dependabot-hex 0.260.0 → 0.261.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39dd9ca7f95a819b66edcc28326f4f0a95b1e3998d34722026c306a0b19fb800
-  data.tar.gz: 1a55909dce2ef7233bfcf75b48885a4d7c6d0ada3e4a2f61ba285a6ee724de2a
+  metadata.gz: 27d33792dfe1e80e7983633d35c802b8e740e597b27511bbf5b62d7d53d2524e
+  data.tar.gz: f8a13617553b91170a7dca0a50ebdb3a9d68326961c3919851119e1b6b08b972
 SHA512:
-  metadata.gz: 7e319edb1873858b339c1bcdc7063a55e452f6c1d6d5b071e03b49079f9151dd8b4cf5723190d0ec0f349b624a98129a9e41b2debab8c160ae0d66929bb72738
-  data.tar.gz: 46c804f5470f9fc7969fe24b9e1bf076737786215042baea77f457eac52e67a8c4775e7094dce8faef76675f6d62605fa5100f8d0324fd2e8b72422ed4a58fa2
+  metadata.gz: d21ffaea5f67baf3b4c937d578cc1f2f7dc5945d7cdc90e6f7bd28a38309f58b2821aff0df65d41aa3be7d970995bc8792045f23a83da1c4c79f16b730b14e3c
+  data.tar.gz: ab89c2440795290fd4088ed5b6d7d705d8d4b2d33f96e396ea3e5c56492c9ab7f943783282cb91b28759ce10e3c00982a27ef0b57c9bb5bb9bbd583cffcdd726

data/lib/dependabot/hex/credential_helpers.rb

@@ -1,13 +1,19 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Hex
     module CredentialHelpers
+      extend T::Sig
+
+      sig { params(credentials: T::Array[Dependabot::Credential]).returns(T::Array[Dependabot::Credential]) }
       def self.hex_credentials(credentials)
         organization_credentials(credentials) + repo_credentials(credentials)
       end
 
+      sig { params(credentials: T.untyped).returns(T::Array[Dependabot::Credential]) }
       def self.organization_credentials(credentials)
         defaults = Dependabot::Credential.new({ "organization" => "", "token" => "" })
         keys = %w(type organization token)
@@ -16,7 +22,7 @@ module Dependabot
           .select { |cred| cred["type"] == "hex_organization" }
           .flat_map { |cred| defaults.merge(cred).slice(*keys).values }
       end
-
+      sig { params(credentials: T::Array[Dependabot::Credential]).returns(T::Array[Dependabot::Credential]) }
       def self.repo_credentials(credentials)
         # Credentials are serialized as an array that may not have optional fields. Using a
         # default ensures that the array is always the same length, even if values are empty.

data/lib/dependabot/hex/file_parser.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
@@ -13,8 +14,10 @@ require "dependabot/errors"
 module Dependabot
   module Hex
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
       require "dependabot/file_parsers/base/dependency_set"
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         # TODO: git sourced dependency's mixfiles are evaluated. Provide guards before removing this.
         raise ::Dependabot::UnexpectedExternalCode if @reject_external_code
@@ -43,11 +46,12 @@ module Dependabot
 
       private
 
+      sig { returns(T::Array[T.any(T::Hash[String, String], T::Hash[String, T.untyped])]) }
       def dependency_details
         SharedHelpers.in_a_temporary_directory do
           write_sanitized_mixfiles
           write_sanitized_supporting_files
-          File.write("mix.lock", lockfile.content) if lockfile
+          File.write("mix.lock", lockfile&.content) if lockfile
           FileUtils.cp(elixir_helper_parse_deps_path, "parse_deps.exs")
 
           SharedHelpers.run_helper_subprocess(
@@ -69,28 +73,32 @@ module Dependabot
         JSON.parse(result_json).fetch("result")
       end
 
+      sig { void }
       def write_sanitized_mixfiles
         mixfiles.each do |file|
           path = file.name
           FileUtils.mkdir_p(Pathname.new(path).dirname)
-          File.write(path, sanitize_mixfile(file.content))
+          File.write(path, sanitize_mixfile(T.must(file.content)))
         end
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def write_sanitized_supporting_files
         dependency_files.select(&:support_file).each do |file|
           path = file.name
           FileUtils.mkdir_p(Pathname.new(path).dirname)
-          File.write(path, sanitize_mixfile(file.content))
+          File.write(path, sanitize_mixfile(T.must(file.content)))
         end
       end
 
+      sig { params(content: String).returns(String) }
       def sanitize_mixfile(content)
         Hex::FileUpdater::MixfileSanitizer.new(
           mixfile_content: content
         ).sanitized_content
       end
 
+      sig { returns(T::Hash[String, String]) }
       def mix_env
         {
           "MIX_EXS" => File.join(NativeHelpers.hex_helpers_dir, "mix.exs"),
@@ -100,28 +108,34 @@ module Dependabot
         }
       end
 
+      sig { returns(String) }
       def elixir_helper_path
         File.join(NativeHelpers.hex_helpers_dir, "lib/run.exs")
       end
 
+      sig { returns(String) }
       def elixir_helper_parse_deps_path
         File.join(NativeHelpers.hex_helpers_dir, "lib/parse_deps.exs")
       end
 
+      sig { override.void }
       def check_required_files
         raise "No mixfile!" if mixfiles.none?
       end
 
+      sig { params(hash: T::Hash[String, String]).returns(T::Hash[Symbol, T.nilable(String)]) }
       def symbolize_keys(hash)
         hash.keys.to_h { |k| [k.to_sym, hash[k]] }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def mixfiles
         dependency_files.select { |f| f.name.end_with?("mix.exs") }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("mix.lock")
+        @lockfile ||= T.let(get_original_file("mix.lock"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

data/lib/dependabot/hex/file_updater/mixfile_git_pin_updater.rb

@@ -1,13 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/hex/file_updater"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater
       class MixfileGitPinUpdater
+        extend T::Sig
+
+        sig { params(dependency_name: String, mixfile_content: String, previous_pin: String, updated_pin: String).void }
         def initialize(dependency_name:, mixfile_content:,
                        previous_pin:, updated_pin:)
           @dependency_name = dependency_name
@@ -16,6 +20,7 @@ module Dependabot
           @updated_pin     = updated_pin
         end
 
+        sig { returns(String) }
         def updated_content
           updated_content = update_pin(mixfile_content)
 
@@ -26,11 +31,19 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         attr_reader :dependency_name
+
+        sig { returns(String) }
         attr_reader :mixfile_content
+
+        sig { returns(String) }
         attr_reader :previous_pin
+
+        sig { returns(String) }
         attr_reader :updated_pin
 
+        sig { params(content: String).returns(String) }
         def update_pin(content)
           requirement_line_regex =
             /
@@ -43,6 +56,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def content_should_change?
           previous_pin == updated_pin
         end

data/lib/dependabot/hex/file_updater/mixfile_sanitizer.rb

@@ -1,20 +1,23 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/hex/file_updater"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater
       class MixfileSanitizer
+        extend T::Sig
+        sig { params(mixfile_content: String).void }
         def initialize(mixfile_content:)
           @mixfile_content = mixfile_content
         end
 
         FILE_READ      = /File.read\(.*?\)/
         FILE_READ_BANG = /File.read!\(.*?\)/
-        PIPE           = Regexp.escape("|>").freeze
+        PIPE           = T.let(Regexp.escape("|>").freeze, String)
         VERSION_FILE   = /"VERSION"/i
 
         NESTED_VERSION_FILE_READ = /String\.trim\(#{FILE_READ}\)/
@@ -22,18 +25,25 @@ module Dependabot
         PIPED_VERSION_FILE_READ = /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ}/
         PIPED_VERSION_FILE_READ_BANG = /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ_BANG}/
 
-        # rubocop:disable Performance/MethodObjectAsBlock
+        sig { returns(String) }
         def sanitized_content
-          mixfile_content
-            .then(&method(:prevent_version_file_loading))
-            .then(&method(:prevent_config_path_loading))
+          @mixfile_content
+            .then { |content| prevent_version_file_loading(content) }
+            .then { |content| prevent_config_path_loading(content) }
         end
-        # rubocop:enable Performance/MethodObjectAsBlock
 
         private
 
+        sig { returns(String) }
         attr_reader :mixfile_content
 
+        sig { params(configuration: String).returns(String) }
+        def prevent_config_path_loading(configuration)
+          configuration
+            .gsub(/^\s*config_path:.*(?:,|$)/, "")
+        end
+
+        sig { params(configuration: String).returns(String) }
         def prevent_version_file_loading(configuration)
           configuration
             .gsub(NESTED_VERSION_FILE_READ_BANG, 'String.trim("0.0.1")')
@@ -41,11 +51,6 @@ module Dependabot
             .gsub(PIPED_VERSION_FILE_READ, '{:ok, "0.0.1"}')
             .gsub(PIPED_VERSION_FILE_READ_BANG, '"0.0.1"')
         end
-
-        def prevent_config_path_loading(configuration)
-          configuration
-            .gsub(/^\s*config_path:.*(?:,|$)/, "")
-        end
       end
     end
   end

data/lib/dependabot/hex/file_updater.rb

@@ -1,16 +1,20 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/mixfile_updater"
       require_relative "file_updater/lockfile_updater"
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^mix\.exs$/,
@@ -18,6 +22,7 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         updated_files = []
 
@@ -30,7 +35,7 @@ module Dependabot
 
         if lockfile
           updated_files <<
-            updated_file(file: lockfile, content: updated_lockfile_content)
+            updated_file(file: T.must(lockfile), content: updated_lockfile_content)
         end
 
         updated_files
@@ -38,10 +43,12 @@ module Dependabot
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No mix.exs!" unless get_original_file("mix.exs")
       end
 
+      sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_mixfile_content(file)
         MixfileUpdater.new(
           dependencies: dependencies,
@@ -49,21 +56,24 @@ module Dependabot
         ).updated_mixfile_content
       end
 
+      sig { returns(String) }
       def updated_lockfile_content
-        @updated_lockfile_content ||=
-          LockfileUpdater.new(
-            dependencies: dependencies,
-            dependency_files: dependency_files,
-            credentials: credentials
-          ).updated_lockfile_content
+        @updated_lockfile_content ||= T.let(nil, T.nilable(String))
+        LockfileUpdater.new(
+          dependencies: dependencies,
+          dependency_files: dependency_files,
+          credentials: credentials
+        ).updated_lockfile_content
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def mixfiles
         dependency_files.select { |f| f.name.end_with?("mix.exs") }
       end
 
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
-        @lockfile ||= get_original_file("mix.lock")
+        @lockfile ||= T.let(get_original_file("mix.lock"), T.nilable(Dependabot::DependencyFile))
       end
     end
   end

data/lib/dependabot/hex/metadata_finder.rb

@@ -1,23 +1,27 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/registry_client"
+require "sorbet-runtime"
 
 module Dependabot
   module Hex
     class MetadataFinder < Dependabot::MetadataFinders::Base
-      SOURCE_KEYS = %w(
+      extend T::Sig
+
+      SOURCE_KEYS = T.let(%w(
         GitHub Github github
         GitLab Gitlab gitlab
         BitBucket Bitbucket bitbucket
         Source source
-      ).freeze
+      ).freeze, T::Array[String])
 
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         case new_source_type
         when "default" then find_source_from_hex_listing
@@ -26,19 +30,22 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def new_source_type
         dependency.source_type
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_hex_listing
         potential_source_urls =
           SOURCE_KEYS
-          .filter_map { |key| hex_listing.dig("meta", "links", key) }
+          .filter_map { |key| T.must(hex_listing).dig("meta", "links", key) }
 
         source_url = potential_source_urls.find { |url| Source.from_url(url) }
         Source.from_url(source_url)
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
         info = dependency.requirements.filter_map { |r| r[:source] }.first
 
@@ -46,11 +53,12 @@ module Dependabot
         Source.from_url(url)
       end
 
+      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
       def hex_listing
         return @hex_listing unless @hex_listing.nil?
 
         response = Dependabot::RegistryClient.get(url: "https://hex.pm/api/packages/#{dependency.name}")
-        @hex_listing = JSON.parse(response.body)
+        @hex_listing = T.let(JSON.parse(response.body), T.nilable(T::Hash[String, T.untyped]))
       end
     end
   end

data/lib/dependabot/hex/native_helpers.rb

@@ -1,9 +1,14 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Hex
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.hex_helpers_dir
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "hex") unless helpers_root.nil?
@@ -11,6 +16,7 @@ module Dependabot
         File.join(__dir__, "../../../../hex/helpers")
       end
 
+      sig { params(path: String).returns(String) }
       def self.clean_path(path)
         Pathname.new(path).cleanpath.to_path
       end

data/lib/dependabot/hex/update_checker/file_preparer.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/dependency_file"
 require "dependabot/hex/update_checker"
 require "dependabot/hex/file_updater/mixfile_requirement_updater"
@@ -14,6 +16,8 @@ module Dependabot
       # This class takes a set of dependency files and sanitizes them for use
       # in UpdateCheckers::Elixir::Hex.
       class FilePreparer
+        extend T::Sig
+
         def initialize(dependency_files:, dependency:,
                        unlock_requirement: true,
                        replacement_git_pin: nil,
@@ -179,7 +183,7 @@ module Dependabot
         end
 
         def version_regex
-          version_class::VERSION_PATTERN
+          Dependabot::Hex::Version::VERSION_PATTERN
         end
 
         def dependency_appears_in_file?(file_name)

data/lib/dependabot/hex/version.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -11,6 +13,8 @@ require "dependabot/utils"
 module Dependabot
   module Hex
     class Version < Dependabot::Version
+      extend T::Sig
+
       attr_reader :build_info
 
       VERSION_PATTERN = Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?'
@@ -40,7 +44,7 @@ module Dependabot
 
       def <=>(other)
         version_comparison = super(other)
-        return version_comparison unless version_comparison.zero?
+        return version_comparison unless version_comparison&.zero?
 
         return build_info.nil? ? 0 : 1 unless other.is_a?(Hex::Version)
 
@@ -54,7 +58,7 @@ module Dependabot
 
         local_comparison = Gem::Version.new(lhs) <=> Gem::Version.new(rhs)
 
-        return local_comparison unless local_comparison.zero?
+        return local_comparison unless local_comparison&.zero?
 
         lhsegments.count <=> rhsegments.count
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.260.0
+  version: 0.261.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-06 00:00:00.000000000 Z
+date: 2024-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.260.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.1
 post_install_message: 
 rdoc_options: []
 require_paths: