dependabot-composer 0.310.0 → 0.312.0

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
 require "uri"
+require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/shared_helpers"
@@ -17,30 +18,49 @@ module Dependabot
   module Composer
     class UpdateChecker
       class VersionResolver # rubocop:disable Metrics/ClassLength
+        extend T::Sig
+
         class MissingExtensions < StandardError
+          extend T::Sig
+
+          sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
           attr_reader :extensions
 
+          sig { params(extensions: T::Array[T::Hash[Symbol, T.untyped]]).void }
           def initialize(extensions)
-            @extensions = extensions
+            @extensions = T.let(extensions, T::Array[T::Hash[Symbol, T.untyped]])
             super
           end
         end
 
-        MISSING_EXPLICIT_PLATFORM_REQ_REGEX =
+        MISSING_EXPLICIT_PLATFORM_REQ_REGEX = T.let(
           %r{
             (?<=PHP\sextension\s)ext\-[^\s\/]+\s.*?\s(?=is|but)|
             (?<=requires\s)php(?:\-[^\s\/]+)?\s.*?\s(?=but)
-          }x
-        MISSING_IMPLICIT_PLATFORM_REQ_REGEX =
+          }x,
+          Regexp
+        )
+        MISSING_IMPLICIT_PLATFORM_REQ_REGEX = T.let(
           %r{
             (?<!with|for|by)\sext\-[^\s\/]+\s.*?\s(?=->)|
             (?<=require\s)php(?:\-[^\s\/]+)?\s.*?\s(?=->) # composer v2
-          }x
-        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
+          }x,
+          Regexp
+        )
+        VERSION_REGEX = T.let(/[0-9]+(?:\.[A-Za-z0-9\-_]+)*/, Regexp)
 
         # Example Timeout error from Composer 2.7.7: "curl error 28 while downloading https://example.com:81/packages.json: Failed to connect to example.com port 81 after 9853 ms: Connection timed out" # rubocop:disable Layout/LineLength
-        SOURCE_TIMED_OUT_REGEX = %r{curl error 28 while downloading (?<url>https?://.+/packages\.json): }
+        SOURCE_TIMED_OUT_REGEX = T.let(%r{curl error 28 while downloading (?<url>https?://.+/packages\.json): }, Regexp)
 
+        sig do
+          params(
+            credentials: T::Array[Dependabot::Credential],
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            requirements_to_unlock: Symbol,
+            latest_allowable_version: T.nilable(Gem::Version)
+          ).void
+        end
         def initialize(credentials:, dependency:, dependency_files:,
                        requirements_to_unlock:, latest_allowable_version:)
           @credentials                  = credentials
@@ -48,24 +68,43 @@ module Dependabot
           @dependency_files             = dependency_files
           @requirements_to_unlock       = requirements_to_unlock
           @latest_allowable_version     = latest_allowable_version
-          @composer_platform_extensions = initial_platform
-          @error_handler                = ComposerErrorHandler.new
+          @composer_platform_extensions = T.let(initial_platform, T::Hash[String, T::Array[String]])
+          @error_handler                = T.let(ComposerErrorHandler.new, ComposerErrorHandler)
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version
-          @latest_resolvable_version ||= fetch_latest_resolvable_version
+          @latest_resolvable_version ||= T.let(
+            fetch_latest_resolvable_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
         private
 
+        # Initialize instance variables with T.let for strict typing
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(Symbol) }
         attr_reader :requirements_to_unlock
+
+        sig { returns(T.nilable(Gem::Version)) }
         attr_reader :latest_allowable_version
+
+        sig { returns(T::Hash[String, T::Array[String]]) }
         attr_reader :composer_platform_extensions
+
+        sig { returns(ComposerErrorHandler) }
         attr_reader :error_handler
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_latest_resolvable_version
           version = fetch_latest_resolvable_version_string
           return if version.nil?
@@ -80,8 +119,9 @@ module Dependabot
           retry
         end
 
+        sig { returns(T.nilable(String)) }
         def fetch_latest_resolvable_version_string
-          base_directory = dependency_files.first.directory
+          base_directory = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files
             run_update_checker
@@ -93,6 +133,7 @@ module Dependabot
           handle_composer_errors(e)
         end
 
+        sig { params(unlock_requirement: T::Boolean).void }
         def write_temporary_dependency_files(unlock_requirement: true)
           write_dependency_file(unlock_requirement: unlock_requirement)
           write_path_dependency_files
@@ -101,6 +142,7 @@ module Dependabot
           write_auth_file
         end
 
+        sig { void }
         def write_zipped_path_dependency_files
           zipped_path_dependency_files.each do |file|
             FileUtils.mkdir_p(Pathname.new(file.name).dirname)
@@ -108,6 +150,7 @@ module Dependabot
           end
         end
 
+        sig { params(unlock_requirement: T::Boolean).void }
         def write_dependency_file(unlock_requirement:)
           File.write(
             PackageManager::MANIFEST_FILENAME,
@@ -117,6 +160,7 @@ module Dependabot
           )
         end
 
+        sig { void }
         def write_path_dependency_files
           path_dependency_files.each do |file|
             FileUtils.mkdir_p(Pathname.new(file.name).dirname)
@@ -124,14 +168,17 @@ module Dependabot
           end
         end
 
+        sig { void }
         def write_lockfile
-          File.write(PackageManager::LOCKFILE_FILENAME, lockfile.content) if lockfile
+          File.write(PackageManager::LOCKFILE_FILENAME, T.must(lockfile).content) if lockfile
         end
 
+        sig { void }
         def write_auth_file
-          File.write(PackageManager::AUTH_FILENAME, auth_json.content) if auth_json
+          File.write(PackageManager::AUTH_FILENAME, T.must(auth_json).content) if auth_json
         end
 
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def transitory_failure?(error)
           return true if error.message.include?("404 Not Found")
           return true if error.message.include?("timed out")
@@ -140,6 +187,7 @@ module Dependabot
           error.message.include?("Content-Length mismatch")
         end
 
+        sig { returns(String) }
         def run_update_checker
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
@@ -156,14 +204,16 @@ module Dependabot
           end
         end
 
+        sig { params(unlock_requirement: T::Boolean).returns(String) }
         def prepared_composer_json_content(unlock_requirement: true)
-          content = composer_file.content
+          content = T.must(T.must(composer_file).content)
           content = unlock_dep_being_updated(content) if unlock_requirement
           content = lock_git_dependencies(content) if lockfile
           content = add_temporary_platform_extensions(content)
           content
         end
 
+        sig { params(content: String).returns(String) }
         def unlock_dep_being_updated(content)
           content.gsub(
             /"#{Regexp.escape(dependency.name)}"\s*:\s*".*"/,
@@ -171,6 +221,7 @@ module Dependabot
           )
         end
 
+        sig { params(content: String).returns(String) }
         def add_temporary_platform_extensions(content)
           json = JSON.parse(content)
 
@@ -186,6 +237,7 @@ module Dependabot
           JSON.dump(json)
         end
 
+        sig { params(content: String).returns(String) }
         def lock_git_dependencies(content)
           json = JSON.parse(content)
 
@@ -197,7 +249,7 @@ module Dependabot
               next if req.include?("#")
 
               commit_sha = parsed_lockfile
-                           .fetch(keys[:lockfile], [])
+                           .fetch(T.must(keys[:lockfile]), [])
                            .find { |d| d["name"] == name }
                            &.dig("source", "reference")
               updated_req_parts = req.split
@@ -211,6 +263,7 @@ module Dependabot
 
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
+        sig { returns(String) }
         def updated_version_requirement_string
           lower_bound =
             if requirements_to_unlock == :none
@@ -253,6 +306,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/MethodLength
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.nilable(NilClass)) }
         def handle_composer_errors(error)
           # Special case for Laravel Nova, which will fall back to attempting
           # to close a private repo if given invalid (or no) credentials
@@ -271,7 +325,11 @@ module Dependabot
             missing_extensions =
               error.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-                name, requirement = extension_string.strip.split(" ", 2)
+                name, requirement = if extension_string.is_a?(Array)
+                                      [extension_string.first.to_s.strip, extension_string.last.to_s]
+                                    else
+                                      extension_string.to_s.strip.split(" ", 2)
+                                    end
                 { name: name, requirement: requirement }
               end
             raise MissingExtensions, missing_extensions
@@ -282,7 +340,7 @@ module Dependabot
             missing_extensions =
               error.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-                name, requirement = extension_string.strip.split(" ", 2)
+                name, requirement = T.cast(extension_string, String).strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end
 
@@ -291,7 +349,7 @@ module Dependabot
               version_for_reqs(existing_reqs + [hash[:requirement]])
             end
 
-            raise MissingExtensions, [missing_extension]
+            raise MissingExtensions, [missing_extension].compact
           elsif error.message.include?("cannot require itself") ||
                 error.message.include?('packages.json" file could not be down')
             raise Dependabot::DependencyFileNotResolvable, error.message
@@ -312,14 +370,14 @@ module Dependabot
             # now, we therefore just ignore the dependency and log the error.
 
             Dependabot.logger.error(error.message)
-            error.backtrace.each { |line| Dependabot.logger.error(line) }
+            error.backtrace&.each { |line| Dependabot.logger.error(line) }
             nil
           elsif error.message.include?("URL required authentication") ||
                 error.message.include?("403 Forbidden")
-            source = error.message.match(%r{https?://(?<source>[^/]+)/}).named_captures.fetch("source")
+            source = error.message.match(%r{https?://(?<source>[^/]+)/})&.named_captures&.fetch("source")
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           elsif error.message.match?(SOURCE_TIMED_OUT_REGEX)
-            url = error.message.match(SOURCE_TIMED_OUT_REGEX).named_captures.fetch("url")
+            url = T.must(error.message.match(SOURCE_TIMED_OUT_REGEX)&.named_captures&.fetch("url"))
             raise if [
               "packagist.org",
               "www.packagist.org"
@@ -357,6 +415,7 @@ module Dependabot
         # rubocop:enable Metrics/CyclomaticComplexity
         # rubocop:enable Metrics/MethodLength
 
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def unresolvable_error?(error)
           error.message.start_with?("Could not parse version") ||
             error.message.include?("does not allow connections to http://") ||
@@ -364,15 +423,17 @@ module Dependabot
             error.message.start_with?("Invalid version string")
         end
 
+        sig { returns(T::Boolean) }
         def library?
           parsed_composer_file["type"] == "library"
         end
 
+        sig { params(message: String).returns(T::Boolean) }
         def implicit_platform_reqs_satisfiable?(message)
           missing_extensions =
             message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-              name, requirement = extension_string.strip.split(" ", 2)
+              name, requirement = T.cast(extension_string, String).strip.split(" ", 2)
               { name: name, requirement: requirement }
             end
 
@@ -382,8 +443,9 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def check_original_requirements_resolvable
-          base_directory = dependency_files.first.directory
+          base_directory = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files(unlock_requirement: false)
 
@@ -414,6 +476,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, e.message
         end
 
+        sig { params(requirements: T::Array[String]).returns(T.nilable(String)) }
         def version_for_reqs(requirements)
           req_arrays =
             requirements
@@ -438,25 +501,32 @@ module Dependabot
           version.to_s
         end
 
+        sig { params(additional_extensions: T::Array[T::Hash[Symbol, String]]).void }
         def update_required_extensions(additional_extensions)
           additional_extensions.each do |ext|
             composer_platform_extensions[ext.fetch(:name)] ||= []
-            composer_platform_extensions[ext.fetch(:name)] +=
-              [ext.fetch(:requirement)]
             composer_platform_extensions[ext.fetch(:name)] =
-              composer_platform_extensions[ext.fetch(:name)].uniq
+              T.must(composer_platform_extensions[ext.fetch(:name)]) + [ext.fetch(:requirement)]
+            composer_platform_extensions[ext.fetch(:name)] =
+              T.must(composer_platform_extensions[ext.fetch(:name)]).uniq
           end
         end
 
+        sig { returns(String) }
         def php_helper_path
           NativeHelpers.composer_helper_path(composer_version: composer_version)
         end
 
+        sig { returns(String) }
         def composer_version
           parsed_lockfile_or_nil = lockfile ? parsed_lockfile : nil
-          @composer_version ||= Helpers.composer_version(parsed_composer_file, parsed_lockfile_or_nil)
+          @composer_version ||= T.let(
+            Helpers.composer_version(parsed_composer_file, parsed_lockfile_or_nil),
+            T.nilable(String)
+          )
         end
 
+        sig { returns(T::Hash[String, T::Array[String]]) }
         def initial_platform
           platform_php = Helpers.capture_platform_php(parsed_composer_file)
 
@@ -477,38 +547,63 @@ module Dependabot
           platform
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_composer_file
-          @parsed_composer_file ||= JSON.parse(composer_file.content)
+          @parsed_composer_file ||= T.let(
+            JSON.parse(T.must(T.must(composer_file).content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_lockfile
-          @parsed_lockfile ||= JSON.parse(lockfile.content)
+          @parsed_lockfile ||= T.let(
+            JSON.parse(T.must(lockfile&.content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def composer_file
-          @composer_file ||=
-            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
+          @composer_file ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def path_dependency_files
-          @path_dependency_files ||=
-            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") }
+          @path_dependency_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def zipped_path_dependency_files
-          @zipped_path_dependency_files ||=
-            dependency_files.select { |f| f.name.end_with?(".zip", ".gitkeep") }
+          @zipped_path_dependency_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?(".zip", ".gitkeep") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
-          @lockfile ||=
-            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME }
+          @lockfile ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def auth_json
-          @auth_json ||= dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
+          @auth_json ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { params(req_string: String).returns(T::Boolean) }
         def requirement_valid?(req_string)
           Composer::Requirement.requirements_array(req_string)
           true
@@ -516,12 +611,14 @@ module Dependabot
           false
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def git_credentials
           credentials
             .select { |cred| cred["type"] == "git_source" }
             .select { |cred| cred["password"] }
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials
             .select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY }
@@ -534,23 +631,24 @@ module Dependabot
       extend T::Sig
 
       # Private source errors
-      CURL_ERROR = /curl error 52 while downloading (?<url>.*): Empty reply from server/
+      CURL_ERROR = T.let(/curl error 52 while downloading (?<url>.*): Empty reply from server/, Regexp)
 
-      PRIVATE_SOURCE_AUTH_FAIL = [
+      PRIVATE_SOURCE_AUTH_FAIL = T.let([
         /Could not authenticate against (?<url>.*)/,
         /The '(?<url>.*)' URL could not be accessed \(HTTP 403\)/,
         /The "(?<url>.*)" file could not be downloaded/
-      ].freeze
+      ].freeze, T::Array[Regexp])
 
-      REQUIREMENT_ERROR = /^(?<req>.*) is invalid, it should not contain uppercase characters/
+      REQUIREMENT_ERROR = T.let(/^(?<req>.*) is invalid, it should not contain uppercase characters/, Regexp)
 
-      NO_URL = "No URL specified"
+      NO_URL = T.let("No URL specified", String)
 
+      sig { params(url: String).returns(String) }
       def sanitize_uri(url)
         url = "http://#{url}" unless url.start_with?("http")
         uri = URI.parse(url)
         host = T.must(uri.host).downcase
-        host.start_with?("www.") ? host[4..-1] : host
+        host.start_with?("www.") ? T.must(host[4..-1]) : host
       end
 
       # Handles errors with specific to composer error codes
@@ -561,7 +659,8 @@ module Dependabot
           next unless error.message.match?(regex)
 
           url = T.must(error.message.match(regex)).named_captures["url"]
-          raise Dependabot::PrivateSourceAuthenticationFailure, sanitize_uri(url).empty? ? NO_URL : sanitize_uri(url)
+          sanitized_url = sanitize_uri(T.must(url))
+          raise Dependabot::PrivateSourceAuthenticationFailure, sanitized_url.empty? ? NO_URL : sanitized_url
         end
 
         # invalid requirement mentioned in manifest file
@@ -573,7 +672,7 @@ module Dependabot
         return unless error.message.match?(CURL_ERROR)
 
         url = T.must(error.message.match(CURL_ERROR)).named_captures["url"]
-        raise PrivateSourceBadResponse, url
+        raise PrivateSourceBadResponse, T.must(url)
       end
     end
   end

data/lib/dependabot/composer/update_checker.rb

@@ -28,7 +28,7 @@ module Dependabot
         latest_version_from_registry || latest_resolvable_version
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version
         return nil if path_dependency? || git_dependency?
 
@@ -40,26 +40,26 @@ module Dependabot
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :own
           ).latest_resolvable_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
         @lowest_resolvable_security_fix_version ||= T.let(
           fetch_lowest_resolvable_security_fix_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version_with_no_unlock
         return nil if path_dependency? || git_dependency?
 
@@ -71,7 +71,7 @@ module Dependabot
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :none
           ).latest_resolvable_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
@@ -80,7 +80,7 @@ module Dependabot
         RequirementsUpdater.new(
           requirements: dependency.requirements,
           latest_resolvable_version: preferred_resolvable_version&.to_s,
-          update_strategy: requirements_update_strategy
+          update_strategy: T.must(requirements_update_strategy)
         ).updated_requirements
       end
 
@@ -111,7 +111,7 @@ module Dependabot
         raise NotImplementedError
       end
 
-      sig { returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       def latest_version_from_registry
         latest_version_finder.latest_version
       end
@@ -131,7 +131,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_resolvable_security_fix_version
         return nil if path_dependency? || git_dependency?
 

data/lib/dependabot/composer/version.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -11,11 +13,15 @@ require "dependabot/utils"
 module Dependabot
   module Composer
     class Version < Dependabot::Version
+      extend T::Sig
+
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
-        @version_string = version.to_s
+        @version_string = T.let(version.to_s, String)
         super
       end
 
+      sig { returns(String) }
       def to_s
         @version_string
       end