dependabot-gradle 0.320.0 → 0.321.0

data/lib/dependabot/gradle/update_checker.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/gradle/file_parser"
@@ -8,16 +9,20 @@ require "dependabot/gradle/file_parser"
 module Dependabot
   module Gradle
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_finder"
       require_relative "update_checker/multi_dependency_updater"
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_version
         return if git_dependency?
 
         latest_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version
         # TODO: Resolve the build.gradle to find the latest version we could
         # update to without updating any other dependencies at the same time.
@@ -31,10 +36,12 @@ module Dependabot
         latest_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         lowest_security_fix_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         return if git_dependency?
         return nil if version_comes_from_multi_dependency_property?
@@ -43,6 +50,7 @@ module Dependabot
         lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Gradle has a single dependency file.
         #
@@ -54,6 +62,7 @@ module Dependabot
         nil
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         property_names =
           declarations_using_a_property
@@ -67,6 +76,7 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { override.returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         # If the dependency version come from a property we couldn't
         # interpolate then there's nothing we can do.
@@ -75,6 +85,7 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         unless version_comes_from_multi_dependency_property? ||
                version_comes_from_dependency_set?
@@ -84,39 +95,51 @@ module Dependabot
         multi_dependency_updater.update_possible?
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         multi_dependency_updater.updated_dependencies
       end
 
+      sig { override.returns(T::Boolean) }
       def numeric_version_up_to_date?
         return false unless version_class.correct?(dependency.version)
 
         super
       end
 
+      sig { override.params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Boolean) }
       def numeric_version_can_update?(requirements_to_unlock:)
         return false unless version_class.correct?(dependency.version)
 
         super
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def preferred_version_details
         return lowest_security_fix_version_details if vulnerable?
 
         latest_version_details
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_version_details
-        @latest_version_details ||= version_finder.latest_version_details
+        @latest_version_details ||= T.let(
+          version_finder.latest_version_details,
+          T.nilable(T::Hash[Symbol, T.untyped])
+        )
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def lowest_security_fix_version_details
-        @lowest_security_fix_version_details ||=
-          version_finder.lowest_security_fix_version_details
+        @lowest_security_fix_version_details ||= T.let(
+          version_finder.lowest_security_fix_version_details,
+          T.nilable(T::Hash[Symbol, T.untyped])
+        )
       end
 
+      sig { returns(VersionFinder) }
       def version_finder
-        @version_finder ||=
+        @version_finder ||= T.let(
           VersionFinder.new(
             dependency: dependency,
             dependency_files: dependency_files,
@@ -125,11 +148,14 @@ module Dependabot
             raise_on_ignored: raise_on_ignored,
             cooldown_options: update_cooldown,
             security_advisories: security_advisories
-          )
+          ),
+          T.nilable(VersionFinder)
+        )
       end
 
+      sig { returns(MultiDependencyUpdater) }
       def multi_dependency_updater
-        @multi_dependency_updater ||=
+        @multi_dependency_updater ||= T.let(
           MultiDependencyUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
@@ -137,21 +163,28 @@ module Dependabot
             target_version_details: latest_version_details,
             ignored_versions: ignored_versions,
             raise_on_ignored: raise_on_ignored
-          )
+          ),
+          T.nilable(MultiDependencyUpdater)
+        )
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
-        @git_commit_checker ||=
+        @git_commit_checker ||= T.let(
           GitCommitChecker.new(
             dependency: dependency,
             credentials: credentials
-          )
+          ),
+          T.nilable(Dependabot::GitCommitChecker)
+        )
       end
 
+      sig { returns(T::Boolean) }
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
           property_name = requirement.fetch(:metadata).fetch(:property_name)
@@ -166,26 +199,33 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Boolean) }
       def version_comes_from_dependency_set?
         dependency.requirements.any? do |req|
           req.dig(:metadata, :dependency_set)
         end
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def declarations_using_a_property
-        @declarations_using_a_property ||=
+        @declarations_using_a_property ||= T.let(
           dependency.requirements
-                    .select { |req| req.dig(:metadata, :property_name) }
+                    .select { |req| req.dig(:metadata, :property_name) },
+          T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::Dependency]) }
       def all_property_based_dependencies
-        @all_property_based_dependencies ||=
+        @all_property_based_dependencies ||= T.let(
           Gradle::FileParser.new(
             dependency_files: dependency_files,
             source: nil
           ).parse.select do |dep|
             dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
-          end
+          end,
+          T.nilable(T::Array[Dependabot::Dependency])
+        )
       end
     end
   end

data/lib/dependabot/gradle/version.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -12,13 +13,15 @@ require "dependabot/utils"
 module Dependabot
   module Gradle
     class Version < Dependabot::Version
-      NULL_VALUES = %w(0 final ga).freeze
-      PREFIXED_TOKEN_HIERARCHY = {
+      extend T::Sig
+
+      NULL_VALUES = T.let(%w(0 final ga).freeze, T::Array[String])
+      PREFIXED_TOKEN_HIERARCHY = T.let({
         "." => { qualifier: 1, number: 4 },
         "-" => { qualifier: 2, number: 3 },
         "_" => { qualifier: 2, number: 3 }
-      }.freeze
-      NAMED_QUALIFIERS_HIERARCHY = {
+      }.freeze, T::Hash[String, T::Hash[Symbol, Integer]])
+      NAMED_QUALIFIERS_HIERARCHY = T.let({
         "a" => 1, "alpha"     => 1,
         "b" => 2, "beta"      => 2,
         "m" => 3, "milestone" => 3,
@@ -26,37 +29,44 @@ module Dependabot
         "snapshot" => 5, "dev" => 5,
         "ga" => 6, "" => 6, "final" => 6,
         "sp" => 7
-      }.freeze
-      VERSION_PATTERN =
+      }.freeze, T::Hash[String, Integer])
+      VERSION_PATTERN = T.let(
         "[0-9a-zA-Z]+" \
         '(?>\.[0-9a-zA-Z]*)*' \
-        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?'
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
+        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?',
+        String
+      )
+      ANCHORED_VERSION_PATTERN = T.let(/\A\s*(#{VERSION_PATTERN})?\s*\z/, Regexp)
 
+      sig { override.params(version: T.untyped).returns(T::Boolean) }
       def self.correct?(version)
         return false if version.nil?
 
         version.to_s.match?(ANCHORED_VERSION_PATTERN)
       end
 
+      sig { override.params(version: T.untyped).void }
       def initialize(version)
-        @version_string = version.to_s
+        @version_string = T.let(version.to_s, String)
         super(version.to_s.tr("_", "-"))
       end
 
+      sig { override.returns(String) }
       def to_s
         @version_string
       end
 
+      sig { override.returns(T::Boolean) }
       def prerelease?
         tokens.any? do |token|
           next true if token == "eap"
           next false unless NAMED_QUALIFIERS_HIERARCHY[token]
 
-          NAMED_QUALIFIERS_HIERARCHY[token] < 6
+          T.must(NAMED_QUALIFIERS_HIERARCHY[token]) < 6
         end
       end
 
+      sig { params(other: T.untyped).returns(Integer) }
       def <=>(other)
         version = stringify_version(@version_string)
         version = fill_tokens(version)
@@ -76,10 +86,10 @@ module Dependabot
 
         prefixed_tokens.count.times.each do |index|
           comp = compare_prefixed_token(
-            prefix: prefixed_tokens[index][0],
-            token: prefixed_tokens[index][1..-1] || "",
-            other_prefix: other_prefixed_tokens[index][0],
-            other_token: other_prefixed_tokens[index][1..-1] || ""
+            prefix: T.must(T.must(prefixed_tokens[index])[0]),
+            token: T.must(prefixed_tokens[index])[1..-1] || "",
+            other_prefix: T.must(T.must(other_prefixed_tokens[index])[0]),
+            other_token: T.must(other_prefixed_tokens[index])[1..-1] || ""
           )
           return comp unless comp.zero?
         end
@@ -89,16 +99,21 @@ module Dependabot
 
       private
 
+      sig { returns(T::Array[String]) }
       def tokens
-        @tokens ||=
+        @tokens ||= T.let(
           begin
             version = @version_string.to_s.downcase
             version = fill_tokens(version)
             version = trim_version(version)
-            split_into_prefixed_tokens(version).map { |t| t[1..-1] }
-          end
+            split_into_prefixed_tokens(version).map { |t| T.must(t[1..-1]) }
+          end,
+          T.nilable(T::Array[String])
+        )
+        @tokens
       end
 
+      sig { params(version: T.untyped).returns(String) }
       def stringify_version(version)
         version = version.to_s.downcase
 
@@ -106,6 +121,7 @@ module Dependabot
         version.gsub(/^v(?=\d)/, "")
       end
 
+      sig { params(version: String).returns(String) }
       def fill_tokens(version)
         # Add separators when transitioning from digits to characters
         version = version.gsub(/(\d)([A-Za-z])/, '\1-\2')
@@ -117,14 +133,16 @@ module Dependabot
         version.gsub(/([\.\-])$/, '\10')
       end
 
+      sig { params(version: String).returns(String) }
       def trim_version(version)
         version.split("-").filter_map do |v|
           parts = v.split(".")
-          parts = parts[0..-2] while NULL_VALUES.include?(parts&.last)
-          parts&.join(".")
+          parts = T.must(parts[0..-2]) while NULL_VALUES.include?(parts.last)
+          parts.join(".")
         end.reject(&:empty?).join("-")
       end
 
+      sig { params(version: String, other_version: String).returns([String, String]) }
       def convert_dates(version, other_version)
         default = [version, other_version]
         return default unless version.match?(/^\d{4}-?\d{2}-?\d{2}$/)
@@ -133,26 +151,34 @@ module Dependabot
         [version.delete("-"), other_version.delete("-")]
       end
 
+      sig { params(version: String).returns(T::Array[String]) }
       def split_into_prefixed_tokens(version)
         ".#{version}".split(/(?=[_\-\.])/)
       end
 
+      sig do
+        params(
+          prefixed_tokens: T::Array[String],
+          other_prefixed_tokens: T::Array[String]
+        ).returns([T::Array[String], T::Array[String]])
+      end
       def pad_for_comparison(prefixed_tokens, other_prefixed_tokens)
         prefixed_tokens = prefixed_tokens.dup
         other_prefixed_tokens = other_prefixed_tokens.dup
 
-        longest = [prefixed_tokens, other_prefixed_tokens].max_by(&:count)
-        shortest = [prefixed_tokens, other_prefixed_tokens].min_by(&:count)
+        longest = T.must([prefixed_tokens, other_prefixed_tokens].max_by(&:count))
+        shortest = T.must([prefixed_tokens, other_prefixed_tokens].min_by(&:count))
 
         longest.count.times do |index|
           next unless shortest[index].nil?
 
-          shortest[index] = longest[index].start_with?(".") ? ".0" : "-"
+          shortest[index] = T.must(longest[index]).start_with?(".") ? ".0" : "-"
         end
 
         [prefixed_tokens, other_prefixed_tokens]
       end
 
+      sig { params(prefix: String, token: String, other_prefix: String, other_token: String).returns(Integer) }
       def compare_prefixed_token(prefix:, token:, other_prefix:, other_token:)
         return 1 if token == "+" && other_token != "+"
         return -1 if other_token == "+" && token != "+"
@@ -171,18 +197,21 @@ module Dependabot
         compare_token(token: token, other_token: other_token)
       end
 
+      sig { params(token: String, other_token: String).returns(Integer) }
       def compare_token(token:, other_token:)
         if (token_hierarchy = NAMED_QUALIFIERS_HIERARCHY[token])
           return -1 unless NAMED_QUALIFIERS_HIERARCHY[other_token]
 
-          return token_hierarchy <=> NAMED_QUALIFIERS_HIERARCHY[other_token]
+          return token_hierarchy <=> T.must(NAMED_QUALIFIERS_HIERARCHY[other_token])
         end
 
         return 1 if NAMED_QUALIFIERS_HIERARCHY[other_token]
 
-        token = token.to_i if token.match?(/^\d+$/)
-        other_token = other_token.to_i if other_token.match?(/^\d+$/)
-        token <=> other_token
+        if token.match?(/^\d+$/) && other_token.match?(/^\d+$/)
+          token.to_i <=> other_token.to_i
+        else
+          (token <=> other_token) || 0
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.320.0
+  version: 0.321.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.321.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.321.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.321.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.321.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -280,7 +280,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.320.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.321.0
 rdoc_options: []
 require_paths:
 - lib