dependabot-gradle 0.386.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e13edb6e52c235438f37abde8da6e16acbf8af7c9ad353b1107d5e3640c452b
-  data.tar.gz: 3a3e95bec57181355b897de358e3de6bf713b96968cbe8c28cc2465a81aa6599
+  metadata.gz: f1925c8db0e74ac32a01d84fbe6eb268c93381e3f8e6d2da4e1750088788c439
+  data.tar.gz: b0319754d34aa6a7e9fe6921d0c73a1f69ef8ee39d77be4c9d497f0dabee2c33
 SHA512:
-  metadata.gz: ebe25caa251686e54aea6dddddfe590c400e7261eba31772dd43e8dece9a4d037dbfa530f67737521d2f3e7b4c1389e8219bda2aa52a6a6e46c79687d2d62e0b
-  data.tar.gz: e12a6f556feb7ba1883c1458fc5a1f482be3b60d0a268c1048b86d11470efe262caa70dd324eb7dc9a564b7bc71c0cc941c797ab527b1e1e5a91f4f8bf1c2bc6
+  metadata.gz: f63fa431cbd89d827dfd77a9618cda55907ea79311069a0f177266ac93678e21f6e3fda16a8650bf7b7c4a59c12c67c6317d4313552bd21a06a32cb4281bbc55
+  data.tar.gz: ff703db39eafc5a298fad53b79a534ebcb4b6518e2937b9714e3c9096409e7382e53572e5a64cada6e251a977a89b3ff6249e9e3f183ef40ea7fc2055dae9f94

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -174,9 +174,9 @@ module Dependabot
           base_credential ? T.must(base_credential["url"]).gsub(%r{/+$}, "") : CENTRAL_REPO_URL
         end
 
-        sig { params(credential: T.untyped).returns(T::Boolean) }
+        sig { params(credential: T.any(Dependabot::Credential, T::Hash[String, Object])).returns(T::Boolean) }
         def replaces_base?(credential)
-          if credential.respond_to?(:replaces_base?)
+          if credential.is_a?(Dependabot::Credential)
             credential.replaces_base?
           else
             credential["replaces-base"] == true

data/lib/dependabot/gradle/file_parser.rb

@@ -142,7 +142,7 @@ module Dependabot
 
       sig do
         params(
-          parsed_toml_file: T::Hash[String, T.untyped],
+          parsed_toml_file: T::Hash[String, Object],
           toml_file: Dependabot::DependencyFile
         ).returns(DependencySet)
       end
@@ -156,7 +156,7 @@ module Dependabot
 
       sig do
         params(
-          parsed_toml_file: T::Hash[String, T.untyped],
+          parsed_toml_file: T::Hash[String, Object],
           toml_file: Dependabot::DependencyFile
         ).returns(DependencySet)
       end
@@ -247,9 +247,9 @@ module Dependabot
         end
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Hash[String, T.untyped]) }
+      sig { params(file: Dependabot::DependencyFile).returns(T::Hash[String, Object]) }
       def parsed_toml_file(file)
-        T.cast(TomlRB.parse(file.content), T::Hash[String, T.untyped])
+        T.cast(TomlRB.parse(file.content), T::Hash[String, Object])
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
         raise Dependabot::DependencyFileNotParseable, file.path
       end

data/lib/dependabot/gradle/file_updater.rb

@@ -88,10 +88,10 @@ module Dependabot
 
           raise DependencyFileNotResolvable, "No build file found to update the dependency" if buildfile.nil?
 
-          metadata = T.let(new_req[:metadata], T.nilable(T::Hash[Symbol, T.untyped]))
-          if T.let(metadata&.[](:property_name), T.nilable(String))
+          metadata = symbol_object_hash(T.cast(new_req[:metadata], T.nilable(Object)))
+          if metadata && metadata[:property_name].is_a?(String)
             files = update_files_for_property_change(files, old_req, new_req)
-          elsif T.let(metadata&.[](:dependency_set), T.nilable(T::Hash[Symbol, String]))
+          elsif metadata && symbol_object_hash(metadata[:dependency_set])
             files = update_files_for_dep_set_change(files, old_req, new_req)
           else
             files[T.must(files.index(buildfile))] = update_version_in_buildfile(dependency, buildfile, old_req, new_req)
@@ -156,47 +156,47 @@ module Dependabot
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, T.untyped],
-          new_req: T::Hash[Symbol, T.untyped]
+          old_req: T::Hash[Symbol, Object],
+          new_req: T::Hash[Symbol, Object]
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_property_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = T.let(new_req.fetch(:metadata), T::Hash[Symbol, T.untyped])
-        property_name = T.let(metadata.fetch(:property_name), String)
-        file = T.let(new_req.fetch(:file), String)
+        metadata = symbol_object_hash_value(new_req, :metadata)
+        property_name = string_value(metadata, :property_name)
+        file = string_value(new_req, :file)
         buildfile = T.must(files.find { |f| f.name == file })
 
         PropertyValueUpdater.new(dependency_files: files)
                             .update_files_for_property_change(
                               property_name: property_name,
                               callsite_buildfile: buildfile,
-                              previous_value: T.let(old_req.fetch(:requirement), String),
-                              updated_value: T.let(new_req.fetch(:requirement), String)
+                              previous_value: string_value(old_req, :requirement),
+                              updated_value: string_value(new_req, :requirement)
                             )
       end
 
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, T.untyped],
-          new_req: T::Hash[Symbol, T.untyped]
+          old_req: T::Hash[Symbol, Object],
+          new_req: T::Hash[Symbol, Object]
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_dep_set_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = T.let(new_req.fetch(:metadata), T::Hash[Symbol, T.untyped])
-        dependency_set = T.let(metadata.fetch(:dependency_set), T::Hash[Symbol, String])
-        buildfile = T.must(files.find { |f| f.name == T.let(new_req.fetch(:file), String) })
+        metadata = symbol_object_hash_value(new_req, :metadata)
+        dependency_set = symbol_string_hash_value(metadata, :dependency_set)
+        buildfile = T.must(files.find { |f| f.name == string_value(new_req, :file) })
 
         DependencySetUpdater.new(dependency_files: files)
                             .update_files_for_dep_set_change(
                               dependency_set: dependency_set,
                               buildfile: buildfile,
-                              previous_requirement: T.let(old_req.fetch(:requirement), String),
-                              updated_requirement: T.let(new_req.fetch(:requirement), String)
+                              previous_requirement: string_value(old_req, :requirement),
+                              updated_requirement: string_value(new_req, :requirement)
                             )
       end
 
@@ -204,8 +204,8 @@ module Dependabot
         params(
           dependency: Dependabot::Dependency,
           buildfile: Dependabot::DependencyFile,
-          previous_req: T::Hash[Symbol, T.untyped],
-          requirement: T::Hash[Symbol, T.untyped]
+          previous_req: T::Hash[Symbol, Object],
+          requirement: T::Hash[Symbol, Object]
         )
           .returns(Dependabot::DependencyFile)
       end
@@ -235,13 +235,14 @@ module Dependabot
       sig do
         params(
           dependency: Dependabot::Dependency,
-          requirement: T::Hash[Symbol, T.untyped]
+          requirement: T::Hash[Symbol, Object]
         ).returns(T::Array[String])
       end
       def original_buildfile_declarations(dependency, requirement)
         # This implementation is limited to declarations that appear on a
         # single line.
-        buildfile = T.must(buildfiles.find { |f| f.name == T.let(requirement.fetch(:file), String) })
+        file = string_value(requirement, :file)
+        buildfile = T.must(buildfiles.find { |f| f.name == file })
 
         T.must(buildfile.content).lines.select do |line|
           line = evaluate_properties(line, buildfile)
@@ -250,11 +251,14 @@ module Dependabot
           if dependency.name.include?(":")
             dep_parts = dependency.name.split(":")
             next false unless line.include?(T.must(dep_parts.first)) || line.include?(T.must(dep_parts.last))
-          elsif T.let(requirement.fetch(:file), String).end_with?(".properties")
-            property = T.let(requirement, T::Hash[Symbol, T.nilable(T::Hash[Symbol, T.nilable(String)])])
-                        .dig(:source, :property)
-            next false unless !property.nil? && line.start_with?(property)
-          elsif T.let(requirement.fetch(:file), String).end_with?(".toml")
+          elsif file.end_with?(".properties")
+            source = requirement[:source]
+            property = T.let(nil, T.nilable(String))
+            source_hash = symbol_object_hash(source)
+            source_property = source_hash&.[](:property)
+            property = source_property if source_property.is_a?(String)
+            next false unless property && line.start_with?(property)
+          elsif file.end_with?(".toml")
             next false unless line.include?(dependency.name)
           else
             name_regex_value = /['"]#{Regexp.quote(dependency.name)}['"]/
@@ -262,7 +266,7 @@ module Dependabot
             next false unless line.match?(name_regex)
           end
 
-          line.include?(T.let(requirement.fetch(:requirement), String))
+          line.include?(string_value(requirement, :requirement))
         end
       end
       # rubocop:enable Metrics/AbcSize
@@ -297,17 +301,57 @@ module Dependabot
       sig do
         params(
           original_buildfile_declaration: String,
-          previous_req: T::Hash[Symbol, T.untyped],
-          requirement: T::Hash[Symbol, T.untyped]
+          previous_req: T::Hash[Symbol, Object],
+          requirement: T::Hash[Symbol, Object]
         ).returns(String)
       end
       def updated_buildfile_declaration(original_buildfile_declaration, previous_req, requirement)
-        original_req_string = T.let(previous_req.fetch(:requirement), String)
-        new_req_string = T.let(requirement.fetch(:requirement), String)
+        original_req_string = string_value(previous_req, :requirement)
+        new_req_string = string_value(requirement, :requirement)
 
         original_buildfile_declaration.gsub(original_req_string, new_req_string)
       end
 
+      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(String) }
+      def string_value(hash, key)
+        value = hash.fetch(key)
+        raise TypeError, "Expected #{key} to be a String" unless value.is_a?(String)
+
+        value
+      end
+
+      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, Object]) }
+      def symbol_object_hash_value(hash, key)
+        value = hash.fetch(key)
+        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
+
+        value
+      end
+
+      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, String]) }
+      def symbol_string_hash_value(hash, key)
+        value = hash.fetch(key)
+        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
+
+        result = T.let({}, T::Hash[Symbol, String])
+        value.each_pair do |hash_key_object, hash_value_object|
+          hash_key = T.cast(hash_key_object, T.nilable(Object))
+          hash_value = T.cast(hash_value_object, T.nilable(Object))
+          raise TypeError, "Expected #{key} keys and values to be Symbols and Strings" unless hash_key.is_a?(Symbol) &&
+                                                                                              hash_value.is_a?(String)
+
+          result[hash_key] = hash_value
+        end
+        result
+      end
+
+      sig { params(value: T.nilable(Object)).returns(T.nilable(T::Hash[Symbol, Object])) }
+      def symbol_object_hash(value)
+        return unless value.is_a?(Hash)
+
+        value
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def buildfiles
         @buildfiles ||= T.let(dependency_files.reject(&:support_file?), T.nilable(T::Array[Dependabot::DependencyFile]))

data/lib/dependabot/gradle/package/distributions_fetcher.rb

@@ -11,10 +11,10 @@ module Dependabot
       class DistributionsFetcher
         extend T::Sig
 
-        @available_versions = T.let([], T::Array[T::Hash[String, T.untyped]])
+        @available_versions = T.let([], T::Array[T::Hash[Symbol, Object]])
         @distributions_checksums = T.let({}, T::Hash[String, T::Array[String]])
 
-        sig { returns(T.any(T::Array[T::Hash[String, T.untyped]], T::Array[T::Hash[Symbol, T.untyped]])) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def self.available_versions
           return @available_versions if @available_versions.any?
 
@@ -24,7 +24,7 @@ module Dependabot
               T.let(response.body, String),
               symbolize_names: true
             ),
-            T::Array[T::Hash[Symbol, T.untyped]]
+            T::Array[T::Hash[Symbol, Object]]
           )
           @available_versions +=
             versions
@@ -38,14 +38,17 @@ module Dependabot
             end
         end
 
-        sig { params(version: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
+        sig { params(version: T::Hash[Symbol, Object]).returns(T::Boolean) }
         def self.release_version?(version:)
-          Gradle::Version.correct?(T.let(version[:version], String)) &&
-            T.let(version[:broken], T::Boolean) == false &&
-            T.let(version[:snapshot], T::Boolean) == false &&
-            T.let(version[:rcFor], String) == "" &&
-            T.let(version[:milestoneFor], String) == "" &&
-            /.*-(rc|milestone)-.*/.match?(T.let(version[:version], String)) == false
+          version_number = version[:version]
+          return false unless version_number.is_a?(String)
+
+          Gradle::Version.correct?(version_number) &&
+            version[:broken] == false &&
+            version[:snapshot] == false &&
+            version[:rcFor] == "" &&
+            version[:milestoneFor] == "" &&
+            /.*-(rc|milestone)-.*/.match?(version_number) == false
         end
 
         sig { params(distribution_url: String).returns(T.nilable(T::Array[String])) }

data/lib/dependabot/gradle/package/package_details_fetcher.rb

@@ -28,7 +28,7 @@ module Dependabot
         sig do
           params(
             url: String,
-            headers: T::Hash[T.any(String, Symbol), T.untyped]
+            headers: T::Hash[T.any(String, Symbol), Object]
           ).returns(Excon::Response)
         end
         def self.get(url:, headers:)
@@ -45,8 +45,29 @@ module Dependabot
         end
       end
 
+      module RepositoryDetailsHelpers
+        extend T::Sig
+
+        sig { params(hash: T::Hash[String, Object], key: String).returns(String) }
+        def string_key_value(hash, key)
+          value = hash.fetch(key)
+          return value if value.is_a?(String)
+
+          Kernel.raise TypeError, "Expected #{key} to be a String"
+        end
+
+        sig { params(hash: T::Hash[String, Object]).returns(T::Hash[T.any(String, Symbol), Object]) }
+        def auth_headers_value(hash)
+          value = hash.fetch("auth_headers")
+          return value if value.is_a?(Hash)
+
+          Kernel.raise TypeError, "Expected auth_headers to be a Hash"
+        end
+      end
+
       class PackageDetailsFetcher
         extend T::Sig
+        include RepositoryDetailsHelpers
 
         CENTRAL_REPO_URL = "https://repo.maven.apache.org/maven2"
         KOTLIN_PLUGIN_REPO_PREFIX = "org.jetbrains.kotlin"
@@ -66,10 +87,10 @@ module Dependabot
           @credentials = credentials
           @forbidden_urls = forbidden_urls
           @cooldown_options = T.let(cooldown_options, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
-          @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
-          @google_version_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
-          @dependency_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
-          @release_details = T.let(nil, T.nilable(T::Hash[String, T::Hash[Symbol, T.untyped]]))
+          @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
+          @google_version_details = T.let(nil, T.nilable(Nokogiri::XML::Document))
+          @dependency_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
+          @release_details = T.let(nil, T.nilable(T::Hash[String, T::Hash[Symbol, Object]]))
           @version_release_date_fallback_fetcher = T.let(nil, T.nilable(VersionReleaseDateFallbackFetcher))
         end
 
@@ -86,9 +107,9 @@ module Dependabot
         attr_reader :forbidden_urls
 
         # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def fetch_available_versions
-          package_releases = T.let([], T::Array[T::Hash[String, T.untyped]])
+          package_releases = T.let([], T::Array[T::Hash[Symbol, Object]])
           version_details =
             repositories.map do |repository_details|
               url = repository_details.fetch("url")
@@ -125,6 +146,7 @@ module Dependabot
           return release if release.released_at
 
           release_date = release_details[release.version.to_s]&.fetch(:release_date, nil)
+          release_date = nil unless release_date.is_a?(Time)
           hydrated_release = build_release_with_date(release, release_date)
 
           return hydrated_release if hydrated_release.released_at || !plugin?
@@ -132,7 +154,7 @@ module Dependabot
           build_release_with_date(hydrated_release, version_release_date_fallback(release.version.to_s))
         end
 
-        sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Hash[String, T::Hash[Symbol, Object]]) }
         def release_details
           @release_details ||= begin
             extractor = ReleaseDateExtractor.new(dependency_name: dependency.name, version_class: version_class)
@@ -180,7 +202,7 @@ module Dependabot
           )
         end
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def repositories
           return @repositories if @repositories
 
@@ -200,11 +222,12 @@ module Dependabot
             end
         end
 
-        sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+        sig { returns(T.nilable(T::Array[T::Hash[Symbol, Object]])) }
         def distribution_version_details
           DistributionsFetcher.available_versions.map do |info|
+            build_time = info[:build_time]
             release_date = begin
-              Time.parse(info[:build_time])
+              Time.parse(build_time) if build_time.is_a?(String)
             rescue StandardError
               nil
             end
@@ -219,7 +242,7 @@ module Dependabot
           nil
         end
 
-        sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+        sig { returns(T.nilable(T::Array[T::Hash[Symbol, Object]])) }
         def google_version_details
           url = Gradle::FileParser::RepositoriesFinder::GOOGLE_MAVEN_REPO
           group_id, artifact_id = group_and_artifact_ids
@@ -247,17 +270,18 @@ module Dependabot
           nil
         end
 
-        sig { params(repository_details: T::Hash[T.untyped, T.untyped]).returns(T.untyped) }
+        sig { params(repository_details: T::Hash[String, Object]).returns(Nokogiri::XML::Document) }
         def dependency_metadata(repository_details)
-          @dependency_metadata ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
+          @dependency_metadata ||= T.let({}, T.nilable(T::Hash[Integer, Nokogiri::XML::Document]))
           @dependency_metadata[repository_details.hash] ||=
             begin
+              repository_url = string_key_value(repository_details, "url")
               response = EofRetry.get(
-                url: dependency_metadata_url(repository_details.fetch("url")),
-                headers: repository_details.fetch("auth_headers")
+                url: dependency_metadata_url(repository_url),
+                headers: auth_headers_value(repository_details)
               )
 
-              check_response(response, repository_details.fetch("url"))
+              check_response(response, repository_url)
               Nokogiri::XML(response.body)
             rescue URI::InvalidURIError
               Nokogiri::XML("")
@@ -269,17 +293,18 @@ module Dependabot
             end
         end
 
-        sig { params(repository_details: T::Hash[T.untyped, T.untyped]).returns(T.untyped) }
+        sig { params(repository_details: T::Hash[String, Object]).returns(Nokogiri::HTML::Document) }
         def release_info_metadata(repository_details)
-          @release_info_metadata ||= T.let({}, T.nilable(T::Hash[Integer, T.untyped]))
+          @release_info_metadata ||= T.let({}, T.nilable(T::Hash[Integer, Nokogiri::HTML::Document]))
           @release_info_metadata[repository_details.hash] ||=
             begin
+              repository_url = string_key_value(repository_details, "url")
               response = EofRetry.get(
-                url: dependency_metadata_url(repository_details.fetch("url")).gsub("maven-metadata.xml", ""),
-                headers: repository_details.fetch("auth_headers")
+                url: dependency_metadata_url(repository_url).gsub("maven-metadata.xml", ""),
+                headers: auth_headers_value(repository_details)
               )
 
-              check_response(response, repository_details.fetch("url"))
+              check_response(response, repository_url)
               Nokogiri::HTML(response.body)
             rescue URI::InvalidURIError
               Nokogiri::HTML("")
@@ -291,12 +316,12 @@ module Dependabot
             end
         end
 
-        sig { returns(T::Array[T::Hash[String, String]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def repository_urls
           plugin? ? plugin_repository_details : dependency_repository_details
         end
 
-        sig { params(response: T.untyped, repository_url: T.untyped).returns(T.nilable(T::Array[T.untyped])) }
+        sig { params(response: Excon::Response, repository_url: String).void }
         def check_response(response, repository_url)
           return unless response.status == 401 || response.status == 403
           return if T.must(@forbidden_urls).include?(repository_url)
@@ -317,7 +342,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Array[T::Hash[String, String]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def dependency_repository_details
           requirement_files =
             dependency.requirements
@@ -337,18 +362,18 @@ module Dependabot
             end.uniq
         end
 
-        sig { returns(T::Array[T::Hash[String, String]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def plugin_repository_details
           [{ "url" => Gradle::FileParser::RepositoriesFinder::GRADLE_PLUGINS_REPO, "auth_headers" => {} }] +
             dependency_repository_details
         end
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def distribution_repository_details
           [{ "url" => Gradle::Distributions::DISTRIBUTION_REPOSITORY_URL, "auth_headers" => {} }]
         end
 
-        sig { params(comparison_version: T.untyped).returns(T::Boolean) }
+        sig { params(comparison_version: Object).returns(T::Boolean) }
         def matches_dependency_version_type?(comparison_version)
           return true unless dependency.version
 
@@ -375,7 +400,7 @@ module Dependabot
           dependency_files.find { |f| f.name == filename }
         end
 
-        sig { params(repository_url: T.untyped).returns(String) }
+        sig { params(repository_url: String).returns(String) }
         def dependency_metadata_url(repository_url)
           group_id, artifact_id = group_and_artifact_ids
           group_id = "#{Dependabot::Gradle::MetadataFinder::KOTLIN_PLUGIN_REPO_PREFIX}.#{group_id}" if kotlin_plugin?

data/lib/dependabot/gradle/package/release_date_extractor.rb

@@ -32,17 +32,17 @@ module Dependabot
         # This supports mirrors/proxies of both Maven Central and Gradle Plugin Portal.
         sig do
           params(
-            repositories: T::Array[T::Hash[String, T.untyped]],
+            repositories: T::Array[T::Hash[String, Object]],
             dependency_metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::XML::Document),
             release_info_metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::HTML::Document)
-          ).returns(T::Hash[String, T::Hash[Symbol, T.untyped]])
+          ).returns(T::Hash[String, T::Hash[Symbol, Object]])
         end
         def extract(repositories:, dependency_metadata_fetcher:, release_info_metadata_fetcher:)
-          release_date_info = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
+          release_date_info = T.let({}, T::Hash[String, T::Hash[Symbol, Object]])
 
           begin
             parse_repository_release_dates(
@@ -72,13 +72,13 @@ module Dependabot
 
         sig do
           params(
-            repositories: T::Array[T::Hash[String, T.untyped]],
-            release_date_info: T::Hash[String, T::Hash[Symbol, T.untyped]],
+            repositories: T::Array[T::Hash[String, Object]],
+            release_date_info: T::Hash[String, T::Hash[Symbol, Object]],
             dependency_metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::XML::Document),
             release_info_metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::HTML::Document)
           ).void
         end
@@ -106,10 +106,10 @@ module Dependabot
         # Parses Maven-style HTML directory listings to extract release dates.
         sig do
           params(
-            repository_details: T::Hash[String, T.untyped],
-            release_date_info: T::Hash[String, T::Hash[Symbol, T.untyped]],
+            repository_details: T::Hash[String, Object],
+            release_date_info: T::Hash[String, T::Hash[Symbol, Object]],
             metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::HTML::Document)
           ).void
         end
@@ -134,10 +134,10 @@ module Dependabot
         # Parses Gradle Plugin Portal maven-metadata.xml for release dates.
         sig do
           params(
-            repository_details: T::Hash[String, T.untyped],
-            release_date_info: T::Hash[String, T::Hash[Symbol, T.untyped]],
+            repository_details: T::Hash[String, Object],
+            release_date_info: T::Hash[String, T::Hash[Symbol, Object]],
             metadata_fetcher: T.proc.params(
-              repo: T::Hash[String, T.untyped]
+              repo: T::Hash[String, Object]
             ).returns(Nokogiri::XML::Document)
           ).void
         end

data/lib/dependabot/gradle/package/version_release_date_fallback_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/logger"
@@ -14,7 +14,7 @@ module Dependabot
         sig do
           params(
             dependency_name: String,
-            repositories: T::Array[T::Hash[String, T.untyped]],
+            repositories: T::Array[T::Hash[String, Object]],
             forbidden_urls: T::Array[String],
             pom_url_builder: T.proc.params(repository_url: String, version: String).returns(String)
           ).void
@@ -35,10 +35,14 @@ module Dependabot
 
           ordered_repositories.each do |repo|
             repository_url = repo.fetch("url")
+            next unless repository_url.is_a?(String)
+
             pom_url = @pom_url_builder.call(repository_url, version)
 
             begin
-              response = Dependabot::RegistryClient.head(url: pom_url, headers: repo["auth_headers"])
+              headers = repo["auth_headers"]
+              headers = {} unless headers.is_a?(Hash)
+              response = Dependabot::RegistryClient.head(url: pom_url, headers: headers)
               last_modified = response.headers["Last-Modified"] || response.headers["last-modified"]
               next unless last_modified
 
@@ -63,10 +67,10 @@ module Dependabot
 
         private
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[String, Object]]) }
         def ordered_repositories
           candidates = @repositories.reject do |repo|
-            @forbidden_urls.include?(repo.fetch("url"))
+            @forbidden_urls.include?(repo.fetch("url").to_s)
           end
 
           preferred, remaining = candidates.partition do |repo|

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -14,13 +14,12 @@ module Dependabot
         require_relative "version_finder"
         require_relative "requirements_updater"
 
-        # rubocop:disable Metrics/AbcSize
         sig do
           params(
             dependency: Dependabot::Dependency,
             dependency_files: T::Array[Dependabot::DependencyFile],
             credentials: T::Array[Dependabot::Credential],
-            target_version_details: T.nilable(T::Hash[Symbol, Dependabot::Gradle::Version]),
+            target_version_details: T.nilable(T::Hash[Symbol, Object]),
             ignored_versions: T::Array[String],
             raise_on_ignored: T::Boolean
           ).void
@@ -37,11 +36,11 @@ module Dependabot
           @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
           @credentials = T.let(credentials, T::Array[Dependabot::Credential])
           @target_version = T.let(
-            target_version_details&.fetch(:version),
+            version_from_details(target_version_details),
             T.nilable(Dependabot::Gradle::Version)
           )
           @source_url = T.let(
-            T.cast(target_version_details&.fetch(:source_url), T.nilable(String)),
+            source_url_from_details(target_version_details),
             T.nilable(String)
           )
           @ignored_versions = T.let(ignored_versions, T::Array[String])
@@ -51,10 +50,8 @@ module Dependabot
           @dependencies_to_update = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
           @property_name = T.let(nil, T.nilable(String))
           @dependency_set = T.let(nil, T.nilable(T::Hash[Symbol, String]))
-          @updated_requirements = T.let({}, T::Hash[String, T::Array[T::Hash[Symbol, T.untyped]]])
+          @updated_requirements = T.let({}, T::Hash[String, T::Array[T::Hash[Symbol, Object]]])
         end
-        # rubocop:enable Metrics/AbcSize
-
         sig { returns(T::Boolean) }
         def update_possible?
           return false unless target_version
@@ -93,6 +90,18 @@ module Dependabot
 
         private
 
+        sig { params(details: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(Dependabot::Gradle::Version)) }
+        def version_from_details(details)
+          version = details&.fetch(:version, nil)
+          version if version.is_a?(Dependabot::Gradle::Version)
+        end
+
+        sig { params(details: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
+        def source_url_from_details(details)
+          source_url = details&.fetch(:source_url, nil)
+          source_url if source_url.is_a?(String)
+        end
+
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
@@ -142,7 +151,7 @@ module Dependabot
                                         &.dig(:metadata, :dependency_set)
         end
 
-        sig { params(dep: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { params(dep: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(dep)
           @updated_requirements[dep.name] ||=
             RequirementsUpdater.new(

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -49,7 +49,7 @@ module Dependabot
           @dependency_files    = dependency_files
           @credentials         = credentials
           @raise_on_ignored    = raise_on_ignored
-          @forbidden_urls      = T.let([], T::Array[T.untyped])
+          @forbidden_urls      = T.let([], T::Array[String])
           @ignored_versions    = ignored_versions
 
           super(
@@ -64,7 +64,7 @@ module Dependabot
           )
         end
 
-        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_version_details
           possible_versions = package_release(versions)
 
@@ -92,7 +92,7 @@ module Dependabot
           true
         end
 
-        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def lowest_security_fix_version_details
           possible_versions = package_release(versions)
 
@@ -118,7 +118,7 @@ module Dependabot
             source_url: url }
         end
 
-        sig { returns(T.any(T::Array[T::Hash[String, T.untyped]], T::Array[T::Hash[Symbol, T.untyped]])) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def versions
           Package::PackageDetailsFetcher.new(
             dependency: dependency,
@@ -134,10 +134,10 @@ module Dependabot
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
         sig { returns(T.nilable(T::Array[String])) }
@@ -149,15 +149,16 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { params(version: T::Array[T.untyped]).returns(T::Array[Dependabot::Package::PackageRelease]) }
+        sig { params(version: T::Array[T::Hash[Symbol, Object]]).returns(T::Array[Dependabot::Package::PackageRelease]) }
         def package_release(version)
           package_releases = []
 
           version.map do |info|
+            released_at = info[:released_at]
             package_releases << Dependabot::Package::PackageRelease.new(
-              version: info[:version],
-              released_at: info[:released_at],
-              url: info[:source_url]
+              version: Dependabot::Gradle::Version.new(info[:version].to_s),
+              released_at: released_at.is_a?(Time) ? released_at : nil,
+              url: info[:source_url]&.to_s
             )
           end
           package_releases
@@ -177,7 +178,10 @@ module Dependabot
           )
         end
 
-        sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
+        sig do
+          params(possible_versions: T::Array[Dependabot::Package::PackageRelease])
+            .returns(T::Array[Dependabot::Package::PackageRelease])
+        end
         def filter_ignored_versions(possible_versions)
           filtered = possible_versions
 

data/lib/dependabot/gradle/update_checker.rb

@@ -19,7 +19,7 @@ module Dependabot
       def latest_version
         return if git_dependency?
 
-        latest_version_details&.fetch(:version)
+        version_from_details(latest_version_details)
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -38,7 +38,7 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
-        lowest_security_fix_version_details&.fetch(:version)
+        version_from_details(lowest_security_fix_version_details)
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -66,12 +66,12 @@ module Dependabot
       def updated_requirements
         property_names =
           declarations_using_a_property
-          .map { |req| req.dig(:metadata, :property_name) }
+          .filter_map { |req| property_name_from_requirement(req) }
 
         RequirementsUpdater.new(
           requirements: dependency.requirements,
           latest_version: preferred_resolvable_version&.to_s,
-          source_url: preferred_version_details&.fetch(:source_url),
+          source_url: source_url_from_details(preferred_version_details),
           properties_to_update: property_names
         ).updated_requirements
       end
@@ -114,26 +114,26 @@ module Dependabot
         super
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def preferred_version_details
         return lowest_security_fix_version_details if vulnerable?
 
         latest_version_details
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def latest_version_details
         @latest_version_details ||= T.let(
           version_finder.latest_version_details,
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(T::Hash[Symbol, Object])
         )
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def lowest_security_fix_version_details
         @lowest_security_fix_version_details ||= T.let(
           version_finder.lowest_security_fix_version_details,
-          T.nilable(T::Hash[Symbol, T.untyped])
+          T.nilable(T::Hash[Symbol, Object])
         )
       end
 
@@ -168,6 +168,18 @@ module Dependabot
         )
       end
 
+      sig { params(details: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(Dependabot::Version)) }
+      def version_from_details(details)
+        version = details&.fetch(:version, nil)
+        version if version.is_a?(Dependabot::Version)
+      end
+
+      sig { params(details: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
+      def source_url_from_details(details)
+        source_url = details&.fetch(:source_url, nil)
+        source_url if source_url.is_a?(String)
+      end
+
       sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
@@ -187,7 +199,8 @@ module Dependabot
       sig { returns(T::Boolean) }
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
-          property_name = requirement.fetch(:metadata).fetch(:property_name)
+          property_name = property_name_from_requirement(requirement)
+          next false unless property_name
 
           all_property_based_dependencies.any? do |dep|
             next false if dep.name == dependency.name
@@ -199,6 +212,15 @@ module Dependabot
         end
       end
 
+      sig { params(requirement: T::Hash[Symbol, Object]).returns(T.nilable(String)) }
+      def property_name_from_requirement(requirement)
+        metadata = requirement[:metadata]
+        return unless metadata.is_a?(Hash)
+
+        property_name = metadata[:property_name]
+        property_name if property_name.is_a?(String)
+      end
+
       sig { returns(T::Boolean) }
       def version_comes_from_dependency_set?
         dependency.requirements.any? do |req|
@@ -206,12 +228,12 @@ module Dependabot
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
       def declarations_using_a_property
         @declarations_using_a_property ||= T.let(
           dependency.requirements
                     .select { |req| req.dig(:metadata, :property_name) },
-          T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+          T.nilable(T::Array[T::Hash[Symbol, Object]])
         )
       end
 

data/lib/dependabot/gradle/version.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -47,14 +47,14 @@ module Dependabot
       )
       ANCHORED_VERSION_PATTERN = T.let(/\A\s*(#{VERSION_PATTERN})?\s*\z/, Regexp)
 
-      sig { override.params(version: T.untyped).returns(T::Boolean) }
+      sig { override.params(version: Object).returns(T::Boolean) }
       def self.correct?(version)
         return false if version.nil?
 
         version.to_s.match?(ANCHORED_VERSION_PATTERN)
       end
 
-      sig { override.params(version: T.untyped).void }
+      sig { override.params(version: Object).void }
       def initialize(version)
         @version_string = T.let(version.to_s, String)
         super(version.to_s.tr("_", "-"))
@@ -75,7 +75,7 @@ module Dependabot
         end
       end
 
-      sig { params(other: T.untyped).returns(Integer) }
+      sig { params(other: Object).returns(Integer) }
       def <=>(other)
         version = stringify_version(@version_string)
         version = fill_tokens(version)
@@ -122,7 +122,7 @@ module Dependabot
         @tokens
       end
 
-      sig { params(version: T.untyped).returns(String) }
+      sig { params(version: Object).returns(String) }
       def stringify_version(version)
         version = version.to_s.downcase
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib