dependabot-composer 0.308.0 → 0.309.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8cf83dff0ec628783dcf7ec7c9213b172c4b73b95f29f22c74360766e06fedb
-  data.tar.gz: a5a7275d8226e18617c650554e1f3260ff6c5d311de4de575725471a1e85fa5e
+  metadata.gz: 5b48559b241f9da95640467394b1126858e5eabfbfe6f14d409e2ce774dd7afc
+  data.tar.gz: 3a0e66c465ea0793a19353c01a631e8f77e0ff46ecb9418a27690b544e32a214
 SHA512:
-  metadata.gz: 82504108facc90a27aa88fc5274634b75095c9ad21f2aaae9996ad166c0021d64df43bffa8468eba5a8d6f96dd5bab7ecf5e26086edc660d6c4e8cc6dfd5bbe0
-  data.tar.gz: 791e9ef944a5c1352246ae1663309cda79d62cd04a7da42f39601a092abaf91ee4c635c64b14dcb429655f104d97d11400ec150a50da1117989648fc2cdd295c
+  metadata.gz: 4074f195864b3aec259bf220a25901c7532dd994c3c950a3d3eeaa985492e9dac9c2904b0210a87050aab8f75f3e14a2eb7476c6e019a133655e700c121889c3
+  data.tar.gz: c7744f1a7bf86c76acedeb4b5e6552cc1a63d6723d32034d0195261756e4a8c243bbd08ccbd289fa0851516e6fe9c7335a73a7c44bb79f5d62173fa328d67526

data/lib/dependabot/composer/file_fetcher/path_dependency_builder.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
+require "sorbet-runtime"
+
 require "dependabot/dependency_file"
 require "dependabot/composer/file_fetcher"
 require "dependabot/composer/file_parser"
@@ -10,12 +12,17 @@ module Dependabot
   module Composer
     class FileFetcher
       class PathDependencyBuilder
+        extend T::Sig
+
+        sig { params(path: String, directory: String, lockfile: T.untyped).void }
         def initialize(path:, directory:, lockfile:)
-          @path = path
-          @directory = directory
-          @lockfile = lockfile
+          @path = T.let(path, String)
+          @directory = T.let(directory, String)
+          @lockfile = T.let(lockfile, T.untyped)
+          @parsed_lockfile = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         end
 
+        sig { returns(T.nilable(DependencyFile)) }
         def dependency_file
           filename = File.join(path, PackageManager::MANIFEST_FILENAME)
 
@@ -35,10 +42,16 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         attr_reader :path
+
+        sig { returns(T.untyped) }
         attr_reader :lockfile
+
+        sig { returns(String) }
         attr_reader :directory
 
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
         def details_from_lockfile
           keys = FileParser::DEPENDENCY_GROUP_KEYS
                  .map { |h| h.fetch(:lockfile) }
@@ -54,16 +67,18 @@ module Dependabot
           nil
         end
 
+        sig { returns(T.nilable(String)) }
         def build_path_dep_content
           return unless details_from_lockfile
 
           details_from_lockfile.to_json
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_lockfile
           return {} unless lockfile
 
-          @parsed_lockfile ||= JSON.parse(lockfile.content)
+          @parsed_lockfile ||= T.let(JSON.parse(lockfile.content), T.nilable(T::Hash[String, T.untyped]))
         rescue JSON::ParserError
           {}
         end

data/lib/dependabot/composer/metadata_finder.rb

@@ -12,10 +12,12 @@ module Dependabot
     class MetadataFinder < Dependabot::MetadataFinders::Base
       private
 
+      sig { override.returns(T.nilable(Source)) }
       def look_up_source
         source_from_dependency || look_up_source_from_packagist
       end
 
+      sig { returns(T.nilable(Source)) }
       def source_from_dependency
         source_url =
           dependency.requirements
@@ -25,18 +27,21 @@ module Dependabot
         Source.from_url(source_url)
       end
 
+      sig { returns(T.nilable(Source)) }
       def look_up_source_from_packagist
-        return nil if packagist_listing&.fetch("packages", nil) == []
-        return nil unless packagist_listing&.dig("packages", dependency.name.downcase)
+        listing = packagist_listing
+        return nil if listing&.fetch("packages", nil) == []
+
+        packages = listing&.dig("packages", dependency.name.downcase)
+        return nil unless packages
 
-        version_listings = packagist_listing["packages"][dependency.name.downcase]
         # Packagist returns an array of version listings sorted newest to oldest.
         # So iterate until we find the first URL that appears to be a source URL.
         #
         # NOTE: Each listing may not have all fields because they are minified to remove duplicate elements:
         # * https://github.com/composer/composer/blob/main/UPGRADE-2.0.md#for-composer-repository-implementors
         # * https://github.com/composer/metadata-minifier
-        version_listings.each do |i|
+        packages.each do |i|
           [i["homepage"], i.dig("source", "url")].each do |url|
             source_url = Source.from_url(url)
             return source_url unless source_url.nil?
@@ -45,6 +50,7 @@ module Dependabot
         nil
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def packagist_listing
         return @packagist_listing unless @packagist_listing.nil?
 

data/lib/dependabot/composer/native_helpers.rb

@@ -1,17 +1,24 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Composer
     module NativeHelpers
+      extend T::Sig
+
+      sig { params(composer_version: String).returns(String) }
       def self.composer_helper_path(composer_version: "2")
         File.join(composer_helpers_dir, "v#{composer_version}", "bin/run")
       end
 
+      sig { returns(String) }
       def self.composer_helpers_dir
         File.join(native_helpers_root, "composer")
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         default_path = File.join(__dir__, "../../../..")
         ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", default_path)

data/lib/dependabot/composer/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -14,6 +14,7 @@ module Dependabot
       AND_SEPARATOR = /(?<=[a-zA-Z0-9*])(?<!\sas)[\s,]+(?![\s,]*[|-]|as)/
       OR_SEPARATOR = /(?<=[a-zA-Z0-9*])[\s,]*\|\|?\s*/
 
+      sig { params(obj: String).returns(T::Array[T.any(String, Version)]) }
       def self.parse(obj)
         new_obj = obj.gsub(/@\w+/, "").gsub(/[a-z0-9\-_\.]*\sas\s+/i, "")
         return DefaultRequirement if new_obj == ""
@@ -30,6 +31,7 @@ module Dependabot
         end
       end
 
+      sig { params(requirements: T.untyped).void }
       def initialize(*requirements)
         requirements =
           requirements.flatten
@@ -41,6 +43,7 @@ module Dependabot
 
       private
 
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
       def convert_php_constraint_to_ruby_constraint(req_string)
         req_string = req_string.strip.gsub(/v(?=\d)/, "").gsub(/\.$/, "")
 
@@ -59,6 +62,7 @@ module Dependabot
         end
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_wildcard_req(req_string)
         if req_string.start_with?(">", "<")
           msg = "Illformed requirement [#{req_string.inspect}]"
@@ -69,17 +73,19 @@ module Dependabot
         "~> #{version}.0"
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_tilde_req(req_string)
         version = req_string.gsub(/^~/, "")
         "~> #{version}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^/, "").gsub("x-dev", "0")
         parts = version.split(".")
         first_non_zero = parts.find { |d| d != "0" }
         first_non_zero_index =
-          first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          first_non_zero ? T.must(parts.index(first_non_zero)) : parts.count - 1
         upper_bound = parts.map.with_index do |part, i|
           if i < first_non_zero_index then part
           elsif i == first_non_zero_index then (part.to_i + 1).to_s
@@ -91,8 +97,10 @@ module Dependabot
         [">= #{version}", "< #{upper_bound}"]
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_hyphen_req(req_string)
         lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+        upper_bound = T.must(upper_bound)
         if upper_bound.split(".").count < 3
           upper_bound_parts = upper_bound.split(".")
           upper_bound_parts[-1] = (upper_bound_parts[-1].to_i + 1).to_s

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -260,23 +260,6 @@ module Dependabot
             raise PrivateSourceAuthenticationFailure, "nova.laravel.com"
           end
 
-          # To handle the case where the PHP version (configured in composer.json) is not supported
-          # league/csv 9.21.0 requires php ^8.1.2 -> your php version 8.1
-          if error.message.include?("your php version")
-            tool_name = "PHP"
-            # Match for the detected PHP version
-            detected_version_match =
-              error.message.match(/your php version \((\d+\.\d+\.\d+)\)/) ||
-              error.message.match(/your php version \((.*?)\s*;/)
-            detected_version = detected_version_match ? detected_version_match[1] : nil
-
-            # Match for the supported PHP versions
-            supported_versions_match = error.message.match(/requires php\s(.*?)\s->/)
-            supported_versions = supported_versions_match ? supported_versions_match[1] : nil
-
-            raise ToolVersionNotSupported.new(tool_name, detected_version, supported_versions)
-          end
-
           dependency_url = Helpers.dependency_url_from_git_clone_error(error.message)
           if dependency_url
             raise Dependabot::GitDependenciesNotReachable, dependency_url

data/lib/dependabot/composer/update_checker.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
+require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/requirements_update_strategy"
@@ -12,10 +13,13 @@ require "dependabot/update_checkers/base"
 module Dependabot
   module Composer
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/latest_version_finder"
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         return nil if path_dependency?
         return latest_version_for_git_dependency if git_dependency?
@@ -24,45 +28,54 @@ module Dependabot
         latest_version_from_registry || latest_resolvable_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
       def latest_resolvable_version
         return nil if path_dependency? || git_dependency?
 
-        @latest_resolvable_version ||=
+        @latest_resolvable_version ||= T.let(
           VersionResolver.new(
             credentials: credentials,
             dependency: dependency,
             dependency_files: dependency_files,
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :own
-          ).latest_resolvable_version
+          ).latest_resolvable_version,
+          T.nilable(Dependabot::Composer::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
-        return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
-
-        @lowest_resolvable_security_fix_version =
-          fetch_lowest_resolvable_security_fix_version
+        @lowest_resolvable_security_fix_version ||= T.let(
+          fetch_lowest_resolvable_security_fix_version,
+          T.nilable(Dependabot::Composer::Version)
+        )
       end
 
+      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
       def latest_resolvable_version_with_no_unlock
         return nil if path_dependency? || git_dependency?
 
-        @latest_resolvable_version_with_no_unlock ||=
+        @latest_resolvable_version_with_no_unlock ||= T.let(
           VersionResolver.new(
             credentials: credentials,
             dependency: dependency,
             dependency_files: dependency_files,
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :none
-          ).latest_resolvable_version
+          ).latest_resolvable_version,
+          T.nilable(Dependabot::Composer::Version)
+        )
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -71,10 +84,12 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
-        !requirements_update_strategy.lockfile_only?
+        !requirements_update_strategy&.lockfile_only?
       end
 
+      sig { returns(T.nilable(Dependabot::RequirementsUpdateStrategy)) }
       def requirements_update_strategy
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
@@ -85,30 +100,38 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Composer (yet)
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
+      sig { returns(T.nilable(Dependabot::Composer::Version)) }
       def latest_version_from_registry
         latest_version_finder.latest_version
       end
 
+      sig { returns(Dependabot::Composer::UpdateChecker::LatestVersionFinder) }
       def latest_version_finder
-        @latest_version_finder ||= LatestVersionFinder.new(
-          dependency: dependency,
-          dependency_files: dependency_files,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          raise_on_ignored: raise_on_ignored,
-          security_advisories: security_advisories
+        @latest_version_finder ||= T.let(
+          LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
+            security_advisories: security_advisories
+          ),
+          T.nilable(Dependabot::Composer::UpdateChecker::LatestVersionFinder)
         )
       end
 
+      sig { returns(T.nilable(Dependabot::Composer::Version)) }
       def fetch_lowest_resolvable_security_fix_version
         return nil if path_dependency? || git_dependency?
 
@@ -128,15 +151,18 @@ module Dependabot
         latest_resolvable_version
       end
 
+      sig { returns(T::Boolean) }
       def path_dependency?
         dependency.requirements.any? { |r| r.dig(:source, :type) == "path" }
       end
 
       # To be a true git dependency, it must have a branch.
+      sig { returns(T::Boolean) }
       def git_dependency?
         dependency.requirements.any? { |r| r.dig(:source, :branch) }
       end
 
+      sig { returns(Dependabot::DependencyFile) }
       def composer_file
         composer_file =
           dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
@@ -145,10 +171,12 @@ module Dependabot
         composer_file
       end
 
+      sig { returns(T::Boolean) }
       def library?
-        JSON.parse(composer_file.content)["type"] == "library"
+        JSON.parse(T.must(composer_file.content))["type"] == "library"
       end
 
+      sig { returns(T.nilable(String)) }
       def latest_version_for_git_dependency
         # If the dependency isn't pinned then we just want to check that it
         # points to the latest commit on the relevant branch.
@@ -160,7 +188,7 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            git_commit_checker.local_tag_for_latest_version
           latest_tag = git_commit_checker.local_tag_for_latest_version
-          return latest_tag.fetch(:commit_sha)
+          return latest_tag&.fetch(:commit_sha)
         end
 
         # If the dependency is pinned to a tag that doesn't look like a
@@ -168,12 +196,16 @@ module Dependabot
         dependency.version
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
-        @git_commit_checker ||= Dependabot::GitCommitChecker.new(
-          dependency: dependency,
-          credentials: credentials,
-          ignored_versions: ignored_versions,
-          raise_on_ignored: raise_on_ignored
+        @git_commit_checker ||= T.let(
+          Dependabot::GitCommitChecker.new(
+            dependency: dependency,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored
+          ),
+          T.nilable(Dependabot::GitCommitChecker)
         )
       end
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.308.0
+  version: 0.309.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-04-12 00:00:00.000000000 Z
+date: 2025-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.308.0
+        version: 0.309.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -279,7 +279,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.308.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.309.0
 rdoc_options: []
 require_paths:
 - lib