dependabot-composer 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c875aeabc51932faf7843fbe6d4444bc294d795159d0c782c0d4daf153d11dd
-  data.tar.gz: 12a8bcbcfcac84a6c9cdf1bff39d85969a8bf542c473823ec37b0eeb91b7bfcf
+  metadata.gz: 07e12166ab0d190876866057dd8196ab1effbdf3ac9e13e8634201d9675c9c3f
+  data.tar.gz: 0fc9b490113ad41da273feb357c8b08dc9b35526cdd345692501cd1cae7e03fb
 SHA512:
-  metadata.gz: 0d703bf16a31c5a7bdf828b61889901ba8d5f429afab240570aee4ba31981f38b2f3927f43721ebeaa7c231113d35c5fff48fd70f55aa2299ce1afc5c4e3bfdf
-  data.tar.gz: bd19ceff60eb473eb7b0da0400d127c634ebd5d1e5ca20de9a4313ff1f99dc4f4ba24abfa0ec2da29dc41440b227974aab56bf3503beca192cd1c3e092e3c298
+  metadata.gz: c9699dd1e74f17cbc50870681f33115a431105f802548c98676060350ea708544be22308edd1a140095877af63abd11a32bd567fe8301c7f53606b1757e04f03
+  data.tar.gz: eb7597f863112fafa2ebde80a654fee792b7a1ac9f2a6a92ef2cb4d5300ea046f55f3cebd5c10b80a8e00dd2adb5263fe9df386e1d88b8b2b22701b7591d1ff8

data/helpers/v2/composer.lock

@@ -405,16 +405,16 @@
         },
         {
             "name": "composer/semver",
-            "version": "3.4.4",
+            "version": "3.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/semver.git",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95"
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/semver/zipball/198166618906cb2de69b95d7d47e5fa8aa1b2b95",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95",
+                "url": "https://api.github.com/repos/composer/semver/zipball/f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
                 "shasum": ""
             },
             "require": {
@@ -456,7 +456,7 @@
                     "homepage": "http://robbast.nl"
                 }
             ],
-            "description": "Semver library that offers utilities, version constraint parsing and validation.",
+            "description": "Version comparison library that offers utilities, version constraint parsing and validation.",
             "keywords": [
                 "semantic",
                 "semver",
@@ -466,7 +466,7 @@
             "support": {
                 "irc": "ircs://irc.libera.chat:6697/composer",
                 "issues": "https://github.com/composer/semver/issues",
-                "source": "https://github.com/composer/semver/tree/3.4.4"
+                "source": "https://github.com/composer/semver/tree/3.5.0"
             },
             "funding": [
                 {
@@ -478,7 +478,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-08-20T19:15:30+00:00"
+            "time": "2026-09-24T14:38:51+00:00"
         },
         {
             "name": "composer/spdx-licenses",
@@ -2563,16 +2563,16 @@
         },
         {
             "name": "friendsofphp/php-cs-fixer",
-            "version": "v3.95.25",
+            "version": "v3.95.27",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git",
-                "reference": "2cdfc1f3daf173d83a1ebb6177949b58c95de6ff"
+                "reference": "1d0c68ee5f37446d8ad5970b82384cd1bb0a3317"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/2cdfc1f3daf173d83a1ebb6177949b58c95de6ff",
-                "reference": "2cdfc1f3daf173d83a1ebb6177949b58c95de6ff",
+                "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/1d0c68ee5f37446d8ad5970b82384cd1bb0a3317",
+                "reference": "1d0c68ee5f37446d8ad5970b82384cd1bb0a3317",
                 "shasum": ""
             },
             "require": {
@@ -2606,15 +2606,15 @@
             "require-dev": {
                 "facile-it/paraunit": "^1.3.1 || ^2.11.0",
                 "infection/infection": "^0.32.7",
-                "justinrainbow/json-schema": "^6.10.0",
+                "justinrainbow/json-schema": "^6.12.0",
                 "keradus/cli-executor": "^2.3",
                 "php-coveralls/php-coveralls": "^2.9.1",
                 "php-cs-fixer/phpunit-constraint-isidenticalstring": "^1.8",
                 "php-cs-fixer/phpunit-constraint-xmlmatchesxsd": "^1.8",
-                "phpunit/phpunit": "^9.6.35 || ^10.5.64 || ^11.5.56 || ^12.5.31 || ^13.0.6",
-                "symfony/polyfill-php85": "^1.38",
-                "symfony/var-dumper": "^5.4.48 || ^6.4.36 || ^7.4.8 || ^8.1.1",
-                "symfony/yaml": "^5.4.53 || ^6.4.41 || ^7.4.13 || ^8.1.1"
+                "phpunit/phpunit": "^9.6.36 || ^10.5.64 || ^11.5.56 || ^12.5.35 || ^13.3.3",
+                "symfony/polyfill-php85": "^1.41",
+                "symfony/var-dumper": "^5.4.48 || ^6.4.45 || ^7.4.18 || ^8.1.7",
+                "symfony/yaml": "^5.4.53 || ^6.4.45 || ^7.4.18 || ^8.1.6"
             },
             "suggest": {
                 "ext-dom": "For handling output formats in XML",
@@ -2655,7 +2655,7 @@
             ],
             "support": {
                 "issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues",
-                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.25"
+                "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.27"
             },
             "funding": [
                 {
@@ -2663,15 +2663,15 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-09-08T11:11:37+00:00"
+            "time": "2026-09-22T09:54:55+00:00"
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.14",
+            "version": "2.2.15",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9c672e7a8e791dfc3d30e55f683e73fc0b63a3ac",
-                "reference": "9c672e7a8e791dfc3d30e55f683e73fc0b63a3ac",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/b158556ffd26825cf615a1c1f72fb5157a2301b7",
+                "reference": "b158556ffd26825cf615a1c1f72fb5157a2301b7",
                 "shasum": ""
             },
             "require": {
@@ -2727,7 +2727,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-09-12T21:39:33+00:00"
+            "time": "2026-09-23T12:23:07+00:00"
         },
         {
             "name": "psr/event-dispatcher",

data/lib/dependabot/composer/document_value_parser.rb

@@ -0,0 +1,41 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Composer
+    module DocumentValueParser
+      extend T::Sig
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object_hash(value, context)
+        raise TypeError, "#{context} must be an object" unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise TypeError, "#{context} keys must be strings" unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+
+      sig { params(value: Object, context: String).returns(String) }
+      def self.string(value, context)
+        return value if value.is_a?(String)
+
+        raise TypeError, "#{context} must be a string"
+      end
+
+      sig { params(value: Object, context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+
+        string(value, context)
+      end
+    end
+    private_constant :DocumentValueParser
+  end
+end

data/lib/dependabot/composer/file_fetcher/path_dependency_builder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -7,6 +7,7 @@ require "sorbet-runtime"
 require "dependabot/dependency_file"
 require "dependabot/composer/file_fetcher"
 require "dependabot/composer/file_parser"
+require "dependabot/composer/lockfile_document"
 
 module Dependabot
   module Composer
@@ -19,7 +20,7 @@ module Dependabot
           @path = path
           @directory = directory
           @lockfile = lockfile
-          @parsed_lockfile = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @lockfile_document = T.let(nil, T.nilable(LockfileDocument))
         end
 
         sig { returns(T.nilable(DependencyFile)) }
@@ -45,23 +46,20 @@ module Dependabot
         sig { returns(String) }
         attr_reader :path
 
-        sig { returns(T.untyped) }
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :lockfile
 
         sig { returns(String) }
         attr_reader :directory
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(LockfileDocument::PackageRecord)) }
         def details_from_lockfile
           keys = FileParser::DEPENDENCY_GROUP_KEYS
                  .map { |h| h.fetch(:lockfile) }
 
           keys.each do |key|
-            next unless parsed_lockfile[key]
-
-            parsed_lockfile[key].each do |details|
-              return details if details.dig("dist", "url") == path
-            end
+            package = lockfile_document&.find_path_package(key, path)
+            return package if package
           end
 
           nil
@@ -69,18 +67,16 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def build_path_dep_content
-          return unless details_from_lockfile
-
-          details_from_lockfile.to_json
+          details_from_lockfile&.to_manifest_json
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
-        def parsed_lockfile
-          return {} unless lockfile
+        sig { returns(T.nilable(LockfileDocument)) }
+        def lockfile_document
+          return unless lockfile
 
-          @parsed_lockfile ||= T.let(JSON.parse(lockfile.content), T.nilable(T::Hash[String, T.untyped]))
+          @lockfile_document ||= LockfileDocument.from_file(T.must(lockfile))
         rescue JSON::ParserError
-          {}
+          nil
         end
       end
     end

data/lib/dependabot/composer/file_fetcher.rb

@@ -30,7 +30,7 @@ module Dependabot
       def ecosystem_versions
         {
           package_managers: {
-            PackageManager::NAME => Helpers.composer_version(parsed_composer_json, parsed_lockfile)
+            PackageManager::NAME => Helpers.composer_version(manifest_document, lockfile_document)
           }
         }
       end
@@ -152,31 +152,17 @@ module Dependabot
 
       sig { returns(T::Array[String]) }
       def artifact_sources
-        sources.select { |details| details["type"] == "artifact" }.map { |details| details["url"] }
+        sources.select { |details| details.type == "artifact" }.map(&:url)
       end
 
       sig { returns(T::Array[String]) }
       def path_sources
-        sources.select { |details| details["type"] == "path" }.map { |details| details["url"] }
+        sources.select { |details| details.type == "path" }.map(&:url)
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[ManifestDocument::Repository]) }
       def sources
-        @sources ||= T.let(
-          begin
-            repos = parsed_composer_json.fetch("repositories", [])
-            if repos.is_a?(Hash) || repos.is_a?(Array)
-              repos = repos.values if repos.is_a?(Hash)
-              repos = repos.grep(Hash)
-
-              repos
-                .select { |details| details["type"] == "path" || details["type"] == "artifact" }
-            else
-              []
-            end
-          end,
-          T.nilable(T::Array[T::Hash[String, T.untyped]])
-        )
+        @sources ||= T.let(manifest_document.repositories, T.nilable(T::Array[ManifestDocument::Repository]))
       end
 
       sig { params(unfetchable_deps: T::Array[String]).returns(T::Array[Dependabot::DependencyFile]) }
@@ -212,44 +198,38 @@ module Dependabot
         end
         directories
       rescue Octokit::NotFound, Gitlab::Error::NotFound
-        lockfile_path_dependency_paths
-          .select { |p| p.to_s.start_with?(path.gsub(/\*$/, "")) }
+        lockfile_path_dependency_paths(prefix: path.gsub(/\*$/, ""))
       end
 
-      sig { returns(T::Array[String]) }
-      def lockfile_path_dependency_paths
+      sig { params(prefix: String).returns(T::Array[String]) }
+      def lockfile_path_dependency_paths(prefix:)
         keys = FileParser::DEPENDENCY_GROUP_KEYS
                .map { |h| h.fetch(:lockfile) }
 
         keys.flat_map do |key|
-          next [] unless parsed_lockfile[key]
-
-          parsed_lockfile[key]
-            .select { |details| details.dig("dist", "type") == "path" }
-            .map { |details| details.dig("dist", "url") }
+          lockfile_document.path_packages(key)
+                           .select { |package| package.dist_url_starts_with?(prefix) }
+                           .map(&:dist_url)
         end
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def parsed_composer_json
-        @parsed_composer_json ||= T.let(
-          JSON.parse(T.must(composer_json.content)),
-          T.nilable(T::Hash[String, T.untyped])
-        )
+      sig { returns(ManifestDocument) }
+      def manifest_document
+        @manifest_document ||= T.let(ManifestDocument.from_file(composer_json), T.nilable(ManifestDocument))
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, composer_json.path
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def parsed_lockfile
-        return {} unless composer_lock
+      sig { returns(LockfileDocument) }
+      def lockfile_document
+        return LockfileDocument.new(data: {}, context: PackageManager::LOCKFILE_FILENAME) unless composer_lock
 
-        @parsed_lockfile ||= T.let(
-          JSON.parse(T.must(T.must(composer_lock).content)),
-          T.nilable(T::Hash[String, T.untyped])
+        @lockfile_document ||= T.let(
+          LockfileDocument.from_file(T.must(composer_lock)),
+          T.nilable(LockfileDocument)
         )
       rescue JSON::ParserError
-        {}
+        LockfileDocument.new(data: {}, context: PackageManager::LOCKFILE_FILENAME)
       end
 
       sig { params(filename: String).returns(Dependabot::DependencyFile) }

data/lib/dependabot/composer/file_parser.rb

@@ -1,9 +1,11 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/composer"
 require "dependabot/dependency"
 require "dependabot/composer/version"
+require "dependabot/composer/manifest_document"
+require "dependabot/composer/lockfile_document"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
@@ -94,7 +96,7 @@ module Dependabot
       # Capture PHP requirement from the composer.json
       sig { returns(T.nilable(Requirement)) }
       def php_requirement
-        requirement_string = Helpers.php_constraint(parsed_composer_json)
+        requirement_string = Helpers.php_constraint(manifest_document)
 
         return nil unless requirement_string
 
@@ -117,15 +119,15 @@ module Dependabot
           manifest = keys[:manifest]
           next unless manifest.is_a?(String)
 
-          next unless parsed_composer_json[manifest].is_a?(Hash)
-
-          parsed_composer_json[manifest].each do |name, req|
+          manifest_document.requirements(manifest).each do |entry|
+            name = entry.name
             next unless package?(name)
 
+            req = entry.string_requirement
             local_package_prefix = ["dev-main", "dev-master", "@dev"]
 
             # we avoid updating local packages, so we skip them adding to dependency list
-            if local_package_prefix.include?(req)
+            if req && local_package_prefix.include?(req)
               Dependabot.logger.info("Skipping #{name} with version #{req} as it cannot be updated.")
               next
             end
@@ -143,7 +145,7 @@ module Dependabot
                           version&.match?(/^[0-9a-f]{40}$/)
             end
 
-            dependencies << build_manifest_dependency(name, req, keys)
+            dependencies << build_manifest_dependency(name, entry.requirement, keys)
           end
         end
 
@@ -180,13 +182,11 @@ module Dependabot
 
         DEPENDENCY_GROUP_KEYS.each do |keys|
           key = keys.fetch(:lockfile)
-          next unless parsed_lockfile&.[](key).is_a?(Array)
-
-          parsed_lockfile&.[](key)&.each do |details|
-            name = details["name"]
-            next unless name.is_a?(String) && package?(name)
+          lockfile_document&.packages(key)&.each do |details|
+            name = details.name
+            next unless name && package?(name)
 
-            version = details["version"]&.to_s&.sub(/^v?/, "")
+            version = details.version&.sub(/^v?/, "")
             next unless version.is_a?(String)
             next unless version.match?(/^\d/) ||
                         version.match?(/^[0-9a-f]{40}$/)
@@ -219,10 +219,10 @@ module Dependabot
         package = lockfile_details(name: name, type: type)
         return unless package
 
-        version = package.fetch("version")&.to_s&.sub(/^v?/, "")
+        version = package.required_version&.sub(/^v?/, "")
         return version unless version&.start_with?("dev-")
 
-        package.dig("source", "reference")
+        package.source_reference
       end
 
       sig do
@@ -230,7 +230,7 @@ module Dependabot
           name: String,
           type: String,
           requirement: String
-        ).returns(T.nilable(T::Hash[Symbol, T.nilable(String)]))
+        ).returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash))
       end
       def dependency_source(name:, type:, requirement:)
         return unless lockfile
@@ -238,22 +238,20 @@ module Dependabot
         package_details = lockfile_details(name: name, type: type)
         return unless package_details
 
-        if package_details["source"].nil? &&
-           package_details.dig("dist", "type") == "path"
-          return { type: "path" }
-        end
+        return { type: "path" } if package_details.path_source?
 
         git_dependency_details(package_details, requirement)
       end
 
       sig do
         params(
-          package_details: T::Hash[String, T.untyped],
+          package_details: LockfileDocument::PackageRecord,
           requirement: String
-        ).returns(T.nilable(T::Hash[Symbol, T.nilable(String)]))
+        ).returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash))
       end
       def git_dependency_details(package_details, requirement)
-        return unless package_details.dig("source", "type") == "git"
+        details = package_details.git_source
+        return unless details
 
         branch =
           if requirement.start_with?("dev-")
@@ -261,20 +259,19 @@ module Dependabot
               .sub(/^dev-/, "")
               .sub(/\s+as\s.*/, "")
               .split("#").first
-          elsif package_details.fetch("version")&.to_s&.start_with?("dev-")
-            package_details.fetch("version")&.to_s&.sub(/^dev-/, "")
+          elsif package_details.required_version&.start_with?("dev-")
+            package_details.required_version&.sub(/^dev-/, "")
           end
 
-        details = { type: "git", url: package_details.dig("source", "url") }
         return details unless branch
 
         details.merge(branch: branch, ref: nil)
       end
 
-      sig { params(name: String, type: String).returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { params(name: String, type: String).returns(T.nilable(LockfileDocument::PackageRecord)) }
       def lockfile_details(name:, type:)
         key = lockfile_key(type)
-        parsed_lockfile&.fetch(key, [])&.find { |d| d["name"] == name }
+        lockfile_document&.find_package(key, name)
       end
 
       sig { params(type: String).returns(String) }
@@ -296,21 +293,21 @@ module Dependabot
         raise "No #{PackageManager::MANIFEST_FILENAME}!" unless get_original_file(PackageManager::MANIFEST_FILENAME)
       end
 
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
-      def parsed_lockfile # rubocop:disable Metrics/PerceivedComplexity
+      sig { returns(T.nilable(LockfileDocument)) }
+      def lockfile_document # rubocop:disable Metrics/PerceivedComplexity
         return unless lockfile
 
         content = lockfile&.content
 
         raise Dependabot::DependencyFileNotParseable, lockfile&.path || "" if content.nil? || content.strip.empty?
 
-        @parsed_lockfile ||= T.let(JSON.parse(content), T.nilable(T::Hash[String, T.untyped]))
+        @lockfile_document ||= T.let(LockfileDocument.from_file(T.must(lockfile)), T.nilable(LockfileDocument))
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, lockfile&.path || ""
       end
 
-      sig { returns(T::Hash[String, T.untyped]) }
-      def parsed_composer_json
+      sig { returns(ManifestDocument) }
+      def manifest_document
         content = composer_json&.content
 
         if content.nil? || content.strip.empty?
@@ -318,7 +315,7 @@ module Dependabot
                 composer_json&.path || ""
         end
 
-        @parsed_composer_json ||= T.let(JSON.parse(content), T.nilable(T::Hash[String, T.untyped]))
+        @manifest_document ||= T.let(ManifestDocument.from_file(T.must(composer_json)), T.nilable(ManifestDocument))
       rescue JSON::ParserError
         raise Dependabot::DependencyFileNotParseable, composer_json&.path || ""
       end
@@ -342,7 +339,7 @@ module Dependabot
       sig { returns(String) }
       def composer_version
         @composer_version ||= T.let(
-          Helpers.composer_version(parsed_composer_json, parsed_lockfile),
+          Helpers.composer_version(manifest_document, lockfile_document),
           T.nilable(String)
         )
       end

data/lib/dependabot/composer/file_updater/lockfile_updater.rb

@@ -509,7 +509,10 @@ module Dependabot
         sig { returns(String) }
         def composer_version
           @composer_version ||= T.let(
-            Helpers.composer_version(parsed_composer_json, parsed_lockfile),
+            Helpers.composer_version(
+              manifest_document,
+              LockfileDocument.new(data: parsed_lockfile, context: lockfile.path)
+            ),
             T.nilable(String)
           )
         end
@@ -537,7 +540,7 @@ module Dependabot
 
         sig { returns(T::Hash[String, T::Array[String]]) }
         def initial_platform
-          platform_php = Helpers.capture_platform_php(parsed_composer_json)
+          platform_php = Helpers.capture_platform_php(manifest_document)
 
           platform = {}
           platform[Language::NAME] = [platform_php] if platform_php.is_a?(String) && requirement_valid?(platform_php)
@@ -545,7 +548,7 @@ module Dependabot
           # NOTE: We *don't* include the require-dev PHP version in our initial
           # platform. If we fail to resolve with the PHP version specified in
           # `require` then it will be picked up in a subsequent iteration.
-          requirement_php = Helpers.php_constraint(parsed_composer_json)
+          requirement_php = Helpers.php_constraint(manifest_document)
           return platform unless requirement_php.is_a?(String)
           return platform unless requirement_valid?(requirement_php)
 
@@ -562,6 +565,14 @@ module Dependabot
           false
         end
 
+        sig { returns(ManifestDocument) }
+        def manifest_document
+          @manifest_document ||= T.let(
+            ManifestDocument.new(data: parsed_composer_json, context: composer_json.path),
+            T.nilable(ManifestDocument)
+          )
+        end
+
         sig { returns(T::Hash[String, T.untyped]) }
         def parsed_composer_json
           @parsed_composer_json ||= T.let(