dependabot-gradle 0.389.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbe1f38539a5dd887e3c8fa64bb88e70766c846ca198c504780303b63464c8ab
-  data.tar.gz: e5618a45ebe2bd554fb3edaf73b89e5472d5d334919676cac60e154a38b6853f
+  metadata.gz: dc95dfd45dcabce388680e617eaffd9ba19b84ef8a729cffd616cfb06ad4cb43
+  data.tar.gz: 67e2f381c9cabd09d54a93b0c153ad7e64a1344a652954e0d59a5008dfd7d56e
 SHA512:
-  metadata.gz: 0ef872f7affa834445ba93e8f1c47ced0bd9c77165edf43b07eac7de49f7b1d38bf22a80826ed1bf3849b922bd43ca4c1cfd1d72ad4da5c2e38afc7ed41bfdcb
-  data.tar.gz: 44b02a0f2b977a165d499c33405ddd12fc53424af928fcfa358ecd8c0184b592f60a5ed4455db2465b853b0a987c0c7daa07f247f4c3f15c55905b6425b4341d
+  metadata.gz: 31931d172c06b4afca6bb258af47b1e6420fc59c46ac3dc63d483e5c5e18395a775dcbe6fcd8ae77a38f611378e5cb4d84db26d26851ca52e36dc20413b4f220
+  data.tar.gz: b2faa2bcf5a79fb88d2e085ff504ad55028cfcd8f8f6851d54815a902137fa19b91eef51d1e1eb60c514d1f8e4f039b1d588f75d1d037b43aae58cf700863013

data/lib/dependabot/gradle/distributions.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency_requirement"
@@ -14,7 +14,7 @@ module Dependabot
       sig { params(requirements: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def self.distribution_requirements?(requirements)
         requirements.any? do |req|
-          req.dig(:source, :type) == DISTRIBUTION_DEPENDENCY_TYPE
+          req.source_string("type") == DISTRIBUTION_DEPENDENCY_TYPE
         end
       end
     end

data/lib/dependabot/gradle/file_fetcher/settings_file_parser.rb

@@ -33,6 +33,22 @@ module Dependabot
           subprojects.uniq.map { |name| process_subproject_name(name) }
         end
 
+        # Returns a map of filesystem directory path => Gradle project name for all declared subprojects.
+        # For example: { 'app' => ':app', 'subprojects/chrome-trace' => ':chrome-trace' }
+        # This correctly handles custom projectDir mappings in settings files.
+        sig { returns(T::Hash[String, String]) }
+        def subproject_path_to_name_map
+          subprojects = T.let([], T::Array[String])
+          process_include_functions(subprojects)
+          subprojects.uniq.each_with_object(T.let({}, T::Hash[String, String])) do |name, map|
+            path = process_subproject_name(name)
+            next unless path
+
+            # Normalise name to Gradle colon-separated project path (e.g. ':app', ':sub:module')
+            map[path] = ":#{name.sub(/^:/, '')}"
+          end
+        end
+
         private
 
         sig { params(subprojects: T::Array[String]).void }

data/lib/dependabot/gradle/file_fetcher.rb

@@ -16,13 +16,13 @@ module Dependabot
       require_relative "file_parser"
       require_relative "file_fetcher/settings_file_parser"
 
-      SUPPORTED_LOCK_FILE_NAMES = T.let(%w(gradle.lockfile).freeze, T::Array[String])
+      SUPPORTED_LOCK_FILE_NAMES = %w(gradle.lockfile).freeze
 
       SUPPORTED_BUILD_FILE_NAMES =
-        T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
+        %w(build.gradle build.gradle.kts).freeze
 
       SUPPORTED_SETTINGS_FILE_NAMES =
-        T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
+        %w(settings.gradle settings.gradle.kts).freeze
 
       SUPPORTED_WRAPPER_FILES_PATH = %w(
         gradlew
@@ -33,7 +33,10 @@ module Dependabot
 
       # For now Gradle only supports library .toml files in the main gradle folder
       SUPPORTED_VERSION_CATALOG_FILE_PATH =
-        T.let(%w(/gradle/libs.versions.toml).freeze, T::Array[String])
+        %w(/gradle/libs.versions.toml).freeze
+
+      PLUGIN_SOURCE_SET_DIRS =
+        %w(src/main/java src/main/kotlin src/main/groovy src/main/resources).freeze
 
       sig do
         override
@@ -49,7 +52,7 @@ module Dependabot
       def initialize(source:, credentials:, repo_contents_path: nil, options: {}, update_config: nil)
         super
 
-        @lockfile_name = T.let(T.must(SUPPORTED_LOCK_FILE_NAMES.first), String)
+        @lockfile_name = T.let(SUPPORTED_LOCK_FILE_NAMES.first, String)
         @buildfile_name = T.let(nil, T.nilable(String))
       end
 
@@ -88,10 +91,74 @@ module Dependabot
         files += subproject_buildfiles(root_dir)
         files += subproject_lockfiles(root_dir)
         files += dependency_script_plugins(root_dir)
+        files += convention_plugin_source_files(files, root_dir) if fetch_plugin_sources_for_lockfiles?
+
         files + included_builds(root_dir)
                 .flat_map { |dir| all_buildfiles_in_build(dir) }
       end
 
+      sig { returns(T::Boolean) }
+      def fetch_plugin_sources_for_lockfiles?
+        Dependabot::Experiments.enabled?(:gradle_lockfile_updater)
+      end
+
+      # Only fetch source trees for *nested* project directories (e.g. "build-logic/convention"
+      # or "included/convention"), plus the root of a non-top-level build (e.g. "build-logic" or
+      # "buildSrc" itself), never the top-level repo root ("app" style modules of the outermost
+      # build). This targets the common convention-plugin module pattern - whether declared at an
+      # included/buildSrc build's own root or nested within it - without recursively scanning
+      # every ordinary top-level application module of the outermost build.
+      sig { params(files: T::Array[DependencyFile], root_dir: String).returns(T::Array[DependencyFile]) }
+      def convention_plugin_source_files(files, root_dir)
+        nested_plugin_project_dirs(files, root_dir).flat_map do |project_dir|
+          PLUGIN_SOURCE_SET_DIRS.flat_map do |relative_dir|
+            fetch_tree_support_files(clean_join([project_dir, relative_dir]))
+          end
+        end
+      end
+
+      sig { params(files: T::Array[DependencyFile], root_dir: String).returns(T::Array[String]) }
+      def nested_plugin_project_dirs(files, root_dir)
+        buildfile_dirs(files).select { |dir| plugin_source_eligible_dir?(dir, root_dir) }
+      end
+
+      # A directory is eligible for convention-plugin source scanning if it's nested below the
+      # outermost repo root (contains a "/"), or if it's the own root of a build that is itself
+      # nested (i.e. root_dir isn't the outermost "."), such as an included build or buildSrc.
+      sig { params(dir: String, root_dir: String).returns(T::Boolean) }
+      def plugin_source_eligible_dir?(dir, root_dir)
+        return true if root_dir != "." && dir == root_dir
+
+        dir.include?("/")
+      end
+
+      sig { params(files: T::Array[DependencyFile]).returns(T::Array[String]) }
+      def buildfile_dirs(files)
+        files.filter_map do |file|
+          next unless SUPPORTED_BUILD_FILE_NAMES.include?(File.basename(file.name))
+
+          clean_join([File.dirname(file.name)])
+        end
+      end
+
+      sig { params(dir: String).returns(T::Array[DependencyFile]) }
+      def fetch_tree_support_files(dir)
+        entries = repo_contents(dir: dir, raise_errors: false)
+        return [] if entries.empty?
+
+        entries.flat_map do |entry|
+          entry_path = clean_join([dir, entry.name])
+          if entry.type == "dir"
+            fetch_tree_support_files(entry_path)
+          else
+            file = fetch_support_file(entry_path)
+            file ? [file] : []
+          end
+        end
+      rescue Dependabot::DependencyFileNotFound
+        []
+      end
+
       sig { params(root_dir: String).returns(T::Array[String]) }
       def included_builds(root_dir)
         builds = []

data/lib/dependabot/gradle/file_parser/property_value_finder.rb

@@ -73,7 +73,7 @@ module Dependabot
 
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @dependency_files = dependency_files
           @properties = T.let({}, T::Hash[String, T::Hash[String, T::Hash[Symbol, String]]])
           @top_level_buildfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
         end

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,8 +11,8 @@ module Dependabot
       class RepositoriesFinder
         extend T::Sig
 
-        SUPPORTED_BUILD_FILE_NAMES = T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
-        SUPPORTED_SETTINGS_FILE_NAMES = T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
+        SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
+        SUPPORTED_SETTINGS_FILE_NAMES = %w(settings.gradle settings.gradle.kts).freeze
 
         # The Central Repo doesn't have special status for Gradle, but until
         # we're confident we're selecting repos correctly it's wise to include
@@ -37,8 +37,8 @@ module Dependabot
           ).void
         end
         def initialize(dependency_files:, target_dependency_file:, credentials: [])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @dependency_files = dependency_files
+          @credentials = credentials
           raise "No target file!" unless target_dependency_file
 
           @target_dependency_file = T.let(target_dependency_file, Dependabot::DependencyFile)

data/lib/dependabot/gradle/file_parser.rb

@@ -28,28 +28,22 @@ module Dependabot
       require_relative "file_parser/distributions_finder"
       require_relative "file_parser/property_value_finder"
 
-      SUPPORTED_BUILD_FILE_NAMES = T.let(
-        %w(build.gradle build.gradle.kts settings.gradle settings.gradle.kts).freeze,
-        T::Array[String]
-      )
+      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts settings.gradle settings.gradle.kts).freeze
 
-      PROPERTY_REGEX = T.let(
-        /
+      PROPERTY_REGEX = /
           (?:\$\{property\((?<property_name>[^:\s]*?)\)\})|
           (?:\$\{(?<property_name>[^:\s]*?)\})|
           (?:\$(?<property_name>[^:\s"']*))
-        /x,
-        Regexp
-      )
-
-      PART = T.let(%r{[^\s,@'":/\\]+}, Regexp)
-      VSN_PART = T.let(%r{[^\s,'":/\\]+}, Regexp)
-      DEPENDENCY_DECLARATION_REGEX = T.let(/(?:\(|\s)\s*['"](?<declaration>#{PART}:#{PART}:#{VSN_PART})['"]/o, Regexp)
-
-      DEPENDENCY_SET_DECLARATION_REGEX = T.let(/(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/, Regexp)
-      DEPENDENCY_SET_ENTRY_REGEX = T.let(/entry\s+['"](?<name>#{PART})['"]/o, Regexp)
-      PLUGIN_BLOCK_DECLARATION_REGEX = T.let(/(?:^|\s)plugins\s*\{/, Regexp)
-      PLUGIN_ID_REGEX = T.let(/['"](?<id>#{PART})['"]/o, Regexp)
+        /x
+
+      PART = %r{[^\s,@'":/\\]+}
+      VSN_PART = %r{[^\s,'":/\\]+}
+      DEPENDENCY_DECLARATION_REGEX = /(?:\(|\s)\s*['"](?<declaration>#{PART}:#{PART}:#{VSN_PART})['"]/o
+
+      DEPENDENCY_SET_DECLARATION_REGEX = /(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/
+      DEPENDENCY_SET_ENTRY_REGEX = /entry\s+['"](?<name>#{PART})['"]/o
+      PLUGIN_BLOCK_DECLARATION_REGEX = /(?:^|\s)plugins\s*\{/
+      PLUGIN_ID_REGEX = /['"](?<id>#{PART})['"]/o
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse

data/lib/dependabot/gradle/file_updater/lockfile_updater.rb

@@ -7,6 +7,7 @@ require "shellwords"
 require "sorbet-runtime"
 
 require "dependabot/gradle/file_updater"
+require "dependabot/gradle/file_fetcher/settings_file_parser"
 
 module Dependabot
   module Gradle
@@ -14,15 +15,29 @@ module Dependabot
       class LockfileUpdater
         extend T::Sig
 
-        INIT_SCRIPT_TASK_NAME = T.let("dependabotResolveAll", String)
-
-        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
-        def initialize(dependency_files:)
+        INIT_SCRIPT_TASK_NAME = "dependabotResolveAll"
+        GRADLE_JVMARGS_ATTEMPTS = [
+          "-Xmx1536m -Dfile.encoding=UTF-8",
+          "-Xmx2048m -Dfile.encoding=UTF-8"
+        ].freeze
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
+        def initialize(dependency_files:, repo_contents_path: nil)
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
         end
 
-        sig { params(build_file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
-        def update_lockfiles(build_file)
+        sig do
+          params(
+            build_file: Dependabot::DependencyFile,
+            build_files: T::Array[Dependabot::DependencyFile]
+          ).returns(T::Array[Dependabot::DependencyFile])
+        end
+        def update_lockfiles(build_file, build_files: [build_file])
           root_dir = determine_root_dir(build_file: build_file)
           lockfiles = lockfiles_for_root(root_dir)
 
@@ -36,7 +51,7 @@ module Dependabot
             cwd = File.join(temp_dir, root_dir == "/" ? "" : root_dir.delete_prefix("/"))
             FileUtils.mkdir_p(cwd)
 
-            write_properties_file(File.join(cwd, "gradle.properties"))
+            properties_file_path = File.join(cwd, "gradle.properties")
 
             init_script_path = File.join(cwd, "dependabot-locking.init.gradle")
             write_init_script(init_script_path)
@@ -44,12 +59,16 @@ module Dependabot
             command_parts = [
               gradle_executable_for(cwd: cwd, workspace_root: temp_dir.to_s),
               "--init-script", init_script_path,
-              INIT_SCRIPT_TASK_NAME,
+              *lockfile_tasks_for(build_files),
               "--write-locks",
               "--no-daemon"
             ]
             command = Shellwords.join(command_parts)
-            SharedHelpers.run_shell_command(command, cwd: cwd)
+            run_lockfile_update_with_retry(
+              command: command,
+              cwd: cwd,
+              properties_file_path: properties_file_path
+            )
 
             update_lockfiles_content(temp_dir, lockfiles, updated_files)
           rescue SharedHelpers::HelperSubprocessFailed => e
@@ -171,6 +190,8 @@ module Dependabot
 
         sig { params(temp_dir: T.any(Pathname, String)).void }
         def populate_temp_directory(temp_dir)
+          copy_repo_contents_to_temp_dir(temp_dir, @repo_contents_path)
+
           @dependency_files.each do |file|
             # Handle "/" directory as root - File.join treats "/" as absolute path and ignores prior components
             relative_dir = file.directory == "/" ? "" : file.directory
@@ -180,8 +201,33 @@ module Dependabot
           end
         end
 
-        sig { params(file_name: String).void }
-        def write_properties_file(file_name) # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(temp_dir: T.any(Pathname, String), repo_contents_path: T.nilable(String)).void }
+        def copy_repo_contents_to_temp_dir(temp_dir, repo_contents_path)
+          return if repo_contents_path.nil? || repo_contents_path.strip.empty?
+
+          source_dir = Pathname.new(repo_contents_path).expand_path
+          return unless source_dir.directory?
+
+          # Use the full checkout when available to ensure Gradle can compile
+          # convention plugin implementations from non-manifest source trees.
+          Dir.each_child(source_dir.to_s) do |entry|
+            entry = T.let(entry, String)
+            source_entry = File.join(source_dir.to_s, entry)
+            dest_entry = File.join(temp_dir.to_s, entry)
+
+            if entry == ".git"
+              # Some convention plugins shell out to `git` (e.g. for version derivation) and
+              # fail without a working repository. Symlink instead of copying to avoid the
+              # disk/time cost of duplicating the whole history for every lockfile update.
+              File.symlink(source_entry, dest_entry)
+            else
+              FileUtils.cp_r(source_entry, dest_entry)
+            end
+          end
+        end
+
+        sig { params(file_name: String, jvmargs: String, base_content: String).void }
+        def write_properties_file(file_name, jvmargs:, base_content:) # rubocop:disable Metrics/PerceivedComplexity
           http_proxy = ENV.fetch("HTTP_PROXY", nil)
           https_proxy = ENV.fetch("HTTPS_PROXY", nil)
           http_split = http_proxy&.split(":")
@@ -191,9 +237,20 @@ module Dependabot
           http_proxy_port = http_split&.fetch(2) || "1080"
           https_proxy_port = https_split&.fetch(2) || "1080"
 
-          existing_content = File.exist?(file_name) ? File.read(file_name) : ""
+          existing_jvmargs = base_content[/^org\.gradle\.jvmargs=(.*)$/, 1]
+          # Preserve any existing jvmargs (e.g. --add-opens flags) by merging rather than
+          # replacing them outright; the raw line is dropped from existing_content below
+          # since combined_jvmargs already includes its value.
+          has_existing_jvmargs = existing_jvmargs && !existing_jvmargs.strip.empty?
+          combined_jvmargs = has_existing_jvmargs ? "#{existing_jvmargs.strip} #{jvmargs}" : jvmargs
+          existing_content = base_content.gsub(/^org\.gradle\.jvmargs=.*$\n?/, "")
 
           proxy_properties = "
+org.gradle.jvmargs=#{combined_jvmargs}
+org.gradle.workers.max=1
+org.gradle.java.installations.auto-download=false
+org.gradle.java.installations.paths=#{installed_gradle_toolchain_paths}
+kotlin.compiler.execution.strategy=in-process
 systemProp.http.proxyHost=#{http_proxy_host}
 systemProp.http.proxyPort=#{http_proxy_port}
 systemProp.https.proxyHost=#{https_proxy_host}
@@ -203,24 +260,160 @@ systemProp.https.proxyPort=#{https_proxy_port}"
           File.write(file_name, existing_content + separator + proxy_properties)
         end
 
+        sig { params(command: String, cwd: String, properties_file_path: String).void }
+        def run_lockfile_update_with_retry(command:, cwd:, properties_file_path:)
+          base_content = File.exist?(properties_file_path) ? File.read(properties_file_path) : ""
+
+          catch(:success) do
+            GRADLE_JVMARGS_ATTEMPTS.each_with_index do |jvmargs, index|
+              write_properties_file(properties_file_path, jvmargs: jvmargs, base_content: base_content)
+              begin
+                SharedHelpers.run_shell_command(command, cwd: cwd)
+                throw :success
+              rescue SharedHelpers::HelperSubprocessFailed => e
+                # If this is the last attempt, re-raise the error
+                raise e if index == GRADLE_JVMARGS_ATTEMPTS.length - 1
+
+                # Only retry if it's a retryable failure
+                raise e unless retryable_daemon_failure?(e)
+
+                Dependabot.logger.warn(
+                  "Gradle build failed with jvmargs '#{jvmargs}'. Retrying once with larger heap size..."
+                )
+              end
+            end
+          end
+        end
+
+        sig { params(error: SharedHelpers::HelperSubprocessFailed).returns(T::Boolean) }
+        def retryable_daemon_failure?(error)
+          message = error.message.downcase
+          # Retry if daemon disappeared
+          if message.include?("daemon disappeared") || message.include?("build daemon disappeared unexpectedly")
+            return true
+          end
+
+          # Retry if process was killed (SIGKILL)
+          return true if T.cast(error.error_context[:process_termsig], T.nilable(Integer)) == SharedHelpers::SIGKILL
+
+          false
+        end
+
+        sig { returns(String) }
+        def installed_gradle_toolchain_paths
+          Dir.glob("/usr/lib/jvm/java-*-openjdk-*").join(",")
+        end
+
         sig { params(file_name: String).void }
         def write_init_script(file_name)
-          # Resolve all resolvable configurations across all loaded projects so
-          # Gradle rewrites every relevant lockfile in one invocation.
+          # Resolve every lockable configuration in one invocation. Not from the task action: that
+          # needs the project, which the configuration cache forbids.
           script_content = <<~GRADLE
             allprojects {
               if (tasks.findByName("#{INIT_SCRIPT_TASK_NAME}") == null) {
-                tasks.register("#{INIT_SCRIPT_TASK_NAME}") {
-                  doLast {
-                    configurations.findAll { it.canBeResolved }.each { it.resolve() }
-                  }
-                }
+                tasks.create("#{INIT_SCRIPT_TASK_NAME}") { }
+              }
+            }
+
+            gradle.projectsEvaluated {
+              // Prepare every project before resolving anything: with a project dependency,
+              // resolving one project computes the other project's javaCompiler.
+            #{compiler_fallback_snippet}
+
+              gradle.rootProject.allprojects { target ->
+                target.configurations.findAll {
+                  it.canBeResolved &&
+                    it.resolutionStrategy.dependencyLockingEnabled &&
+                    it.allDependencies.any { dependency ->
+                      dependency instanceof org.gradle.api.artifacts.ModuleDependency
+                    }
+                }.each { it.incoming.resolutionResult.allDependencies }
               }
             }
           GRADLE
           File.write(file_name, script_content)
         end
 
+        # Resolving computes the compile task's javaCompiler, which fails when the toolchain is
+        # missing. Only the compiler is swapped, so resolution is unaffected.
+        sig { returns(String) }
+        def compiler_fallback_snippet
+          <<~GRADLE.gsub(/^/, "  ")
+            gradle.rootProject.allprojects { target ->
+                // By name: JavaToolchainService only exists from 6.7, locking from 4.8.
+                def javaExtension = target.extensions.findByName("java")
+                def toolchainService = target.extensions.findByName("javaToolchains")
+                if (javaExtension != null && toolchainService != null) {
+                  def toolchain = javaExtension.toolchain
+                  // Toolchains landed in 6.7, vendor and implementation in 6.8, native image in 8.14.
+                  def constraints = ["vendor", "implementation", "nativeImageCapable"].collectEntries { name ->
+                    [(name): toolchain.hasProperty(name) ? toolchain."$name".getOrNull() : null]
+                  }
+                  if (toolchain.languageVersion.present) {
+                    def requested = toolchain.languageVersion.get()
+                    try {
+                      // Throwaway spec: compilerFor finalizes whatever spec it is given.
+                      toolchainService.compilerFor { spec ->
+                        spec.languageVersion.set(requested)
+                        constraints.each { name, value -> if (value != null) spec."$name".set(value) }
+                      }.get()
+                    } catch (Exception ignored) {
+                      def fallback = JavaLanguageVersion.of(JavaVersion.current().majorVersion)
+                      target.logger.lifecycle("Dependabot: Java toolchain " + requested +
+                        " is not available, compiling with " + fallback + " to resolve dependencies.")
+                      def c = toolchainService.compilerFor { s -> s.languageVersion.set(fallback) }
+                      target.tasks.withType(JavaCompile).configureEach { t -> t.javaCompiler.set(c) }
+                      // Kotlin asks for its own toolchain; convention plugins compile during config.
+                      def l = toolchainService.launcherFor { s -> s.languageVersion.set(fallback) }
+                      target.tasks.matching { it.hasProperty("kotlinJavaToolchain") }
+                        .configureEach { t -> t.kotlinJavaToolchain.toolchain.use(l) }
+                    }
+                  }
+                }
+              }
+          GRADLE
+        end
+
+        sig { params(build_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[String]) }
+        def lockfile_tasks_for(build_files)
+          build_files.filter_map { |build_file| dependency_task_for(build_file) }.uniq << INIT_SCRIPT_TASK_NAME
+        end
+
+        sig { params(build_file: Dependabot::DependencyFile).returns(T.nilable(String)) }
+        def dependency_task_for(build_file)
+          settings_file = find_settings_file(build_file)
+          return nil unless settings_file
+
+          root_dir = determine_root_dir(build_file: build_file)
+          file_path = normalized_file_path(build_file)
+          relative_path = path_relative_to_root(file_path, root_dir)
+
+          return nil if relative_path.start_with?("gradle/")
+
+          dirname = File.dirname(relative_path)
+          return nil if dirname == "." || dirname.empty?
+
+          # Look up the canonical Gradle project name from the settings file to handle repos
+          # that use custom projectDir mappings
+          # (e.g. project(':chrome-trace').projectDir = file('subprojects/chrome-trace')).
+          # Deriving the task from the filesystem path alone would produce a wrong Gradle task path.
+          parser = FileFetcher::SettingsFileParser.new(settings_file: settings_file)
+          project_name = parser.subproject_path_to_name_map[dirname]
+          return nil unless project_name
+
+          "#{project_name}:dependencies"
+        end
+
+        sig { params(file_path: String, root_dir: String).returns(String) }
+        def path_relative_to_root(file_path, root_dir)
+          return file_path.sub(%r{^/}, "") if root_dir == "/"
+
+          root_prefix = "#{root_dir}/"
+          return file_path.delete_prefix(root_prefix) if file_path.start_with?(root_prefix)
+
+          file_path.sub(%r{^/}, "")
+        end
+
         sig { params(cwd: String, workspace_root: String).returns(String) }
         def gradle_executable_for(cwd:, workspace_root:)
           cwd_path = Pathname.new(cwd).expand_path

data/lib/dependabot/gradle/file_updater/wrapper/command_builder.rb

@@ -79,19 +79,19 @@ module Dependabot
 
           sig { returns(String) }
           def version
-            T.let(T.must(@requirements[0])[:requirement], String)
+            T.must(T.must(@requirements[0]).requirement_string)
           end
 
           sig { returns(T.nilable(String)) }
           def checksum
             return nil unless @requirements.size > 1
 
-            T.let(T.must(@requirements[1])[:requirement], String)
+            T.must(T.must(@requirements[1]).requirement_string)
           end
 
           sig { returns(T.nilable(String)) }
           def distribution_type
-            url = T.let(T.must(@requirements[0])[:source], T::Hash[Symbol, String])[:url]
+            url = T.must(@requirements[0]).source_string("url")
             # Anchor to the `-bin.zip` / `-all.zip` filename suffix so a path segment such as a
             # mirror host (e.g. https://binaries.example.com/...) can't false-match `bin`/`all`.
             url&.match(/-(bin|all)\.zip/)&.captures&.first

data/lib/dependabot/gradle/file_updater/wrapper/executing_version_detector.rb

@@ -23,13 +23,10 @@ module Dependabot
           # Anchored to the `gradle-<version>-(bin|all).zip` filename so host/port numbers in custom
           # mirror URLs are never mistaken for the version. The captured token is validated with
           # Version.correct? so non-version matches (and RC/milestone names) are handled safely.
-          DISTRIBUTION_URL_VERSION_REGEX = T.let(
-            /gradle-(?<version>.+?)-(?:bin|all)\.zip/,
-            Regexp
-          )
+          DISTRIBUTION_URL_VERSION_REGEX = /gradle-(?<version>.+?)-(?:bin|all)\.zip/
 
           # Matches the version printed by `gradle --version`, e.g. "Gradle 9.2.1".
-          GRADLE_VERSION_OUTPUT_REGEX = T.let(/^Gradle\s+(?<version>\d+(?:\.\d+){1,2}(?:-[\w.]+)?)/, Regexp)
+          GRADLE_VERSION_OUTPUT_REGEX = /^Gradle\s+(?<version>\d+(?:\.\d+){1,2}(?:-[\w.]+)?)/
 
           sig { params(distribution_url: T.nilable(String)).returns(T.nilable(Dependabot::Gradle::Version)) }
           def self.from_distribution_url(distribution_url)

data/lib/dependabot/gradle/file_updater/wrapper/properties_document.rb

@@ -29,8 +29,8 @@ module Dependabot
 
           # Properties files use `=`, `:` or whitespace as the key/value separator. Gradle always
           # writes `=`, but we parse all three so user-authored files are handled faithfully.
-          KEY_VALUE_REGEX = T.let(/\A(\s*)([^\s:=]+)(\s*[:=]\s*|\s+)(.*)\z/, Regexp)
-          COMMENT_REGEX = T.let(/\A\s*[#!]/, Regexp)
+          KEY_VALUE_REGEX = /\A(\s*)([^\s:=]+)(\s*[:=]\s*|\s+)(.*)\z/
+          COMMENT_REGEX = /\A\s*[#!]/
 
           sig { params(content: String).returns(PropertiesDocument) }
           def self.parse(content)

data/lib/dependabot/gradle/file_updater/wrapper/properties_reconciler.rb

@@ -22,10 +22,7 @@ module Dependabot
 
           # Keys whose value is owned by the update itself and therefore taken from the regenerated
           # file. Everything not listed here is preserved verbatim from the user's original file.
-          MANAGED_KEYS = T.let(
-            %w(distributionUrl distributionSha256Sum).freeze,
-            T::Array[String]
-          )
+          MANAGED_KEYS = %w(distributionUrl distributionSha256Sum).freeze
 
           # Reconciles the regenerated wrapper properties back onto the user's original file.
           #

data/lib/dependabot/gradle/file_updater/wrapper_updater.rb

@@ -59,7 +59,7 @@ module Dependabot
 
           # we only run this updater if the build file has a requirement for this dependency
           target_requirements = dependency.requirements.select do |req|
-            T.let(req[:file], String) == build_file.name
+            req.file == build_file.name
           end
           return [] unless target_requirements.any?
 

data/lib/dependabot/gradle/file_updater.rb

@@ -17,7 +17,7 @@ module Dependabot
       require_relative "file_updater/lockfile_updater"
       require_relative "file_updater/wrapper_updater"
 
-      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts gradle.lockfile).freeze
+      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
 
       sig { override.returns(T::Array[::Dependabot::DependencyFile]) }
       def updated_dependency_files
@@ -74,10 +74,10 @@ module Dependabot
                          .reject { |new_req, old_req| new_req == old_req }
         # Loop through each changed requirement and update the buildfiles
         reqs.each do |new_req, old_req|
-          raise "Bad req match" if old_req.nil? || T.let(new_req[:file], String) != T.let(old_req[:file], String)
-          next if T.let(new_req[:requirement], String) == T.let(old_req[:requirement], String)
+          raise "Bad req match" if old_req.nil? || new_req.file != old_req.file
+          next if new_req.requirement == old_req.requirement
 
-          buildfile = files.find { |f| f.name == T.let(new_req.fetch(:file), String) }
+          buildfile = files.find { |f| f.name == new_req.file }
 
           # Currently, Dependabot assumes that Gradle projects using Gradle submodules are all in a single
           # repo. However, some projects are actually using git submodule references for the Gradle submodules.
@@ -88,16 +88,18 @@ module Dependabot
 
           raise DependencyFileNotResolvable, "No build file found to update the dependency" if buildfile.nil?
 
-          metadata = symbol_object_hash(T.cast(new_req[:metadata], T.nilable(Object)))
-          if metadata && metadata[:property_name].is_a?(String)
+          if new_req.metadata_string("property_name")
             files = update_files_for_property_change(files, old_req, new_req)
-          elsif metadata && symbol_object_hash(metadata[:dependency_set])
+          elsif new_req.metadata_string_hash("dependency_set")
             files = update_files_for_dep_set_change(files, old_req, new_req)
           else
             files[T.must(files.index(buildfile))] = update_version_in_buildfile(dependency, buildfile, old_req, new_req)
           end
 
-          buildfiles_processed[buildfile.name] = buildfile
+          # Always look up the updated buildfile from files after any modification
+          # to ensure buildfiles_processed contains the latest version
+          updated_buildfile = files.find { |f| f.name == buildfile.name }
+          buildfiles_processed[buildfile.name] = T.must(updated_buildfile)
         end
 
         # runs native updaters (e.g. wrapper, lockfile) on relevant build files updated
@@ -122,17 +124,28 @@ module Dependabot
         ).void
       end
       def update_lockfiles_for_buildfiles(files, buildfiles_processed)
-        lockfile_roots_processed = T.let(Set.new, T::Set[String])
+        # Support files (e.g. fetched convention plugin sources) are excluded from
+        # `buildfiles`/`files`, but Gradle still needs them on disk to compile
+        # plugins referenced by included/buildSrc builds, so pass them through too.
+        support_files = dependency_files.select(&:support_file?)
+        lockfile_updater = LockfileUpdater.new(
+          dependency_files: files + support_files,
+          repo_contents_path: repo_contents_path
+        )
+        buildfiles_by_root = T.let({}, T::Hash[String, T::Array[Dependabot::DependencyFile]])
 
         buildfiles_processed.each_value do |buildfile|
-          lockfile_updater = LockfileUpdater.new(dependency_files: files)
           root_dir = lockfile_updater.determine_root_dir(build_file: buildfile)
-          next if lockfile_roots_processed.include?(root_dir)
+          buildfiles_by_root[root_dir] ||= []
+          T.must(buildfiles_by_root[root_dir]) << buildfile
+        end
 
-          lockfile_roots_processed.add(root_dir)
+        buildfiles_by_root.each_value do |buildfiles|
+          updated_files = lockfile_updater.update_lockfiles(T.must(buildfiles.first), build_files: buildfiles)
 
-          updated_files = lockfile_updater.update_lockfiles(buildfile)
-          replace_updated_files(files, updated_files)
+          # Support files are only needed to populate Gradle's working directory;
+          # they must never be reintroduced into the buildfiles-only result set.
+          replace_updated_files(files, updated_files.reject(&:support_file?))
         end
       end
       sig do
@@ -156,47 +169,45 @@ module Dependabot
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, Object],
-          new_req: T::Hash[Symbol, Object]
+          old_req: Dependabot::DependencyRequirement,
+          new_req: Dependabot::DependencyRequirement
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_property_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = symbol_object_hash_value(new_req, :metadata)
-        property_name = string_value(metadata, :property_name)
-        file = string_value(new_req, :file)
+        property_name = T.must(new_req.metadata_string("property_name"))
+        file = T.must(new_req.file)
         buildfile = T.must(files.find { |f| f.name == file })
 
         PropertyValueUpdater.new(dependency_files: files)
                             .update_files_for_property_change(
                               property_name: property_name,
                               callsite_buildfile: buildfile,
-                              previous_value: string_value(old_req, :requirement),
-                              updated_value: string_value(new_req, :requirement)
+                              previous_value: T.must(old_req.requirement_string),
+                              updated_value: T.must(new_req.requirement_string)
                             )
       end
 
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, Object],
-          new_req: T::Hash[Symbol, Object]
+          old_req: Dependabot::DependencyRequirement,
+          new_req: Dependabot::DependencyRequirement
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_dep_set_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = symbol_object_hash_value(new_req, :metadata)
-        dependency_set = symbol_string_hash_value(metadata, :dependency_set)
-        buildfile = T.must(files.find { |f| f.name == string_value(new_req, :file) })
+        dependency_set = T.must(new_req.metadata_string_hash("dependency_set"))
+        buildfile = T.must(files.find { |f| f.name == new_req.file })
 
         DependencySetUpdater.new(dependency_files: files)
                             .update_files_for_dep_set_change(
                               dependency_set: dependency_set,
                               buildfile: buildfile,
-                              previous_requirement: string_value(old_req, :requirement),
-                              updated_requirement: string_value(new_req, :requirement)
+                              previous_requirement: T.must(old_req.requirement_string),
+                              updated_requirement: T.must(new_req.requirement_string)
                             )
       end
 
@@ -204,8 +215,8 @@ module Dependabot
         params(
           dependency: Dependabot::Dependency,
           buildfile: Dependabot::DependencyFile,
-          previous_req: T::Hash[Symbol, Object],
-          requirement: T::Hash[Symbol, Object]
+          previous_req: Dependabot::DependencyRequirement,
+          requirement: Dependabot::DependencyRequirement
         )
           .returns(Dependabot::DependencyFile)
       end
@@ -235,13 +246,13 @@ module Dependabot
       sig do
         params(
           dependency: Dependabot::Dependency,
-          requirement: T::Hash[Symbol, Object]
+          requirement: Dependabot::DependencyRequirement
         ).returns(T::Array[String])
       end
       def original_buildfile_declarations(dependency, requirement)
         # This implementation is limited to declarations that appear on a
         # single line.
-        file = string_value(requirement, :file)
+        file = T.must(requirement.file)
         buildfile = T.must(buildfiles.find { |f| f.name == file })
 
         T.must(buildfile.content).lines.select do |line|
@@ -252,11 +263,7 @@ module Dependabot
             dep_parts = dependency.name.split(":")
             next false unless line.include?(T.must(dep_parts.first)) || line.include?(T.must(dep_parts.last))
           elsif file.end_with?(".properties")
-            source = requirement[:source]
-            property = T.let(nil, T.nilable(String))
-            source_hash = symbol_object_hash(source)
-            source_property = source_hash&.[](:property)
-            property = source_property if source_property.is_a?(String)
+            property = requirement.source_string("property")
             next false unless property && line.start_with?(property)
           elsif file.end_with?(".toml")
             next false unless line.include?(dependency.name)
@@ -266,7 +273,7 @@ module Dependabot
             next false unless line.match?(name_regex)
           end
 
-          line.include?(string_value(requirement, :requirement))
+          line.include?(T.must(requirement.requirement_string))
         end
       end
       # rubocop:enable Metrics/AbcSize
@@ -301,57 +308,17 @@ module Dependabot
       sig do
         params(
           original_buildfile_declaration: String,
-          previous_req: T::Hash[Symbol, Object],
-          requirement: T::Hash[Symbol, Object]
+          previous_req: Dependabot::DependencyRequirement,
+          requirement: Dependabot::DependencyRequirement
         ).returns(String)
       end
       def updated_buildfile_declaration(original_buildfile_declaration, previous_req, requirement)
-        original_req_string = string_value(previous_req, :requirement)
-        new_req_string = string_value(requirement, :requirement)
+        original_req_string = T.must(previous_req.requirement_string)
+        new_req_string = T.must(requirement.requirement_string)
 
         original_buildfile_declaration.gsub(original_req_string, new_req_string)
       end
 
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(String) }
-      def string_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a String" unless value.is_a?(String)
-
-        value
-      end
-
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, Object]) }
-      def symbol_object_hash_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
-
-        value
-      end
-
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, String]) }
-      def symbol_string_hash_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
-
-        result = T.let({}, T::Hash[Symbol, String])
-        value.each_pair do |hash_key_object, hash_value_object|
-          hash_key = T.cast(hash_key_object, T.nilable(Object))
-          hash_value = T.cast(hash_value_object, T.nilable(Object))
-          raise TypeError, "Expected #{key} keys and values to be Symbols and Strings" unless hash_key.is_a?(Symbol) &&
-                                                                                              hash_value.is_a?(String)
-
-          result[hash_key] = hash_value
-        end
-        result
-      end
-
-      sig { params(value: T.nilable(Object)).returns(T.nilable(T::Hash[Symbol, Object])) }
-      def symbol_object_hash(value)
-        return unless value.is_a?(Hash)
-
-        value
-      end
-
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def buildfiles
         @buildfiles ||= T.let(dependency_files.reject(&:support_file?), T.nilable(T::Array[Dependabot::DependencyFile]))

data/lib/dependabot/gradle/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -66,11 +66,12 @@ module Dependabot
 
       sig { override.returns(String) }
       def maven_repo_url
-        source = dependency.requirements
-                           .find { |r| r.fetch(:source) }&.fetch(:source)
+        requirement = dependency.requirements.find(&:source)
+        return Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL unless requirement
 
-        source&.fetch(:url, nil) ||
-          source&.fetch("url") ||
+        raise TypeError, "Gradle repository source must be a hash" if requirement.source_hash.nil?
+
+        requirement.source_string("url") ||
           Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
       end
 
@@ -81,12 +82,12 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def plugin?
-        dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
+        dependency.requirements.any? { |r| r.groups&.include?("plugins") }
       end
 
       sig { returns(T::Boolean) }
       def kotlin_plugin?
-        plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
+        plugin? && dependency.requirements.any? { |r| r.groups&.include?("kotlin") }
       end
     end
   end

data/lib/dependabot/gradle/package/package_details_fetcher.rb

@@ -86,7 +86,7 @@ module Dependabot
           @dependency_files = dependency_files
           @credentials = credentials
           @forbidden_urls = forbidden_urls
-          @cooldown_options = T.let(cooldown_options, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+          @cooldown_options = cooldown_options
           @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
           @google_version_details = T.let(nil, T.nilable(Nokogiri::XML::Document))
           @dependency_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
@@ -346,7 +346,7 @@ module Dependabot
         def dependency_repository_details
           requirement_files =
             dependency.requirements
-                      .map { |r| r.fetch(:file) }
+                      .filter_map(&:file)
                       .map { |nm| dependency_files.find { |f| f.name == nm } }
 
           @dependency_repository_details ||=
@@ -396,7 +396,7 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pom
-          filename = T.must(dependency.requirements.first).fetch(:file)
+          filename = T.must(dependency.requirements.first).file
           dependency_files.find { |f| f.name == filename }
         end
 
@@ -425,12 +425,12 @@ module Dependabot
 
         sig { returns(T::Boolean) }
         def plugin?
-          dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
+          dependency.requirements.any? { |r| r.groups&.include?("plugins") }
         end
 
         sig { returns(T.nilable(T::Boolean)) }
         def kotlin_plugin?
-          plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
+          plugin? && dependency.requirements.any? { |r| r.groups&.include?("kotlin") }
         end
 
         sig { returns(T::Boolean) }

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -32,9 +32,9 @@ module Dependabot
           ignored_versions:,
           raise_on_ignored: false
         )
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
           @target_version = T.let(
             version_from_details(target_version_details),
             T.nilable(Dependabot::Gradle::Version)
@@ -43,14 +43,14 @@ module Dependabot
             source_url_from_details(target_version_details),
             T.nilable(String)
           )
-          @ignored_versions = T.let(ignored_versions, T::Array[String])
-          @raise_on_ignored = T.let(raise_on_ignored, T::Boolean)
+          @ignored_versions = ignored_versions
+          @raise_on_ignored = raise_on_ignored
           @update_possible = T.let(nil, T.nilable(T::Boolean))
           @updated_dependencies = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
           @dependencies_to_update = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
           @property_name = T.let(nil, T.nilable(String))
           @dependency_set = T.let(nil, T.nilable(T::Hash[Symbol, String]))
-          @updated_requirements = T.let({}, T::Hash[String, T::Array[T::Hash[Symbol, Object]]])
+          @updated_requirements = T.let({}, T::Hash[String, T::Array[Dependabot::DependencyRequirement]])
         end
         sig { returns(T::Boolean) }
         def update_possible?
@@ -128,8 +128,8 @@ module Dependabot
               source: nil
             ).parse.select do |dep|
               dep.requirements.any? do |r|
-                tmp_p_name = r.dig(:metadata, :property_name)
-                tmp_dep_set = r.dig(:metadata, :dependency_set)
+                tmp_p_name = r.metadata_string("property_name")
+                tmp_dep_set = r.metadata_string_hash("dependency_set")
                 next true if property_name && tmp_p_name == property_name
 
                 dependency_set && tmp_dep_set == dependency_set
@@ -140,18 +140,18 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def property_name
           @property_name ||= dependency.requirements
-                                       .find { |r| r.dig(:metadata, :property_name) }
-                                       &.dig(:metadata, :property_name)
+                                       .find { |r| r.metadata_string("property_name") }
+                                       &.metadata_string("property_name")
         end
 
         sig { returns(T.nilable(T::Hash[Symbol, String])) }
         def dependency_set
           @dependency_set ||= dependency.requirements
-                                        .find { |r| r.dig(:metadata, :dependency_set) }
-                                        &.dig(:metadata, :dependency_set)
+                                        .find { |r| r.metadata_string_hash("dependency_set") }
+                                        &.metadata_string_hash("dependency_set")
         end
 
-        sig { params(dep: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig { params(dep: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements(dep)
           @updated_requirements[dep.name] ||=
             RequirementsUpdater.new(

data/lib/dependabot/gradle/update_checker/requirements_updater.rb

@@ -61,13 +61,14 @@ module Dependabot
           # requirement at index `i` to correspond to the previous requirement
           # at the same index.
           requirements.map do |req|
-            next req if req.fetch(:requirement).nil?
-            next req if req.fetch(:requirement).include?(",")
+            requirement = req.requirement_string
+            next req if requirement.nil?
+            next req if requirement.include?(",")
 
-            property_name = req.dig(:metadata, :property_name)
+            property_name = req.metadata_string("property_name")
             next req if property_name && !properties_to_update.include?(property_name)
 
-            new_req = update_requirement(req[:requirement])
+            new_req = update_requirement(requirement)
             Dependabot::DependencyRequirement.create(req.merge(requirement: new_req, source: updated_source))
           end
         end
@@ -124,27 +125,29 @@ module Dependabot
           distribution_url = T.let(nil, T.nilable(String))
 
           requirements.map do |req|
-            source = req[:source]
+            source = req.source_hash
             next req unless source
 
-            case source[:property]
+            case req.source_string("property")
             when "distributionUrl"
-              requirement = req[:requirement]
+              requirement = T.must(req.requirement_string)
               version = update_exact_requirement(requirement)
-              distribution_url = source[:url].gsub(requirement, version)
+              distribution_url = T.must(req.source_string("url")).gsub(requirement, version)
+              updated_source = set_source_string(source.dup, "url", distribution_url)
 
               Dependabot::DependencyRequirement.create(
                 req.merge(
                   requirement: version,
-                  source: source.merge(url: distribution_url)
+                  source: updated_source
                 )
               )
             when "distributionSha256Sum"
               checksum_url, checksum = Gradle::Package::DistributionsFetcher.resolve_checksum(T.must(distribution_url))
+              updated_source = set_source_string(source.dup, "url", checksum_url)
               Dependabot::DependencyRequirement.create(
                 req.merge(
                   requirement: checksum,
-                  source: source.merge(url: checksum_url)
+                  source: updated_source
                 )
               )
             else
@@ -153,6 +156,23 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            source: Dependabot::DependencyRequirement::ObjectHash,
+            key: String,
+            value: T.nilable(String)
+          ).returns(Dependabot::DependencyRequirement::ObjectHash)
+        end
+        def set_source_string(source, key, value)
+          symbol_key = key.to_sym
+          if source.key?(key) && !source.key?(symbol_key)
+            source[key] = value
+          else
+            source[symbol_key] = value
+          end
+          source
+        end
+
         sig { override.returns(T::Class[Version]) }
         def version_class
           Gradle::Version

data/lib/dependabot/gradle/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -206,34 +206,30 @@ module Dependabot
             next false if dep.name == dependency.name
 
             dep.requirements.any? do |req|
-              req.dig(:metadata, :property_name) == property_name
+              req.metadata_string("property_name") == property_name
             end
           end
         end
       end
 
-      sig { params(requirement: T::Hash[Symbol, Object]).returns(T.nilable(String)) }
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
       def property_name_from_requirement(requirement)
-        metadata = requirement[:metadata]
-        return unless metadata.is_a?(Hash)
-
-        property_name = metadata[:property_name]
-        property_name if property_name.is_a?(String)
+        requirement.metadata_string("property_name")
       end
 
       sig { returns(T::Boolean) }
       def version_comes_from_dependency_set?
         dependency.requirements.any? do |req|
-          req.dig(:metadata, :dependency_set)
+          req.metadata_string_hash("dependency_set")
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def declarations_using_a_property
         @declarations_using_a_property ||= T.let(
           dependency.requirements
-                    .select { |req| req.dig(:metadata, :property_name) },
-          T.nilable(T::Array[T::Hash[Symbol, Object]])
+                    .select { |req| req.metadata_string("property_name") },
+          T.nilable(T::Array[Dependabot::DependencyRequirement])
         )
       end
 
@@ -244,7 +240,7 @@ module Dependabot
             dependency_files: dependency_files,
             source: nil
           ).parse.select do |dep|
-            dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
+            dep.requirements.any? { |req| req.metadata_string("property_name") }
           end,
           T.nilable(T::Array[Dependabot::Dependency])
         )

data/lib/dependabot/gradle/version.rb

@@ -15,7 +15,7 @@ module Dependabot
     class Version < Dependabot::Version
       extend T::Sig
 
-      NULL_VALUES = T.let(%w(0 final ga).freeze, T::Array[String])
+      NULL_VALUES = %w(0 final ga).freeze
       PREFIXED_TOKEN_HIERARCHY = T.let(
         {
           "." => { qualifier: 1, number: 4 },
@@ -39,13 +39,10 @@ module Dependabot
         }.freeze,
         T::Hash[String, Integer]
       )
-      VERSION_PATTERN = T.let(
-        "[0-9a-zA-Z]+" \
-        '(?>\.[0-9a-zA-Z]*)*' \
-        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?',
-        String
-      )
-      ANCHORED_VERSION_PATTERN = T.let(/\A\s*(#{VERSION_PATTERN})?\s*\z/, Regexp)
+      VERSION_PATTERN = "[0-9a-zA-Z]+" \
+                        '(?>\.[0-9a-zA-Z]*)*' \
+                        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?'
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       sig { override.params(version: Object).returns(T::Boolean) }
       def self.correct?(version)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib