dependabot-composer 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cafb57b046f1164755a998a31aa72aba68c3aea1bac24495f6f8118dc629c591
-  data.tar.gz: b1e4d87a77c309bfcf68a3de9815ba0f0aafbd7f464c16359d06b3810f8a22e4
+  metadata.gz: 78b54a4ac406d7d5f1cae0f767b47f6ba8eb7671d202fd379bd560201f5d7cc7
+  data.tar.gz: 020ec993034ceea2e4aa1e4f11d6d87486499bb0a5e241a7087ffbad2b0d981f
 SHA512:
-  metadata.gz: d853e55644fa3a6ea0ad5e87b8cfa030f9e377a093479dcabca223ee925e7fc19b78c6eefced487b551cb3daf336c1c246eedea9dbdc36818ac6c1d65146cf7b
-  data.tar.gz: 4e44a6f2b7190d21ccca3fd7ab29eb0ab7775d98beb73f131bb766c99ece304e410a8cb27d94c9312ff1edecdfbb130036bdc7115a90134a970de5e67c9b0d8d
+  metadata.gz: de52472901295cf6f857c01953829a2931d77423ec1b713e4789ed782b016012cdd70543be3c9c4463f89f78f2e4239b6c88eee521c71230e227e73f576c0c61
+  data.tar.gz: d8ea50434bf9909eb7bc3592bbcbe597c72112ac29e611e04fa6688ea31a2ab45e2984d149c0c89fb365c07bf05836a2a8bc0384ec5d691d58801028311cc58e

data/helpers/v2/composer.lock

@@ -2684,11 +2684,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.7",
+            "version": "2.2.8",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/692db47b9dddb0487934e5236e77d48594aef921",
-                "reference": "692db47b9dddb0487934e5236e77d48594aef921",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e285254e60f33c21902efef4a926ca0987c06804",
+                "reference": "e285254e60f33c21902efef4a926ca0987c06804",
                 "shasum": ""
             },
             "require": {
@@ -2744,7 +2744,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-29T17:39:32+00:00"
+            "time": "2026-08-04T22:21:45+00:00"
         },
         {
             "name": "psr/event-dispatcher",

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -122,21 +122,24 @@ module Dependabot
 
         sig { returns(T::Hash[String, String]) }
         def run_update_helper
-          SharedHelpers.with_git_configured(credentials: T.unsafe(credentials)) do
-            SharedHelpers.run_helper_subprocess(
-              command: "php -d memory_limit=-1 #{php_helper_path}",
-              allow_unsafe_shell_command: true,
-              function: "update",
-              env: credentials_env,
-              args: [
-                Dir.pwd,
-                dependency.name,
-                dependency.version,
-                git_credentials,
-                registry_credentials
-              ]
-            )
-          end
+          T.cast(
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              SharedHelpers.run_helper_subprocess(
+                command: "php -d memory_limit=-1 #{php_helper_path}",
+                allow_unsafe_shell_command: true,
+                function: "update",
+                env: credentials_env,
+                args: [
+                  Dir.pwd,
+                  dependency.name,
+                  dependency.version,
+                  git_credentials,
+                  registry_credentials
+                ]
+              )
+            end,
+            T::Hash[String, String]
+          )
         end
 
         sig { returns(String) }
@@ -320,8 +323,8 @@ module Dependabot
             next content unless Composer::Version.correct?(updated_req)
 
             old_req =
-              dep.requirements.find { |r| r[:file] == PackageManager::MANIFEST_FILENAME }
-                              &.fetch(:requirement)
+              dep.requirements.find { |r| r.file == PackageManager::MANIFEST_FILENAME }
+                              &.requirement_string
 
             # When updating a subdep there won't be an old requirement
             next content unless old_req
@@ -418,13 +421,15 @@ module Dependabot
           SharedHelpers.in_a_temporary_directory do
             File.write(PackageManager::MANIFEST_FILENAME, updated_composer_json_content)
 
-            content_hash =
+            content_hash = T.cast(
               SharedHelpers.run_helper_subprocess(
                 command: "#{Language::NAME} #{php_helper_path}",
                 function: "get_content_hash",
                 env: credentials_env,
                 args: [Dir.pwd]
-              )
+              ),
+              String
+            )
 
             content.gsub(existing_hash, content_hash)
           end

data/lib/dependabot/composer/file_updater/manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -23,8 +23,8 @@ module Dependabot
             dependencies.reduce(manifest.content.dup) do |content, dep|
               updated_content = content
               updated_requirements(dep).each do |new_req|
-                old_req = old_requirement(dep, new_req)&.fetch(:requirement)
-                updated_req = new_req.fetch(:requirement)
+                old_req = T.must(old_requirement(dep, new_req)&.requirement_string)
+                updated_req = T.must(new_req.requirement_string)
 
                 regex =
                   /
@@ -54,20 +54,20 @@ module Dependabot
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
         def new_requirements(dependency)
-          dependency.requirements.select { |r| r[:file] == manifest.name }
+          dependency.requirements.select { |r| r.file == manifest.name }
         end
 
         sig do
           params(
             dependency: Dependabot::Dependency,
-            new_requirement: T::Hash[Symbol, T.untyped]
+            new_requirement: Dependabot::DependencyRequirement
           )
-            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+            .returns(T.nilable(Dependabot::DependencyRequirement))
         end
         def old_requirement(dependency, new_requirement)
           T.must(dependency.previous_requirements)
-           .select { |r| r[:file] == manifest.name }
-           .find { |r| r[:groups] == new_requirement[:groups] }
+           .select { |r| r.file == manifest.name }
+           .find { |r| r.groups == new_requirement.groups }
         end
 
         sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -81,7 +81,7 @@ module Dependabot
           changed_requirements =
             dependency.requirements - T.must(dependency.previous_requirements)
 
-          changed_requirements.any? { |f| f[:file] == file.name }
+          changed_requirements.any? { |requirement| requirement.file == file.name }
         end
       end
     end

data/lib/dependabot/composer/metadata_finder.rb

@@ -36,12 +36,7 @@ module Dependabot
 
       sig { returns(T.nilable(Source)) }
       def source_from_dependency
-        source_url =
-          dependency.requirements
-                    .filter_map { |r| r.fetch(:source) }
-                    .first&.fetch(:url, nil)
-
-        Source.from_url(source_url)
+        Source.from_url(dependency.source_string("url"))
       end
 
       sig { returns(T.nilable(Source)) }

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -74,7 +74,7 @@ module Dependabot
           return true if current_version&.prerelease?
 
           dependency.requirements.any? do |req|
-            req[:requirement].match?(/\d-[A-Za-z]/)
+            req.requirement_string&.match?(/\d-[A-Za-z]/)
           end
         end
 

data/lib/dependabot/composer/update_checker/requirements_updater.rb

@@ -11,6 +11,7 @@ require "sorbet-runtime"
 require "dependabot/composer/requirement"
 require "dependabot/composer/update_checker"
 require "dependabot/composer/version"
+require "dependabot/dependency_requirement"
 require "dependabot/requirements_update_strategy"
 
 module Dependabot
@@ -36,7 +37,7 @@ module Dependabot
 
         sig do
           params(
-            requirements: T::Array[T::Hash[Symbol, String]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             latest_resolvable_version: T.nilable(T.any(String, Composer::Version))
           ).void
@@ -46,7 +47,10 @@ module Dependabot
           update_strategy:,
           latest_resolvable_version:
         )
-          @requirements = requirements
+          @requirements = T.let(
+            requirements.map { |requirement| Dependabot::DependencyRequirement.create(requirement) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @update_strategy = update_strategy
 
           check_update_strategy
@@ -59,7 +63,7 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, String]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
           return requirements unless latest_resolvable_version
@@ -69,7 +73,7 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T::Hash[Symbol, String]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(Dependabot::RequirementsUpdateStrategy) }
@@ -85,9 +89,12 @@ module Dependabot
           raise "Unknown update strategy: #{update_strategy}"
         end
 
-        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
+        sig do
+          params(req: Dependabot::DependencyRequirement)
+            .returns(Dependabot::DependencyRequirement)
+        end
         def updated_requirement(req)
-          req_string = T.must(req[:requirement]).strip
+          req_string = T.must(req.requirement_string).strip
           or_string_reqs = req_string.split(OR_SEPARATOR)
           or_separator = req_string.match(OR_SEPARATOR)&.to_s || " || "
           branch_or_string_reqs, numeric_or_string_reqs = or_string_reqs
@@ -110,12 +117,16 @@ module Dependabot
           # Add a T.must for new_req as it's defined in the case statement with multiple options
           new_req = T.must(new_req)
           new_req_string =
-            [new_req[:requirement], *branch_or_string_reqs].join(or_separator)
-          new_req.merge(requirement: new_req_string)
+            [T.must(new_req.requirement_string), *branch_or_string_reqs].join(or_separator)
+          Dependabot::DependencyRequirement.create(new_req.merge(requirement: new_req_string))
+        end
+
+        sig do
+          params(req: Dependabot::DependencyRequirement)
+            .returns(Dependabot::DependencyRequirement)
         end
-        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
         def updated_alias(req)
-          req_string = T.must(req[:requirement])
+          req_string = T.must(req.requirement_string)
           parts = req_string.split(/\sas\s/)
           real_version = T.must(parts.first).strip
 
@@ -125,13 +136,16 @@ module Dependabot
 
           new_version_string = T.must(latest_resolvable_version).to_s
           new_req = req_string.sub(real_version, new_version_string)
-          req.merge(requirement: new_req)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: new_req))
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
+        sig do
+          params(req: Dependabot::DependencyRequirement, or_separator: String)
+            .returns(Dependabot::DependencyRequirement)
+        end
         def widen_requirement(req, or_separator)
-          current_requirement = T.must(req[:requirement])
+          current_requirement = T.must(req.requirement_string)
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
@@ -147,13 +161,16 @@ module Dependabot
               update_version_string(current_requirement)
             end
 
-          req.merge(requirement: updated_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: updated_requirement))
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
-        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
+        sig do
+          params(req: Dependabot::DependencyRequirement, or_separator: String)
+            .returns(Dependabot::DependencyRequirement)
+        end
         def update_requirement_version(req, or_separator)
-          current_requirement = T.must(req[:requirement])
+          current_requirement = T.must(req.requirement_string)
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
@@ -167,7 +184,7 @@ module Dependabot
               update_version_string(current_requirement)
             end
 
-          req.merge(requirement: updated_requirement)
+          Dependabot::DependencyRequirement.create(req.merge(requirement: updated_requirement))
         end
 
         sig { params(requirement_string: String).returns(T::Boolean) }

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -188,19 +188,22 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def run_update_checker
-          SharedHelpers.with_git_configured(credentials: credentials) do
-            SharedHelpers.run_helper_subprocess(
-              command: "php -d memory_limit=-1 #{php_helper_path}",
-              allow_unsafe_shell_command: true,
-              function: "get_latest_resolvable_version",
-              args: [
-                Dir.pwd,
-                dependency.name.downcase,
-                git_credentials,
-                registry_credentials
-              ]
-            )
-          end
+          T.cast(
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              SharedHelpers.run_helper_subprocess(
+                command: "php -d memory_limit=-1 #{php_helper_path}",
+                allow_unsafe_shell_command: true,
+                function: "get_latest_resolvable_version",
+                args: [
+                  Dir.pwd,
+                  dependency.name.downcase,
+                  git_credentials,
+                  registry_credentials
+                ]
+              )
+            end,
+            T.nilable(String)
+          )
         end
 
         sig { params(unlock_requirement: T::Boolean).returns(String) }
@@ -265,22 +268,22 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        # rubocop:disable Metrics/AbcSize
         sig { returns(String) }
         def updated_version_requirement_string
           lower_bound =
             if requirements_to_unlock == :none
-              dependency.requirements.first&.fetch(:requirement) || ">= 0"
+              dependency.requirements.first&.requirement_string || ">= 0"
             elsif dependency.version
               ">= #{dependency.version}"
             else
               version_for_requirement =
-                dependency.requirements.filter_map { |r| r[:requirement] }
-                                       .reject { |req_string| req_string.start_with?("<") }
-                                       .select { |req_string| req_string.match?(VERSION_REGEX) }
-                                       .map { |req_string| req_string.match(VERSION_REGEX) }
-                                       .select { |version| requirement_valid?(">= #{version}") }
-                                       .max_by { |version| Composer::Version.new(version.to_s) }
+                dependency.requirements
+                          .filter_map(&:requirement_string)
+                          .reject { |req_string| req_string.start_with?("<") }
+                          .select { |req_string| req_string.match?(VERSION_REGEX) }
+                          .map { |req_string| req_string.match(VERSION_REGEX) }
+                          .select { |version| requirement_valid?(">= #{version}") }
+                          .max_by { |version| Composer::Version.new(version.to_s) }
 
               ">= #{version_for_requirement || 0}"
             end
@@ -301,7 +304,6 @@ module Dependabot
           lower_bound + ", == #{latest_allowable_version}"
         end
         # rubocop:enable Metrics/PerceivedComplexity
-        # rubocop:enable Metrics/AbcSize
 
         # TODO: Extract error handling and share between the lockfile updater
         #

data/lib/dependabot/composer/update_checker.rb

@@ -156,13 +156,13 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def path_dependency?
-        dependency.requirements.any? { |r| r.dig(:source, :type) == "path" }
+        dependency.requirements.any? { |r| r.source_string("type") == "path" }
       end
 
       # To be a true git dependency, it must have a branch.
       sig { returns(T::Boolean) }
       def git_dependency?
-        dependency.requirements.any? { |r| r.dig(:source, :branch) }
+        dependency.requirements.any? { |r| r.source_string("branch") }
       end
 
       sig { returns(Dependabot::DependencyFile) }
@@ -191,7 +191,7 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            git_commit_checker.local_tag_for_latest_version(update_cooldown)
           latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
-          return latest_tag&.fetch(:commit_sha)
+          return latest_tag&.commit_sha
         end
 
         # If the dependency is pinned to a tag that doesn't look like a

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -276,7 +276,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib