dependabot-hex 0.260.0 → 0.261.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39dd9ca7f95a819b66edcc28326f4f0a95b1e3998d34722026c306a0b19fb800
-  data.tar.gz: 1a55909dce2ef7233bfcf75b48885a4d7c6d0ada3e4a2f61ba285a6ee724de2a
+  metadata.gz: b7a1982afe65fa3a20dc24e88e76ccb71e14504f542e53871d8cbb043ddc69db
+  data.tar.gz: 649fe3b1df9d36d3bf06afc7a0b21013ac57d72be6724b2b6428c8ebd50d3cbb
 SHA512:
-  metadata.gz: 7e319edb1873858b339c1bcdc7063a55e452f6c1d6d5b071e03b49079f9151dd8b4cf5723190d0ec0f349b624a98129a9e41b2debab8c160ae0d66929bb72738
-  data.tar.gz: 46c804f5470f9fc7969fe24b9e1bf076737786215042baea77f457eac52e67a8c4775e7094dce8faef76675f6d62605fa5100f8d0324fd2e8b72422ed4a58fa2
+  metadata.gz: 4ac067d549efcb29b1264fc56191592c5b19a2527973cb534143d24a71c1edc313c116360ebca81e1b95cd03c6838c044298dfb1c15a54d7fd1b9e4400855023
+  data.tar.gz: daae200036c3f100ae25c08bbe1989df254bab20c37a3e6db8257fce4dc9e23a71163b7cc0ffbf4bfb932289bfe13e12ddd67c5af4d0025b722c1325e8a031a8

data/lib/dependabot/hex/file_updater/mixfile_git_pin_updater.rb

@@ -1,13 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/hex/file_updater"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater
       class MixfileGitPinUpdater
+        extend T::Sig
+
+        sig { params(dependency_name: String, mixfile_content: String, previous_pin: String, updated_pin: String).void }
         def initialize(dependency_name:, mixfile_content:,
                        previous_pin:, updated_pin:)
           @dependency_name = dependency_name
@@ -16,6 +20,7 @@ module Dependabot
           @updated_pin     = updated_pin
         end
 
+        sig { returns(String) }
         def updated_content
           updated_content = update_pin(mixfile_content)
 
@@ -26,11 +31,19 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         attr_reader :dependency_name
+
+        sig { returns(String) }
         attr_reader :mixfile_content
+
+        sig { returns(String) }
         attr_reader :previous_pin
+
+        sig { returns(String) }
         attr_reader :updated_pin
 
+        sig { params(content: String).returns(String) }
         def update_pin(content)
           requirement_line_regex =
             /
@@ -43,6 +56,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def content_should_change?
           previous_pin == updated_pin
         end

data/lib/dependabot/hex/file_updater.rb

@@ -1,16 +1,20 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/mixfile_updater"
       require_relative "file_updater/lockfile_updater"
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^mix\.exs$/,
@@ -18,6 +22,7 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
 
@@ -30,7 +35,7 @@ module Dependabot
 
         if lockfile
           updated_files <<
-            updated_file(file: lockfile, content: updated_lockfile_content)
+            updated_file(file: T.must(lockfile), content: updated_lockfile_content)
         end
 
         updated_files
@@ -38,10 +43,12 @@ module Dependabot
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No mix.exs!" unless get_original_file("mix.exs")
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_mixfile_content(file)
         MixfileUpdater.new(
           dependencies: dependencies,
@@ -49,21 +56,24 @@ module Dependabot
         ).updated_mixfile_content
       end
 
+      sig { returns(String) }
       def updated_lockfile_content
-        @updated_lockfile_content ||=
-          LockfileUpdater.new(
-            dependencies: dependencies,
-            dependency_files: dependency_files,
-            credentials: credentials
-          ).updated_lockfile_content
+        @updated_lockfile_content ||= T.let(nil, T.nilable(String))
+        LockfileUpdater.new(
+          dependencies: dependencies,
+          dependency_files: dependency_files,
+          credentials: credentials
+        ).updated_lockfile_content
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def mixfiles
         dependency_files.select { |f| f.name.end_with?("mix.exs") }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("mix.lock")
+        @lockfile ||= T.let(get_original_file("mix.lock"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

data/lib/dependabot/hex/metadata_finder.rb

@@ -1,23 +1,27 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class MetadataFinder < Dependabot::MetadataFinders::Base
-      SOURCE_KEYS = %w(
+      extend T::Sig
+
+      SOURCE_KEYS = T.let(%w(
         GitHub Github github
         GitLab Gitlab gitlab
         BitBucket Bitbucket bitbucket
         Source source
-      ).freeze
+      ).freeze, T::Array[String])
 
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         case new_source_type
         when "default" then find_source_from_hex_listing
@@ -26,19 +30,22 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def new_source_type
         dependency.source_type
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_hex_listing
         potential_source_urls =
           SOURCE_KEYS
-          .filter_map { |key| hex_listing.dig("meta", "links", key) }
+          .filter_map { |key| T.must(hex_listing).dig("meta", "links", key) }
 
         source_url = potential_source_urls.find { |url| Source.from_url(url) }
         Source.from_url(source_url)
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
         info = dependency.requirements.filter_map { |r| r[:source] }.first
 
@@ -46,11 +53,12 @@ module Dependabot
         Source.from_url(url)
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def hex_listing
         return @hex_listing unless @hex_listing.nil?
 
         response = Dependabot::RegistryClient.get(url: "https://hex.pm/api/packages/#{dependency.name}")
-        @hex_listing = JSON.parse(response.body)
+        @hex_listing = T.let(JSON.parse(response.body), T.nilable(T::Hash[String, T.untyped]))
       end
     end
   end

data/lib/dependabot/hex/native_helpers.rb

@@ -1,9 +1,14 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Hex
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.hex_helpers_dir
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "hex") unless helpers_root.nil?
@@ -11,6 +16,7 @@ module Dependabot
         File.join(__dir__, "../../../../hex/helpers")
       end
 
+      sig { params(path: String).returns(String) }
       def self.clean_path(path)
         Pathname.new(path).cleanpath.to_path
       end

data/lib/dependabot/hex/update_checker/file_preparer.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/dependency_file"
 require "dependabot/hex/update_checker"
 require "dependabot/hex/file_updater/mixfile_requirement_updater"
@@ -14,6 +16,8 @@ module Dependabot
       # This class takes a set of dependency files and sanitizes them for use
       # in UpdateCheckers::Elixir::Hex.
       class FilePreparer
+        extend T::Sig
+
         def initialize(dependency_files:, dependency:,
                        unlock_requirement: true,
                        replacement_git_pin: nil,
@@ -179,7 +183,7 @@ module Dependabot
         end
 
         def version_regex
-          version_class::VERSION_PATTERN
+          Dependabot::Hex::Version::VERSION_PATTERN
         end
 
         def dependency_appears_in_file?(file_name)

data/lib/dependabot/hex/version.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -11,6 +13,8 @@ require "dependabot/utils"
 module Dependabot
   module Hex
     class Version < Dependabot::Version
+      extend T::Sig
+
       attr_reader :build_info
 
       VERSION_PATTERN = Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?'
@@ -40,7 +44,7 @@ module Dependabot
 
       def <=>(other)
         version_comparison = super(other)
-        return version_comparison unless version_comparison.zero?
+        return version_comparison unless version_comparison&.zero?
 
         return build_info.nil? ? 0 : 1 unless other.is_a?(Hex::Version)
 
@@ -54,7 +58,7 @@ module Dependabot
 
         local_comparison = Gem::Version.new(lhs) <=> Gem::Version.new(rhs)
 
-        return local_comparison unless local_comparison.zero?
+        return local_comparison unless local_comparison&.zero?
 
         lhsegments.count <=> rhsegments.count
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.260.0
+  version: 0.261.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-06 00:00:00.000000000 Z
+date: 2024-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.260.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.0
 post_install_message: 
 rdoc_options: []
 require_paths: