dependabot-maven 0.305.0 → 0.306.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: edfa9b495411ee0c7f0e315b0e46edcb649c1e0d94d7b4538adae4fbb797057e
-  data.tar.gz: 535081e417481ba4e5928410f1d28590814437cdd8047d394bc59470bba9e0c7
+  metadata.gz: ad0045ecf222ca64f0953ca81cda66b318b9b6f3fd073ee1d3ae329e01165a10
+  data.tar.gz: 67792a247a3d1a8dd8d82973bec8d2853bccb0e2a84543710b769f100f55eeb5
 SHA512:
-  metadata.gz: 4d503a9c107865106132ae1e2a65f4399df27a15b785a2587a334620e60625c75b30a60413fe385f04f94af3a6ef218c51c7a4d5339170ae81e74ef6d14838d7
-  data.tar.gz: 9ba9470f1b4f4ab968be52ec0d32c85a0fc462a73082c1e625d1348845613acfb5b5b0cf55cbd5d335bb457dad79337de95ea15902160143df623295405ebb9c
+  metadata.gz: 7bf491217c706d453933ec9524d0898622c7fce8db1a004d9b751fb44e3dc4fdd363ba66fce915b5931800dfcd4eaa25b1eae8b9cfdb05e53ffa28ed6225674b
+  data.tar.gz: 825b3ad39ac19fc162dbb36ccf7f2eb5083f9c0550ee67aaf09db94ceaf2519846fde3cda02306362cb77cf7d81cb657bba7f2466d5218c4c21ecf8e7982a4e5

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -19,6 +19,16 @@ module Dependabot
 
         TYPE_SUFFICES = %w(jre android java native_mt agp).freeze
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            raise_on_ignored: T::Boolean
+          ).void
+        end
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)
@@ -28,10 +38,16 @@ module Dependabot
           @ignored_versions    = ignored_versions
           @raise_on_ignored    = raise_on_ignored
           @security_advisories = security_advisories
-          @forbidden_urls      = []
-          @dependency_metadata = {}
+          @forbidden_urls      = T.let([], T::Array[String])
+          @dependency_metadata = T.let({}, T::Hash[T.untyped, Nokogiri::XML::Document])
+          @auth_headers_finder = T.let(nil, T.nilable(Utils::AuthHeadersFinder))
+          @pom_repository_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @repository_finder = T.let(nil, T.nilable(Maven::FileParser::RepositoriesFinder))
+          @repositories = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @released_check = T.let({}, T::Hash[Version, T::Boolean])
         end
 
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
         def latest_version_details
           possible_versions = versions
 
@@ -43,6 +59,7 @@ module Dependabot
           possible_versions.reverse.find { |v| released?(v.fetch(:version)) }
         end
 
+        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
         def lowest_security_fix_version_details
           possible_versions = versions
 
@@ -78,11 +95,17 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+        sig { returns(T::Array[String]) }
         attr_reader :forbidden_urls
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
         sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
@@ -112,7 +135,7 @@ module Dependabot
           filtered = possible_versions.select { |v| matches_dependency_version_type?(v.fetch(:version)) }
           if possible_versions.count > filtered.count
             diff = possible_versions.count - filtered.count
-            classifier = dependency.version.split(/[.\-]/).last
+            classifier = dependency.version&.split(/[.\-]/)&.last
             Dependabot.logger.info("Filtered out #{diff} non-#{classifier} classifier versions")
           end
           filtered
@@ -151,23 +174,23 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Boolean) }
         def wants_prerelease?
           return false unless dependency.numeric_version
 
-          dependency.numeric_version.prerelease?
+          dependency.numeric_version&.prerelease? || false
         end
 
+        sig { returns(T::Boolean) }
         def wants_date_based_version?
           return false unless dependency.numeric_version
 
-          dependency.numeric_version >= version_class.new(100)
+          T.must(dependency.numeric_version) >= version_class.new(100)
         end
 
+        sig { params(version: Version).returns(T::Boolean) }
         def released?(version)
-          @released_check ||= {}
-          return @released_check[version] if @released_check.key?(version)
-
-          @released_check[version] =
+          @released_check[version] ||=
             repositories.any? do |repository_details|
               url = repository_details.fetch("url")
               response = Dependabot::RegistryClient.head(
@@ -184,13 +207,18 @@ module Dependabot
             end
         end
 
+        sig { params(repository_details: T::Hash[String, T.untyped]).returns(T.nilable(Nokogiri::XML::Document)) }
         def dependency_metadata(repository_details)
           repository_key = repository_details.hash
           return @dependency_metadata[repository_key] if @dependency_metadata.key?(repository_key)
 
-          @dependency_metadata[repository_key] = fetch_dependency_metadata(repository_details)
+          xml_document = fetch_dependency_metadata(repository_details)
+
+          @dependency_metadata[repository_key] ||= xml_document if xml_document
+          @dependency_metadata[repository_key]
         end
 
+        sig { params(repository_details: T::Hash[String, T.untyped]).returns(T.nilable(Nokogiri::XML::Document)) }
         def fetch_dependency_metadata(repository_details)
           response = Dependabot::RegistryClient.get(
             url: dependency_metadata_url(repository_details.fetch("url")),
@@ -219,6 +247,7 @@ module Dependabot
           nil
         end
 
+        sig { params(response: Excon::Response, repository_url: String).void }
         def check_response(response, repository_url)
           return unless [401, 403].include?(response.status)
           return if @forbidden_urls.include?(repository_url)
@@ -227,8 +256,9 @@ module Dependabot
           @forbidden_urls << repository_url
         end
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def repositories
-          return @repositories if defined?(@repositories)
+          return @repositories if @repositories
 
           @repositories = credentials_repository_details
           pom_repository_details.each do |repo|
@@ -237,24 +267,33 @@ module Dependabot
           @repositories
         end
 
+        sig { returns(Maven::FileParser::RepositoriesFinder) }
         def repository_finder
-          @repository_finder ||=
+          return @repository_finder if @repository_finder
+
+          @repository_finder =
             Maven::FileParser::RepositoriesFinder.new(
               pom_fetcher: Maven::FileParser::PomFetcher.new(dependency_files: dependency_files),
               dependency_files: dependency_files,
               credentials: credentials
             )
+          @repository_finder
         end
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def pom_repository_details
-          @pom_repository_details ||=
+          return @pom_repository_details if @pom_repository_details
+
+          @pom_repository_details =
             repository_finder
             .repository_urls(pom: pom)
             .map do |url|
               { "url" => url, "auth_headers" => {} }
             end
+          @pom_repository_details
         end
 
+        sig { returns(T::Array[T.untyped]) }
         def credentials_repository_details
           credentials
             .select { |cred| cred["type"] == "maven_repository" && cred["url"] }
@@ -266,13 +305,14 @@ module Dependabot
             end
         end
 
+        sig { params(comparison_version: Version).returns(T::Boolean) }
         def matches_dependency_version_type?(comparison_version)
           return true unless dependency.version
 
           current_type = dependency.version
-                                   .gsub("native-mt", "native_mt")
-                                   .split(/[.\-]/)
-                                   .find do |type|
+                                   &.gsub("native-mt", "native_mt")
+                                   &.split(/[.\-]/)
+                                   &.find do |type|
             TYPE_SUFFICES.find { |s| type.include?(s) }
           end
 
@@ -286,47 +326,57 @@ module Dependabot
           current_type == version_type
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pom
-          filename = dependency.requirements.first.fetch(:file)
+          filename = dependency.requirements.first&.fetch(:file)
           dependency_files.find { |f| f.name == filename }
         end
 
+        sig { params(repository_url: String).returns(String) }
         def dependency_metadata_url(repository_url)
           group_id, artifact_id = dependency.name.split(":")
 
           "#{repository_url}/" \
-            "#{group_id.tr('.', '/')}/" \
+            "#{group_id&.tr('.', '/')}/" \
             "#{artifact_id}/" \
             "maven-metadata.xml"
         end
 
+        sig { params(repository_url: String, version: Version).returns(String) }
         def dependency_files_url(repository_url, version)
           group_id, artifact_id = dependency.name.split(":")
-          type = dependency.requirements.first.dig(:metadata, :packaging_type)
-          classifier = dependency.requirements.first.dig(:metadata, :classifier)
+          type = dependency.requirements.first&.dig(:metadata, :packaging_type)
+          classifier = dependency.requirements.first&.dig(:metadata, :classifier)
 
           actual_classifier = classifier.nil? ? "" : "-#{classifier}"
           "#{repository_url}/" \
-            "#{group_id.tr('.', '/')}/" \
+            "#{group_id&.tr('.', '/')}/" \
             "#{artifact_id}/" \
             "#{version}/" \
             "#{artifact_id}-#{version}#{actual_classifier}.#{type}"
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T::Array[String]) }
         def central_repo_urls
           central_url_without_protocol = repository_finder.central_repo_url.gsub(%r{^.*://}, "")
 
           %w(http:// https://).map { |p| p + central_url_without_protocol }
         end
 
+        sig { returns(Utils::AuthHeadersFinder) }
         def auth_headers_finder
-          @auth_headers_finder ||= Utils::AuthHeadersFinder.new(credentials)
+          return @auth_headers_finder if @auth_headers_finder
+
+          @auth_headers_finder = Utils::AuthHeadersFinder.new(credentials)
+          @auth_headers_finder
         end
 
+        sig { params(maven_repo_url: String).returns(T::Hash[String, String]) }
         def auth_headers(maven_repo_url)
           auth_headers_finder.auth_headers(maven_repo_url)
         end

data/lib/dependabot/maven/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/update_checkers"
@@ -12,10 +12,42 @@ module Dependabot
       require_relative "update_checker/version_finder"
       require_relative "update_checker/property_updater"
 
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          dependency_files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[Dependabot::Credential],
+          repo_contents_path: T.nilable(String),
+          ignored_versions: T::Array[String],
+          raise_on_ignored: T::Boolean,
+          security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
+          dependency_group: T.nilable(Dependabot::DependencyGroup),
+          update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          options: T::Hash[Symbol, T.untyped]
+        )
+          .void
+      end
+      def initialize(dependency:, dependency_files:, credentials:,
+                     repo_contents_path: nil, ignored_versions: [],
+                     raise_on_ignored: false, security_advisories: [],
+                     requirements_update_strategy: nil, dependency_group: nil,
+                     update_cooldown: nil, options: {})
+        super
+
+        @version_finder = T.let(nil, T.nilable(VersionFinder))
+        @property_updater = T.let(nil, T.nilable(PropertyUpdater))
+        @property_value_finder = T.let(nil, T.nilable(Maven::FileParser::PropertyValueFinder))
+        @declarations_using_a_property = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+        @all_property_based_dependencies = T.let(nil, T.nilable(T::Array[Dependabot::Dependency]))
+      end
+
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_version
         latest_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version
         # Maven's version resolution algorithm is very simple: it just uses
         # the version defined "closest", with the first declaration winning
@@ -27,14 +59,17 @@ module Dependabot
         latest_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         lowest_security_fix_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Maven has a single dependency file (the pom.xml).
         #
@@ -46,6 +81,7 @@ module Dependabot
         nil
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         property_names =
           declarations_using_a_property
@@ -59,11 +95,14 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { override.returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         declarations_using_a_property.none? do |requirement|
           prop_name = requirement.dig(:metadata, :property_name)
           pom = dependency_files.find { |f| f.name == requirement[:file] }
 
+          return false unless prop_name && pom
+
           declaration_pom_name =
             property_value_finder
             .property_details(property_name: prop_name, callsite_pom: pom)
@@ -75,43 +114,50 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         return false unless version_comes_from_multi_dependency_property?
 
         property_updater.update_possible?
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         property_updater.updated_dependencies
       end
 
+      sig { override.returns(T::Boolean) }
       def numeric_version_up_to_date?
         return false unless version_class.correct?(dependency.version)
 
         super
       end
 
+      sig { override.params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Boolean) }
       def numeric_version_can_update?(requirements_to_unlock:)
         return false unless version_class.correct?(dependency.version)
 
         super
       end
 
+      sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
       def preferred_version_details
         return lowest_security_fix_version_details if vulnerable?
 
         latest_version_details
       end
 
+      sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
       def latest_version_details
-        @latest_version_details ||= version_finder.latest_version_details
+        version_finder.latest_version_details
       end
 
+      sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
       def lowest_security_fix_version_details
-        @lowest_security_fix_version_details ||=
-          version_finder.lowest_security_fix_version_details
+        version_finder.lowest_security_fix_version_details
       end
 
+      sig { returns(VersionFinder) }
       def version_finder
         @version_finder ||=
           VersionFinder.new(
@@ -124,6 +170,7 @@ module Dependabot
           )
       end
 
+      sig { returns(PropertyUpdater) }
       def property_updater
         @property_updater ||=
           PropertyUpdater.new(
@@ -135,12 +182,14 @@ module Dependabot
           )
       end
 
+      sig { returns(Maven::FileParser::PropertyValueFinder) }
       def property_value_finder
         @property_value_finder ||=
           Maven::FileParser::PropertyValueFinder
           .new(dependency_files: dependency_files, credentials: credentials.map(&:to_s))
       end
 
+      sig { returns(T::Boolean) }
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
           property_name = requirement.fetch(:metadata).fetch(:property_name)
@@ -159,12 +208,14 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def declarations_using_a_property
         @declarations_using_a_property ||=
           dependency.requirements
                     .select { |req| req.dig(:metadata, :property_name) }
       end
 
+      sig { returns(T::Array[Dependabot::Dependency]) }
       def all_property_based_dependencies
         @all_property_based_dependencies ||=
           Maven::FileParser.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.305.0
+  version: 0.306.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-06 00:00:00.000000000 Z
+date: 2025-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.305.0
+        version: 0.306.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -268,7 +268,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.305.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.306.0
 post_install_message:
 rdoc_options: []
 require_paths: