dependabot-docker 0.385.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd34c41d8f34c7fbd8a68dac70aa18a7a7aec37180044321b75b6b9add0f31cb
-  data.tar.gz: 3c2c803bab214190b06d60ffe76c4de7781cc81254403a616220d685f1040347
+  metadata.gz: ffe99e23ddb69d7afac96bf33d403c43b104fa4498dc2ad969025db5cc2dc391
+  data.tar.gz: '0785c238b7814483f797a6d31642deb80748a718b386be4f188dc32886d7b6c5'
 SHA512:
-  metadata.gz: 971bb0776d6b9910f0d8f12f1e8f8f124a8b614b7ce68f9b4f9e48ec4e312ebd06180f6b26bd95d6c9827f5e99a440458ac96e30e56f4a1deef3ea38e6641537
-  data.tar.gz: f3d93ecfb28273c0af1fe959cc830b67121c20ec8010f086865bbcf3191bbff301da0e406b7305a609e946ae6342898a50b815eea776bf782f09512f3dccc585
+  metadata.gz: bb35d82d30d4764f37e39346ab21907caa08a895fc7c01d13c3d5e31c916a8b7376fef385c38d77e5dd93c230dd8fc9716f1b642642e4230dfa4db16f5e10cb3
+  data.tar.gz: a451bc5070ef987e560032f7761cb8a29d349947cb4dc9e4988a9954fd3e554538f56cde67347ab23a5feb6fb2a6da6e7633eba9a4072a8d063689dcd95b03e9

data/lib/dependabot/docker/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/shared/shared_file_parser"
@@ -120,7 +120,7 @@ module Dependabot
         end
       end
 
-      sig { params(json_object: T::Hash[T.untyped, T.untyped]).returns(T::Array[String]) }
+      sig { params(json_object: T::Hash[Object, Object]).returns(T::Array[String]) }
       def deep_fetch_images_from_hash(json_object)
         img = json_object.fetch("image", nil)
 
@@ -136,13 +136,13 @@ module Dependabot
         images + json_object.values.flat_map { |obj| deep_fetch_images(obj) }
       end
 
-      sig { params(img_hash: T::Hash[String, T.nilable(String)]).returns(T::Array[String]) }
+      sig { params(img_hash: T::Hash[Object, Object]).returns(T::Array[String]) }
       def parse_helm(img_hash)
         tag_value = img_hash.key?("tag") ? img_hash.fetch("tag", nil) : img_hash.fetch("version", nil)
         return [] unless tag_value
 
         repo = img_hash.fetch("repository", nil)
-        return [] unless repo
+        return [] unless repo.is_a?(String)
 
         match = tag_value.to_s.match(TAG_WITH_DIGEST)
         return [] unless match

data/lib/dependabot/docker/metadata_finder.rb

@@ -11,6 +11,14 @@ module Dependabot
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
 
+      DockerSource = T.type_alias do
+        T::Hash[Symbol, T.nilable(String)]
+      end
+
+      ImageDetails = T.type_alias do
+        T::Hash[String, Object]
+      end
+
       private
 
       # Finds the repository for the Docker image using OCI annotations.
@@ -23,8 +31,7 @@ module Dependabot
         return unless new_source && new_source[:registry] && (new_source[:tag] || new_source[:digest])
 
         details = image_details(new_source)
-        image_source = details.dig("config", "Labels", "org.opencontainers.image.source")
-        # Return early if the org.opencontainers.image.source label is not present
+        image_source = image_label(details, "org.opencontainers.image.source")
         return unless image_source
 
         # If we have a tag, return the source directly without additional version metadata
@@ -39,9 +46,9 @@ module Dependabot
 
       sig do
         params(
-          source: T::Hash[Symbol, T.untyped]
+          source: DockerSource
         ).returns(
-          T::Hash[String, T.untyped]
+          ImageDetails
         )
       end
       def image_details(source)
@@ -62,18 +69,35 @@ module Dependabot
         JSON.parse(output)
       end
 
+      sig { params(details: ImageDetails).returns(T.nilable(T::Hash[String, Object])) }
+      def image_labels(details)
+        config = details["config"]
+        return unless config.is_a?(Hash)
+
+        labels = config["Labels"]
+        return unless labels.is_a?(Hash)
+
+        labels
+      end
+
+      sig { params(details: ImageDetails, label: String).returns(T.nilable(String)) }
+      def image_label(details, label)
+        value = image_labels(details)&.fetch(label, nil)
+        value if value.is_a?(String)
+      end
+
       # Builds a Dependabot::Source object using the OCI image version label.
       #
       # This is used as a fallback when an image is referenced by digest rather than a tag
       sig do
         params(
           image_source: String,
-          details: T::Hash[String, T.untyped]
+          details: ImageDetails
         ).returns(T.nilable(Dependabot::Source))
       end
       def build_source_from_image_version(image_source, details)
-        image_version = details.dig("config", "Labels", "org.opencontainers.image.version")
-        revision = details.dig("config", "Labels", "org.opencontainers.image.revision")
+        image_version = image_label(details, "org.opencontainers.image.version")
+        revision = image_label(details, "org.opencontainers.image.revision")
         # Sometimes the versions are not tags (e.g., "24.04")
         # We only want to build a source if the version looks like a tag (starts with "v")
         # This is a safeguard for a first iteration. We may adjust this later based on user feedback.

data/lib/dependabot/docker/update_checker.rb

@@ -25,7 +25,7 @@ rescue LoadError
     class Response
       extend T::Sig
 
-      sig { returns(T::Hash[T.untyped, T.untyped]) }
+      sig { returns(T::Hash[Symbol, String]) }
       def headers
         {}
       end
@@ -80,6 +80,18 @@ module Dependabot
       # so we cap the attempts to avoid rate limiting or excessive latency.
       MAX_PLATFORM_VALIDATION_ATTEMPTS = T.let(5, Integer)
 
+      DockerSource = T.type_alias do
+        T::Hash[Symbol, T.nilable(String)]
+      end
+
+      ManifestHash = T.type_alias do
+        T::Hash[T.any(String, Symbol), Object]
+      end
+
+      ManifestList = T.type_alias do
+        T::Array[ManifestHash]
+      end
+
       # Legacy patterns used when docker_created_timestamp_validation experiment is disabled.
       # The broad alphanumeric regex matches tokens like "alpine3", "ltsc2022", "rc1"
       # and classifies them as version-related, preserving pre-experiment behavior.
@@ -220,7 +232,7 @@ module Dependabot
         digest_requirements.all? { |req| digest_requirement_up_to_date?(req) }
       end
 
-      sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+      sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
       def digest_requirement_up_to_date?(req)
         source = req.fetch(:source)
         source_digest = source.fetch(:digest)
@@ -467,8 +479,7 @@ module Dependabot
           client.dohead "v2/#{docker_repo_name}/#{endpoint}/#{first_digest}"
         end
 
-        last_modified = head_response.headers[:last_modified]
-        published_date = last_modified ? Time.parse(last_modified) : nil
+        published_date = published_date_from_response_headers(head_response.headers, tag.name)
 
         Dependabot::Package::PackageRelease.new(
           version: release_version_for(tag),
@@ -489,9 +500,25 @@ module Dependabot
         nil
       end
 
+      sig { params(headers: T::Hash[Symbol, String], tag_name: String).returns(T.nilable(Time)) }
+      def published_date_from_response_headers(headers, tag_name)
+        last_modified = headers[:last_modified]
+        published_date = begin
+          Time.parse(last_modified) if last_modified
+        rescue ArgumentError, TypeError => e
+          Dependabot.logger.info(
+            "Invalid Last-Modified header for #{docker_repo_name}:#{tag_name}: #{e.message}"
+          )
+          nil
+        end
+        # Fall back to the image config blob's "created" timestamp when Last-Modified
+        # is absent (e.g., Docker Hub multi-arch manifest lists).
+        published_date || fetch_image_config_created(tag_name)
+      end
+
       sig do
         params(
-          digest_info: T.untyped,
+          digest_info: Object,
           tag: Dependabot::Docker::Tag
         ).returns(T.nilable(String))
       end
@@ -505,7 +532,8 @@ module Dependabot
             )
             return nil
           end
-          digest_info.first&.fetch("digest")
+          digest = digest_info.first&.fetch("digest")
+          digest if digest.is_a?(String)
         when String
           digest_info
         else
@@ -518,11 +546,11 @@ module Dependabot
       end
 
       sig do
-        params(
+        type_parameters(:Result).params(
           max_attempts: Integer,
           errors: T::Array[T.class_of(StandardError)],
-          _blk: T.proc.returns(T.untyped)
-        ).returns(T.untyped)
+          _blk: T.proc.returns(T.type_parameter(:Result))
+        ).returns(T.type_parameter(:Result))
       end
       def with_retries(max_attempts: 3, errors: [], &_blk)
         attempt = 0
@@ -912,7 +940,7 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def digest_requirements
         dependency.requirements.select do |requirement|
           requirement.dig(:source, :digest)
@@ -1027,7 +1055,7 @@ module Dependabot
       # digest moved; otherwise this is a genuine version/digest change.
       sig do
         params(
-          source: T::Hash[Symbol, T.untyped],
+          source: DockerSource,
           current_digest: String,
           expected_digest: String,
           digest_only_refresh: T::Boolean
@@ -1045,7 +1073,7 @@ module Dependabot
       # Fails open (returns false) whenever a confident comparison isn't possible.
       sig do
         params(
-          source: T::Hash[Symbol, T.untyped],
+          source: DockerSource,
           current_digest: String,
           candidate_digest: String
         ).returns(T::Boolean)
@@ -1109,8 +1137,11 @@ module Dependabot
         resolved = resolve_platform_manifest(manifest)
         return nil unless resolved
 
-        config_digest = resolved.dig("config", "digest")
-        return nil unless config_digest
+        config = resolved["config"]
+        return nil unless config.is_a?(Hash)
+
+        config_digest = config["digest"]
+        return nil unless config_digest.is_a?(String)
 
         parse_created_from_config_blob(config_digest)
       end
@@ -1137,13 +1168,11 @@ module Dependabot
       # Resolves a manifest to a single platform-specific manifest.
       # If the manifest is a manifest list (multi-arch), selects the most
       # appropriate platform (preferring linux/amd64).
-      sig { params(manifest: T.untyped).returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { params(manifest: ManifestHash).returns(T.nilable(ManifestHash)) }
       def resolve_platform_manifest(manifest)
         media_type = manifest["mediaType"] || manifest[:mediaType]
 
-        unless MANIFEST_LIST_TYPES.include?(media_type)
-          return manifest.is_a?(Hash) ? manifest : manifest.to_h
-        end
+        return manifest unless MANIFEST_LIST_TYPES.include?(media_type)
 
         platform_digest = select_platform_digest(manifest)
         return nil unless platform_digest
@@ -1157,19 +1186,25 @@ module Dependabot
 
       # Selects the digest of the best platform-specific manifest from a manifest list,
       # preferring linux/amd64.
-      sig { params(manifest: T.untyped).returns(T.nilable(String)) }
+      sig { params(manifest: ManifestHash).returns(T.nilable(String)) }
       def select_platform_digest(manifest)
         manifests = manifest["manifests"] || manifest[:manifests] || []
+        return nil unless manifests.is_a?(Array)
         return nil if manifests.empty?
 
         selected = find_amd64_manifest(manifests) || manifests.first
-        selected&.dig("digest") || selected&.dig(:digest)
+        return nil unless selected.is_a?(Hash)
+
+        digest = selected["digest"] || selected[:digest]
+        digest if digest.is_a?(String)
       end
 
-      sig { params(manifests: T.untyped).returns(T.untyped) }
+      sig { params(manifests: ManifestList).returns(T.nilable(ManifestHash)) }
       def find_amd64_manifest(manifests)
         manifests.find do |m|
           platform = m["platform"] || m[:platform] || {}
+          next false unless platform.is_a?(Hash)
+
           (platform["architecture"] || platform[:architecture]) == "amd64"
         end
       end
@@ -1338,7 +1373,7 @@ module Dependabot
       # array of per-platform manifest entries, or nil for single-platform images
       # (not a manifest list). Cached so the platform-inspection methods below
       # share a single registry GET per tag.
-      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { params(tag_name: String).returns(T.nilable(ManifestList)) }
       def fetch_manifest_list(tag_name)
         return manifest_list_cache[tag_name] if manifest_list_cache.key?(tag_name)
 
@@ -1356,7 +1391,7 @@ module Dependabot
         nil
       end
 
-      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { params(tag_name: String).returns(T.nilable(ManifestList)) }
       def fetch_manifest_list_from_registry(tag_name)
         manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
           docker_registry_client.manifest(docker_repo_name, tag_name)
@@ -1365,7 +1400,10 @@ module Dependabot
         media_type = manifest["mediaType"] || manifest[:mediaType]
         return nil unless MANIFEST_LIST_TYPES.include?(media_type)
 
-        manifest["manifests"] || manifest[:manifests] || []
+        manifests = manifest["manifests"] || manifest[:manifests] || []
+        return [] unless manifests.is_a?(Array)
+
+        manifests.grep(Hash)
       end
 
       # Fetches a map of platform key (e.g. "linux/amd64") to platform manifest
@@ -1395,7 +1433,7 @@ module Dependabot
         collect_platform_digests(manifests)
       end
 
-      sig { params(manifests: T.untyped).returns(T::Hash[String, String]) }
+      sig { params(manifests: ManifestList).returns(T::Hash[String, String]) }
       def collect_platform_digests(manifests)
         digests = {}
 
@@ -1404,7 +1442,7 @@ module Dependabot
           next unless platform
 
           digest = m["digest"] || m[:digest]
-          next unless digest
+          next unless digest.is_a?(String)
 
           digests[platform_key(platform)] = digest
         end
@@ -1414,7 +1452,7 @@ module Dependabot
 
       # Fetches the platform entries from a manifest list for a given tag.
       # Returns nil if the tag is a single-platform image (not a manifest list).
-      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { params(tag_name: String).returns(T.nilable(ManifestList)) }
       def fetch_manifest_platforms(tag_name)
         return manifest_platforms_cache[tag_name] if manifest_platforms_cache.key?(tag_name)
 
@@ -1430,7 +1468,7 @@ module Dependabot
         nil
       end
 
-      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { params(tag_name: String).returns(T.nilable(ManifestList)) }
       def fetch_manifest_platforms_from_registry(tag_name)
         manifests = fetch_manifest_list(tag_name)
         return nil unless manifests
@@ -1452,10 +1490,10 @@ module Dependabot
         digests
       end
 
-      sig { params(manifest_entry: T.untyped).returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { params(manifest_entry: ManifestHash).returns(T.nilable(ManifestHash)) }
       def extract_platform(manifest_entry)
         platform = manifest_entry["platform"] || manifest_entry[:platform]
-        return unless platform
+        return unless platform.is_a?(Hash)
 
         os = platform["os"] || platform[:os]
         arch = platform["architecture"] || platform[:architecture]
@@ -1465,7 +1503,7 @@ module Dependabot
       end
 
       # Builds a normalized string key from a platform hash, e.g. "linux/amd64" or "linux/arm64/v8"
-      sig { params(platform: T::Hash[T.any(String, Symbol), T.untyped]).returns(String) }
+      sig { params(platform: ManifestHash).returns(String) }
       def platform_key(platform)
         os = platform["os"] || platform[:os]
         arch = platform["architecture"] || platform[:architecture]
@@ -1502,7 +1540,7 @@ module Dependabot
         collect_platform_timestamps(manifests)
       end
 
-      sig { params(manifests: T.untyped).returns(T::Hash[String, T.nilable(Time)]) }
+      sig { params(manifests: ManifestList).returns(T::Hash[String, T.nilable(Time)]) }
       def collect_platform_timestamps(manifests)
         timestamps = {}
 
@@ -1511,7 +1549,7 @@ module Dependabot
           next unless platform
 
           digest = m["digest"] || m[:digest]
-          next unless digest
+          next unless digest.is_a?(String)
 
           key = platform_key(platform)
           timestamps[key] = fetch_platform_created_timestamp(digest)
@@ -1533,11 +1571,11 @@ module Dependabot
         parse_created_from_config_blob(config_digest)
       end
 
-      sig { returns(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])]) }
+      sig { returns(T::Hash[String, T.nilable(ManifestList)]) }
       def manifest_list_cache
         @manifest_list_cache ||= T.let(
           {},
-          T.nilable(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])])
+          T.nilable(T::Hash[String, T.nilable(ManifestList)])
         )
       end
 
@@ -1549,11 +1587,11 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])]) }
+      sig { returns(T::Hash[String, T.nilable(ManifestList)]) }
       def manifest_platforms_cache
         @manifest_platforms_cache ||= T.let(
           {},
-          T.nilable(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])])
+          T.nilable(T::Hash[String, T.nilable(ManifestList)])
         )
       end
 

data/lib/dependabot/docker_compose/file_parser.rb

@@ -61,16 +61,18 @@ module Dependabot
 
       private
 
-      sig { params(service: T.untyped).returns(T.nilable(T::Hash[String, T.nilable(String)])) }
+      sig { params(service: T::Hash[String, Object]).returns(T.nilable(T::Hash[String, T.nilable(String)])) }
       def parse_image_spec(service)
-        return nil unless service
+        image = service["image"]
+        return service_image(image) if image.is_a?(String)
 
-        if service["image"]
-          return service_image(service["image"])
-        elsif service["build"].is_a?(Hash) && service["build"]["dockerfile_inline"]
-          return nil if service["build"]["dockerfile_inline"].match?(/^FROM\s+\${[^}]+}$/)
+        build = service["build"]
+        if build.is_a?(Hash)
+          dockerfile_inline = build["dockerfile_inline"]
+          return nil unless dockerfile_inline.is_a?(String)
+          return nil if dockerfile_inline.match?(/^FROM\s+\${[^}]+}$/)
 
-          match = FROM_LINE.match(service["build"]["dockerfile_inline"])
+          match = FROM_LINE.match(dockerfile_inline)
           return match&.named_captures
         end
 

data/lib/dependabot/shared/shared_file_updater.rb

@@ -232,13 +232,13 @@ module Dependabot
         !source[:digest].nil?
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyRequirement]) }
       def requirements(file)
         T.must(dependency).requirements
          .select { |r| r[:file] == file.name }
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
+      sig { params(file: Dependabot::DependencyFile).returns(T.nilable(T::Array[Dependabot::DependencyRequirement])) }
       def previous_requirements(file)
         T.must(dependency).previous_requirements
          &.select { |r| r[:file] == file.name }

data/lib/dependabot/shared/utils/helpers.rb

@@ -6,7 +6,7 @@ require "sorbet-runtime"
 module Dependabot
   module Shared
     module Utils
-      HELM_REGEXP = /values[\-a-zA-Z_0-9]*\.ya?ml$/i
+      HELM_REGEXP = /values[\-a-zA-Z_0-9.]*\.ya?ml$/i
 
       extend T::Sig
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib