dependabot-devcontainers 0.384.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe10eda0b9f3a6e929ab5af2b974f22abdbf724a3e7c28ea72b9f940c811e90f
-  data.tar.gz: 60157b701669ee55bc224bc526352ec10f4bf899d2c679eb41e4c250f9c3480d
+  metadata.gz: 5882eb429b9ec36741663d84fedf2782f19aa13db7716d46ee88e0acbcc1753d
+  data.tar.gz: 1e1b42fc429c9e69f5f4bf5e692845092c72ff8fe7102605b86c6d1e54d1a059
 SHA512:
-  metadata.gz: 3c5c8f861bf7cd8d5780577b7e3d0a94e7df90ef3cbf3f8b515c3e8bc053540e82ebeff0eeb7766b8536b385243354dd6fbbec3dd7d6cc05a7e93a4ef75fb25c
-  data.tar.gz: d489231eca1710b7fd361f7684e0f20bb09dc6a763f95a7021fe58f101749e784067db49cf257eae6d858df21f8a03c8b7207c20754648e297afd3e24063b906
+  metadata.gz: 7887c168071758bbe91880bcdfd418b8cfba97311b108319347307a3aa053b2bbefe72bb635d19293cf4140474c938707c7fadc1338d2f0907459b1614593a8f
+  data.tar.gz: b7cd260b85e56e04ed58d4b16ecb78a25fe888a2b8df2b009468b58a49a7ec0c3d3e9d927a58fa5a8856d85ee4d993da7e9d7225439b610a74dcc99b2e02d1fd

data/lib/dependabot/devcontainers/file_fetcher.rb

@@ -63,21 +63,21 @@ module Dependabot
         return [] unless devcontainer_directory
 
         custom_directories.flat_map do |directory|
-          fetch_config_and_lockfile_from(directory.path)
+          fetch_config_and_lockfile_from(T.must(directory.path))
         end
       end
 
-      sig { returns(T::Array[T.untyped]) }
+      sig { returns(T::Array[Dependabot::FileFetchers::RepositoryContent]) }
       def custom_directories
         repo_contents(dir: ".devcontainer").select { |f| f.type == "dir" && f.name != ".devcontainer" }
       end
 
-      sig { returns(T.untyped) }
+      sig { returns(T.nilable(Dependabot::FileFetchers::RepositoryContent)) }
       def devcontainer_directory
         @devcontainer_directory ||=
           T.let(
             repo_contents.find { |f| f.type == "dir" && f.name == ".devcontainer" },
-            T.untyped
+            T.nilable(Dependabot::FileFetchers::RepositoryContent)
           )
       end
 

data/lib/dependabot/devcontainers/file_parser/feature_dependency_parser.rb

@@ -46,7 +46,7 @@ module Dependabot
         end
 
         # https://github.com/devcontainers/cli/blob/9444540283b236298c28f397dea879e7ec222ca1/src/spec-node/devContainersSpecCLI.ts#L1072
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(T::Hash[String, T.anything]) }
         def evaluate_with_cli
           raise "config_file_path must be a string" unless config_file_path.is_a?(String) && !config_file_path.empty?
 
@@ -61,13 +61,14 @@ module Dependabot
           JSON.parse(json)
         end
 
-        sig { params(json: T::Hash[String, T.untyped]).returns(T::Array[Dependabot::Dependency]) }
+        sig { params(json: T::Hash[String, T.anything]).returns(T::Array[Dependabot::Dependency]) }
         def parse_cli_json(json)
           dependencies = []
 
-          features = json["features"]
+          features = T.cast(json["features"], T::Hash[String, T.anything])
           features.each do |feature, versions_object|
             name, requirement = feature.split(":")
+            next if name.nil?
 
             # Skip sha pinned tags for now. Ideally the devcontainers CLI would give us updated SHA info
             next if name.end_with?("@sha256")
@@ -76,7 +77,7 @@ module Dependabot
             # and `devcontainer upgrade` work with them. See https://github.com/devcontainers/cli/issues/712
             next unless name.include?("/")
 
-            current = versions_object["current"]
+            current = T.cast(T.cast(versions_object, T::Hash[String, T.anything])["current"], T.nilable(String))
 
             dep = Dependency.new(
               name: name,

data/lib/dependabot/devcontainers/file_updater/config_updater.rb

@@ -18,7 +18,7 @@ module Dependabot
         sig do
           params(
             feature: String,
-            requirement: T.any(String, Dependabot::Devcontainers::Version),
+            requirement: T.nilable(T.any(String, Dependabot::Devcontainers::Version)),
             version: String,
             manifest: Dependabot::DependencyFile,
             repo_contents_path: String,
@@ -65,7 +65,7 @@ module Dependabot
 
         sig do
           params(
-            target_requirement: T.any(String, Dependabot::Devcontainers::Version),
+            target_requirement: T.nilable(T.any(String, Dependabot::Devcontainers::Version)),
             target_version: String
           )
             .void
@@ -79,8 +79,16 @@ module Dependabot
           force_target_requirement(lockfile_path, from: target_version, to: target_requirement)
         end
 
-        sig { params(file_name: String, from: String, to: T.any(String, Dependabot::Devcontainers::Version)).void }
+        sig do
+          params(
+            file_name: String,
+            from: String,
+            to: T.nilable(T.any(String, Dependabot::Devcontainers::Version))
+          ).void
+        end
         def force_target_requirement(file_name, from:, to:)
+          return if to.nil?
+
           File.write(file_name, File.read(file_name).gsub("#{feature}:#{from}", "#{feature}:#{to}"))
         end
 
@@ -100,7 +108,7 @@ module Dependabot
         sig { returns(String) }
         attr_reader :feature
 
-        sig { returns(T.any(String, Dependabot::Devcontainers::Version)) }
+        sig { returns(T.nilable(T.any(String, Dependabot::Devcontainers::Version))) }
         attr_reader :requirement
 
         sig { returns(String) }

data/lib/dependabot/devcontainers/file_updater.rb

@@ -77,14 +77,14 @@ module Dependabot
       sig do
         params(
           manifest: Dependabot::DependencyFile,
-          requirement: T::Hash[Symbol, T.untyped]
+          requirement: T::Hash[Symbol, T.anything]
         )
           .returns(T::Array[String])
       end
       def update(manifest, requirement)
         ConfigUpdater.new(
           feature: dependency.name,
-          requirement: requirement[:requirement],
+          requirement: T.cast(requirement[:requirement], T.nilable(String)),
           version: T.must(dependency.version),
           manifest: manifest,
           repo_contents_path: T.must(repo_contents_path),

data/lib/dependabot/devcontainers/update_checker/latest_version_finder.rb

@@ -31,7 +31,7 @@ module Dependabot
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
             raise_on_ignored: T::Boolean,
-            options: T::Hash[Symbol, T.untyped],
+            options: T::Hash[Symbol, T.anything],
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end

data/lib/dependabot/devcontainers/update_checker.rb

@@ -35,13 +35,21 @@ module Dependabot
       def updated_requirements
         updated_reqs = dependency.requirements.map do |requirement|
           required_version = T.cast(version_class.new(requirement[:requirement]), Dependabot::Devcontainers::Version)
-          updated_requirement = remove_precision_changes(
-            T.cast(release_versions, T::Array[Dependabot::Devcontainers::Version]),
-            required_version
-          ).last
+          versions = T.cast(release_versions, T::Array[Dependabot::Devcontainers::Version])
+          precision_matches = remove_precision_changes(versions, required_version)
+          # When the published tags don't include a precision-matching tag (e.g. a feature
+          # that only publishes full semver like "1.10.0" but the pin is the major-only ":1"),
+          # fall back to truncating the latest version to the required precision so that
+          # ":1" stays ":1" within the same major and becomes ":2" on a major bump.
+          updated_requirement =
+            if precision_matches.any?
+              precision_matches.last
+            else
+              versions.last&.truncate_to_precision_of(required_version)
+            end
           {
             file: requirement[:file],
-            requirement: updated_requirement&.to_s,
+            requirement: updated_requirement&.to_s || requirement[:requirement],
             groups: requirement[:groups],
             source: requirement[:source]
           }

data/lib/dependabot/devcontainers/version.rb

@@ -16,6 +16,16 @@ module Dependabot
         precision == other.precision
       end
 
+      sig { params(target_precision: Integer).returns(Dependabot::Devcontainers::Version) }
+      def truncate(target_precision)
+        T.cast(self.class.new(segments.first(target_precision).join(".")), Dependabot::Devcontainers::Version)
+      end
+
+      sig { params(other: Dependabot::Devcontainers::Version).returns(Dependabot::Devcontainers::Version) }
+      def truncate_to_precision_of(other)
+        truncate(other.precision)
+      end
+
       sig { params(requirement: Dependabot::Requirement).returns(T::Boolean) }
       def satisfies?(requirement)
         requirement.satisfied_by?(self)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-devcontainers
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -260,7 +260,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib