dependabot-gradle 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93f82ad110e67a9345a7a672f828eabb90aac5cfa6349d2f5ec939f18e4a16c5
-  data.tar.gz: ea556afb860bfd5bcbb565eb722ebb0523240163d8b99d197972771647dfd080
+  metadata.gz: dc95dfd45dcabce388680e617eaffd9ba19b84ef8a729cffd616cfb06ad4cb43
+  data.tar.gz: 67e2f381c9cabd09d54a93b0c153ad7e64a1344a652954e0d59a5008dfd7d56e
 SHA512:
-  metadata.gz: a447eb2f78a3ab4163126e1fc63bb472d8162a8b1f452de815e1d4fc84caf5610c107af127f9f770b06e06cfda024f9080f41c0b052c30443ed9f604139ff52d
-  data.tar.gz: 0551f56c448535c80265c04797a0af1f6f019b8250d41286b99901a2b1740de9bfc4b94eeae966283bbf6c4dbacfa5c0f2bfad7723ae76bf1ac3a7b3703dc145
+  metadata.gz: 31931d172c06b4afca6bb258af47b1e6420fc59c46ac3dc63d483e5c5e18395a775dcbe6fcd8ae77a38f611378e5cb4d84db26d26851ca52e36dc20413b4f220
+  data.tar.gz: b2faa2bcf5a79fb88d2e085ff504ad55028cfcd8f8f6851d54815a902137fa19b91eef51d1e1eb60c514d1f8e4f039b1d588f75d1d037b43aae58cf700863013

data/lib/dependabot/gradle/distributions.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency_requirement"
@@ -14,7 +14,7 @@ module Dependabot
       sig { params(requirements: T::Array[Dependabot::DependencyRequirement]).returns(T::Boolean) }
       def self.distribution_requirements?(requirements)
         requirements.any? do |req|
-          req.dig(:source, :type) == DISTRIBUTION_DEPENDENCY_TYPE
+          req.source_string("type") == DISTRIBUTION_DEPENDENCY_TYPE
         end
       end
     end

data/lib/dependabot/gradle/file_fetcher.rb

@@ -16,13 +16,13 @@ module Dependabot
       require_relative "file_parser"
       require_relative "file_fetcher/settings_file_parser"
 
-      SUPPORTED_LOCK_FILE_NAMES = T.let(%w(gradle.lockfile).freeze, T::Array[String])
+      SUPPORTED_LOCK_FILE_NAMES = %w(gradle.lockfile).freeze
 
       SUPPORTED_BUILD_FILE_NAMES =
-        T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
+        %w(build.gradle build.gradle.kts).freeze
 
       SUPPORTED_SETTINGS_FILE_NAMES =
-        T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
+        %w(settings.gradle settings.gradle.kts).freeze
 
       SUPPORTED_WRAPPER_FILES_PATH = %w(
         gradlew
@@ -33,10 +33,10 @@ module Dependabot
 
       # For now Gradle only supports library .toml files in the main gradle folder
       SUPPORTED_VERSION_CATALOG_FILE_PATH =
-        T.let(%w(/gradle/libs.versions.toml).freeze, T::Array[String])
+        %w(/gradle/libs.versions.toml).freeze
 
       PLUGIN_SOURCE_SET_DIRS =
-        T.let(%w(src/main/java src/main/kotlin src/main/groovy src/main/resources).freeze, T::Array[String])
+        %w(src/main/java src/main/kotlin src/main/groovy src/main/resources).freeze
 
       sig do
         override
@@ -52,7 +52,7 @@ module Dependabot
       def initialize(source:, credentials:, repo_contents_path: nil, options: {}, update_config: nil)
         super
 
-        @lockfile_name = T.let(T.must(SUPPORTED_LOCK_FILE_NAMES.first), String)
+        @lockfile_name = T.let(SUPPORTED_LOCK_FILE_NAMES.first, String)
         @buildfile_name = T.let(nil, T.nilable(String))
       end
 

data/lib/dependabot/gradle/file_parser/property_value_finder.rb

@@ -73,7 +73,7 @@ module Dependabot
 
         sig { params(dependency_files: T::Array[Dependabot::DependencyFile]).void }
         def initialize(dependency_files:)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @dependency_files = dependency_files
           @properties = T.let({}, T::Hash[String, T::Hash[String, T::Hash[Symbol, String]]])
           @top_level_buildfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
         end

data/lib/dependabot/gradle/file_parser/repositories_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -11,8 +11,8 @@ module Dependabot
       class RepositoriesFinder
         extend T::Sig
 
-        SUPPORTED_BUILD_FILE_NAMES = T.let(%w(build.gradle build.gradle.kts).freeze, T::Array[String])
-        SUPPORTED_SETTINGS_FILE_NAMES = T.let(%w(settings.gradle settings.gradle.kts).freeze, T::Array[String])
+        SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts).freeze
+        SUPPORTED_SETTINGS_FILE_NAMES = %w(settings.gradle settings.gradle.kts).freeze
 
         # The Central Repo doesn't have special status for Gradle, but until
         # we're confident we're selecting repos correctly it's wise to include
@@ -37,8 +37,8 @@ module Dependabot
           ).void
         end
         def initialize(dependency_files:, target_dependency_file:, credentials: [])
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @dependency_files = dependency_files
+          @credentials = credentials
           raise "No target file!" unless target_dependency_file
 
           @target_dependency_file = T.let(target_dependency_file, Dependabot::DependencyFile)

data/lib/dependabot/gradle/file_parser.rb

@@ -28,28 +28,22 @@ module Dependabot
       require_relative "file_parser/distributions_finder"
       require_relative "file_parser/property_value_finder"
 
-      SUPPORTED_BUILD_FILE_NAMES = T.let(
-        %w(build.gradle build.gradle.kts settings.gradle settings.gradle.kts).freeze,
-        T::Array[String]
-      )
+      SUPPORTED_BUILD_FILE_NAMES = %w(build.gradle build.gradle.kts settings.gradle settings.gradle.kts).freeze
 
-      PROPERTY_REGEX = T.let(
-        /
+      PROPERTY_REGEX = /
           (?:\$\{property\((?<property_name>[^:\s]*?)\)\})|
           (?:\$\{(?<property_name>[^:\s]*?)\})|
           (?:\$(?<property_name>[^:\s"']*))
-        /x,
-        Regexp
-      )
-
-      PART = T.let(%r{[^\s,@'":/\\]+}, Regexp)
-      VSN_PART = T.let(%r{[^\s,'":/\\]+}, Regexp)
-      DEPENDENCY_DECLARATION_REGEX = T.let(/(?:\(|\s)\s*['"](?<declaration>#{PART}:#{PART}:#{VSN_PART})['"]/o, Regexp)
-
-      DEPENDENCY_SET_DECLARATION_REGEX = T.let(/(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/, Regexp)
-      DEPENDENCY_SET_ENTRY_REGEX = T.let(/entry\s+['"](?<name>#{PART})['"]/o, Regexp)
-      PLUGIN_BLOCK_DECLARATION_REGEX = T.let(/(?:^|\s)plugins\s*\{/, Regexp)
-      PLUGIN_ID_REGEX = T.let(/['"](?<id>#{PART})['"]/o, Regexp)
+        /x
+
+      PART = %r{[^\s,@'":/\\]+}
+      VSN_PART = %r{[^\s,'":/\\]+}
+      DEPENDENCY_DECLARATION_REGEX = /(?:\(|\s)\s*['"](?<declaration>#{PART}:#{PART}:#{VSN_PART})['"]/o
+
+      DEPENDENCY_SET_DECLARATION_REGEX = /(?:^|\s)dependencySet\((?<arguments>[^\)]+)\)\s*\{/
+      DEPENDENCY_SET_ENTRY_REGEX = /entry\s+['"](?<name>#{PART})['"]/o
+      PLUGIN_BLOCK_DECLARATION_REGEX = /(?:^|\s)plugins\s*\{/
+      PLUGIN_ID_REGEX = /['"](?<id>#{PART})['"]/o
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse

data/lib/dependabot/gradle/file_updater/lockfile_updater.rb

@@ -15,14 +15,11 @@ module Dependabot
       class LockfileUpdater
         extend T::Sig
 
-        INIT_SCRIPT_TASK_NAME = T.let("dependabotResolveAll", String)
-        GRADLE_JVMARGS_ATTEMPTS = T.let(
-          [
-            "-Xmx1536m -Dfile.encoding=UTF-8",
-            "-Xmx2048m -Dfile.encoding=UTF-8"
-          ].freeze,
-          T::Array[String]
-        )
+        INIT_SCRIPT_TASK_NAME = "dependabotResolveAll"
+        GRADLE_JVMARGS_ATTEMPTS = [
+          "-Xmx1536m -Dfile.encoding=UTF-8",
+          "-Xmx2048m -Dfile.encoding=UTF-8"
+        ].freeze
         sig do
           params(
             dependency_files: T::Array[Dependabot::DependencyFile],
@@ -64,8 +61,7 @@ module Dependabot
               "--init-script", init_script_path,
               *lockfile_tasks_for(build_files),
               "--write-locks",
-              "--no-daemon",
-              "--no-configuration-cache"
+              "--no-daemon"
             ]
             command = Shellwords.join(command_parts)
             run_lockfile_update_with_retry(
@@ -310,28 +306,74 @@ systemProp.https.proxyPort=#{https_proxy_port}"
 
         sig { params(file_name: String).void }
         def write_init_script(file_name)
-          # Resolve all resolvable configurations across all loaded projects so
-          # Gradle rewrites every relevant lockfile in one invocation.
+          # Resolve every lockable configuration in one invocation. Not from the task action: that
+          # needs the project, which the configuration cache forbids.
           script_content = <<~GRADLE
             allprojects {
               if (tasks.findByName("#{INIT_SCRIPT_TASK_NAME}") == null) {
-                tasks.register("#{INIT_SCRIPT_TASK_NAME}") {
-                  doLast {
-                    configurations.findAll {
-                      it.canBeResolved &&
-                        it.resolutionStrategy.dependencyLockingEnabled &&
-                        it.allDependencies.any { dependency ->
-                          dependency instanceof org.gradle.api.artifacts.ModuleDependency
-                        }
-                    }.each { it.incoming.resolutionResult.allDependencies }
-                  }
-                }
+                tasks.create("#{INIT_SCRIPT_TASK_NAME}") { }
+              }
+            }
+
+            gradle.projectsEvaluated {
+              // Prepare every project before resolving anything: with a project dependency,
+              // resolving one project computes the other project's javaCompiler.
+            #{compiler_fallback_snippet}
+
+              gradle.rootProject.allprojects { target ->
+                target.configurations.findAll {
+                  it.canBeResolved &&
+                    it.resolutionStrategy.dependencyLockingEnabled &&
+                    it.allDependencies.any { dependency ->
+                      dependency instanceof org.gradle.api.artifacts.ModuleDependency
+                    }
+                }.each { it.incoming.resolutionResult.allDependencies }
               }
             }
           GRADLE
           File.write(file_name, script_content)
         end
 
+        # Resolving computes the compile task's javaCompiler, which fails when the toolchain is
+        # missing. Only the compiler is swapped, so resolution is unaffected.
+        sig { returns(String) }
+        def compiler_fallback_snippet
+          <<~GRADLE.gsub(/^/, "  ")
+            gradle.rootProject.allprojects { target ->
+                // By name: JavaToolchainService only exists from 6.7, locking from 4.8.
+                def javaExtension = target.extensions.findByName("java")
+                def toolchainService = target.extensions.findByName("javaToolchains")
+                if (javaExtension != null && toolchainService != null) {
+                  def toolchain = javaExtension.toolchain
+                  // Toolchains landed in 6.7, vendor and implementation in 6.8, native image in 8.14.
+                  def constraints = ["vendor", "implementation", "nativeImageCapable"].collectEntries { name ->
+                    [(name): toolchain.hasProperty(name) ? toolchain."$name".getOrNull() : null]
+                  }
+                  if (toolchain.languageVersion.present) {
+                    def requested = toolchain.languageVersion.get()
+                    try {
+                      // Throwaway spec: compilerFor finalizes whatever spec it is given.
+                      toolchainService.compilerFor { spec ->
+                        spec.languageVersion.set(requested)
+                        constraints.each { name, value -> if (value != null) spec."$name".set(value) }
+                      }.get()
+                    } catch (Exception ignored) {
+                      def fallback = JavaLanguageVersion.of(JavaVersion.current().majorVersion)
+                      target.logger.lifecycle("Dependabot: Java toolchain " + requested +
+                        " is not available, compiling with " + fallback + " to resolve dependencies.")
+                      def c = toolchainService.compilerFor { s -> s.languageVersion.set(fallback) }
+                      target.tasks.withType(JavaCompile).configureEach { t -> t.javaCompiler.set(c) }
+                      // Kotlin asks for its own toolchain; convention plugins compile during config.
+                      def l = toolchainService.launcherFor { s -> s.languageVersion.set(fallback) }
+                      target.tasks.matching { it.hasProperty("kotlinJavaToolchain") }
+                        .configureEach { t -> t.kotlinJavaToolchain.toolchain.use(l) }
+                    }
+                  }
+                }
+              }
+          GRADLE
+        end
+
         sig { params(build_files: T::Array[Dependabot::DependencyFile]).returns(T::Array[String]) }
         def lockfile_tasks_for(build_files)
           build_files.filter_map { |build_file| dependency_task_for(build_file) }.uniq << INIT_SCRIPT_TASK_NAME

data/lib/dependabot/gradle/file_updater/wrapper/command_builder.rb

@@ -79,19 +79,19 @@ module Dependabot
 
           sig { returns(String) }
           def version
-            T.let(T.must(@requirements[0])[:requirement], String)
+            T.must(T.must(@requirements[0]).requirement_string)
           end
 
           sig { returns(T.nilable(String)) }
           def checksum
             return nil unless @requirements.size > 1
 
-            T.let(T.must(@requirements[1])[:requirement], String)
+            T.must(T.must(@requirements[1]).requirement_string)
           end
 
           sig { returns(T.nilable(String)) }
           def distribution_type
-            url = T.let(T.must(@requirements[0])[:source], T::Hash[Symbol, String])[:url]
+            url = T.must(@requirements[0]).source_string("url")
             # Anchor to the `-bin.zip` / `-all.zip` filename suffix so a path segment such as a
             # mirror host (e.g. https://binaries.example.com/...) can't false-match `bin`/`all`.
             url&.match(/-(bin|all)\.zip/)&.captures&.first

data/lib/dependabot/gradle/file_updater/wrapper/executing_version_detector.rb

@@ -23,13 +23,10 @@ module Dependabot
           # Anchored to the `gradle-<version>-(bin|all).zip` filename so host/port numbers in custom
           # mirror URLs are never mistaken for the version. The captured token is validated with
           # Version.correct? so non-version matches (and RC/milestone names) are handled safely.
-          DISTRIBUTION_URL_VERSION_REGEX = T.let(
-            /gradle-(?<version>.+?)-(?:bin|all)\.zip/,
-            Regexp
-          )
+          DISTRIBUTION_URL_VERSION_REGEX = /gradle-(?<version>.+?)-(?:bin|all)\.zip/
 
           # Matches the version printed by `gradle --version`, e.g. "Gradle 9.2.1".
-          GRADLE_VERSION_OUTPUT_REGEX = T.let(/^Gradle\s+(?<version>\d+(?:\.\d+){1,2}(?:-[\w.]+)?)/, Regexp)
+          GRADLE_VERSION_OUTPUT_REGEX = /^Gradle\s+(?<version>\d+(?:\.\d+){1,2}(?:-[\w.]+)?)/
 
           sig { params(distribution_url: T.nilable(String)).returns(T.nilable(Dependabot::Gradle::Version)) }
           def self.from_distribution_url(distribution_url)

data/lib/dependabot/gradle/file_updater/wrapper/properties_document.rb

@@ -29,8 +29,8 @@ module Dependabot
 
           # Properties files use `=`, `:` or whitespace as the key/value separator. Gradle always
           # writes `=`, but we parse all three so user-authored files are handled faithfully.
-          KEY_VALUE_REGEX = T.let(/\A(\s*)([^\s:=]+)(\s*[:=]\s*|\s+)(.*)\z/, Regexp)
-          COMMENT_REGEX = T.let(/\A\s*[#!]/, Regexp)
+          KEY_VALUE_REGEX = /\A(\s*)([^\s:=]+)(\s*[:=]\s*|\s+)(.*)\z/
+          COMMENT_REGEX = /\A\s*[#!]/
 
           sig { params(content: String).returns(PropertiesDocument) }
           def self.parse(content)

data/lib/dependabot/gradle/file_updater/wrapper/properties_reconciler.rb

@@ -22,10 +22,7 @@ module Dependabot
 
           # Keys whose value is owned by the update itself and therefore taken from the regenerated
           # file. Everything not listed here is preserved verbatim from the user's original file.
-          MANAGED_KEYS = T.let(
-            %w(distributionUrl distributionSha256Sum).freeze,
-            T::Array[String]
-          )
+          MANAGED_KEYS = %w(distributionUrl distributionSha256Sum).freeze
 
           # Reconciles the regenerated wrapper properties back onto the user's original file.
           #

data/lib/dependabot/gradle/file_updater/wrapper_updater.rb

@@ -59,7 +59,7 @@ module Dependabot
 
           # we only run this updater if the build file has a requirement for this dependency
           target_requirements = dependency.requirements.select do |req|
-            T.let(req[:file], String) == build_file.name
+            req.file == build_file.name
           end
           return [] unless target_requirements.any?
 

data/lib/dependabot/gradle/file_updater.rb

@@ -74,10 +74,10 @@ module Dependabot
                          .reject { |new_req, old_req| new_req == old_req }
         # Loop through each changed requirement and update the buildfiles
         reqs.each do |new_req, old_req|
-          raise "Bad req match" if old_req.nil? || T.let(new_req[:file], String) != T.let(old_req[:file], String)
-          next if T.let(new_req[:requirement], String) == T.let(old_req[:requirement], String)
+          raise "Bad req match" if old_req.nil? || new_req.file != old_req.file
+          next if new_req.requirement == old_req.requirement
 
-          buildfile = files.find { |f| f.name == T.let(new_req.fetch(:file), String) }
+          buildfile = files.find { |f| f.name == new_req.file }
 
           # Currently, Dependabot assumes that Gradle projects using Gradle submodules are all in a single
           # repo. However, some projects are actually using git submodule references for the Gradle submodules.
@@ -88,10 +88,9 @@ module Dependabot
 
           raise DependencyFileNotResolvable, "No build file found to update the dependency" if buildfile.nil?
 
-          metadata = symbol_object_hash(T.cast(new_req[:metadata], T.nilable(Object)))
-          if metadata && metadata[:property_name].is_a?(String)
+          if new_req.metadata_string("property_name")
             files = update_files_for_property_change(files, old_req, new_req)
-          elsif metadata && symbol_object_hash(metadata[:dependency_set])
+          elsif new_req.metadata_string_hash("dependency_set")
             files = update_files_for_dep_set_change(files, old_req, new_req)
           else
             files[T.must(files.index(buildfile))] = update_version_in_buildfile(dependency, buildfile, old_req, new_req)
@@ -170,47 +169,45 @@ module Dependabot
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, Object],
-          new_req: T::Hash[Symbol, Object]
+          old_req: Dependabot::DependencyRequirement,
+          new_req: Dependabot::DependencyRequirement
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_property_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = symbol_object_hash_value(new_req, :metadata)
-        property_name = string_value(metadata, :property_name)
-        file = string_value(new_req, :file)
+        property_name = T.must(new_req.metadata_string("property_name"))
+        file = T.must(new_req.file)
         buildfile = T.must(files.find { |f| f.name == file })
 
         PropertyValueUpdater.new(dependency_files: files)
                             .update_files_for_property_change(
                               property_name: property_name,
                               callsite_buildfile: buildfile,
-                              previous_value: string_value(old_req, :requirement),
-                              updated_value: string_value(new_req, :requirement)
+                              previous_value: T.must(old_req.requirement_string),
+                              updated_value: T.must(new_req.requirement_string)
                             )
       end
 
       sig do
         params(
           buildfiles: T::Array[Dependabot::DependencyFile],
-          old_req: T::Hash[Symbol, Object],
-          new_req: T::Hash[Symbol, Object]
+          old_req: Dependabot::DependencyRequirement,
+          new_req: Dependabot::DependencyRequirement
         )
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_files_for_dep_set_change(buildfiles, old_req, new_req)
         files = buildfiles.dup
-        metadata = symbol_object_hash_value(new_req, :metadata)
-        dependency_set = symbol_string_hash_value(metadata, :dependency_set)
-        buildfile = T.must(files.find { |f| f.name == string_value(new_req, :file) })
+        dependency_set = T.must(new_req.metadata_string_hash("dependency_set"))
+        buildfile = T.must(files.find { |f| f.name == new_req.file })
 
         DependencySetUpdater.new(dependency_files: files)
                             .update_files_for_dep_set_change(
                               dependency_set: dependency_set,
                               buildfile: buildfile,
-                              previous_requirement: string_value(old_req, :requirement),
-                              updated_requirement: string_value(new_req, :requirement)
+                              previous_requirement: T.must(old_req.requirement_string),
+                              updated_requirement: T.must(new_req.requirement_string)
                             )
       end
 
@@ -218,8 +215,8 @@ module Dependabot
         params(
           dependency: Dependabot::Dependency,
           buildfile: Dependabot::DependencyFile,
-          previous_req: T::Hash[Symbol, Object],
-          requirement: T::Hash[Symbol, Object]
+          previous_req: Dependabot::DependencyRequirement,
+          requirement: Dependabot::DependencyRequirement
         )
           .returns(Dependabot::DependencyFile)
       end
@@ -249,13 +246,13 @@ module Dependabot
       sig do
         params(
           dependency: Dependabot::Dependency,
-          requirement: T::Hash[Symbol, Object]
+          requirement: Dependabot::DependencyRequirement
         ).returns(T::Array[String])
       end
       def original_buildfile_declarations(dependency, requirement)
         # This implementation is limited to declarations that appear on a
         # single line.
-        file = string_value(requirement, :file)
+        file = T.must(requirement.file)
         buildfile = T.must(buildfiles.find { |f| f.name == file })
 
         T.must(buildfile.content).lines.select do |line|
@@ -266,11 +263,7 @@ module Dependabot
             dep_parts = dependency.name.split(":")
             next false unless line.include?(T.must(dep_parts.first)) || line.include?(T.must(dep_parts.last))
           elsif file.end_with?(".properties")
-            source = requirement[:source]
-            property = T.let(nil, T.nilable(String))
-            source_hash = symbol_object_hash(source)
-            source_property = source_hash&.[](:property)
-            property = source_property if source_property.is_a?(String)
+            property = requirement.source_string("property")
             next false unless property && line.start_with?(property)
           elsif file.end_with?(".toml")
             next false unless line.include?(dependency.name)
@@ -280,7 +273,7 @@ module Dependabot
             next false unless line.match?(name_regex)
           end
 
-          line.include?(string_value(requirement, :requirement))
+          line.include?(T.must(requirement.requirement_string))
         end
       end
       # rubocop:enable Metrics/AbcSize
@@ -315,57 +308,17 @@ module Dependabot
       sig do
         params(
           original_buildfile_declaration: String,
-          previous_req: T::Hash[Symbol, Object],
-          requirement: T::Hash[Symbol, Object]
+          previous_req: Dependabot::DependencyRequirement,
+          requirement: Dependabot::DependencyRequirement
         ).returns(String)
       end
       def updated_buildfile_declaration(original_buildfile_declaration, previous_req, requirement)
-        original_req_string = string_value(previous_req, :requirement)
-        new_req_string = string_value(requirement, :requirement)
+        original_req_string = T.must(previous_req.requirement_string)
+        new_req_string = T.must(requirement.requirement_string)
 
         original_buildfile_declaration.gsub(original_req_string, new_req_string)
       end
 
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(String) }
-      def string_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a String" unless value.is_a?(String)
-
-        value
-      end
-
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, Object]) }
-      def symbol_object_hash_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
-
-        value
-      end
-
-      sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(T::Hash[Symbol, String]) }
-      def symbol_string_hash_value(hash, key)
-        value = hash.fetch(key)
-        raise TypeError, "Expected #{key} to be a Hash" unless value.is_a?(Hash)
-
-        result = T.let({}, T::Hash[Symbol, String])
-        value.each_pair do |hash_key_object, hash_value_object|
-          hash_key = T.cast(hash_key_object, T.nilable(Object))
-          hash_value = T.cast(hash_value_object, T.nilable(Object))
-          raise TypeError, "Expected #{key} keys and values to be Symbols and Strings" unless hash_key.is_a?(Symbol) &&
-                                                                                              hash_value.is_a?(String)
-
-          result[hash_key] = hash_value
-        end
-        result
-      end
-
-      sig { params(value: T.nilable(Object)).returns(T.nilable(T::Hash[Symbol, Object])) }
-      def symbol_object_hash(value)
-        return unless value.is_a?(Hash)
-
-        value
-      end
-
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def buildfiles
         @buildfiles ||= T.let(dependency_files.reject(&:support_file?), T.nilable(T::Array[Dependabot::DependencyFile]))

data/lib/dependabot/gradle/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -66,11 +66,12 @@ module Dependabot
 
       sig { override.returns(String) }
       def maven_repo_url
-        source = dependency.requirements
-                           .find { |r| r.fetch(:source) }&.fetch(:source)
+        requirement = dependency.requirements.find(&:source)
+        return Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL unless requirement
 
-        source&.fetch(:url, nil) ||
-          source&.fetch("url") ||
+        raise TypeError, "Gradle repository source must be a hash" if requirement.source_hash.nil?
+
+        requirement.source_string("url") ||
           Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL
       end
 
@@ -81,12 +82,12 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def plugin?
-        dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
+        dependency.requirements.any? { |r| r.groups&.include?("plugins") }
       end
 
       sig { returns(T::Boolean) }
       def kotlin_plugin?
-        plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
+        plugin? && dependency.requirements.any? { |r| r.groups&.include?("kotlin") }
       end
     end
   end

data/lib/dependabot/gradle/package/package_details_fetcher.rb

@@ -86,7 +86,7 @@ module Dependabot
           @dependency_files = dependency_files
           @credentials = credentials
           @forbidden_urls = forbidden_urls
-          @cooldown_options = T.let(cooldown_options, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+          @cooldown_options = cooldown_options
           @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
           @google_version_details = T.let(nil, T.nilable(Nokogiri::XML::Document))
           @dependency_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, Object]]))
@@ -346,7 +346,7 @@ module Dependabot
         def dependency_repository_details
           requirement_files =
             dependency.requirements
-                      .map { |r| r.fetch(:file) }
+                      .filter_map(&:file)
                       .map { |nm| dependency_files.find { |f| f.name == nm } }
 
           @dependency_repository_details ||=
@@ -396,7 +396,7 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pom
-          filename = T.must(dependency.requirements.first).fetch(:file)
+          filename = T.must(dependency.requirements.first).file
           dependency_files.find { |f| f.name == filename }
         end
 
@@ -425,12 +425,12 @@ module Dependabot
 
         sig { returns(T::Boolean) }
         def plugin?
-          dependency.requirements.any? { |r| r.fetch(:groups).include? "plugins" }
+          dependency.requirements.any? { |r| r.groups&.include?("plugins") }
         end
 
         sig { returns(T.nilable(T::Boolean)) }
         def kotlin_plugin?
-          plugin? && dependency.requirements.any? { |r| r.fetch(:groups).include? "kotlin" }
+          plugin? && dependency.requirements.any? { |r| r.groups&.include?("kotlin") }
         end
 
         sig { returns(T::Boolean) }

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -32,9 +32,9 @@ module Dependabot
           ignored_versions:,
           raise_on_ignored: false
         )
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
           @target_version = T.let(
             version_from_details(target_version_details),
             T.nilable(Dependabot::Gradle::Version)
@@ -43,14 +43,14 @@ module Dependabot
             source_url_from_details(target_version_details),
             T.nilable(String)
           )
-          @ignored_versions = T.let(ignored_versions, T::Array[String])
-          @raise_on_ignored = T.let(raise_on_ignored, T::Boolean)
+          @ignored_versions = ignored_versions
+          @raise_on_ignored = raise_on_ignored
           @update_possible = T.let(nil, T.nilable(T::Boolean))
           @updated_dependencies = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
           @dependencies_to_update = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
           @property_name = T.let(nil, T.nilable(String))
           @dependency_set = T.let(nil, T.nilable(T::Hash[Symbol, String]))
-          @updated_requirements = T.let({}, T::Hash[String, T::Array[T::Hash[Symbol, Object]]])
+          @updated_requirements = T.let({}, T::Hash[String, T::Array[Dependabot::DependencyRequirement]])
         end
         sig { returns(T::Boolean) }
         def update_possible?
@@ -128,8 +128,8 @@ module Dependabot
               source: nil
             ).parse.select do |dep|
               dep.requirements.any? do |r|
-                tmp_p_name = r.dig(:metadata, :property_name)
-                tmp_dep_set = r.dig(:metadata, :dependency_set)
+                tmp_p_name = r.metadata_string("property_name")
+                tmp_dep_set = r.metadata_string_hash("dependency_set")
                 next true if property_name && tmp_p_name == property_name
 
                 dependency_set && tmp_dep_set == dependency_set
@@ -140,18 +140,18 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         def property_name
           @property_name ||= dependency.requirements
-                                       .find { |r| r.dig(:metadata, :property_name) }
-                                       &.dig(:metadata, :property_name)
+                                       .find { |r| r.metadata_string("property_name") }
+                                       &.metadata_string("property_name")
         end
 
         sig { returns(T.nilable(T::Hash[Symbol, String])) }
         def dependency_set
           @dependency_set ||= dependency.requirements
-                                        .find { |r| r.dig(:metadata, :dependency_set) }
-                                        &.dig(:metadata, :dependency_set)
+                                        .find { |r| r.metadata_string_hash("dependency_set") }
+                                        &.metadata_string_hash("dependency_set")
         end
 
-        sig { params(dep: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig { params(dep: Dependabot::Dependency).returns(T::Array[Dependabot::DependencyRequirement]) }
         def updated_requirements(dep)
           @updated_requirements[dep.name] ||=
             RequirementsUpdater.new(

data/lib/dependabot/gradle/update_checker/requirements_updater.rb

@@ -61,13 +61,14 @@ module Dependabot
           # requirement at index `i` to correspond to the previous requirement
           # at the same index.
           requirements.map do |req|
-            next req if req.fetch(:requirement).nil?
-            next req if req.fetch(:requirement).include?(",")
+            requirement = req.requirement_string
+            next req if requirement.nil?
+            next req if requirement.include?(",")
 
-            property_name = req.dig(:metadata, :property_name)
+            property_name = req.metadata_string("property_name")
             next req if property_name && !properties_to_update.include?(property_name)
 
-            new_req = update_requirement(req[:requirement])
+            new_req = update_requirement(requirement)
             Dependabot::DependencyRequirement.create(req.merge(requirement: new_req, source: updated_source))
           end
         end
@@ -124,27 +125,29 @@ module Dependabot
           distribution_url = T.let(nil, T.nilable(String))
 
           requirements.map do |req|
-            source = req[:source]
+            source = req.source_hash
             next req unless source
 
-            case source[:property]
+            case req.source_string("property")
             when "distributionUrl"
-              requirement = req[:requirement]
+              requirement = T.must(req.requirement_string)
               version = update_exact_requirement(requirement)
-              distribution_url = source[:url].gsub(requirement, version)
+              distribution_url = T.must(req.source_string("url")).gsub(requirement, version)
+              updated_source = set_source_string(source.dup, "url", distribution_url)
 
               Dependabot::DependencyRequirement.create(
                 req.merge(
                   requirement: version,
-                  source: source.merge(url: distribution_url)
+                  source: updated_source
                 )
               )
             when "distributionSha256Sum"
               checksum_url, checksum = Gradle::Package::DistributionsFetcher.resolve_checksum(T.must(distribution_url))
+              updated_source = set_source_string(source.dup, "url", checksum_url)
               Dependabot::DependencyRequirement.create(
                 req.merge(
                   requirement: checksum,
-                  source: source.merge(url: checksum_url)
+                  source: updated_source
                 )
               )
             else
@@ -153,6 +156,23 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            source: Dependabot::DependencyRequirement::ObjectHash,
+            key: String,
+            value: T.nilable(String)
+          ).returns(Dependabot::DependencyRequirement::ObjectHash)
+        end
+        def set_source_string(source, key, value)
+          symbol_key = key.to_sym
+          if source.key?(key) && !source.key?(symbol_key)
+            source[key] = value
+          else
+            source[symbol_key] = value
+          end
+          source
+        end
+
         sig { override.returns(T::Class[Version]) }
         def version_class
           Gradle::Version

data/lib/dependabot/gradle/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -206,34 +206,30 @@ module Dependabot
             next false if dep.name == dependency.name
 
             dep.requirements.any? do |req|
-              req.dig(:metadata, :property_name) == property_name
+              req.metadata_string("property_name") == property_name
             end
           end
         end
       end
 
-      sig { params(requirement: T::Hash[Symbol, Object]).returns(T.nilable(String)) }
+      sig { params(requirement: Dependabot::DependencyRequirement).returns(T.nilable(String)) }
       def property_name_from_requirement(requirement)
-        metadata = requirement[:metadata]
-        return unless metadata.is_a?(Hash)
-
-        property_name = metadata[:property_name]
-        property_name if property_name.is_a?(String)
+        requirement.metadata_string("property_name")
       end
 
       sig { returns(T::Boolean) }
       def version_comes_from_dependency_set?
         dependency.requirements.any? do |req|
-          req.dig(:metadata, :dependency_set)
+          req.metadata_string_hash("dependency_set")
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def declarations_using_a_property
         @declarations_using_a_property ||= T.let(
           dependency.requirements
-                    .select { |req| req.dig(:metadata, :property_name) },
-          T.nilable(T::Array[T::Hash[Symbol, Object]])
+                    .select { |req| req.metadata_string("property_name") },
+          T.nilable(T::Array[Dependabot::DependencyRequirement])
         )
       end
 
@@ -244,7 +240,7 @@ module Dependabot
             dependency_files: dependency_files,
             source: nil
           ).parse.select do |dep|
-            dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
+            dep.requirements.any? { |req| req.metadata_string("property_name") }
           end,
           T.nilable(T::Array[Dependabot::Dependency])
         )

data/lib/dependabot/gradle/version.rb

@@ -15,7 +15,7 @@ module Dependabot
     class Version < Dependabot::Version
       extend T::Sig
 
-      NULL_VALUES = T.let(%w(0 final ga).freeze, T::Array[String])
+      NULL_VALUES = %w(0 final ga).freeze
       PREFIXED_TOKEN_HIERARCHY = T.let(
         {
           "." => { qualifier: 1, number: 4 },
@@ -39,13 +39,10 @@ module Dependabot
         }.freeze,
         T::Hash[String, Integer]
       )
-      VERSION_PATTERN = T.let(
-        "[0-9a-zA-Z]+" \
-        '(?>\.[0-9a-zA-Z]*)*' \
-        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?',
-        String
-      )
-      ANCHORED_VERSION_PATTERN = T.let(/\A\s*(#{VERSION_PATTERN})?\s*\z/, Regexp)
+      VERSION_PATTERN = "[0-9a-zA-Z]+" \
+                        '(?>\.[0-9a-zA-Z]*)*' \
+                        '([_\-\+][0-9A-Za-z_-]*(\.[0-9A-Za-z_-]*)*)?'
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       sig { override.params(version: Object).returns(T::Boolean) }
       def self.correct?(version)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: dependabot-maven
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib