dependabot-gradle 0.263.0 → 0.265.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 24cb48fee1554bb80686222457a3ac875711f7aa66d301fe5df8cbac7dd391b2
-  data.tar.gz: 6ca760eaefb642e424de330300dc9df7822d5c582c114807e5c14b0497acb60e
+  metadata.gz: d0fc61d351f3a8383749a79c08ee71678d78442ff7edb3538ccfd2ad15ca414b
+  data.tar.gz: ff7f1194ffbf904f20529dcc0498536bc0dd848a3fd21c1e3c04996ff8780f82
 SHA512:
-  metadata.gz: 9f461e1de8da682cdf99c4750e8f04022486d70a54eca1526ee3ef70e2a95939e7099fca0ffba60e533148345dd1a0277c6ea54566fc05bfaff73d75f238a4f5
-  data.tar.gz: a92c58501204b577f31be4570170a4fc078495abb9c779b792c9d36529fecbf2e8067b9c49956a6de9071e1235bf69d85723568ee06a7169487083d9a821772e
+  metadata.gz: f2206ad2b7353fb69259091341093c06139ba98f760ad90356d128ffabe06ebde7dbd35c9d303305df91ce737563585045423efb34d84f060cc0303cbec530df
+  data.tar.gz: e97691808b349179c8a3ff8f39c574904ee39f24cbed749cf5f5f064b26fccf76c1ba667d23a2a6fd9a1a21bd5b892b277a6ebab66b57bc273878cf9f18faff0

data/lib/dependabot/gradle/file_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -16,21 +16,39 @@ module Dependabot
       require_relative "file_fetcher/settings_file_parser"
 
       SUPPORTED_BUILD_FILE_NAMES =
-        %w(build.gradle build.gradle.kts).freeze
+        T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
 
       SUPPORTED_SETTINGS_FILE_NAMES =
-        %w(settings.gradle settings.gradle.kts).freeze
+        T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
 
       # For now Gradle only supports library .toml files in the main gradle folder
       SUPPORTED_VERSION_CATALOG_FILE_PATH =
-        %w(/gradle/libs.versions.toml).freeze
+        T.let(%w(/gradle/libs.versions.toml).freeze, T::Array[String])
 
+      sig do
+        override
+          .params(
+            source: Dependabot::Source,
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String),
+            options: T::Hash[String, String]
+          )
+          .void
+      end
+      def initialize(source:, credentials:, repo_contents_path: nil, options: {})
+        super
+
+        @buildfile_name = T.let(nil, T.nilable(String))
+      end
+
+      sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         filenames.any? do |filename|
           SUPPORTED_BUILD_FILE_NAMES.any? { |supported| filename.end_with?(supported) }
         end
       end
 
+      sig { override.returns(String) }
       def self.required_files_message
         "Repo must contain a build.gradle / build.gradle.kts file."
       end
@@ -42,6 +60,7 @@ module Dependabot
 
       private
 
+      sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def all_buildfiles_in_build(root_dir)
         files = [buildfile(root_dir), settings_file(root_dir), version_catalog_file(root_dir)].compact
         files += subproject_buildfiles(root_dir)
@@ -50,6 +69,7 @@ module Dependabot
                 .flat_map { |dir| all_buildfiles_in_build(dir) }
       end
 
+      sig { params(root_dir: String).returns(T::Array[String]) }
       def included_builds(root_dir)
         builds = []
 
@@ -61,7 +81,7 @@ module Dependabot
         return builds unless settings_file(root_dir)
 
         builds += SettingsFileParser
-                  .new(settings_file: settings_file(root_dir))
+                  .new(settings_file: T.must(settings_file(root_dir)))
                   .included_build_paths
                   .map { |p| clean_join([root_dir, p]) }
 
@@ -73,17 +93,19 @@ module Dependabot
         Pathname.new(File.join(parts)).cleanpath.to_path
       end
 
+      sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def subproject_buildfiles(root_dir)
         return [] unless settings_file(root_dir)
 
         subproject_paths =
           SettingsFileParser
-          .new(settings_file: settings_file(root_dir))
+          .new(settings_file: T.must(settings_file(root_dir)))
           .subproject_paths
 
         subproject_paths.filter_map do |path|
           if @buildfile_name
-            fetch_file_from_host(File.join(root_dir, path, @buildfile_name))
+            buildfile_path = File.join(root_dir, path, @buildfile_name)
+            fetch_file_from_host(buildfile_path)
           else
             buildfile(File.join(root_dir, path))
           end
@@ -93,6 +115,7 @@ module Dependabot
         end
       end
 
+      sig { params(root_dir: String).returns(T.nilable(DependencyFile)) }
       def version_catalog_file(root_dir)
         return nil unless root_dir == "."
 
@@ -100,6 +123,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { params(root_dir: String).returns(T::Array[DependencyFile]) }
       def dependency_script_plugins(root_dir)
         return [] unless buildfile(root_dir)
 
@@ -123,6 +147,7 @@ module Dependabot
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
+      sig { params(path: T.any(Pathname, String)).returns(T::Boolean) }
       def file_exists_in_submodule?(path)
         fetch_file_from_host(path, fetch_submodules: true)
         true
@@ -130,20 +155,24 @@ module Dependabot
         false
       end
 
+      sig { params(dir: String).returns(T.nilable(DependencyFile)) }
       def buildfile(dir)
         file = find_first(dir, SUPPORTED_BUILD_FILE_NAMES) || return
         @buildfile_name ||= File.basename(file.name)
         file
       end
 
+      sig { params(dir: String).returns(T.nilable(DependencyFile)) }
       def gradle_toml_file(dir)
         find_first(dir, SUPPORTED_VERSION_CATALOG_FILE_PATH)
       end
 
+      sig { params(dir: String).returns(T.nilable(DependencyFile)) }
       def settings_file(dir)
         find_first(dir, SUPPORTED_SETTINGS_FILE_NAMES)
       end
 
+      sig { params(dir: String, supported_names: T::Array[String]).returns(T.nilable(DependencyFile)) }
       def find_first(dir, supported_names)
         paths = supported_names
                 .map { |name| clean_join([dir, name]) }
@@ -153,10 +182,12 @@ module Dependabot
         fetch_first_if_present(paths)
       end
 
+      sig { returns(T::Hash[String, DependencyFile]) }
       def cached_files
-        @cached_files ||= {}
+        @cached_files ||= T.let({}, T.nilable(T::Hash[String, DependencyFile]))
       end
 
+      sig { params(paths: T::Array[String]).returns(T.nilable(DependencyFile)) }
       def fetch_first_if_present(paths)
         paths.each do |path|
           file = fetch_file_if_present(path) || next

data/lib/dependabot/gradle/file_updater.rb

@@ -56,7 +56,6 @@ module Dependabot
 
       def update_buildfiles_for_dependency(buildfiles:, dependency:)
         files = buildfiles.dup
-
         # The UpdateChecker ensures the order of requirements is preserved
         # when updating, so we can zip them together in new/old pairs.
         reqs = dependency.requirements.zip(dependency.previous_requirements)
@@ -69,6 +68,13 @@ module Dependabot
 
           buildfile = files.find { |f| f.name == new_req.fetch(:file) }
 
+          # Exception raised to handle issue that arises when buildfiles function (see this file)
+          # removes the build file that contains the dependency itself. So no build file exists to
+          # update dependency, This behaviour is evident for extremely small number of users
+          # that have added separate repos as sub-modules in parent projects
+
+          raise DependencyFileNotResolvable, "No build file found to update the dependency" if buildfile.nil?
+
           if new_req.dig(:metadata, :property_name)
             files = update_files_for_property_change(files, old_req, new_req)
           elsif new_req.dig(:metadata, :dependency_set)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.263.0
+  version: 0.265.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-27 00:00:00.000000000 Z
+date: 2024-07-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.265.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.263.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.265.0
 post_install_message: 
 rdoc_options: []
 require_paths: