dependabot-gradle 0.248.0 → 0.249.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e67de95ed0ebc5aaa70aebd08b8722cff25ca415f9a67082d8a040ac1fc79799
-  data.tar.gz: 04bd6dc1433696b46120247051d3fb158c45c2f74baebb8eb00d5c056d6b1e2a
+  metadata.gz: b6b88c185132e0757e166517d91f8eec67bb81700556092db7575ff8315872f6
+  data.tar.gz: 4ffa864fecdbb4cbd35f4e852db4149fe305c51ea26c943436ee3f5f18b74a07
 SHA512:
-  metadata.gz: 6c028921409f0d2926f388d1fe93edfaff7da1223129cd9515c8dea5a6037dc1afe2bc5f2e348ce82111a6ee7d6fd0b3f3e4734a1e3598b1bcc31a08cb5ca7b2
-  data.tar.gz: 22c05c745aa589d4c9ca9dceda3bffc73d37187d191b0fafb456912e068955cc070b2ad9f223fd6020c19ce072890ec4c7fbcedb9efc9c96effe904eae58205e
+  metadata.gz: 4b664778ef30123ac9f08028d7154e9e1fd6c546d6144a574a5bf412fa6300bba16ef8e3fe47511bec1c74ec929f1ee1eef473ddbd6bff424070826197d9d040
+  data.tar.gz: 2e255ff81474cd16e17f5381204b37372720ce41d7ba3b87c66b90b8771c543811de5d8c654872453c1b7974f32370a8b653f2700d8284e66a8af1baf7a6fc3f

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -48,7 +48,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency_files, :target_dependency_file
+        attr_reader :dependency_files
+        attr_reader :target_dependency_file
 
         def inherited_repository_urls(dependency_file)
           return [] unless dependency_file

data/lib/dependabot/gradle/file_updater/dependency_set_updater.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/gradle/file_parser"
 require "dependabot/gradle/file_updater"
 
@@ -8,10 +10,21 @@ module Dependabot
   module Gradle
     class FileUpdater
       class DependencySetUpdater
+        extend T::Sig
+
+        sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        sig do
+          params(
+            dependency_set: T::Hash[Symbol, String],
+            buildfile: Dependabot::DependencyFile,
+            previous_requirement: String,
+            updated_requirement: String
+          ).returns(T::Array[Dependabot::DependencyFile])
+        end
         def update_files_for_dep_set_change(dependency_set:,
                                             buildfile:,
                                             previous_requirement:,
@@ -21,7 +34,7 @@ module Dependabot
 
           return dependency_files unless declaration_string
 
-          updated_content = buildfile.content.sub(
+          updated_content = T.must(buildfile.content).sub(
             declaration_string,
             declaration_string.sub(
               previous_requirement,
@@ -30,7 +43,7 @@ module Dependabot
           )
 
           updated_files = dependency_files.dup
-          updated_files[updated_files.index(buildfile)] =
+          updated_files[T.must(updated_files.index(buildfile))] =
             update_file(file: buildfile, content: updated_content)
 
           updated_files
@@ -38,22 +51,31 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig do
+          params(
+            dependency_set: T::Hash[Symbol, String],
+            buildfile: Dependabot::DependencyFile
+          )
+            .returns(T.nilable(String))
+        end
         def original_declaration_string(dependency_set, buildfile)
           regex = Gradle::FileParser::DEPENDENCY_SET_DECLARATION_REGEX
-          dependency_sets = []
-          buildfile.content.scan(regex) do
+          dependency_sets = T.let([], T::Array[String])
+          T.must(buildfile.content).scan(regex) do
             dependency_sets << Regexp.last_match.to_s
           end
 
           dependency_sets.find do |mtch|
-            next unless mtch.include?(dependency_set[:group])
+            next unless mtch.include?(T.must(dependency_set[:group]))
 
-            mtch.include?(dependency_set[:version])
+            mtch.include?(T.must(dependency_set[:version]))
           end
         end
 
+        sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }
         def update_file(file:, content:)
           updated_file = file.dup
           updated_file.content = content

data/lib/dependabot/gradle/metadata_finder.rb

@@ -1,13 +1,15 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
 require "sorbet-runtime"
-require "dependabot/metadata_finders"
-require "dependabot/metadata_finders/base"
+
 require "dependabot/file_fetchers/base"
+require "dependabot/gradle/file_fetcher"
 require "dependabot/gradle/file_parser/repositories_finder"
 require "dependabot/maven/utils/auth_headers_finder"
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
 
 module Dependabot
@@ -21,6 +23,7 @@ module Dependabot
 
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         tmp_source = look_up_source_in_pom(dependency_pom_file)
         return tmp_source if tmp_source
@@ -31,14 +34,15 @@ module Dependabot
         return unless tmp_source
 
         artifact = dependency.name.split(":").last
-        return tmp_source if tmp_source.repo.end_with?(artifact)
+        return tmp_source if tmp_source.repo.end_with?(T.must(artifact))
 
         tmp_source if repo_has_subdir_for_dep?(tmp_source)
       end
 
+      sig { params(tmp_source: Dependabot::Source).returns(T::Boolean) }
       def repo_has_subdir_for_dep?(tmp_source)
-        @repo_has_subdir_for_dep ||= {}
-        return @repo_has_subdir_for_dep[tmp_source] if @repo_has_subdir_for_dep.key?(tmp_source)
+        @repo_has_subdir_for_dep ||= T.let({}, T.nilable(T::Hash[Dependabot::Source, T::Boolean]))
+        return T.must(@repo_has_subdir_for_dep[tmp_source]) if @repo_has_subdir_for_dep.key?(tmp_source)
 
         artifact = dependency.name.split(":").last
         fetcher =
@@ -52,9 +56,10 @@ module Dependabot
         tmp_source.branch = nil
         retry
       rescue Dependabot::RepoNotFound
-        @repo_has_subdir_for_dep[tmp_source] = false
+        T.must(@repo_has_subdir_for_dep)[tmp_source] = false
       end
 
+      sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Dependabot::Source)) }
       def look_up_source_in_pom(pom)
         potential_source_urls = [
           pom.at_css("project > url")&.content,
@@ -69,15 +74,16 @@ module Dependabot
         Source.from_url(source_url)
       end
 
+      sig { params(source_url: T.nilable(String), pom: Nokogiri::XML::Document).returns(T.nilable(String)) }
       def substitute_property_in_source_url(source_url, pom)
         return unless source_url
         return source_url unless source_url.include?("${")
 
         regex = PROPERTY_REGEX
-        property_name = source_url.match(regex).named_captures["property"]
+        property_name = T.must(source_url.match(regex)).named_captures["property"]
         doc = pom.dup
         doc.remove_namespaces!
-        nm = property_name.sub(/^pom\./, "").sub(/^project\./, "")
+        nm = T.must(property_name).sub(/^pom\./, "").sub(/^project\./, "")
         property_value =
           loop do
             candidate_node =
@@ -93,6 +99,7 @@ module Dependabot
         source_url.gsub("${#{property_name}}", property_value)
       end
 
+      sig { params(pom: T.any(String, Nokogiri::XML::Document)).returns(T.nilable(String)) }
       def source_from_anywhere_in_pom(pom)
         github_urls = []
         pom.to_s.scan(Source::SOURCE_REGEX) do
@@ -105,6 +112,7 @@ module Dependabot
         end
       end
 
+      sig { returns(Nokogiri::XML::Document) }
       def dependency_pom_file
         return @dependency_pom_file unless @dependency_pom_file.nil?
 
@@ -120,11 +128,12 @@ module Dependabot
           headers: auth_headers
         )
 
-        @dependency_pom_file = Nokogiri::XML(response.body)
+        @dependency_pom_file = T.let(Nokogiri::XML(response.body), T.nilable(Nokogiri::XML::Document))
       rescue Excon::Error::Timeout
-        @dependency_pom_file = Nokogiri::XML("")
+        @dependency_pom_file ||= T.let(Nokogiri::XML(""), T.nilable(Nokogiri::XML::Document))
       end
 
+      sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Nokogiri::XML::Document)) }
       def parent_pom_file(pom)
         doc = pom.dup
         doc.remove_namespaces!
@@ -143,6 +152,7 @@ module Dependabot
         Nokogiri::XML(response.body)
       end
 
+      sig { returns(String) }
       def maven_repo_url
         source = dependency.requirements
                            .find { |r| r.fetch(:source) }&.fetch(:source)
@@ -152,6 +162,7 @@ module Dependabot
           Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
       end
 
+      sig { returns(String) }
       def maven_repo_dependency_url
         group_id, artifact_id =
           if kotlin_plugin?
@@ -165,16 +176,22 @@ module Dependabot
         "#{maven_repo_url}/#{group_id&.tr('.', '/')}/#{artifact_id}"
       end
 
+      sig { returns(T::Boolean) }
       def plugin?
         dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
       end
 
+      sig { returns(T::Boolean) }
       def kotlin_plugin?
         plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
       end
 
+      sig { returns(T::Hash[String, String]) }
       def auth_headers
-        @auth_headers ||= Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials).auth_headers(maven_repo_url)
+        @auth_headers ||= T.let(
+          Dependabot::Maven::Utils::AuthHeadersFinder.new(credentials).auth_headers(maven_repo_url),
+          T.nilable(T::Hash[String, String])
+        )
       end
     end
   end

data/lib/dependabot/gradle/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -14,9 +14,10 @@ module Dependabot
       extend T::Sig
 
       quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
-      PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{Gradle::Version::VERSION_PATTERN})\\s*".freeze
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{Gradle::Version::VERSION_PATTERN})\\s*".freeze, String)
       PATTERN = /\A#{PATTERN_RAW}\z/
 
+      sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
       def self.parse(obj)
         return ["=", Gradle::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
 
@@ -37,6 +38,7 @@ module Dependabot
         end
       end
 
+      sig { params(requirements: T.any(T.nilable(String), T::Array[T.nilable(String)])).void }
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
           convert_java_constraint_to_ruby_constraint(req_string)
@@ -45,6 +47,7 @@ module Dependabot
         super(requirements)
       end
 
+      sig { override.params(version: Gem::Version).returns(T::Boolean) }
       def satisfied_by?(version)
         version = Gradle::Version.new(version.to_s)
         super
@@ -52,18 +55,20 @@ module Dependabot
 
       private
 
+      sig { params(req_string: T.nilable(String)).returns(T::Array[T.nilable(String)]) }
       def self.split_java_requirement(req_string)
-        return [req_string] unless req_string.match?(Maven::Requirement::OR_SYNTAX)
+        return [req_string] unless req_string&.match?(Maven::Requirement::OR_SYNTAX)
 
         req_string.split(Maven::Requirement::OR_SYNTAX).flat_map do |str|
           next str if str.start_with?("(", "[")
 
           exacts, *rest = str.split(/,(?=\[|\()/)
-          [*exacts.split(","), *rest]
+          [*T.must(exacts).split(","), *rest]
         end
       end
       private_class_method :split_java_requirement
 
+      sig { params(req_string: T.nilable(String)).returns(T.nilable(T::Array[String])) }
       def convert_java_constraint_to_ruby_constraint(req_string)
         return unless req_string
 
@@ -81,35 +86,38 @@ module Dependabot
         end
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_java_range_to_ruby_range(req_string)
         lower_b, upper_b = req_string.split(",").map(&:strip)
 
         lower_b =
           if ["(", "["].include?(lower_b) then nil
-          elsif lower_b.start_with?("(") then "> #{lower_b.sub(/\(\s*/, '')}"
+          elsif T.must(lower_b).start_with?("(") then "> #{T.must(lower_b).sub(/\(\s*/, '')}"
           else
-            ">= #{lower_b.sub(/\[\s*/, '').strip}"
+            ">= #{T.must(lower_b).sub(/\[\s*/, '').strip}"
           end
 
         upper_b =
           if [")", "]"].include?(upper_b) then nil
-          elsif upper_b.end_with?(")") then "< #{upper_b.sub(/\s*\)/, '')}"
+          elsif T.must(upper_b).end_with?(")") then "< #{T.must(upper_b).sub(/\s*\)/, '')}"
           else
-            "<= #{upper_b.sub(/\s*\]/, '').strip}"
+            "<= #{T.must(upper_b).sub(/\s*\]/, '').strip}"
           end
 
         [lower_b, upper_b].compact
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_java_equals_req_to_ruby(req_string)
-        return convert_wildcard_req(req_string) if req_string&.include?("+")
+        return convert_wildcard_req(req_string) if req_string.include?("+")
 
         # If a soft requirement is being used, treat it as an equality matcher
-        return req_string unless req_string&.start_with?("[")
+        return req_string unless req_string.start_with?("[")
 
         req_string.gsub(/[\[\]\(\)]/, "")
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_wildcard_req(req_string)
         version = req_string.split("+").first
         return ">= 0" if version.nil? || version.empty?

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -59,8 +59,12 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :target_version, :source_url, :ignored_versions
+        attr_reader :dependency
+        attr_reader :dependency_files
+        attr_reader :credentials
+        attr_reader :target_version
+        attr_reader :source_url
+        attr_reader :ignored_versions
 
         def dependencies_to_update
           @dependencies_to_update ||=

data/lib/dependabot/gradle/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 #######################################################
@@ -6,6 +6,9 @@
 # https://maven.apache.org/pom.html#Dependencies      #
 #######################################################
 
+require "sorbet-runtime"
+
+require "dependabot/requirements_updater/base"
 require "dependabot/gradle/update_checker"
 require "dependabot/gradle/version"
 require "dependabot/gradle/requirement"
@@ -14,6 +17,23 @@ module Dependabot
   module Gradle
     class UpdateChecker
       class RequirementsUpdater
+        extend T::Sig
+        extend T::Generic
+
+        Version = type_member { { fixed: Dependabot::Gradle::Version } }
+        Requirement = type_member { { fixed: Dependabot::Gradle::Requirement } }
+
+        include Dependabot::RequirementsUpdater::Base
+
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            latest_version: T.nilable(T.any(Version, String)),
+            source_url: String,
+            properties_to_update: T::Array[String]
+          )
+            .void
+        end
         def initialize(requirements:, latest_version:, source_url:,
                        properties_to_update:)
           @requirements = requirements
@@ -21,9 +41,10 @@ module Dependabot
           @properties_to_update = properties_to_update
           return unless latest_version
 
-          @latest_version = version_class.new(latest_version)
+          @latest_version = T.let(version_class.new(latest_version), Version)
         end
 
+        sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements unless latest_version
 
@@ -44,9 +65,19 @@ module Dependabot
 
         private
 
-        attr_reader :requirements, :latest_version, :source_url,
-                    :properties_to_update
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        attr_reader :requirements
+
+        sig { returns(T.nilable(Version)) }
+        attr_reader :latest_version
+
+        sig { returns(String) }
+        attr_reader :source_url
+
+        sig { returns(T::Array[String]) }
+        attr_reader :properties_to_update
 
+        sig { params(req_string: String).returns(String) }
         def update_requirement(req_string)
           if req_string.include?("+")
             update_dynamic_requirement(req_string)
@@ -56,19 +87,21 @@ module Dependabot
           end
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_exact_requirement(req_string)
           old_version = requirement_class.new(req_string)
                                          .requirements.first.last
           req_string.gsub(old_version.to_s, latest_version.to_s)
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_dynamic_requirement(req_string)
           version = req_string.split(/\.?\+/).first || "+"
 
           precision = version.split(".")
                              .take_while { |s| !s.include?("+") }.count
 
-          version_parts = latest_version.segments.first(precision)
+          version_parts = T.must(latest_version).segments.first(precision)
 
           if req_string.end_with?(".+")
             version_parts.join(".") + ".+"
@@ -77,14 +110,17 @@ module Dependabot
           end
         end
 
+        sig { override.returns(T::Class[Version]) }
         def version_class
           Gradle::Version
         end
 
+        sig { override.returns(T::Class[Requirement]) }
         def requirement_class
           Gradle::Requirement
         end
 
+        sig { returns(T::Hash[Symbol, String]) }
         def updated_source
           { type: "maven_repo", url: source_url }
         end

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -76,8 +76,12 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions, :forbidden_urls, :security_advisories
+        attr_reader :dependency
+        attr_reader :dependency_files
+        attr_reader :credentials
+        attr_reader :ignored_versions
+        attr_reader :forbidden_urls
+        attr_reader :security_advisories
 
         sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
         def filter_prereleases(possible_versions)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.248.0
+  version: 0.249.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-21 00:00:00.000000000 Z
+date: 2024-03-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.248.0
+        version: 0.249.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.248.0
+        version: 0.249.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.248.0
+        version: 0.249.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.248.0
+        version: 0.249.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -277,7 +277,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.248.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.249.0
 post_install_message: 
 rdoc_options: []
 require_paths: