dependabot-go_modules 0.263.0 → 0.265.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd3c6aac8571fb961cbc0aee44796dab0f3a6048ef2c9f317358900638accde5
-  data.tar.gz: 8c86047a15e8a143973be0201deb0ed49c69a2b1e15e09f9c8de4706ebb865f7
+  metadata.gz: 604cd71d7e64c5736544cff706f41488d458c3d345be789b5db08516c0d916f4
+  data.tar.gz: 1cc785bd945c0b685468c51eef21ff31e30943bb2d696a383d1f56800eee2e79
 SHA512:
-  metadata.gz: 1a2f326aa6e4cefd8ea1ec8b38ac5e1fd5171785832d1b8488a5c2d0a320bb6a103352e745f09847c61da063bd3fc1bcf7294f143bde0d8f2d618f2da97bd550
-  data.tar.gz: 5c37714f19647c51ec74ca9e91eebb62f138e80058807a4ba9c491f9f544932ba3e45aab0d7848cc1046b736dd670ddf276422e890b1a25800c7997e34fa3480
+  metadata.gz: c44acc2a692e6562c50db689a62ea09cf9638075814d4fabaec68983061e5e9661e52c180870b59a73cbb0bf85699bf37d04f0993d1cbf4d867c39c3f1842fb8
+  data.tar.gz: 587d2e9009e01cd18bfc2032db1224b3dfc565d46edc545aeb2e3165e7792dd223a46ac8fb905509670540e863d306e47edbb8912a164a09733792675dda0219

data/helpers/go.mod

@@ -2,4 +2,7 @@ module github.com/dependabot/dependabot-core/go_modules/helpers
 
 go 1.20
 
-require github.com/Masterminds/vcs v1.13.3
+require (
+	github.com/Masterminds/vcs v1.13.3
+	golang.org/x/mod v0.19.0
+)

data/helpers/go.sum

@@ -1,2 +1,4 @@
 github.com/Masterminds/vcs v1.13.3 h1:IIA2aBdXvfbIM+yl/eTnL4hb1XwdpvuQLglAix1gweE=
 github.com/Masterminds/vcs v1.13.3/go.mod h1:TiE7xuEjl1N4j016moRd6vezp6e6Lz23gypeXfzXeW8=
+golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
+golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=

data/helpers/version_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"encoding/json"
+	"golang.org/x/mod/semver"
+	"os"
+	"reflect"
+	"testing"
+)
+
+// TestVersionComparison verifies that the ordered version fixture is sorted correctly.
+func TestVersionComparison(t *testing.T) {
+	data, err := os.ReadFile("../spec/fixtures/ordered_versions.json")
+	if err != nil {
+		t.Fatalf("failed to read file: %v", err)
+	}
+	var expected []string
+	if err = json.Unmarshal(data, &expected); err != nil {
+		t.Fatalf("failed to unmarshal json: %v", err)
+	}
+
+	actual := make([]string, len(expected))
+	copy(actual, expected)
+	semver.Sort(actual)
+
+	// The sorted order should equal the original order in the file.
+	if !reflect.DeepEqual(actual, expected) {
+		t.Fatalf("got %v", actual)
+	}
+}

data/lib/dependabot/go_modules/file_updater.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/shared_helpers"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
@@ -9,16 +11,29 @@ require "dependabot/file_updaters/vendor_updater"
 module Dependabot
   module GoModules
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/go_mod_updater"
 
-      def initialize(dependencies:, dependency_files:, repo_contents_path: nil,
-                     credentials:, options: {})
+      sig do
+        override
+          .params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String),
+            options: T::Hash[Symbol, T.untyped]
+          )
+          .void
+      end
+      def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path: nil, options: {})
         super
 
-        @goprivate = options.fetch(:goprivate, "*")
+        @goprivate = T.let(options.fetch(:goprivate, "*"), String)
         use_repo_contents_stub if repo_contents_path.nil?
       end
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^go\.mod$/,
@@ -26,25 +41,26 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
 
-        if go_mod && dependency_changed?(go_mod)
+        if go_mod && dependency_changed?(T.must(go_mod))
           updated_files <<
             updated_file(
-              file: go_mod,
-              content: file_updater.updated_go_mod_content
+              file: T.must(go_mod),
+              content: T.must(file_updater.updated_go_mod_content)
             )
 
-          if go_sum && go_sum.content != file_updater.updated_go_sum_content
+          if go_sum && T.must(go_sum).content != file_updater.updated_go_sum_content
             updated_files <<
               updated_file(
-                file: go_sum,
-                content: file_updater.updated_go_sum_content
+                file: T.must(go_sum),
+                content: T.must(file_updater.updated_go_sum_content)
               )
           end
 
-          vendor_updater.updated_vendor_cache_files(base_directory: directory)
+          vendor_updater.updated_files(base_directory: T.must(directory))
                         .each do |file|
             updated_files << file
           end
@@ -57,19 +73,22 @@ module Dependabot
 
       private
 
+      sig { params(go_mod: Dependabot::DependencyFile).returns(T::Boolean) }
       def dependency_changed?(go_mod)
         # file_changed? only checks for changed requirements. Need to check for indirect dep version changes too.
         file_changed?(go_mod) || dependencies.any? { |dep| dep.previous_version != dep.version }
       end
 
+      sig { override.void }
       def check_required_files
         return if go_mod
 
         raise "No go.mod!"
       end
 
+      sig { returns(String) }
       def use_repo_contents_stub
-        @repo_contents_stub = true
+        @repo_contents_stub = T.let(true, T.nilable(T::Boolean))
         @repo_contents_path = Dir.mktmpdir
 
         Dir.chdir(@repo_contents_path) do
@@ -92,22 +111,27 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def go_mod
-        @go_mod ||= get_original_file("go.mod")
+        @go_mod ||= T.let(get_original_file("go.mod"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def go_sum
-        @go_sum ||= get_original_file("go.sum")
+        @go_sum ||= T.let(get_original_file("go.sum"), T.nilable(Dependabot::DependencyFile))
       end
 
+      sig { returns(T.nilable(String)) }
       def directory
         dependency_files.first&.directory
       end
 
+      sig { returns(String) }
       def vendor_dir
         File.join(repo_contents_path, directory, "vendor")
       end
 
+      sig { returns(Dependabot::FileUpdaters::VendorUpdater) }
       def vendor_updater
         Dependabot::FileUpdaters::VendorUpdater.new(
           repo_contents_path: repo_contents_path,
@@ -115,22 +139,27 @@ module Dependabot
         )
       end
 
+      sig { returns(GoModUpdater) }
       def file_updater
-        @file_updater ||=
+        @file_updater ||= T.let(
           GoModUpdater.new(
             dependencies: dependencies,
             dependency_files: dependency_files,
             credentials: credentials,
             repo_contents_path: repo_contents_path,
-            directory: directory,
+            directory: T.must(directory),
             options: { tidy: tidy?, vendor: vendor?, goprivate: @goprivate }
-          )
+          ),
+          T.nilable(Dependabot::GoModules::FileUpdater::GoModUpdater)
+        )
       end
 
+      sig { returns(T::Boolean) }
       def tidy?
         !@repo_contents_stub
       end
 
+      sig { returns(T::Boolean) }
       def vendor?
         File.exist?(File.join(vendor_dir, "modules.txt"))
       end

data/lib/dependabot/go_modules/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

data/lib/dependabot/go_modules/native_helpers.rb

@@ -1,18 +1,25 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module GoModules
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.helper_path
         clean_path(File.join(native_helpers_root, "go_modules/bin/helper"))
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         default_path = File.join(__dir__, "../../../helpers/install-dir")
         ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", default_path)
       end
 
+      sig { params(path: String).returns(String) }
       def self.clean_path(path)
         Pathname.new(path).cleanpath.to_path
       end

data/lib/dependabot/go_modules/path_converter.rb

@@ -1,19 +1,32 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/go_modules/native_helpers"
 
 module Dependabot
   module GoModules
     module PathConverter
+      extend T::Sig
+
+      sig do
+        params(path: String)
+          .returns(
+            T.nilable(String)
+          )
+      end
       def self.git_url_for_path(path)
         # Save a query by manually converting golang.org/x names
         import_path = path.gsub(%r{^golang\.org/x}, "github.com/golang")
 
-        SharedHelpers.run_helper_subprocess(
-          command: NativeHelpers.helper_path,
-          function: "getVcsRemoteForImport",
-          args: { import: import_path }
+        T.cast(
+          SharedHelpers.run_helper_subprocess(
+            command: NativeHelpers.helper_path,
+            function: "getVcsRemoteForImport",
+            args: { import: import_path }
+          ),
+          T.nilable(String)
         )
       end
     end

data/lib/dependabot/go_modules/resolvability_errors.rb

@@ -1,11 +1,16 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module GoModules
     module ResolvabilityErrors
+      extend T::Sig
+
       GITHUB_REPO_REGEX = %r{github.com/[^:@]*}
 
+      sig { params(message: String, goprivate: T.untyped).void }
       def self.handle(message, goprivate:)
         mod_path = message.scan(GITHUB_REPO_REGEX).last
         unless mod_path && message.include?("If this is a private repository")
@@ -17,9 +22,10 @@ module Dependabot
         SharedHelpers.in_a_temporary_directory do
           File.write("go.mod", "module dummy\n")
 
+          mod_path = T.cast(mod_path, String)
           mod_split = mod_path.split("/")
           repo_path = if mod_split.size > 3
-                        mod_split[0..2].join("/")
+                        T.must(mod_split[0..2]).join("/")
                       else
                         mod_path
                       end

data/lib/dependabot/go_modules/update_checker/latest_version_finder.rb

@@ -1,7 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
 
 require "dependabot/go_modules/update_checker"
 require "dependabot/update_checkers/version_filters"
@@ -9,7 +10,6 @@ require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/go_modules/requirement"
 require "dependabot/go_modules/resolvability_errors"
-require "sorbet-runtime"
 
 module Dependabot
   module GoModules
@@ -17,26 +17,47 @@ module Dependabot
       class LatestVersionFinder
         extend T::Sig
 
-        RESOLVABILITY_ERROR_REGEXES = [
-          # Package url/proxy doesn't include any redirect meta tags
-          /no go-import meta tags/,
-          # Package url 404s
-          /404 Not Found/,
-          /Repository not found/,
-          /unrecognized import path/,
-          /malformed module path/,
-          # (Private) module could not be fetched
-          /module .*: git ls-remote .*: exit status 128/m
-        ].freeze
+        RESOLVABILITY_ERROR_REGEXES = T.let(
+          [
+            # Package url/proxy doesn't include any redirect meta tags
+            /no go-import meta tags/,
+            # Package url 404s
+            /404 Not Found/,
+            /Repository not found/,
+            /unrecognized import path/,
+            /malformed module path/,
+            # (Private) module could not be fetched
+            /module .*: git ls-remote .*: exit status 128/m
+          ].freeze,
+          T::Array[Regexp]
+        )
         # The module was retracted from the proxy
         # OR the version of Go required is greater than what Dependabot supports
         # OR other go.mod version errors
         INVALID_VERSION_REGEX = /(go: loading module retractions for)|(version "[^"]+" invalid)/m
         PSEUDO_VERSION_REGEX = /\b\d{14}-[0-9a-f]{12}$/
 
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, security_advisories:, raise_on_ignored: false,
-                       goprivate:)
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            goprivate: String,
+            raise_on_ignored: T::Boolean
+          )
+            .void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          goprivate:,
+          raise_on_ignored: false
+        )
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
@@ -46,32 +67,45 @@ module Dependabot
           @goprivate           = goprivate
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_version
-          @latest_version ||= fetch_latest_version
+          @latest_version ||= T.let(fetch_latest_version, T.nilable(Dependabot::Version))
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def lowest_security_fix_version
-          @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+          @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version, T.nilable(Dependabot::Version))
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_latest_version
           candidate_versions = available_versions
           candidate_versions = filter_prerelease_versions(candidate_versions)
           candidate_versions = filter_ignored_versions(candidate_versions)
           # Adding the psuedo-version to the list to avoid downgrades
-          candidate_versions << dependency.version if PSEUDO_VERSION_REGEX.match?(dependency.version)
+          candidate_versions << version_class.new(dependency.version) if PSEUDO_VERSION_REGEX.match?(dependency.version)
 
           candidate_versions.max
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def fetch_lowest_security_fix_version
           relevant_versions = available_versions
           relevant_versions = filter_prerelease_versions(relevant_versions)
@@ -83,10 +117,12 @@ module Dependabot
           relevant_versions.min
         end
 
+        sig { returns(T::Array[Dependabot::Version]) }
         def available_versions
-          @available_versions ||= fetch_available_versions
+          @available_versions ||= T.let(fetch_available_versions, T.nilable(T::Array[Dependabot::Version]))
         end
 
+        sig { returns(T::Array[Dependabot::Version]) }
         def fetch_available_versions
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do
@@ -124,26 +160,29 @@ module Dependabot
           ResolvabilityErrors.handle(e.message, goprivate: @goprivate)
         end
 
+        sig { params(error: StandardError).returns(T::Boolean) }
         def transitory_failure?(error)
           return true if error.message.include?("EOF")
 
           error.message.include?("Internal Server Error")
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def go_mod
-          @go_mod ||= dependency_files.find { |f| f.name == "go.mod" }
+          @go_mod ||= T.let(dependency_files.find { |f| f.name == "go.mod" }, T.nilable(Dependabot::DependencyFile))
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parse_manifest
           SharedHelpers.in_a_temporary_directory do
-            File.write("go.mod", go_mod.content)
+            File.write("go.mod", T.must(go_mod).content)
             json = SharedHelpers.run_shell_command("go mod edit -json")
 
             JSON.parse(json) || {}
           end
         end
 
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_prerelease_versions(versions_array)
           return versions_array if wants_prerelease?
 
@@ -154,6 +193,7 @@ module Dependabot
           filtered
         end
 
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_lower_versions(versions_array)
           return versions_array unless dependency.numeric_version
 
@@ -161,7 +201,7 @@ module Dependabot
             .select { |version| version > dependency.numeric_version }
         end
 
-        sig { params(versions_array: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
+        sig { params(versions_array: T::Array[Dependabot::Version]).returns(T::Array[Dependabot::Version]) }
         def filter_ignored_versions(versions_array)
           filtered = versions_array
                      .reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v) } }
@@ -176,22 +216,28 @@ module Dependabot
           filtered
         end
 
+        sig { returns(T::Boolean) }
         def wants_prerelease?
-          @wants_prerelease ||=
+          @wants_prerelease ||= T.let(
             begin
               current_version = dependency.numeric_version
-              current_version&.prerelease?
-            end
+              !current_version&.prerelease?.nil?
+            end,
+            T.nilable(T::Boolean)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::Requirement]) }
         def ignore_requirements
           ignored_versions.flat_map { |req| requirement_class.requirements_array(req) }
         end
 
+        sig { returns(T.class_of(Dependabot::Requirement)) }
         def requirement_class
           dependency.requirement_class
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end

data/lib/dependabot/go_modules/update_checker.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/shared_helpers"
@@ -10,8 +12,11 @@ require "dependabot/go_modules/version"
 module Dependabot
   module GoModules
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/latest_version_finder"
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         latest_version_finder.latest_version
       end
@@ -19,25 +24,30 @@ module Dependabot
       # This is currently used to short-circuit latest_resolvable_version,
       # with the assumption that it'll be quicker than checking
       # resolvability. As this is quite quick in Go anyway, we just alias.
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         latest_resolvable_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
         lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         latest_version_finder.lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Go modules uses a single dependency file
         nil
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         dependency.requirements.map do |req|
           req.merge(requirement: latest_version)
@@ -46,8 +56,9 @@ module Dependabot
 
       private
 
+      sig { returns(Dependabot::GoModules::UpdateChecker::LatestVersionFinder) }
       def latest_version_finder
-        @latest_version_finder ||=
+        @latest_version_finder ||= T.let(
           LatestVersionFinder.new(
             dependency: dependency,
             dependency_files: dependency_files,
@@ -56,23 +67,29 @@ module Dependabot
             security_advisories: security_advisories,
             raise_on_ignored: raise_on_ignored,
             goprivate: options.fetch(:goprivate, "*")
-          )
+          ),
+          T.nilable(Dependabot::GoModules::UpdateChecker::LatestVersionFinder)
+        )
       end
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Go (yet)
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
       # Go only supports semver and semver-compliant pseudo-versions, so it can't be a SHA.
+      sig { returns(T::Boolean) }
       def existing_version_is_sha?
         false
       end
 
+      sig { params(tag: T.nilable(T::Hash[Symbol, String])).returns(T.untyped) }
       def version_from_tag(tag)
         # To compare with the current version we either use the commit SHA
         # (if that's what the parser picked up) or the tag name.
@@ -81,6 +98,7 @@ module Dependabot
         tag&.fetch(:tag)
       end
 
+      sig { returns(T::Hash[Symbol, T.untyped]) }
       def default_source
         { type: "default", source: dependency.name }
       end

data/lib/dependabot/go_modules/version.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 # Go pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
@@ -6,6 +6,8 @@
 # alteration.
 # Best docs are at https://github.com/Masterminds/semver
 
+require "sorbet-runtime"
+
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -19,6 +21,7 @@ module Dependabot
                         '(\+incompatible)?'
       ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
       def self.correct?(version)
         version = version.gsub(/^v/, "") if version.is_a?(String)
         version = version.to_s.split("+").first if version.to_s.include?("+")
@@ -26,34 +29,40 @@ module Dependabot
         super(version)
       end
 
+      sig { override.params(version: VersionParameter).void }
       def initialize(version)
-        @version_string = version.to_s.gsub(/^v/, "")
+        @version_string = T.let(version.to_s.gsub(/^v/, ""), String)
         version = version.gsub(/^v/, "") if version.is_a?(String)
         version = version.to_s.split("+").first if version.to_s.include?("+")
+        @prerelease = T.let(nil, T.nilable(String))
         version, @prerelease = version.to_s.split("-", 2) if version.to_s.include?("-")
 
         super
       end
 
+      sig { returns(String) }
       def inspect # :nodoc:
         "#<#{self.class} #{@version_string.inspect}>"
       end
 
+      sig { returns(String) }
       def to_s
         @version_string
       end
 
+      sig { params(other: Object).returns(T.nilable(Integer)) }
       def <=>(other)
         result = super(other)
         return if result.nil?
         return result unless result.zero?
 
-        other = self.class.new(other) unless other.is_a?(Version)
+        other = self.class.new(other.to_s) unless other.is_a?(Version)
         compare_prerelease(@prerelease || "", T.unsafe(other).prerelease || "")
       end
 
       protected
 
+      sig { returns(T.nilable(String)) }
       attr_reader :prerelease
 
       private
@@ -62,6 +71,7 @@ module Dependabot
       # see https://github.com/golang/mod/blob/fa1ba4269bda724bb9f01ec381fbbaf031e45833/semver/semver.go#L333
       # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { params(left: T.untyped, right: T.untyped).returns(Integer) }
       def compare_prerelease(left, right)
         return 0 if left == right
         return 1 if left == ""
@@ -98,12 +108,14 @@ module Dependabot
       # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/PerceivedComplexity
 
+      sig { params(data: String).returns(T.untyped) }
       def next_ident(data)
         i = 0
         i += 1 while i < data.length && data[i] != "."
         [data[0..i], data[i..-1]]
       end
 
+      sig { params(data: T.untyped).returns(T::Boolean) }
       def num?(data)
         i = 0
         i += 1 while i < data.length && data[i] >= "0" && data[i] <= "9"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.263.0
+  version: 0.265.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-27 00:00:00.000000000 Z
+date: 2024-07-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -248,6 +248,7 @@ files:
 - helpers/go.sum
 - helpers/importresolver/main.go
 - helpers/main.go
+- helpers/version_test.go
 - lib/dependabot/go_modules.rb
 - lib/dependabot/go_modules/file_fetcher.rb
 - lib/dependabot/go_modules/file_parser.rb
@@ -267,7 +268,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.263.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.265.0
 post_install_message: 
 rdoc_options: []
 require_paths: