+        end
         def initialize(requirements:, update_strategy:,
                        latest_resolvable_version:)
           @requirements = requirements
@@ -43,10 +50,13 @@ module Dependabot
 
           return unless latest_resolvable_version
 
-          @latest_resolvable_version =
-            version_class.new(latest_resolvable_version)
+          @latest_resolvable_version = T.let(
+            version_class.new(latest_resolvable_version),
+            Dependabot::Version
+          )
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, String]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
           return requirements unless latest_resolvable_version
@@ -56,10 +66,16 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[T::Hash[Symbol, String]]) }
         attr_reader :requirements
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T.nilable(Dependabot::Version)) }
         attr_reader :latest_resolvable_version
 
+        sig { void }
         def check_update_strategy
           return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
 
@@ -67,8 +83,9 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
         def updated_requirement(req)
-          req_string = req[:requirement].strip
+          req_string = T.must(req[:requirement]).strip
           or_string_reqs = req_string.split(OR_SEPARATOR)
           or_separator = req_string.match(OR_SEPARATOR)&.to_s || " || "
           numeric_or_string_reqs = or_string_reqs
@@ -90,28 +107,33 @@ module Dependabot
               update_requirement_version(req, or_separator)
             end
 
+          # Add a T.must for new_req as it's defined in the case statement with multiple options
+          new_req = T.must(new_req)
           new_req_string =
             [new_req[:requirement], *branch_or_string_reqs].join(or_separator)
           new_req.merge(requirement: new_req_string)
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
         def updated_alias(req)
-          req_string = req[:requirement]
-          real_version = req_string.split(/\sas\s/).first.strip
+          req_string = T.must(req[:requirement])
+          parts = req_string.split(/\sas\s/)
+          real_version = T.must(parts.first).strip
 
           # If the version we're aliasing isn't a version then we don't know
           # how to update it, so we just return the existing requirement.
           return req unless version_class.correct?(real_version)
 
-          new_version_string = latest_resolvable_version.to_s
+          new_version_string = T.must(latest_resolvable_version).to_s
           new_req = req_string.sub(real_version, new_version_string)
           req.merge(requirement: new_req)
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
         def widen_requirement(req, or_separator)
-          current_requirement = req[:requirement]
+          current_requirement = T.must(req[:requirement])
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
@@ -131,13 +153,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
         def update_requirement_version(req, or_separator)
-          current_requirement = req[:requirement]
+          current_requirement = T.must(req[:requirement])
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
             if reqs.count > 1
-              "^#{latest_resolvable_version}"
+              "^#{T.must(latest_resolvable_version)}"
             elsif reqs.any? { |r| r.match?(/<|(\s+-\s+)/) }
               update_range_requirement(current_requirement, or_separator)
             elsif reqs.any? { |r| r.match?(/>[^=]/) }
@@ -149,38 +172,42 @@ module Dependabot
           req.merge(requirement: updated_requirement)
         end
 
+        sig { params(requirement_string: String).returns(T::Boolean) }
         def req_satisfied_by_latest_resolvable?(requirement_string)
           ruby_requirements(requirement_string)
-            .any? { |r| r.satisfied_by?(latest_resolvable_version) }
+            .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_version_string(req_string)
           req_string
             .sub(VERSION_REGEX) do |old_version|
-              next latest_resolvable_version.to_s unless req_string.match?(/[~*\^]/)
+              next T.must(latest_resolvable_version).to_s unless req_string.match?(/[~*\^]/)
 
               old_parts = old_version.split(".")
-              new_parts = latest_resolvable_version.to_s.split(".")
-                                                   .first(old_parts.count)
+              new_parts = T.must(latest_resolvable_version).to_s.split(".")
+                           .first(old_parts.count)
               new_parts.map.with_index do |part, i|
                 old_parts[i] == "*" ? "*" : part
               end.join(".")
             end
         end
 
+        sig { params(requirement_string: String).returns(T::Array[Composer::Requirement]) }
         def ruby_requirements(requirement_string)
           Composer::Requirement.requirements_array(requirement_string)
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_caret_requirement(req_string, or_separator)
           caret_requirements =
             req_string.split(SEPARATOR).select { |r| r.strip.start_with?("^") }
-          version_parts = latest_resolvable_version.segments
+          version_parts = T.must(latest_resolvable_version).segments
 
           min_existing_precision =
-            caret_requirements.map { |r| r.split(".").count }.min
+            caret_requirements.map { |r| r.split(".").count }.min || 0
           first_non_zero_index =
-            version_parts.count.times.find { |i| version_parts[i] != 0 }
+            version_parts.count.times.find { |i| version_parts[i] != 0 } || 0
 
           precision = [min_existing_precision, first_non_zero_index + 1].max
           version = version_parts.first(precision).map.with_index do |part, i|
@@ -190,71 +217,78 @@ module Dependabot
           req_string + "#{or_separator}^#{version}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_tilda_requirement(req_string, or_separator)
           tilda_requirements =
             req_string.split(SEPARATOR).select { |r| r.strip.start_with?("~") }
-          precision = tilda_requirements.map { |r| r.split(".").count }.min
+          precision = tilda_requirements.map { |r| r.split(".").count }.min || 0
 
-          version_parts = latest_resolvable_version.segments.first(precision)
-          version_parts[-1] = 0
+          version_parts = T.must(latest_resolvable_version).segments.first(precision)
+          version_parts[-1] = 0 if version_parts.any?
           version = version_parts.join(".")
 
           req_string + "#{or_separator}~#{version}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_wildcard_requirement(req_string, or_separator)
           wildcard_requirements =
             req_string.split(SEPARATOR).select { |r| r.include?("*") }
           precision = wildcard_requirements.map do |r|
             r.split(".").reject { |s| s == "*" }.count
-          end.min
+          end.min || 0
           wildcard_count = wildcard_requirements.map do |r|
             r.split(".").select { |s| s == "*" }.count
-          end.min
+          end.min || 0
 
-          version_parts = latest_resolvable_version.segments.first(precision)
+          version_parts = T.must(latest_resolvable_version).segments.first(precision)
           version = version_parts.join(".")
 
           req_string + "#{or_separator}#{version}#{'.*' * wildcard_count}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_range_requirement(req_string, or_separator)
           range_requirements =
             req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s+-\s+)/) }
 
           if range_requirements.count == 1
-            range_requirement = range_requirements.first
+            range_requirement = T.must(range_requirements.first)
             versions = range_requirement.scan(VERSION_REGEX)
-            upper_bound = versions.map { |v| version_class.new(v) }.max
+            # Convert version strings to Version objects and find the maximum
+            upper_bounds = versions.map { |v| version_class.new(T.cast(v, String)) }
+            upper_bound = T.cast(upper_bounds.max, Dependabot::Version)
             new_upper_bound = update_greatest_version(
               upper_bound,
-              latest_resolvable_version
+              T.must(latest_resolvable_version)
             )
 
-            req_string.sub(upper_bound.to_s, new_upper_bound.to_s)
+            req_string.sub(upper_bound.to_s, new_upper_bound)
           else
-            req_string + "#{or_separator}^#{latest_resolvable_version}"
+            req_string + "#{or_separator}^#{T.must(latest_resolvable_version)}"
           end
         end
 
+        sig { params(old_version: Dependabot::Version, version_to_be_permitted: Dependabot::Version).returns(String) }
         def update_greatest_version(old_version, version_to_be_permitted)
           version = version_class.new(old_version)
           version = version.release if version.prerelease?
 
           index_to_update =
-            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+            version.segments.map.with_index { |seg, i| seg.to_i.zero? ? 0 : i }.max || 0
 
           version.segments.map.with_index do |_, index|
             if index < index_to_update
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
+              version_to_be_permitted.segments[index].to_i + 1
             else
               0
             end
           end.join(".")
         end
 
+        sig { returns(T.class_of(Dependabot::Composer::Version)) }
         def version_class
           Composer::Version
         end