dependabot-maven 0.262.0 → 0.264.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1df09dc9f5ceb0895f026f04588c24d7958cc7e57103dbec7ca73e0c649a0304
-  data.tar.gz: acc42669c61d27ce811e5d32aa04a601842232832eccf0b45305ab0a9f87f56d
+  metadata.gz: 51df7f3dc716cc7674949df83e48d90d04921493c750524def54b0cbe24dc920
+  data.tar.gz: b2cd29d713898236089bd0049b12b05098f5cd9f7e8e3393a711955fc1dbea66
 SHA512:
-  metadata.gz: 06e8d15c8b1aca615997e4b559488238fe45b6826c6ebdfc4ef90954fec9a62d1b6e452b8a13d15d0564c452768b344db697be362203401a35c1f2abd354fd39
-  data.tar.gz: 0bfedaf05554a4c93f33d7986ccf3db38515a0a05f5337c2de27077e1d1aa44647e1c7cfdc817f9b92dc8b717419ddee32cfc110f46015330815adb66b1530dd
+  metadata.gz: 76f561eb9ab1cef94fe2cf02455ba8b63ed98296c8aa17b12a8e7e19297e883b03380fc4feb0644f9b3ff296e59a42bb40563cc905106ff2343195281ae88e95
+  data.tar.gz: 134b49a299b44872d274fad695741584eaced44b3528a78a6d3178334f1f1582c440b9260295f758af5f0310456ac71fa123dc0a062aed73788bdc4aec306098

data/lib/dependabot/maven/file_parser/pom_fetcher.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "nokogiri"
 
 require "dependabot/dependency_file"
@@ -11,15 +12,19 @@ module Dependabot
   module Maven
     class FileParser
       class PomFetcher
+        extend T::Sig
+
+        sig { params(dependency_files: T::Array[DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
-          @poms = {}
+          @poms = T.let({}, T::Hash[String, DependencyFile])
         end
 
+        sig { returns(T::Hash[String, DependencyFile]) }
         def internal_dependency_poms
           return @internal_dependency_poms if @internal_dependency_poms
 
-          @internal_dependency_poms = {}
+          @internal_dependency_poms = T.let({}, T.nilable(T::Hash[String, DependencyFile]))
           dependency_files.each do |pom|
             doc = Nokogiri::XML(pom.content)
             group_id = doc.at_css("project > groupId") ||
@@ -33,12 +38,20 @@ module Dependabot
               artifact_id.content.strip
             ].join(":")
 
-            @internal_dependency_poms[dependency_name] = pom
+            T.must(@internal_dependency_poms)[dependency_name] = pom
           end
 
-          @internal_dependency_poms
+          T.must(@internal_dependency_poms)
         end
 
+        sig do
+          params(
+            group_id: String,
+            artifact_id: String,
+            version: String,
+            urls_to_try: T::Array[String]
+          ).returns(T.nilable(DependencyFile)) # Fix: Added closing parenthesis
+        end
         def fetch_remote_parent_pom(group_id, artifact_id, version, urls_to_try)
           pom_id = "#{group_id}:#{artifact_id}:#{version}"
           return @poms[pom_id] if @poms.key?(pom_id)
@@ -74,24 +87,33 @@ module Dependabot
 
         private
 
+        sig { params(group_id: String, artifact_id: String, version: String, base_repo_url: String).returns(String) }
         def remote_pom_url(group_id, artifact_id, version, base_repo_url)
           "#{base_repo_url}/" \
             "#{group_id.tr('.', '/')}/#{artifact_id}/#{version}/" \
             "#{artifact_id}-#{version}.pom"
         end
 
+        sig do
+          params(group_id: String, artifact_id: String, version: String, snapshot_version: String,
+                 base_repo_url: String).returns(String)
+        end
         def remote_pom_snapshot_url(group_id, artifact_id, version, snapshot_version, base_repo_url)
           "#{base_repo_url}/" \
             "#{group_id.tr('.', '/')}/#{artifact_id}/#{version}/" \
             "#{artifact_id}-#{snapshot_version}.pom"
         end
 
+        sig { params(group_id: String, artifact_id: String, version: String, base_repo_url: String).returns(String) }
         def remote_pom_snapshot_metadata_url(group_id, artifact_id, version, base_repo_url)
           "#{base_repo_url}/" \
             "#{group_id.tr('.', '/')}/#{artifact_id}/#{version}/" \
             "maven-metadata.xml"
         end
 
+        sig do
+          params(group_id: String, artifact_id: String, version: String, base_url: String).returns(T.nilable(String))
+        end
         def fetch_snapshot_pom_url(group_id, artifact_id, version, base_url)
           url = remote_pom_snapshot_metadata_url(group_id, artifact_id, version, base_url)
           response = fetch(url)
@@ -107,15 +129,18 @@ module Dependabot
           remote_pom_snapshot_url(group_id, artifact_id, version, snapshot, base_url)
         end
 
+        sig { params(url: String).returns(Excon::Response) }
         def fetch(url)
-          @maven_responses ||= {}
+          @maven_responses ||= T.let({}, T.nilable(T::Hash[String, Excon::Response]))
           @maven_responses[url] ||= Dependabot::RegistryClient.get(url: url, options: { retry_limit: 1 })
         end
 
+        sig { params(content: String).returns(T::Boolean) }
         def pom?(content)
           !Nokogiri::XML(content).at_css("project > artifactId").nil?
         end
 
+        sig { returns(T::Array[DependencyFile]) }
         attr_reader :dependency_files
       end
     end

data/lib/dependabot/maven/file_parser/property_value_finder.rb

@@ -1,8 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
-
+require "sorbet-runtime"
 require "dependabot/dependency_file"
 require "dependabot/maven/file_parser"
 require "dependabot/registry_client"
@@ -14,17 +14,24 @@ module Dependabot
   module Maven
     class FileParser
       class PropertyValueFinder
+        extend T::Sig
+
         require_relative "repositories_finder"
         require_relative "pom_fetcher"
 
         DOT_SEPARATOR_REGEX = %r{\.(?!\d+([.\/_\-]|$)+)}
 
+        sig { params(dependency_files: T::Array[DependencyFile], credentials: T::Array[String]).void }
         def initialize(dependency_files:, credentials: [])
           @dependency_files = dependency_files
           @credentials = credentials
-          @pom_fetcher = PomFetcher.new(dependency_files: dependency_files)
+          @pom_fetcher = T.let(PomFetcher.new(dependency_files: dependency_files),
+                               Dependabot::Maven::FileParser::PomFetcher)
         end
 
+        sig do
+          params(property_name: String, callsite_pom: DependencyFile).returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def property_details(property_name:, callsite_pom:)
           pom = callsite_pom
           doc = Nokogiri::XML(pom.content)
@@ -71,8 +78,17 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[DependencyFile]) }
         attr_reader :dependency_files
 
+        sig do
+          params(
+            expression: String,
+            property_name: String,
+            callsite_pom: DependencyFile
+          )
+            .returns(T.nilable(T::Hash[Symbol, String]))
+        end
         def extract_value_from_expression(expression:, property_name:, callsite_pom:)
           # and the expression is pointing to self then raise the error
           if expression.eql?("${#{property_name}}")
@@ -83,14 +99,16 @@ module Dependabot
           end
 
           # and the expression is pointing to another tag, then get the value of that tag
-          property_details(property_name: expression.slice(2..-2), callsite_pom: callsite_pom)
+          property_details(property_name: T.must(expression.slice(2..-2)), callsite_pom: callsite_pom)
         end
 
+        sig { params(property_name: String).returns(String) }
         def sanitize_property_name(property_name)
           property_name.sub(/^pom\./, "").sub(/^project\./, "")
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(pom: DependencyFile).returns(T.nilable(DependencyFile)) }
         def parent_pom(pom)
           doc = Nokogiri::XML(pom.content)
           doc.remove_namespaces!
@@ -111,6 +129,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(pom: DependencyFile).returns(T::Array[String]) }
         def parent_repository_urls(pom)
           repositories_finder.repository_urls(
             pom: pom,
@@ -119,14 +138,17 @@ module Dependabot
           )
         end
 
+        sig { returns(RepositoriesFinder) }
         def repositories_finder
-          @repositories_finder ||=
-            RepositoriesFinder.new(
+          @repositories_finder ||= T.let(
+            Dependabot::Maven::FileParser::RepositoriesFinder.new(
               pom_fetcher: @pom_fetcher,
               dependency_files: dependency_files,
               credentials: @credentials,
               evaluate_properties: false
-            )
+            ),
+            T.nilable(Dependabot::Maven::FileParser::RepositoriesFinder)
+          )
         end
       end
     end

data/lib/dependabot/maven/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -15,6 +15,7 @@ require "dependabot/errors"
 module Dependabot
   module Maven
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
       require "dependabot/file_parsers/base/dependency_set"
       require_relative "file_parser/property_value_finder"
 
@@ -35,6 +36,7 @@ module Dependabot
       # Regex to get the property name from a declaration that uses a property
       PROPERTY_REGEX = /\$\{(?<property>.*?)\}/
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         dependency_set = DependencySet.new
         pomfiles.each { |pom| dependency_set += pomfile_dependencies(pom) }
@@ -44,6 +46,7 @@ module Dependabot
 
       private
 
+      sig { params(pom: Dependabot::DependencyFile).returns(DependencySet) }
       def pomfile_dependencies(pom)
         dependency_set = DependencySet.new
 
@@ -70,6 +73,7 @@ module Dependabot
         dependency_set
       end
 
+      sig { params(extension: Dependabot::DependencyFile).returns(DependencySet) }
       def extensionfile_dependencies(extension)
         dependency_set = DependencySet.new
 
@@ -89,6 +93,10 @@ module Dependabot
         dependency_set
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile,
+               dependency_node: Nokogiri::XML::Element).returns(T.nilable(Dependabot::Dependency))
+      end
       def dependency_from_dependency_node(pom, dependency_node)
         return unless (name = dependency_name(dependency_node, pom))
         return if internal_dependency_names.include?(name)
@@ -96,6 +104,10 @@ module Dependabot
         build_dependency(pom, dependency_node, name)
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile,
+               dependency_node: Nokogiri::XML::Element).returns(T.nilable(Dependabot::Dependency))
+      end
       def dependency_from_plugin_node(pom, dependency_node)
         return unless (name = plugin_name(dependency_node, pom))
         return if internal_dependency_names.include?(name)
@@ -103,6 +115,10 @@ module Dependabot
         build_dependency(pom, dependency_node, name)
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element,
+               name: String).returns(T.nilable(Dependabot::Dependency))
+      end
       def build_dependency(pom, dependency_node, name)
         property_details =
           {
@@ -127,6 +143,10 @@ module Dependabot
         )
       end
 
+      sig do
+        params(dependency_node: Nokogiri::XML::Element,
+               pom: Dependabot::DependencyFile).returns(T.nilable(String))
+      end
       def dependency_name(dependency_node, pom)
         return unless dependency_node.at_xpath("./groupId")
         return unless dependency_node.at_xpath("./artifactId")
@@ -143,6 +163,9 @@ module Dependabot
         ].join(":")
       end
 
+      sig do
+        params(dependency_node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String))
+      end
       def dependency_classifier(dependency_node, pom)
         return unless dependency_node.at_xpath("./classifier")
 
@@ -152,6 +175,9 @@ module Dependabot
         )
       end
 
+      sig do
+        params(dependency_node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String))
+      end
       def plugin_name(dependency_node, pom)
         return unless plugin_group_id(pom, dependency_node)
         return unless dependency_node.at_xpath("./artifactId")
@@ -165,6 +191,7 @@ module Dependabot
         ].join(":")
       end
 
+      sig { params(pom: Dependabot::DependencyFile, node: Nokogiri::XML::Element).returns(T.nilable(String)) }
       def plugin_group_id(pom, node)
         return "org.apache.maven.plugins" unless node.at_xpath("./groupId")
 
@@ -174,6 +201,9 @@ module Dependabot
         )
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(T.nilable(String))
+      end
       def dependency_version(pom, dependency_node)
         requirement = dependency_requirement(pom, dependency_node)
         return nil unless requirement
@@ -185,6 +215,9 @@ module Dependabot
         requirement.gsub(/[\(\)\[\]]/, "").strip
       end
 
+      sig do
+        params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(T.nilable(String))
+      end
       def dependency_requirement(pom, dependency_node)
         return unless dependency_node.at_xpath("./version")
 
@@ -194,10 +227,12 @@ module Dependabot
         version_content.empty? ? nil : version_content
       end
 
+      sig { params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(T::Array[String]) }
       def dependency_groups(pom, dependency_node)
         dependency_scope(pom, dependency_node) == "test" ? ["test"] : []
       end
 
+      sig { params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(String) }
       def dependency_scope(pom, dependency_node)
         return "compile" unless dependency_node.at_xpath("./scope")
 
@@ -207,6 +242,7 @@ module Dependabot
         scope_content.empty? ? "compile" : scope_content
       end
 
+      sig { params(pom: Dependabot::DependencyFile, dependency_node: Nokogiri::XML::Element).returns(String) }
       def packaging_type(pom, dependency_node)
         return "pom" if dependency_node.node_name == "parent"
         return "jar" unless dependency_node.at_xpath("./type")
@@ -217,6 +253,7 @@ module Dependabot
         evaluated_value(packaging_type_content, pom)
       end
 
+      sig { params(dependency_node: Nokogiri::XML::Element).returns(T.nilable(String)) }
       def version_property_name(dependency_node)
         return unless dependency_node.at_xpath("./version")
 
@@ -228,17 +265,21 @@ module Dependabot
           .named_captures.fetch("property")
       end
 
+      sig { params(value: String, pom: Dependabot::DependencyFile).returns(String) }
       def evaluated_value(value, pom)
         return value unless value.match?(PROPERTY_REGEX)
 
-        property_name = value.match(PROPERTY_REGEX)
-                             .named_captures.fetch("property")
-        property_value = value_for_property(property_name, pom)
+        property_name = T.must(value.match(PROPERTY_REGEX))
+                         .named_captures.fetch("property")
+        property_value = value_for_property(T.must(property_name), pom)
 
         new_value = value.gsub(value.match(PROPERTY_REGEX).to_s, property_value)
         evaluated_value(new_value, pom)
       end
 
+      sig do
+        params(dependency_node: Nokogiri::XML::Element, pom: Dependabot::DependencyFile).returns(T.nilable(String))
+      end
       def property_source(dependency_node, pom)
         property_name = version_property_name(dependency_node)
         return unless property_name
@@ -254,6 +295,7 @@ module Dependabot
         raise DependencyFileNotEvaluatable, msg
       end
 
+      sig { params(property_name: String, pom: Dependabot::DependencyFile).returns(String) }
       def value_for_property(property_name, pom)
         value =
           property_value_finder
@@ -268,25 +310,35 @@ module Dependabot
 
       # Cached, since this can makes calls to the registry (to get property
       # values from parent POMs)
+      sig { returns(Dependabot::Maven::FileParser::PropertyValueFinder) }
       def property_value_finder
-        @property_value_finder ||=
-          PropertyValueFinder.new(dependency_files: dependency_files, credentials: credentials)
+        @property_value_finder ||= T.let(
+          PropertyValueFinder.new(dependency_files: dependency_files, credentials: credentials.map(&:to_s)),
+          T.nilable(Dependabot::Maven::FileParser::PropertyValueFinder)
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def pomfiles
-        @pomfiles ||=
+        @pomfiles ||= T.let(
           dependency_files.select do |f|
             f.name.end_with?(".xml") && !f.name.end_with?("extensions.xml")
-          end
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def extensionfiles
-        @extensionfiles ||=
-          dependency_files.select { |f| f.name.end_with?("extensions.xml") }
+        @extensionfiles ||= T.let(
+          dependency_files.select { |f| f.name.end_with?("extensions.xml") },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
+      sig { returns(T::Array[String]) }
       def internal_dependency_names
-        @internal_dependency_names ||=
+        @internal_dependency_names ||= T.let(
           dependency_files.filter_map do |pom|
             doc = Nokogiri::XML(pom.content)
             group_id = doc.at_css("project > groupId") ||
@@ -296,9 +348,12 @@ module Dependabot
             next unless group_id && artifact_id
 
             [group_id.content.strip, artifact_id.content.strip].join(":")
-          end
+          end,
+          T.nilable(T::Array[String])
+        )
       end
 
+      sig { override.void }
       def check_required_files
         raise "No pom.xml!" unless get_original_file("pom.xml")
       end

data/lib/dependabot/maven/file_updater/property_value_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "nokogiri"
 
 require "dependabot/dependency_file"
@@ -11,54 +12,72 @@ module Dependabot
   module Maven
     class FileUpdater
       class PropertyValueUpdater
+        extend T::Sig
+
+        sig { params(dependency_files: T::Array[DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/PerceivedComplexity
+        sig do
+          params(
+            property_name: String,
+            callsite_pom: DependencyFile,
+            updated_value: String
+          ).returns(T::Array[DependencyFile])
+        end
         def update_pomfiles_for_property_change(property_name:, callsite_pom:,
                                                 updated_value:)
           declaration_details = property_value_finder.property_details(
             property_name: property_name,
             callsite_pom: callsite_pom
           )
-          node = declaration_details.fetch(:node)
-          filename = declaration_details.fetch(:file)
+          node = declaration_details&.fetch(:node)
+          filename = declaration_details&.fetch(:file)
 
           pom_to_update = dependency_files.find { |f| f.name == filename }
           property_re = %r{<#{Regexp.quote(node.name)}>
             \s*#{Regexp.quote(node.content)}\s*
             </#{Regexp.quote(node.name)}>}xm
           property_text = node.to_s
-          if pom_to_update.content&.match?(property_re)
-            updated_content = pom_to_update.content.sub(
+          if pom_to_update&.content&.match?(property_re)
+            updated_content = pom_to_update&.content&.sub(
               property_re,
               "<#{node.name}>#{updated_value}</#{node.name}>"
             )
-          elsif pom_to_update.content.include? property_text
+          elsif pom_to_update&.content&.include? property_text
             node.content = updated_value
-            updated_content = pom_to_update.content.sub(
+            updated_content = pom_to_update&.content&.sub(
               property_text,
               node.to_s
             )
           end
 
           updated_pomfiles = dependency_files.dup
-          updated_pomfiles[updated_pomfiles.index(pom_to_update)] =
-            update_file(file: pom_to_update, content: updated_content)
+          updated_pomfiles[T.must(updated_pomfiles.index(pom_to_update))] =
+            update_file(file: T.must(pom_to_update), content: T.must(updated_content))
 
           updated_pomfiles
         end
+        # rubocop:enable Metrics/PerceivedComplexity
+        # rubocop:enable Metrics/AbcSize
 
         private
 
+        sig { returns T::Array[Dependabot::DependencyFile] }
         attr_reader :dependency_files
 
+        sig { returns Maven::FileParser::PropertyValueFinder }
         def property_value_finder
-          @property_value_finder ||=
-            Maven::FileParser::PropertyValueFinder
-            .new(dependency_files: dependency_files)
+          @property_value_finder ||= T.let(
+            Maven::FileParser::PropertyValueFinder.new(dependency_files: dependency_files),
+            T.nilable(Dependabot::Maven::FileParser::PropertyValueFinder)
+          )
         end
 
+        sig { params(file: DependencyFile, content: String).returns(DependencyFile) }
         def update_file(file:, content:)
           updated_file = file.dup
           updated_file.content = content

data/lib/dependabot/maven/update_checker.rb

@@ -138,7 +138,7 @@ module Dependabot
       def property_value_finder
         @property_value_finder ||=
           Maven::FileParser::PropertyValueFinder
-          .new(dependency_files: dependency_files, credentials: credentials)
+          .new(dependency_files: dependency_files, credentials: credentials.map(&:to_s))
       end
 
       def version_comes_from_multi_dependency_property?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.262.0
+  version: 0.264.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-20 00:00:00.000000000 Z
+date: 2024-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.262.0
+        version: 0.264.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.262.0
+        version: 0.264.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -264,7 +264,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.262.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.264.0
 post_install_message: 
 rdoc_options: []
 require_paths: