dependabot-hex 0.316.0 → 0.317.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35ac3ee29a60a6fb5e99abd18fdc2546dc2e5f4a3c8b1abefb96177ffde24137
-  data.tar.gz: 8133bdfd85bba1a0535a16d0467d3916abf10e00a573f68388a512923e1bd24c
+  metadata.gz: 5f097b29911ce4e4e5a66d70b5d19b9b5e00a926d0002b21297ce08728b1ce9c
+  data.tar.gz: cd4dce441d5487bf3ff183cad03528f2f476342bb2a148d7d2e98f0590ebf8cb
 SHA512:
-  metadata.gz: '09300a5e8ad34d961a657f290f26c4df26112265f6469d866ea65012b07fb0217ab3e74ecffa0d88f931c6ca1890a5b63a41b1e58e9e16bca8cfd43c30a72f7a'
-  data.tar.gz: 53fff986fe0a530f17181322d6b4cb717f94b7dbefe7ee840f35a50523abbc13e702fe294799654efc246e5e4db57aa27d734a5308044f5ec94fb37b56518785
+  metadata.gz: d038b8da57cc411b7fedfe9587ee9beb4d56a18f908e1f3ca65df24e600bd315fd2987940ab86ccaf2171047a0e48d5c718546aacabfd7d193450e7f7cee90db
+  data.tar.gz: edbf6d10a78e9fe729dbb61b5ee2d4c3ac9afd99f1ec2225d47b68f2ac74e67be5368394888bb5822550f1a64195e2cac4d452d237069c7f854adf2e360a9ab9

data/lib/dependabot/hex/package/package_details_fetcher.rb

@@ -0,0 +1,64 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "cgi"
+require "excon"
+require "nokogiri"
+require "sorbet-runtime"
+require "dependabot/registry_client"
+require "dependabot/hex"
+require "dependabot/hex/version"
+require "dependabot/package/package_release"
+require "dependabot/package/package_details"
+
+module Dependabot
+  module Hex
+    module Package
+      class PackageDetailsFetcher
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency
+          ).void
+        end
+        def initialize(dependency:)
+          @dependency = dependency
+
+          @dependency_url = T.let("https://hex.pm/api/packages/#{dependency.name}", T.nilable(String))
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def fetch_package_releases
+          releases = T.let([], T::Array[Dependabot::Package::PackageRelease])
+
+          begin
+            Dependabot.logger.info("Fetching package (hex) info for #{@dependency.name}")
+
+            response = Dependabot::RegistryClient.get(url: T.must(@dependency_url))
+            return releases unless response.status == 200
+
+            package_metadata = JSON.parse(response.body)&.fetch("releases", []) || []
+            package_metadata.each do |release|
+              releases << Dependabot::Package::PackageRelease.new(
+                version: Hex::Version.new(release["version"]),
+                released_at: release["inserted_at"] ? Time.new(release["inserted_at"]) : nil,
+                url: release["url"]
+              )
+            end
+
+            releases
+          rescue StandardError => e
+            Dependabot.logger.error("Error while fetching package info for hex packages: #{e.message}")
+            releases
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/hex/update_checker/latest_version_finder.rb

@@ -0,0 +1,120 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "excon"
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/errors"
+require "dependabot/package/package_latest_version_finder"
+require "dependabot/shared_helpers"
+require "dependabot/update_checkers/version_filters"
+require "dependabot/hex/file_parser"
+require "dependabot/hex/package/package_details_fetcher"
+require "dependabot/hex/requirement"
+require "dependabot/hex/update_checker"
+require "dependabot/hex/update_checker/requirements_updater"
+
+module Dependabot
+  module Hex
+    class UpdateChecker
+      class LatestVersionFinder < Dependabot::Package::PackageLatestVersionFinder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean,
+            options: T::Hash[Symbol, T.untyped],
+            cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+          ).void
+        end
+        def initialize(
+          dependency:,
+          dependency_files:,
+          credentials:,
+          ignored_versions:,
+          security_advisories:,
+          raise_on_ignored:,
+          options: {},
+          cooldown_options: nil
+        )
+          @dependency          = dependency
+          @dependency_files    = dependency_files
+          @credentials         = credentials
+          @ignored_versions    = ignored_versions
+          @security_advisories = security_advisories
+          @raise_on_ignored    = raise_on_ignored
+          @options             = options
+          @cooldown_options = cooldown_options
+          super
+        end
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }
+        attr_reader :cooldown_options
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+        sig { override.returns(T.nilable(Dependabot::Package::PackageDetails)) }
+        def package_details; end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def release_version
+          releases = package_releases
+
+          releases = filter_prerelease_versions(T.must(releases))
+          releases = filter_ignored_versions(releases)
+          releases = filter_by_cooldown(releases)
+
+          releases.max_by(&:version)&.version
+        end
+
+        private
+
+        sig { returns(T.nilable(T::Array[Dependabot::Package::PackageRelease])) }
+        def package_releases
+          @package_releases = T.let(Dependabot::Hex::Package::PackageDetailsFetcher
+            .new(dependency: dependency)
+            .fetch_package_releases, T.nilable(T::Array[Dependabot::Package::PackageRelease]))
+        end
+
+        sig { override.returns(T::Boolean) }
+        def cooldown_enabled?
+          Dependabot::Experiments.enabled?(:enable_cooldown_for_hex)
+        end
+
+        sig { returns(T::Boolean) }
+        def wants_prerelease?
+          return true if current_version&.prerelease?
+
+          dependency.requirements.any? do |req|
+            req[:requirement]&.match?(/\d-[A-Za-z0-9]/)
+          end
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def current_version
+          @current_version ||=
+            T.let(
+              dependency.numeric_version,
+              T.nilable(Dependabot::Version)
+            )
+        end
+
+        sig { returns(T.class_of(Dependabot::Version)) }
+        def version_class
+          dependency.version_class
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/hex/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -12,11 +12,16 @@ require "json"
 module Dependabot
   module Hex
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
       require_relative "update_checker/file_preparer"
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
+      require_relative "update_checker/latest_version_finder"
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version, Gem::Version))) }
       def latest_version
+        @latest_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version, Gem::Version)))
+
         @latest_version ||=
           if git_dependency?
             latest_version_for_git_dependency
@@ -25,7 +30,10 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version, Gem::Version))) }
       def latest_resolvable_version
+        @latest_resolvable_version = T.let(nil, T.nilable(T.any(String, Dependabot::Version, Gem::Version)))
+
         @latest_resolvable_version ||=
           if git_dependency?
             latest_resolvable_version_for_git_dependency
@@ -34,7 +42,12 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T.any(String, T.nilable(Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
+        @latest_resolvable_version_with_no_unlock = T.let(
+          nil, T.any(String, T.nilable(Dependabot::Version))
+        )
+
         @latest_resolvable_version_with_no_unlock ||=
           if git_dependency?
             latest_resolvable_commit_with_unchanged_git_source
@@ -43,6 +56,7 @@ module Dependabot
           end
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -53,19 +67,18 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # Full unlock checks aren't implemented for Elixir (yet)
         false
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
       end
 
-      def latest_version_for_git_dependency
-        latest_git_version_sha
-      end
-
+      sig { returns(T.any(String, T.nilable(Dependabot::Version))) }
       def latest_resolvable_version_for_git_dependency
         # If the gem isn't pinned, the latest version is just the latest
         # commit for the specified branch.
@@ -77,13 +90,14 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return new_tag.fetch(:commit_sha)
+          return T.must(new_tag).fetch(:commit_sha)
         end
 
         # If the dependency is pinned then there's nothing we can do.
         dependency.version
       end
 
+      sig { returns(T.any(String, T.nilable(Dependabot::Version))) }
       def latest_resolvable_commit_with_unchanged_git_source
         fetch_latest_resolvable_version(unlock_requirement: false)
       rescue SharedHelpers::HelperSubprocessFailed,
@@ -95,11 +109,13 @@ module Dependabot
         raise e
       end
 
+      sig { returns(T::Boolean) }
       def git_dependency?
         git_commit_checker.git_dependency?
       end
 
-      def latest_git_version_sha
+      sig { returns(T.nilable(T.any(String, Dependabot::Version))) }
+      def latest_version_for_git_dependency
         # If the gem isn't pinned, the latest version is just the latest
         # commit for the specified branch.
         return git_commit_checker.head_commit_for_current_branch unless git_commit_checker.pinned?
@@ -117,10 +133,11 @@ module Dependabot
         dependency.version
       end
 
+      sig { returns(T::Boolean) }
       def latest_git_tag_is_resolvable?
-        return @git_tag_resolvable if @latest_git_tag_is_resolvable_checked
+        return T.must(@git_tag_resolvable) if @latest_git_tag_is_resolvable_checked
 
-        @latest_git_tag_is_resolvable_checked = true
+        @latest_git_tag_is_resolvable_checked = T.let(true, T.nilable(T::Boolean))
 
         return false if git_commit_checker.local_tag_for_latest_version.nil?
 
@@ -129,7 +146,7 @@ module Dependabot
         prepared_files = FilePreparer.new(
           dependency: dependency,
           dependency_files: dependency_files,
-          replacement_git_pin: replacement_tag.fetch(:tag)
+          replacement_git_pin: T.must(replacement_tag).fetch(:tag)
         ).prepared_dependency_files
 
         resolver_result = VersionResolver.new(
@@ -144,9 +161,10 @@ module Dependabot
              Dependabot::DependencyFileNotResolvable => e
         raise e unless e.message.include?("resolution failed")
 
-        @git_tag_resolvable = false
+        @git_tag_resolvable = T.let(false, T.nilable(T::Boolean))
       end
 
+      sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -155,26 +173,32 @@ module Dependabot
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
           new_tag = git_commit_checker.local_tag_for_latest_version
-          return dependency_source_details.merge(ref: new_tag.fetch(:tag))
+          return T.must(dependency_source_details).merge(ref: T.must(new_tag).fetch(:tag))
         end
 
         # Otherwise return the original source
         dependency_source_details
       end
 
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
       def dependency_source_details
         dependency.source_details
       end
 
+      sig do
+        params(unlock_requirement: T.any(T.nilable(Symbol), T::Boolean))
+          .returns(T.any(String, T.nilable(Dependabot::Version)))
+      end
       def fetch_latest_resolvable_version(unlock_requirement:)
-        @latest_resolvable_version_hash ||= {}
+        @latest_resolvable_version_hash ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @latest_resolvable_version_hash[unlock_requirement] ||=
           version_resolver(unlock_requirement: unlock_requirement)
           .latest_resolvable_version
       end
 
+      sig { params(unlock_requirement: T.any(T.nilable(Symbol), T::Boolean)).returns(VersionResolver) }
       def version_resolver(unlock_requirement:)
-        @version_resolver ||= {}
+        @version_resolver ||= T.let({}, T.nilable(T::Hash[T.untyped, T.untyped]))
         @version_resolver[unlock_requirement] ||=
           begin
             prepared_dependency_files = prepared_dependency_files(
@@ -191,6 +215,11 @@ module Dependabot
           end
       end
 
+      sig do
+        params(unlock_requirement: T.any(T.nilable(Symbol), T::Boolean),
+               latest_allowable_version: T.nilable(Dependabot::Version))
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
       def prepared_dependency_files(unlock_requirement:,
                                     latest_allowable_version: nil)
         FilePreparer.new(
@@ -201,65 +230,25 @@ module Dependabot
         ).prepared_dependency_files
       end
 
-      # rubocop:disable Metrics/PerceivedComplexity
+      sig { returns(T.nilable(Dependabot::Version)) }
       def latest_release_from_hex_registry
         @latest_release_from_hex_registry ||=
-          begin
-            versions = hex_registry_response&.fetch("releases", []) || []
-            versions =
-              versions
-              .select { |release| version_class.correct?(release["version"]) }
-              .map { |release| version_class.new(release["version"]) }
-
-            versions.reject!(&:prerelease?) unless wants_prerelease?
-
-            filtered = versions.reject do |v|
-              ignore_requirements.any? { |r| r.satisfied_by?(v) }
-            end
-
-            if @raise_on_ignored && filter_lower_versions(filtered).empty? && filter_lower_versions(versions).any?
-              raise AllVersionsIgnored
-            end
-
-            filtered.max
-          end
-      end
-      # rubocop:enable Metrics/PerceivedComplexity
-
-      def filter_lower_versions(versions_array)
-        return versions_array unless current_version
-
-        versions_array.select do |version|
-          version > current_version
-        end
-      end
-
-      def hex_registry_response
-        return @hex_registry_response if @hex_registry_requested
-
-        @hex_registry_requested = true
-
-        response = Dependabot::RegistryClient.get(url: dependency_url)
-        return unless response.status == 200
-
-        @hex_registry_response = JSON.parse(response.body)
-      rescue Excon::Error::Socket, Excon::Error::Timeout
-        nil
-      end
-
-      def wants_prerelease?
-        return true if current_version&.prerelease?
-
-        dependency.requirements.any? do |req|
-          req[:requirement]&.match?(/\d-[A-Za-z0-9]/)
-        end
-      end
-
-      def dependency_url
-        "https://hex.pm/api/packages/#{dependency.name}"
+          T.let(LatestVersionFinder.new(
+            dependency: dependency,
+            credentials: credentials,
+            dependency_files: dependency_files,
+            security_advisories: security_advisories,
+            ignored_versions: ignored_versions,
+            raise_on_ignored: raise_on_ignored,
+            cooldown_options: update_cooldown
+          ).release_version,
+                T.nilable(T.nilable(Dependabot::Version)))
       end
 
+      sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
+        @git_commit_checker = T.let(nil, T.nilable(Dependabot::GitCommitChecker))
+
         @git_commit_checker ||=
           GitCommitChecker.new(
             dependency: dependency,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.316.0
+  version: 0.317.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.316.0
+        version: 0.317.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.316.0
+        version: 0.317.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -260,10 +260,12 @@ files:
 - lib/dependabot/hex/language.rb
 - lib/dependabot/hex/metadata_finder.rb
 - lib/dependabot/hex/native_helpers.rb
+- lib/dependabot/hex/package/package_details_fetcher.rb
 - lib/dependabot/hex/package_manager.rb
 - lib/dependabot/hex/requirement.rb
 - lib/dependabot/hex/update_checker.rb
 - lib/dependabot/hex/update_checker/file_preparer.rb
+- lib/dependabot/hex/update_checker/latest_version_finder.rb
 - lib/dependabot/hex/update_checker/requirements_updater.rb
 - lib/dependabot/hex/update_checker/version_resolver.rb
 - lib/dependabot/hex/version.rb
@@ -272,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.316.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.317.0
 rdoc_options: []
 require_paths:
 - lib