dependabot-maven 0.390.0 → 0.391.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '080903718c6b555bd8c1ccec35b6948489371fd7780b8b4f4b2245bf165b4553'
-  data.tar.gz: cdaa999ecefd1c4d258fffe994e693ed6e513517d9cf8a19c2636d836efc92ad
+  metadata.gz: e291e2478cd805665628ff741f4bf0b36a80c9297c20aa4219080f32155f30a3
+  data.tar.gz: f155a760998f79499829ce17fecea84c3a288f96ee302e70774d2dee66824b64
 SHA512:
-  metadata.gz: 5a77aa339debbaa843309fc30d1c5dfaea68c6cd04bd2cb028b10f950cf11c2b9ceb38b325b33505e45500e2dd25c5cb687dd07a828ead1fc9528fe501679158
-  data.tar.gz: 673d58a9c21b555e0ee4161bea4a8bfe05d1dea29c3c8b7be907067b781e85ccc6ec2c2432b8063a876aaa4394fb4fb227c8f14397ef9d7fc54348aca1d6f808
+  metadata.gz: a3249ddd53286a0e01e1f88a3ab7e07baada7d595a0888f4138d410503847b1a0306e6f575e426c55fb5630d3851e63db59744ee7c97ab70e8e27178d996a175
+  data.tar.gz: d54dcd4d6c97f470cd22f871e4b8532cdf9cfc47ada811ffb2d98854e0f7867d2422310e8f5097dc573102b628e4d8b666c8c9a024376b76f60e63c2794d714a

data/lib/dependabot/maven/file_fetcher.rb

@@ -92,18 +92,20 @@ module Dependabot
 
         doc.css(MODULE_SELECTOR).flat_map do |module_node|
           relative_path = module_node.content.strip
-          name_parts = [
-            base_path,
-            relative_path,
-            relative_path.end_with?(".xml") ? nil : "pom.xml"
-          ].compact.reject(&:empty?)
-          path = Pathname.new(File.join(name_parts)).cleanpath.to_path
-
-          next [] if fetched_filenames.include?(path)
-
-          next [] if Dependabot::FileFiltering.should_exclude_path?(path, "file from final collection", @exclude_paths)
+          module_path = Pathname.new(File.join(base_path, relative_path)).cleanpath.to_path
+
+          # Skip a module whose `pom.xml` was already collected via another path.
+          next [] if fetched_filenames.include?(File.join(module_path, "pom.xml"))
+
+          child_pom = fetch_child_pom(module_path)
+          next [] if child_pom.nil?
+          next [] if fetched_filenames.include?(child_pom.name)
+          next [] if Dependabot::FileFiltering.should_exclude_path?(
+            child_pom.name,
+            "file from final collection",
+            @exclude_paths
+          )
 
-          child_pom = fetch_file_from_host(path)
           fetched_files = [
             child_pom,
             recursively_fetch_child_poms(
@@ -113,10 +115,31 @@ module Dependabot
           ].flatten
           fetched_filenames += [child_pom.name] + fetched_files.map(&:name)
           fetched_files
-        rescue Dependabot::DependencyFileNotFound
-          fetch_file_from_host(T.must(path), fetch_submodules: true)
+        end
+      end
 
-          [] # Ignore any child submodules (since we can't update them)
+      # Resolves a `<module>` value to its pom, preferring the module as a directory
+      # (its `pom.xml`) and otherwise treating an `.xml` value as a pom file.
+      sig { params(module_path: String).returns(T.nilable(Dependabot::DependencyFile)) }
+      def fetch_child_pom(module_path)
+        fetch_file_from_host(File.join(module_path, "pom.xml"))
+      rescue Dependabot::DependencyFileNotFound
+        # A non-`.xml` module may be a git submodule, which we can't update.
+        unless module_path.end_with?(".xml")
+          fetch_file_from_host(File.join(module_path, "pom.xml"), fetch_submodules: true)
+          return nil
+        end
+
+        # An `.xml` value may be a custom-named pom file rather than a directory.
+        begin
+          fetch_file_from_host(module_path)
+        rescue Dependabot::DependencyFileNotFound
+          fetch_file_from_host(module_path, fetch_submodules: true)
+          nil
+        rescue Errno::EISDIR
+          # An `.xml` directory with no `pom.xml` inside it; re-raise so the
+          # error carries the full source-directory path.
+          fetch_file_from_host(File.join(module_path, "pom.xml"))
         end
       end
 

data/lib/dependabot/maven/file_parser.rb

@@ -506,13 +506,14 @@ module Dependabot
         merged = []
         used_indices = Set.new
         requirements.each_with_index do |dep_scan_req, i|
-          next if used_indices.include?(i) || dep_scan_req.dig(:metadata, :pom_file).nil?
+          pom_file = dep_scan_req.metadata_string("pom_file")
+          next if used_indices.include?(i) || pom_file.nil?
 
           # Look for another requirement where pom_file matches property_source
           match_index = requirements.find_index.with_index do |parsing_req, j|
             j > i &&
               !used_indices.include?(j) &&
-              dep_scan_req.dig(:metadata, :pom_file) == parsing_req.fetch(:file)
+              pom_file == parsing_req.file
           end
 
           if match_index
@@ -522,11 +523,11 @@ module Dependabot
             # We prefer file and requirement properties from parsed requirements,
             # because they include correct file and not evaluated property value.
             merged_req = {
-              requirement: parsing_req[:requirement],
-              file: parsing_req[:file],
-              groups: [*dep_scan_req[:groups], *parsing_req[:groups]].uniq.compact,
-              source: dep_scan_req[:source],
-              metadata: merge_metadata(dep_scan_req[:metadata], parsing_req[:metadata])
+              requirement: parsing_req.requirement,
+              file: parsing_req.file,
+              groups: [*dep_scan_req.groups, *parsing_req.groups].uniq.compact,
+              source: dep_scan_req.source,
+              metadata: merge_metadata(T.must(dep_scan_req.metadata), T.must(parsing_req.metadata))
             }
 
             merged << Dependabot::DependencyRequirement.create(merged_req)
@@ -545,9 +546,9 @@ module Dependabot
       # Merge metadata from two requirements, combining all keys
       sig do
         params(
-          metadata1: T::Hash[Symbol, Object],
-          metadata2: T::Hash[Symbol, Object]
-        ).returns(T::Hash[Symbol, Object])
+          metadata1: Dependabot::DependencyRequirement::ObjectHash,
+          metadata2: Dependabot::DependencyRequirement::ObjectHash
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
       end
       def merge_metadata(metadata1, metadata2)
         metadata1.merge(metadata2) do |_key, old_value, new_value|

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -20,12 +20,10 @@ module Dependabot
               <path>.*?</path>|
               <artifactItem>.*?</artifactItem>
             }mx
-        Requirement = T.type_alias { T.any(Dependabot::DependencyRequirement, T::Hash[Symbol, Object]) }
-
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(Requirement) }
+        sig { returns(Dependabot::DependencyRequirement) }
         attr_reader :declaring_requirement
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -35,13 +33,16 @@ module Dependabot
           params(
             dependency: Dependabot::Dependency,
             dependency_files: T::Array[Dependabot::DependencyFile],
-            declaring_requirement: Requirement
+            declaring_requirement: Dependabot::DependencyRequirement::Input
           ).void
         end
         def initialize(dependency:, dependency_files:, declaring_requirement:)
           @dependency = dependency
           @dependency_files = dependency_files
-          @declaring_requirement = declaring_requirement
+          @declaring_requirement = T.let(
+            Dependabot::DependencyRequirement.create(declaring_requirement),
+            Dependabot::DependencyRequirement
+          )
           @declaration_strings = T.let(nil, T.nilable(T::Array[String]))
           @property_value_finder = T.let(nil, T.nilable(Maven::FileParser::PropertyValueFinder))
         end
@@ -62,7 +63,7 @@ module Dependabot
 
         sig { returns(Dependabot::DependencyFile) }
         def declaring_pom
-          filename = declaring_requirement.fetch(:file) || declaring_requirement.dig(:metadata, :pom_file)
+          filename = declaring_requirement.file || declaring_requirement.metadata_string("pom_file")
           declaring_pom = dependency_files.find { |f| f.name == filename }
           return declaring_pom if declaring_pom
 
@@ -90,7 +91,7 @@ module Dependabot
             next false unless classifier_matches?(node)
             next false unless node_name == dependency_name
             next false unless packaging_type_matches?(node)
-            next false unless declaring_requirement.fetch(:groups) == ["plugin"] || scope_matches?(node)
+            next false unless declaring_requirement.groups == ["plugin"] || scope_matches?(node)
 
             declaring_requirement_matches?(node)
           end
@@ -115,7 +116,7 @@ module Dependabot
         def declaring_requirement_matches?(node)
           node_requirement = node.at_css("version")&.content&.strip
 
-          if declaring_requirement.dig(:metadata, :property_name)
+          if (declaring_property_name = declaring_requirement.metadata_string("property_name"))
             return false unless node_requirement
 
             property_name =
@@ -124,15 +125,15 @@ module Dependabot
               &.named_captures
               &.fetch("property")
 
-            property_name == declaring_requirement[:metadata][:property_name]
+            property_name == declaring_property_name
           else
-            node_requirement == declaring_requirement.fetch(:requirement)
+            node_requirement == declaring_requirement.requirement_string
           end
         end
 
         sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }
         def packaging_type_matches?(node)
-          type = declaring_requirement.dig(:metadata, :packaging_type)
+          type = declaring_requirement.metadata_string("packaging_type")
           type == packaging_type(node)
         end
 
@@ -141,13 +142,13 @@ module Dependabot
           return true unless node.at_xpath("./*/classifier")
 
           classifier = evaluated_value(node.at_xpath("./*/classifier").content.strip)
-          dep_classifier = dependency.requirements.first&.dig(:metadata, :classifier)
+          dep_classifier = dependency.requirements.first&.metadata_string("classifier")
           classifier == dep_classifier
         end
 
         sig { params(node: Nokogiri::XML::Document).returns(T::Boolean) }
         def scope_matches?(node)
-          dependency_type = declaring_requirement.fetch(:groups)
+          dependency_type = declaring_requirement.groups
 
           node_type = dependency_scope(node) == "test" ? ["test"] : []
 

data/lib/dependabot/maven/file_updater.rb

@@ -67,11 +67,11 @@ module Dependabot
 
         # Loop through each changed requirement and update the files
         reqs.each do |new_req, old_req|
-          raise "Bad req match" unless new_req[:file] == T.must(old_req)[:file]
-          next if new_req[:requirement] == T.must(old_req)[:requirement]
+          raise "Bad req match" unless new_req.file == T.must(old_req).file
+          next if new_req.requirement == T.must(old_req).requirement
 
-          file_name = T.let(new_req.fetch(:file) || new_req.dig(:metadata, :pom_file), String)
-          if new_req.dig(:metadata, :property_name)
+          file_name = T.must(new_req.file || new_req.metadata_string("pom_file"))
+          if new_req.metadata_string("property_name")
             files = update_pomfiles_for_property_change(files, new_req)
             pom = files.find { |f| f.name == file_name }
             files[T.must(files.index(pom))] =
@@ -95,13 +95,13 @@ module Dependabot
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def update_pomfiles_for_property_change(pomfiles, req)
-        property_name = req.fetch(:metadata).fetch(:property_name)
+        property_name = T.must(req.metadata_string("property_name"))
 
         PropertyValueUpdater.new(dependency_files: pomfiles)
                             .update_pomfiles_for_property_change(
                               property_name: property_name,
-                              callsite_pom: T.must(pomfiles.find { |f| f.name == req.fetch(:file) }),
-                              updated_value: req.fetch(:requirement)
+                              callsite_pom: T.must(pomfiles.find { |f| f.name == req.file }),
+                              updated_value: T.must(req.requirement_string)
                             )
       end
 
@@ -254,11 +254,11 @@ module Dependabot
           .returns(String)
       end
       def updated_file_declaration(old_declaration, previous_req, requirement)
-        original_req_string = previous_req.fetch(:requirement)
+        original_req_string = T.must(previous_req.requirement_string)
 
         old_declaration.gsub(
           /(?<=\s|>)#{Regexp.quote(original_req_string)}(?=\s|<)/,
-          requirement.fetch(:requirement)
+          T.must(requirement.requirement_string)
         )
       end
 
@@ -333,7 +333,7 @@ module Dependabot
         artifact_id.text = dependency.name.split(":").last
         dependency_node.add_text("\n#{current_indentation_level}")
         version = REXML::Element.new("version", dependency_node)
-        version.text = requirement.fetch(:requirement)
+        version.text = T.must(requirement.requirement_string)
         dependency_node.add_text("\n#{parent_indentation_level}")
       end
 

data/lib/dependabot/maven/package/package_details_fetcher.rb

@@ -27,9 +27,9 @@ module Dependabot
           ).void
         end
         def initialize(dependency:, dependency_files:, credentials:)
-          @dependency = T.let(dependency, Dependabot::Dependency)
-          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @dependency = dependency
+          @dependency_files = dependency_files
+          @credentials = credentials
 
           @pom_repository_details = T.let(nil, T.nilable(T::Array[RepositoryDetails]))
           @repository_finder = T.let(nil, T.nilable(Maven::FileParser::RepositoriesFinder))
@@ -123,8 +123,8 @@ module Dependabot
         # Returns the POM file for the dependency, if it exists.
         sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pom
-          filename = dependency.requirements.first&.fetch(:file) ||
-                     dependency.requirements.first&.dig(:metadata, :pom_file)
+          requirement = dependency.requirements.first
+          filename = requirement&.file || requirement&.metadata_string("pom_file")
           dependency_files.find { |f| f.name == filename }
         end
       end

data/lib/dependabot/maven/requirement.rb

@@ -15,9 +15,9 @@ module Dependabot
 
       quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
       PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{Maven::Version::VERSION_PATTERN})\\s*".freeze, String)
-      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
+      PATTERN = /\A#{PATTERN_RAW}\z/
       # Like PATTERN, but the leading operator is required
-      RUBY_STYLE_PATTERN = T.let(/\A\s*(#{quoted})\s*(#{Maven::Version::VERSION_PATTERN})\s*\z/, Regexp)
+      RUBY_STYLE_PATTERN = /\A\s*(#{quoted})\s*(#{Maven::Version::VERSION_PATTERN})\s*\z/
 
       sig { override.returns(Regexp) }
       def self.pattern

data/lib/dependabot/maven/shared/shared_metadata_finder.rb

@@ -170,12 +170,12 @@ module Dependabot
 
         sig { overridable.returns(String) }
         def maven_repo_url
-          source = dependency.requirements
-                             .find { |r| r.fetch(:source) }&.fetch(:source)
+          requirement = dependency.requirements.find(&:source)
+          return central_repo_url unless requirement
 
-          source&.fetch(:url, nil) ||
-            source&.fetch("url", nil) ||
-            central_repo_url
+          raise TypeError, "Maven repository source must be a hash" if requirement.source_hash.nil?
+
+          requirement.source_string("url") || central_repo_url
         end
 
         sig { overridable.returns(String) }

data/lib/dependabot/maven/shared/shared_package_details_fetcher.rb

@@ -17,11 +17,11 @@ module Dependabot
 
         abstract!
 
-        MAVEN_METADATA_XML = T.let("maven-metadata.xml", String)
-        REPOSITORY_TYPE = T.let("maven_repository", String)
-        URL_KEY = T.let("url", String)
-        AUTH_HEADERS_KEY = T.let("auth_headers", String)
-        DEFAULT_CENTRAL_REPO_URL = T.let("https://repo.maven.apache.org/maven2", String)
+        MAVEN_METADATA_XML = "maven-metadata.xml"
+        REPOSITORY_TYPE = "maven_repository"
+        URL_KEY = "url"
+        AUTH_HEADERS_KEY = "auth_headers"
+        DEFAULT_CENTRAL_REPO_URL = "https://repo.maven.apache.org/maven2"
         RepositoryDetails = T.type_alias { T::Hash[String, T.any(String, T::Hash[String, String])] }
         VersionDetails = T.type_alias do
           {
@@ -83,8 +83,9 @@ module Dependabot
         def dependency_files_url(repository_url, version)
           _, artifact_id = dependency_parts
           base_url = dependency_base_url(repository_url)
-          type = dependency.requirements.first&.dig(:metadata, :packaging_type) || "jar"
-          classifier = dependency.requirements.first&.dig(:metadata, :classifier)
+          requirement = dependency.requirements.first
+          type = requirement&.metadata_string("packaging_type") || "jar"
+          classifier = requirement&.metadata_string("classifier")
           actual_classifier = classifier.nil? ? "" : "-#{classifier}"
 
           "#{base_url}/#{version}/#{artifact_id}-#{version}#{actual_classifier}.#{type}"
@@ -350,7 +351,7 @@ module Dependabot
               # the consumer POM omits <type>, causing the parser to default to "jar".
               # Only fall back when there's no classifier (classifier artifacts are specific).
               next false unless response.status == 404
-              next false if dependency.requirements.first&.dig(:metadata, :classifier)
+              next false if dependency.requirements.first&.metadata_string("classifier")
 
               pom_response = Dependabot::RegistryClient.head(
                 url: dependency_pom_url(url, version),

data/lib/dependabot/maven/shared/shared_property_value_updater.rb

@@ -21,7 +21,7 @@ module Dependabot
 
         sig { params(dependency_files: T::Array[DependencyFile]).void }
         def initialize(dependency_files:)
-          @dependency_files = T.let(dependency_files, T::Array[DependencyFile])
+          @dependency_files = dependency_files
         end
 
         sig do

data/lib/dependabot/maven/shared/shared_requirement.rb

@@ -14,7 +14,7 @@ module Dependabot
 
         abstract!
 
-        OR_SYNTAX = T.let(/(?<=\]|\)),/, Regexp)
+        OR_SYNTAX = /(?<=\]|\)),/
 
         sig { abstract.returns(Regexp) }
         def self.pattern; end

data/lib/dependabot/maven/shared/shared_version_finder.rb

@@ -52,10 +52,7 @@ module Dependabot
         # - Only hexadecimal characters (0-9, a-f)
         # - Case-insensitive
         # - At least one letter a-f to avoid purely numeric strings
-        GIT_COMMIT = T.let(
-          /\A(?=[0-9a-f]{#{MIN_GIT_SHA_LENGTH},#{MAX_GIT_SHA_LENGTH}}\z)(?=.*[a-f])/i,
-          Regexp
-        )
+        GIT_COMMIT = /\A(?=[0-9a-f]{#{MIN_GIT_SHA_LENGTH},#{MAX_GIT_SHA_LENGTH}}\z)(?=.*[a-f])/i
 
         sig { params(comparison_version: Dependabot::Version).returns(T::Boolean) }
         def matches_dependency_version_type?(comparison_version)
@@ -111,7 +108,7 @@ module Dependabot
           return true if dependency.numeric_version&.prerelease?
 
           dependency.requirements.any? do |req|
-            req_string = T.cast(req.fetch(:requirement), T.nilable(String)).to_s
+            req_string = req.requirement_string.to_s
             req_string.split(",").any? do |segment|
               normalized = segment.strip.gsub(/\A[\[\(]\s*/, "")
                                   .gsub(/\s*[\]\)]\z/, "")

data/lib/dependabot/maven/update_checker/property_updater.rb

@@ -122,9 +122,9 @@ module Dependabot
               source: nil
             ).parse.select do |dep|
               dep.requirements.any? do |r|
-                next unless r.dig(:metadata, :property_name) == property_name
+                next unless r.metadata_string("property_name") == property_name
 
-                r.dig(:metadata, :property_source) == property_source
+                r.metadata_string("property_source") == property_source
               end
             end,
             T.nilable(T::Array[Dependabot::Dependency])
@@ -135,8 +135,8 @@ module Dependabot
         def property_name
           @property_name ||= T.let(
             dependency.requirements
-                      .find { |r| r.dig(:metadata, :property_name) }
-                      &.dig(:metadata, :property_name),
+                      .find { |r| r.metadata_string("property_name") }
+                      &.metadata_string("property_name"),
             T.nilable(String)
           )
 
@@ -149,8 +149,8 @@ module Dependabot
         def property_source
           @property_source ||= T.let(
             dependency.requirements
-                      .find { |r| r.dig(:metadata, :property_name) == property_name }
-                      &.dig(:metadata, :property_source),
+                      .find { |r| r.metadata_string("property_name") == property_name }
+                      &.metadata_string("property_source"),
             T.nilable(String)
           )
         end
@@ -192,10 +192,10 @@ module Dependabot
         sig { params(dep: Dependabot::Dependency).returns(String) }
         def current_property_value(dep)
           declaring_requirement = declaring_property_requirement(dep)
-          callsite_pom = dependency_files.find { |f| f.name == declaring_requirement.fetch(:file) }
+          callsite_pom = dependency_files.find { |f| f.name == declaring_requirement.file }
           unless callsite_pom
             raise DependencyFileNotEvaluatable,
-                  "POM not found: #{declaring_requirement.fetch(:file)} for property #{property_name}"
+                  "POM not found: #{declaring_requirement.file} for property #{property_name}"
           end
 
           property_value =
@@ -212,9 +212,9 @@ module Dependabot
         def declaring_property_requirement(dep)
           declaring_requirement =
             dep.requirements.find do |r|
-              next false unless r.dig(:metadata, :property_name) == property_name
+              next false unless r.metadata_string("property_name") == property_name
 
-              r.dig(:metadata, :property_source) == property_source
+              r.metadata_string("property_source") == property_source
             end
 
           return declaring_requirement if declaring_requirement

data/lib/dependabot/maven/update_checker/requirements_updater.rb

@@ -54,14 +54,15 @@ module Dependabot
           # requirement at index `i` to correspond to the previous requirement
           # at the same index.
           requirements.map do |req|
-            next req if req.fetch(:requirement).nil?
-            next req if req.fetch(:requirement).include?(",")
+            requirement = req.requirement_string
+            next req if requirement.nil?
+            next req if requirement.include?(",")
 
-            property_name = req.dig(:metadata, :property_name)
+            property_name = req.metadata_string("property_name")
             next req if property_name && !properties_to_update.include?(property_name)
 
-            new_req = update_requirement(req[:requirement])
-            next req if new_req == req[:requirement]
+            new_req = update_requirement(requirement)
+            next req if new_req == requirement
 
             Dependabot::DependencyRequirement.create(req.merge(requirement: new_req, source: updated_source))
           end

data/lib/dependabot/maven/update_checker.rb

@@ -107,7 +107,7 @@ module Dependabot
       def updated_requirements
         property_names =
           declarations_using_a_property
-          .map { |req| req.dig(:metadata, :property_name) }
+          .filter_map { |req| req.metadata_string("property_name") }
 
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -120,8 +120,8 @@ module Dependabot
       sig { override.returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         declarations_using_a_property.none? do |requirement|
-          prop_name = requirement.dig(:metadata, :property_name)
-          pom = dependency_files.find { |f| f.name == requirement[:file] }
+          prop_name = requirement.metadata_string("property_name")
+          pom = dependency_files.find { |f| f.name == requirement.file }
 
           return false unless prop_name && pom
 
@@ -217,17 +217,16 @@ module Dependabot
       sig { returns(T::Boolean) }
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
-          property_name = requirement.fetch(:metadata).fetch(:property_name)
-          property_source = requirement.fetch(:metadata)
-                                       .fetch(:property_source)
+          property_name = T.must(requirement.metadata_string("property_name"))
+          property_source = requirement.metadata_string("property_source")
 
           all_property_based_dependencies.any? do |dep|
             next false if dep.name == dependency.name
 
             dep.requirements.any? do |req|
-              next unless req.dig(:metadata, :property_name) == property_name
+              next unless req.metadata_string("property_name") == property_name
 
-              req.dig(:metadata, :property_source) == property_source
+              req.metadata_string("property_source") == property_source
             end
           end
         end
@@ -237,7 +236,7 @@ module Dependabot
       def declarations_using_a_property
         @declarations_using_a_property ||=
           dependency.requirements
-                    .select { |req| req.dig(:metadata, :property_name) }
+                    .select { |req| req.metadata_string("property_name") }
       end
 
       sig { returns(T::Array[Dependabot::Dependency]) }
@@ -247,14 +246,14 @@ module Dependabot
             dependency_files: dependency_files,
             source: nil
           ).parse.select do |dep|
-            dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
+            dep.requirements.any? { |req| req.metadata_string("property_name") }
           end
       end
 
       sig { returns(T::Boolean) }
       def version_comes_from_project_parent_version?
         declarations_using_a_property.any? do |requirement|
-          requirement.dig(:metadata, :property_name) == "project.parent.version"
+          requirement.metadata_string("property_name") == "project.parent.version"
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.390.0
+  version: 0.391.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.390.0
+        version: 0.391.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -292,7 +292,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
 rdoc_options: []
 require_paths:
 - lib