dependabot-composer 0.311.0 → 0.312.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b7f9286dece3b3c0c35b5be85a580078a6467edb4dd43b9817601f541b5c2cf
-  data.tar.gz: 4d31a01b968c789451178cee2855a6e507fad696663bac7e01cc89103b6a5c0c
+  metadata.gz: 8c49eb03ec5cdf799b6e907a757ba5e332dfcea06312b82cb21d38e94da364f6
+  data.tar.gz: c49110cee8257749ed2d7f03c2f868d088d4219e9cd42cd39835aa8c80b3c48a
 SHA512:
-  metadata.gz: fb35c79db05afba4a18eceb83722484488031b68503975dd13df219b3eaba3d98d931bb0850dd74f2c5a3023689441e436083f01e81a188bd1db897840496a86
-  data.tar.gz: d963a5ccdc05bc63e3ee72b6d59bd8e9e8eedd3ac71d3a7da457d803ccd9ff618cf2d68c5da1e6e6707606cbbc1d094664dbc2d386fe3ca22ace4116eaa3a5cd
+  metadata.gz: d792223dd012bd103ed61ddb50f4dcdd5d0ba86657939c8cdb70f52655e74e9b59535e983a8929bb533fe1ce9bffd00977fa66deb2ecc467fadb472d23cb5d53
+  data.tar.gz: 8618aa8c287c4eee25fedf9a551d5c682fc92464e0e5d3fd7a0018ed5752fdcbe96fe9512032fe86aa32c268c1abbe60dcaceaba2e6ccdc707b228d0e9c26e7f

data/lib/dependabot/composer/helpers.rb

@@ -174,7 +174,7 @@ module Dependabot
 
       sig { params(dependency_url: String).returns(String) }
       def self.clean_dependency_url(dependency_url)
-        return dependency_url unless URI::DEFAULT_PARSER.regexp[:ABS_URI].match?(dependency_url)
+        return dependency_url unless URI::RFC2396_PARSER.regexp[:ABS_URI].match?(dependency_url)
 
         url = URI.parse(dependency_url)
         url.user = nil

data/lib/dependabot/composer/update_checker/latest_version_finder.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "json"
+require "sorbet-runtime"
 
 require "dependabot/composer/update_checker"
 require "dependabot/update_checkers/version_filters"
@@ -13,9 +14,20 @@ module Dependabot
   module Composer
     class UpdateChecker
       class LatestVersionFinder
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
-                       security_advisories:)
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean
+          ).void
+        end
+        def initialize(dependency:, dependency_files:, credentials:, ignored_versions:, security_advisories:,
+                       raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
@@ -24,22 +36,40 @@ module Dependabot
           @security_advisories = security_advisories
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_version
-          @latest_version ||= fetch_latest_version
+          @latest_version ||= T.let(
+            fetch_latest_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def lowest_security_fix_version
-          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+          @lowest_security_fix_version ||= T.let(
+            fetch_lowest_security_fix_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_latest_version
           versions = available_versions
           versions = filter_prerelease_versions(versions)
@@ -47,6 +77,7 @@ module Dependabot
           versions.max
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_lowest_security_fix_version
           versions = available_versions
           versions = filter_prerelease_versions(versions)
@@ -58,12 +89,14 @@ module Dependabot
           versions.min
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
           versions_array.reject(&:prerelease?)
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_ignored_versions(versions_array)
           filtered =
             versions_array
@@ -76,6 +109,7 @@ module Dependabot
           filtered
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.numeric_version
 
@@ -83,6 +117,7 @@ module Dependabot
             .select { |version| version > dependency.numeric_version }
         end
 
+        sig { returns(T::Boolean) }
         def wants_prerelease?
           current_version = dependency.numeric_version
           return true if current_version&.prerelease?
@@ -92,17 +127,19 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::Version]) }
         def available_versions
           registry_version_details
             .select { |version| version_class.correct?(version.gsub(/^v/, "")) }
             .map { |version| version_class.new(version.gsub(/^v/, "")) }
         end
 
+        sig { returns(T::Array[String]) }
         def registry_version_details
           return @registry_version_details unless @registry_version_details.nil?
 
           repositories =
-            JSON.parse(composer_file.content)
+            JSON.parse(T.must(composer_file.content))
                 .fetch("repositories", [])
                 .select { |r| r.is_a?(Hash) }
 
@@ -115,16 +152,19 @@ module Dependabot
             urls << "https://repo.packagist.org/p2/#{dependency.name.downcase}.json"
           end
 
-          @registry_version_details = []
+          @registry_version_details ||= T.let([], T.nilable(T::Array[String]))
           urls.each do |url|
             @registry_version_details += fetch_registry_versions_from_url(url)
           end
           @registry_version_details.uniq
         end
 
+        sig { params(url: String).returns(T::Array[String]) }
         def fetch_registry_versions_from_url(url)
           url_host = URI(url).host
-          cred = registry_credentials.find { |c| url_host == c["registry"] || url_host == URI(c["registry"]).host }
+          cred = registry_credentials.find do |c|
+            url_host == c["registry"] || url_host == URI(T.must(c["registry"])).host
+          end
 
           response = Dependabot::RegistryClient.get(
             url: url,
@@ -139,6 +179,7 @@ module Dependabot
           []
         end
 
+        sig { params(response: T.untyped, url: String).returns(T::Array[String]) }
         def parse_registry_response(response, url)
           return [] unless response.status == 200
 
@@ -154,6 +195,7 @@ module Dependabot
           raise DependencyFileNotResolvable, msg
         end
 
+        sig { params(listing: T::Hash[String, T.untyped]).returns(T::Array[String]) }
         def extract_versions(listing)
           # Packagist's Metadata API format:
           # v1: "packages": {<package name>: {<version_number>: {hash of metadata for a particular release version}}}
@@ -174,26 +216,32 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials.select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY } +
             auth_json_credentials
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def auth_json_credentials
-          return [] unless auth_json
+          json = auth_json
+          return [] unless json
 
-          parsed_auth_json = JSON.parse(auth_json.content)
+          parsed_auth_json = JSON.parse(T.must(json.content))
           parsed_auth_json.fetch("http-basic", {}).map do |reg, details|
-            {
+            Dependabot::Credential.new({
               "registry" => reg,
               "username" => details["username"],
               "password" => details["password"]
-            }
+            })
           end
         rescue JSON::ParserError
-          raise Dependabot::DependencyFileNotParseable, auth_json.path
+          raise Dependabot::DependencyFileNotParseable, json.path if json
+
+          raise Dependabot::DependencyFileNotParseable, "Unknown path"
         end
 
+        sig { returns(Dependabot::DependencyFile) }
         def composer_file
           composer_file =
             dependency_files.find do |f|
@@ -204,18 +252,22 @@ module Dependabot
           composer_file
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def auth_json
           dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
         end
 
+        sig { returns(T::Array[Dependabot::Requirement]) }
         def ignore_requirements
           ignored_versions.map { |req| requirement_class.new(req.split(",")) }
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T.class_of(Dependabot::Requirement)) }
         def requirement_class
           dependency.requirement_class
         end

data/lib/dependabot/composer/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 ################################################################################
@@ -34,6 +34,13 @@ module Dependabot
           T::Array[Dependabot::RequirementsUpdateStrategy]
         )
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, String]],
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            latest_resolvable_version: T.nilable(T.any(String, Composer::Version))
+          ).void
+        end
         def initialize(requirements:, update_strategy:,
                        latest_resolvable_version:)
           @requirements = requirements
@@ -43,10 +50,13 @@ module Dependabot
 
           return unless latest_resolvable_version
 
-          @latest_resolvable_version =
-            version_class.new(latest_resolvable_version)
+          @latest_resolvable_version = T.let(
+            version_class.new(latest_resolvable_version),
+            Dependabot::Version
+          )
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, String]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
           return requirements unless latest_resolvable_version
@@ -56,10 +66,16 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[T::Hash[Symbol, String]]) }
         attr_reader :requirements
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T.nilable(Dependabot::Version)) }
         attr_reader :latest_resolvable_version
 
+        sig { void }
         def check_update_strategy
           return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
 
@@ -67,8 +83,9 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
         def updated_requirement(req)
-          req_string = req[:requirement].strip
+          req_string = T.must(req[:requirement]).strip
           or_string_reqs = req_string.split(OR_SEPARATOR)
           or_separator = req_string.match(OR_SEPARATOR)&.to_s || " || "
           numeric_or_string_reqs = or_string_reqs
@@ -90,28 +107,33 @@ module Dependabot
               update_requirement_version(req, or_separator)
             end
 
+          # Add a T.must for new_req as it's defined in the case statement with multiple options
+          new_req = T.must(new_req)
           new_req_string =
             [new_req[:requirement], *branch_or_string_reqs].join(or_separator)
           new_req.merge(requirement: new_req_string)
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, String]).returns(T::Hash[Symbol, String]) }
         def updated_alias(req)
-          req_string = req[:requirement]
-          real_version = req_string.split(/\sas\s/).first.strip
+          req_string = T.must(req[:requirement])
+          parts = req_string.split(/\sas\s/)
+          real_version = T.must(parts.first).strip
 
           # If the version we're aliasing isn't a version then we don't know
           # how to update it, so we just return the existing requirement.
           return req unless version_class.correct?(real_version)
 
-          new_version_string = latest_resolvable_version.to_s
+          new_version_string = T.must(latest_resolvable_version).to_s
           new_req = req_string.sub(real_version, new_version_string)
           req.merge(requirement: new_req)
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
         def widen_requirement(req, or_separator)
-          current_requirement = req[:requirement]
+          current_requirement = T.must(req[:requirement])
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
@@ -131,13 +153,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, String], or_separator: String).returns(T::Hash[Symbol, String]) }
         def update_requirement_version(req, or_separator)
-          current_requirement = req[:requirement]
+          current_requirement = T.must(req[:requirement])
           reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
 
           updated_requirement =
             if reqs.count > 1
-              "^#{latest_resolvable_version}"
+              "^#{T.must(latest_resolvable_version)}"
             elsif reqs.any? { |r| r.match?(/<|(\s+-\s+)/) }
               update_range_requirement(current_requirement, or_separator)
             elsif reqs.any? { |r| r.match?(/>[^=]/) }
@@ -149,38 +172,42 @@ module Dependabot
           req.merge(requirement: updated_requirement)
         end
 
+        sig { params(requirement_string: String).returns(T::Boolean) }
         def req_satisfied_by_latest_resolvable?(requirement_string)
           ruby_requirements(requirement_string)
-            .any? { |r| r.satisfied_by?(latest_resolvable_version) }
+            .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_version_string(req_string)
           req_string
             .sub(VERSION_REGEX) do |old_version|
-              next latest_resolvable_version.to_s unless req_string.match?(/[~*\^]/)
+              next T.must(latest_resolvable_version).to_s unless req_string.match?(/[~*\^]/)
 
               old_parts = old_version.split(".")
-              new_parts = latest_resolvable_version.to_s.split(".")
-                                                   .first(old_parts.count)
+              new_parts = T.must(latest_resolvable_version).to_s.split(".")
+                           .first(old_parts.count)
               new_parts.map.with_index do |part, i|
                 old_parts[i] == "*" ? "*" : part
               end.join(".")
             end
         end
 
+        sig { params(requirement_string: String).returns(T::Array[Composer::Requirement]) }
         def ruby_requirements(requirement_string)
           Composer::Requirement.requirements_array(requirement_string)
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_caret_requirement(req_string, or_separator)
           caret_requirements =
             req_string.split(SEPARATOR).select { |r| r.strip.start_with?("^") }
-          version_parts = latest_resolvable_version.segments
+          version_parts = T.must(latest_resolvable_version).segments
 
           min_existing_precision =
-            caret_requirements.map { |r| r.split(".").count }.min
+            caret_requirements.map { |r| r.split(".").count }.min || 0
           first_non_zero_index =
-            version_parts.count.times.find { |i| version_parts[i] != 0 }
+            version_parts.count.times.find { |i| version_parts[i] != 0 } || 0
 
           precision = [min_existing_precision, first_non_zero_index + 1].max
           version = version_parts.first(precision).map.with_index do |part, i|
@@ -190,71 +217,78 @@ module Dependabot
           req_string + "#{or_separator}^#{version}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_tilda_requirement(req_string, or_separator)
           tilda_requirements =
             req_string.split(SEPARATOR).select { |r| r.strip.start_with?("~") }
-          precision = tilda_requirements.map { |r| r.split(".").count }.min
+          precision = tilda_requirements.map { |r| r.split(".").count }.min || 0
 
-          version_parts = latest_resolvable_version.segments.first(precision)
-          version_parts[-1] = 0
+          version_parts = T.must(latest_resolvable_version).segments.first(precision)
+          version_parts[-1] = 0 if version_parts.any?
           version = version_parts.join(".")
 
           req_string + "#{or_separator}~#{version}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_wildcard_requirement(req_string, or_separator)
           wildcard_requirements =
             req_string.split(SEPARATOR).select { |r| r.include?("*") }
           precision = wildcard_requirements.map do |r|
             r.split(".").reject { |s| s == "*" }.count
-          end.min
+          end.min || 0
           wildcard_count = wildcard_requirements.map do |r|
             r.split(".").select { |s| s == "*" }.count
-          end.min
+          end.min || 0
 
-          version_parts = latest_resolvable_version.segments.first(precision)
+          version_parts = T.must(latest_resolvable_version).segments.first(precision)
           version = version_parts.join(".")
 
           req_string + "#{or_separator}#{version}#{'.*' * wildcard_count}"
         end
 
+        sig { params(req_string: String, or_separator: String).returns(String) }
         def update_range_requirement(req_string, or_separator)
           range_requirements =
             req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s+-\s+)/) }
 
           if range_requirements.count == 1
-            range_requirement = range_requirements.first
+            range_requirement = T.must(range_requirements.first)
             versions = range_requirement.scan(VERSION_REGEX)
-            upper_bound = versions.map { |v| version_class.new(v) }.max
+            # Convert version strings to Version objects and find the maximum
+            upper_bounds = versions.map { |v| version_class.new(T.cast(v, String)) }
+            upper_bound = T.cast(upper_bounds.max, Dependabot::Version)
             new_upper_bound = update_greatest_version(
               upper_bound,
-              latest_resolvable_version
+              T.must(latest_resolvable_version)
             )
 
-            req_string.sub(upper_bound.to_s, new_upper_bound.to_s)
+            req_string.sub(upper_bound.to_s, new_upper_bound)
           else
-            req_string + "#{or_separator}^#{latest_resolvable_version}"
+            req_string + "#{or_separator}^#{T.must(latest_resolvable_version)}"
           end
         end
 
+        sig { params(old_version: Dependabot::Version, version_to_be_permitted: Dependabot::Version).returns(String) }
         def update_greatest_version(old_version, version_to_be_permitted)
           version = version_class.new(old_version)
           version = version.release if version.prerelease?
 
           index_to_update =
-            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+            version.segments.map.with_index { |seg, i| seg.to_i.zero? ? 0 : i }.max || 0
 
           version.segments.map.with_index do |_, index|
             if index < index_to_update
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
+              version_to_be_permitted.segments[index].to_i + 1
             else
               0
             end
           end.join(".")
         end
 
+        sig { returns(T.class_of(Dependabot::Composer::Version)) }
         def version_class
           Composer::Version
         end

data/lib/dependabot/composer/update_checker/version_resolver.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "json"
 require "uri"
+require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/shared_helpers"
@@ -17,30 +18,49 @@ module Dependabot
   module Composer
     class UpdateChecker
       class VersionResolver # rubocop:disable Metrics/ClassLength
+        extend T::Sig
+
         class MissingExtensions < StandardError
+          extend T::Sig
+
+          sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
           attr_reader :extensions
 
+          sig { params(extensions: T::Array[T::Hash[Symbol, T.untyped]]).void }
           def initialize(extensions)
-            @extensions = extensions
+            @extensions = T.let(extensions, T::Array[T::Hash[Symbol, T.untyped]])
             super
           end
         end
 
-        MISSING_EXPLICIT_PLATFORM_REQ_REGEX =
+        MISSING_EXPLICIT_PLATFORM_REQ_REGEX = T.let(
           %r{
             (?<=PHP\sextension\s)ext\-[^\s\/]+\s.*?\s(?=is|but)|
             (?<=requires\s)php(?:\-[^\s\/]+)?\s.*?\s(?=but)
-          }x
-        MISSING_IMPLICIT_PLATFORM_REQ_REGEX =
+          }x,
+          Regexp
+        )
+        MISSING_IMPLICIT_PLATFORM_REQ_REGEX = T.let(
           %r{
             (?<!with|for|by)\sext\-[^\s\/]+\s.*?\s(?=->)|
             (?<=require\s)php(?:\-[^\s\/]+)?\s.*?\s(?=->) # composer v2
-          }x
-        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
+          }x,
+          Regexp
+        )
+        VERSION_REGEX = T.let(/[0-9]+(?:\.[A-Za-z0-9\-_]+)*/, Regexp)
 
         # Example Timeout error from Composer 2.7.7: "curl error 28 while downloading https://example.com:81/packages.json: Failed to connect to example.com port 81 after 9853 ms: Connection timed out" # rubocop:disable Layout/LineLength
-        SOURCE_TIMED_OUT_REGEX = %r{curl error 28 while downloading (?<url>https?://.+/packages\.json): }
+        SOURCE_TIMED_OUT_REGEX = T.let(%r{curl error 28 while downloading (?<url>https?://.+/packages\.json): }, Regexp)
 
+        sig do
+          params(
+            credentials: T::Array[Dependabot::Credential],
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            requirements_to_unlock: Symbol,
+            latest_allowable_version: T.nilable(Gem::Version)
+          ).void
+        end
         def initialize(credentials:, dependency:, dependency_files:,
                        requirements_to_unlock:, latest_allowable_version:)
           @credentials                  = credentials
@@ -48,24 +68,43 @@ module Dependabot
           @dependency_files             = dependency_files
           @requirements_to_unlock       = requirements_to_unlock
           @latest_allowable_version     = latest_allowable_version
-          @composer_platform_extensions = initial_platform
-          @error_handler                = ComposerErrorHandler.new
+          @composer_platform_extensions = T.let(initial_platform, T::Hash[String, T::Array[String]])
+          @error_handler                = T.let(ComposerErrorHandler.new, ComposerErrorHandler)
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version
-          @latest_resolvable_version ||= fetch_latest_resolvable_version
+          @latest_resolvable_version ||= T.let(
+            fetch_latest_resolvable_version,
+            T.nilable(Dependabot::Version)
+          )
         end
 
         private
 
+        # Initialize instance variables with T.let for strict typing
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(Symbol) }
         attr_reader :requirements_to_unlock
+
+        sig { returns(T.nilable(Gem::Version)) }
         attr_reader :latest_allowable_version
+
+        sig { returns(T::Hash[String, T::Array[String]]) }
         attr_reader :composer_platform_extensions
+
+        sig { returns(ComposerErrorHandler) }
         attr_reader :error_handler
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_latest_resolvable_version
           version = fetch_latest_resolvable_version_string
           return if version.nil?
@@ -80,8 +119,9 @@ module Dependabot
           retry
         end
 
+        sig { returns(T.nilable(String)) }
         def fetch_latest_resolvable_version_string
-          base_directory = dependency_files.first.directory
+          base_directory = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files
             run_update_checker
@@ -93,6 +133,7 @@ module Dependabot
           handle_composer_errors(e)
         end
 
+        sig { params(unlock_requirement: T::Boolean).void }
         def write_temporary_dependency_files(unlock_requirement: true)
           write_dependency_file(unlock_requirement: unlock_requirement)
           write_path_dependency_files
@@ -101,6 +142,7 @@ module Dependabot
           write_auth_file
         end
 
+        sig { void }
         def write_zipped_path_dependency_files
           zipped_path_dependency_files.each do |file|
             FileUtils.mkdir_p(Pathname.new(file.name).dirname)
@@ -108,6 +150,7 @@ module Dependabot
           end
         end
 
+        sig { params(unlock_requirement: T::Boolean).void }
         def write_dependency_file(unlock_requirement:)
           File.write(
             PackageManager::MANIFEST_FILENAME,
@@ -117,6 +160,7 @@ module Dependabot
           )
         end
 
+        sig { void }
         def write_path_dependency_files
           path_dependency_files.each do |file|
             FileUtils.mkdir_p(Pathname.new(file.name).dirname)
@@ -124,14 +168,17 @@ module Dependabot
           end
         end
 
+        sig { void }
         def write_lockfile
-          File.write(PackageManager::LOCKFILE_FILENAME, lockfile.content) if lockfile
+          File.write(PackageManager::LOCKFILE_FILENAME, T.must(lockfile).content) if lockfile
         end
 
+        sig { void }
         def write_auth_file
-          File.write(PackageManager::AUTH_FILENAME, auth_json.content) if auth_json
+          File.write(PackageManager::AUTH_FILENAME, T.must(auth_json).content) if auth_json
         end
 
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def transitory_failure?(error)
           return true if error.message.include?("404 Not Found")
           return true if error.message.include?("timed out")
@@ -140,6 +187,7 @@ module Dependabot
           error.message.include?("Content-Length mismatch")
         end
 
+        sig { returns(String) }
         def run_update_checker
           SharedHelpers.with_git_configured(credentials: credentials) do
             SharedHelpers.run_helper_subprocess(
@@ -156,14 +204,16 @@ module Dependabot
           end
         end
 
+        sig { params(unlock_requirement: T::Boolean).returns(String) }
         def prepared_composer_json_content(unlock_requirement: true)
-          content = composer_file.content
+          content = T.must(T.must(composer_file).content)
           content = unlock_dep_being_updated(content) if unlock_requirement
           content = lock_git_dependencies(content) if lockfile
           content = add_temporary_platform_extensions(content)
           content
         end
 
+        sig { params(content: String).returns(String) }
         def unlock_dep_being_updated(content)
           content.gsub(
             /"#{Regexp.escape(dependency.name)}"\s*:\s*".*"/,
@@ -171,6 +221,7 @@ module Dependabot
           )
         end
 
+        sig { params(content: String).returns(String) }
         def add_temporary_platform_extensions(content)
           json = JSON.parse(content)
 
@@ -186,6 +237,7 @@ module Dependabot
           JSON.dump(json)
         end
 
+        sig { params(content: String).returns(String) }
         def lock_git_dependencies(content)
           json = JSON.parse(content)
 
@@ -197,7 +249,7 @@ module Dependabot
               next if req.include?("#")
 
               commit_sha = parsed_lockfile
-                           .fetch(keys[:lockfile], [])
+                           .fetch(T.must(keys[:lockfile]), [])
                            .find { |d| d["name"] == name }
                            &.dig("source", "reference")
               updated_req_parts = req.split
@@ -211,6 +263,7 @@ module Dependabot
 
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
+        sig { returns(String) }
         def updated_version_requirement_string
           lower_bound =
             if requirements_to_unlock == :none
@@ -253,6 +306,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/MethodLength
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T.nilable(NilClass)) }
         def handle_composer_errors(error)
           # Special case for Laravel Nova, which will fall back to attempting
           # to close a private repo if given invalid (or no) credentials
@@ -271,7 +325,11 @@ module Dependabot
             missing_extensions =
               error.message.scan(MISSING_EXPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-                name, requirement = extension_string.strip.split(" ", 2)
+                name, requirement = if extension_string.is_a?(Array)
+                                      [extension_string.first.to_s.strip, extension_string.last.to_s]
+                                    else
+                                      extension_string.to_s.strip.split(" ", 2)
+                                    end
                 { name: name, requirement: requirement }
               end
             raise MissingExtensions, missing_extensions
@@ -282,7 +340,7 @@ module Dependabot
             missing_extensions =
               error.message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-                name, requirement = extension_string.strip.split(" ", 2)
+                name, requirement = T.cast(extension_string, String).strip.split(" ", 2)
                 { name: name, requirement: requirement }
               end
 
@@ -291,7 +349,7 @@ module Dependabot
               version_for_reqs(existing_reqs + [hash[:requirement]])
             end
 
-            raise MissingExtensions, [missing_extension]
+            raise MissingExtensions, [missing_extension].compact
           elsif error.message.include?("cannot require itself") ||
                 error.message.include?('packages.json" file could not be down')
             raise Dependabot::DependencyFileNotResolvable, error.message
@@ -312,14 +370,14 @@ module Dependabot
             # now, we therefore just ignore the dependency and log the error.
 
             Dependabot.logger.error(error.message)
-            error.backtrace.each { |line| Dependabot.logger.error(line) }
+            error.backtrace&.each { |line| Dependabot.logger.error(line) }
             nil
           elsif error.message.include?("URL required authentication") ||
                 error.message.include?("403 Forbidden")
-            source = error.message.match(%r{https?://(?<source>[^/]+)/}).named_captures.fetch("source")
+            source = error.message.match(%r{https?://(?<source>[^/]+)/})&.named_captures&.fetch("source")
             raise Dependabot::PrivateSourceAuthenticationFailure, source
           elsif error.message.match?(SOURCE_TIMED_OUT_REGEX)
-            url = error.message.match(SOURCE_TIMED_OUT_REGEX).named_captures.fetch("url")
+            url = T.must(error.message.match(SOURCE_TIMED_OUT_REGEX)&.named_captures&.fetch("url"))
             raise if [
               "packagist.org",
               "www.packagist.org"
@@ -357,6 +415,7 @@ module Dependabot
         # rubocop:enable Metrics/CyclomaticComplexity
         # rubocop:enable Metrics/MethodLength
 
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
         def unresolvable_error?(error)
           error.message.start_with?("Could not parse version") ||
             error.message.include?("does not allow connections to http://") ||
@@ -364,15 +423,17 @@ module Dependabot
             error.message.start_with?("Invalid version string")
         end
 
+        sig { returns(T::Boolean) }
         def library?
           parsed_composer_file["type"] == "library"
         end
 
+        sig { params(message: String).returns(T::Boolean) }
         def implicit_platform_reqs_satisfiable?(message)
           missing_extensions =
             message.scan(MISSING_IMPLICIT_PLATFORM_REQ_REGEX)
                    .map do |extension_string|
-              name, requirement = extension_string.strip.split(" ", 2)
+              name, requirement = T.cast(extension_string, String).strip.split(" ", 2)
               { name: name, requirement: requirement }
             end
 
@@ -382,8 +443,9 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def check_original_requirements_resolvable
-          base_directory = dependency_files.first.directory
+          base_directory = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files(unlock_requirement: false)
 
@@ -414,6 +476,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, e.message
         end
 
+        sig { params(requirements: T::Array[String]).returns(T.nilable(String)) }
         def version_for_reqs(requirements)
           req_arrays =
             requirements
@@ -438,25 +501,32 @@ module Dependabot
           version.to_s
         end
 
+        sig { params(additional_extensions: T::Array[T::Hash[Symbol, String]]).void }
         def update_required_extensions(additional_extensions)
           additional_extensions.each do |ext|
             composer_platform_extensions[ext.fetch(:name)] ||= []
-            composer_platform_extensions[ext.fetch(:name)] +=
-              [ext.fetch(:requirement)]
             composer_platform_extensions[ext.fetch(:name)] =
-              composer_platform_extensions[ext.fetch(:name)].uniq
+              T.must(composer_platform_extensions[ext.fetch(:name)]) + [ext.fetch(:requirement)]
+            composer_platform_extensions[ext.fetch(:name)] =
+              T.must(composer_platform_extensions[ext.fetch(:name)]).uniq
           end
         end
 
+        sig { returns(String) }
         def php_helper_path
           NativeHelpers.composer_helper_path(composer_version: composer_version)
         end
 
+        sig { returns(String) }
         def composer_version
           parsed_lockfile_or_nil = lockfile ? parsed_lockfile : nil
-          @composer_version ||= Helpers.composer_version(parsed_composer_file, parsed_lockfile_or_nil)
+          @composer_version ||= T.let(
+            Helpers.composer_version(parsed_composer_file, parsed_lockfile_or_nil),
+            T.nilable(String)
+          )
         end
 
+        sig { returns(T::Hash[String, T::Array[String]]) }
         def initial_platform
           platform_php = Helpers.capture_platform_php(parsed_composer_file)
 
@@ -477,38 +547,63 @@ module Dependabot
           platform
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_composer_file
-          @parsed_composer_file ||= JSON.parse(composer_file.content)
+          @parsed_composer_file ||= T.let(
+            JSON.parse(T.must(T.must(composer_file).content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_lockfile
-          @parsed_lockfile ||= JSON.parse(lockfile.content)
+          @parsed_lockfile ||= T.let(
+            JSON.parse(T.must(lockfile&.content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def composer_file
-          @composer_file ||=
-            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME }
+          @composer_file ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::MANIFEST_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def path_dependency_files
-          @path_dependency_files ||=
-            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") }
+          @path_dependency_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("/#{PackageManager::MANIFEST_FILENAME}") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def zipped_path_dependency_files
-          @zipped_path_dependency_files ||=
-            dependency_files.select { |f| f.name.end_with?(".zip", ".gitkeep") }
+          @zipped_path_dependency_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?(".zip", ".gitkeep") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
-          @lockfile ||=
-            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME }
+          @lockfile ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::LOCKFILE_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def auth_json
-          @auth_json ||= dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME }
+          @auth_json ||= T.let(
+            dependency_files.find { |f| f.name == PackageManager::AUTH_FILENAME },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { params(req_string: String).returns(T::Boolean) }
         def requirement_valid?(req_string)
           Composer::Requirement.requirements_array(req_string)
           true
@@ -516,12 +611,14 @@ module Dependabot
           false
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def git_credentials
           credentials
             .select { |cred| cred["type"] == "git_source" }
             .select { |cred| cred["password"] }
         end
 
+        sig { returns(T::Array[Dependabot::Credential]) }
         def registry_credentials
           credentials
             .select { |cred| cred["type"] == PackageManager::REPOSITORY_KEY }
@@ -534,23 +631,24 @@ module Dependabot
       extend T::Sig
 
       # Private source errors
-      CURL_ERROR = /curl error 52 while downloading (?<url>.*): Empty reply from server/
+      CURL_ERROR = T.let(/curl error 52 while downloading (?<url>.*): Empty reply from server/, Regexp)
 
-      PRIVATE_SOURCE_AUTH_FAIL = [
+      PRIVATE_SOURCE_AUTH_FAIL = T.let([
         /Could not authenticate against (?<url>.*)/,
         /The '(?<url>.*)' URL could not be accessed \(HTTP 403\)/,
         /The "(?<url>.*)" file could not be downloaded/
-      ].freeze
+      ].freeze, T::Array[Regexp])
 
-      REQUIREMENT_ERROR = /^(?<req>.*) is invalid, it should not contain uppercase characters/
+      REQUIREMENT_ERROR = T.let(/^(?<req>.*) is invalid, it should not contain uppercase characters/, Regexp)
 
-      NO_URL = "No URL specified"
+      NO_URL = T.let("No URL specified", String)
 
+      sig { params(url: String).returns(String) }
       def sanitize_uri(url)
         url = "http://#{url}" unless url.start_with?("http")
         uri = URI.parse(url)
         host = T.must(uri.host).downcase
-        host.start_with?("www.") ? host[4..-1] : host
+        host.start_with?("www.") ? T.must(host[4..-1]) : host
       end
 
       # Handles errors with specific to composer error codes
@@ -561,7 +659,8 @@ module Dependabot
           next unless error.message.match?(regex)
 
           url = T.must(error.message.match(regex)).named_captures["url"]
-          raise Dependabot::PrivateSourceAuthenticationFailure, sanitize_uri(url).empty? ? NO_URL : sanitize_uri(url)
+          sanitized_url = sanitize_uri(T.must(url))
+          raise Dependabot::PrivateSourceAuthenticationFailure, sanitized_url.empty? ? NO_URL : sanitized_url
         end
 
         # invalid requirement mentioned in manifest file
@@ -573,7 +672,7 @@ module Dependabot
         return unless error.message.match?(CURL_ERROR)
 
         url = T.must(error.message.match(CURL_ERROR)).named_captures["url"]
-        raise PrivateSourceBadResponse, url
+        raise PrivateSourceBadResponse, T.must(url)
       end
     end
   end

data/lib/dependabot/composer/update_checker.rb

@@ -28,7 +28,7 @@ module Dependabot
         latest_version_from_registry || latest_resolvable_version
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version
         return nil if path_dependency? || git_dependency?
 
@@ -40,26 +40,26 @@ module Dependabot
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :own
           ).latest_resolvable_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
         @lowest_resolvable_security_fix_version ||= T.let(
           fetch_lowest_resolvable_security_fix_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
-      sig { override.returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version_with_no_unlock
         return nil if path_dependency? || git_dependency?
 
@@ -71,7 +71,7 @@ module Dependabot
             latest_allowable_version: latest_version_from_registry,
             requirements_to_unlock: :none
           ).latest_resolvable_version,
-          T.nilable(Dependabot::Composer::Version)
+          T.nilable(Dependabot::Version)
         )
       end
 
@@ -80,7 +80,7 @@ module Dependabot
         RequirementsUpdater.new(
           requirements: dependency.requirements,
           latest_resolvable_version: preferred_resolvable_version&.to_s,
-          update_strategy: requirements_update_strategy
+          update_strategy: T.must(requirements_update_strategy)
         ).updated_requirements
       end
 
@@ -111,7 +111,7 @@ module Dependabot
         raise NotImplementedError
       end
 
-      sig { returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       def latest_version_from_registry
         latest_version_finder.latest_version
       end
@@ -131,7 +131,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(Dependabot::Composer::Version)) }
+      sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_resolvable_security_fix_version
         return nil if path_dependency? || git_dependency?
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-composer
 version: !ruby/object:Gem::Version
-  version: 0.311.0
+  version: 0.312.0
 platform: ruby
 authors:
 - Dependabot
 bindir: bin
 cert_chain: []
-date: 2025-05-01 00:00:00.000000000 Z
+date: 2025-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.311.0
+        version: 0.312.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.311.0
+        version: 0.312.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13'
+        version: '13.2'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -99,98 +99,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: '1.9'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.67.0
+        version: '1.67'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.22.1
+        version: '1.22'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.29.1
+        version: '2.29'
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.7
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -279,7 +279,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.311.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.312.0
 rdoc_options: []
 require_paths:
 - lib