dependabot-npm_and_yarn 0.249.0 → 0.250.0

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -1,22 +1,27 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/dependency_file"
 require "dependabot/npm_and_yarn/file_parser"
 require "dependabot/npm_and_yarn/helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
     class FileParser < Dependabot::FileParsers::Base
       class LockfileParser
+        extend T::Sig
+
         require "dependabot/npm_and_yarn/file_parser/yarn_lock"
         require "dependabot/npm_and_yarn/file_parser/pnpm_lock"
         require "dependabot/npm_and_yarn/file_parser/json_lock"
 
+        sig { params(dependency_files: T::Array[DependencyFile]).void }
         def initialize(dependency_files:)
           @dependency_files = dependency_files
         end
 
+        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def parse_set
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
@@ -31,24 +36,32 @@ module Dependabot
           dependency_set
         end
 
+        sig { returns(T::Array[Dependency]) }
         def parse
           Helpers.dependencies_with_all_versions_metadata(parse_set)
         end
 
+        sig do
+          params(dependency_name: String, requirement: T.nilable(String), manifest_name: String)
+            .returns(T.nilable(T::Hash[String, T.untyped]))
+        end
         def lockfile_details(dependency_name:, requirement:, manifest_name:)
+          details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
           potential_lockfiles_for_manifest(manifest_name).each do |lockfile|
             details = lockfile_for(lockfile).details(dependency_name, requirement, manifest_name)
 
-            return details if details
+            break if details
           end
 
-          nil
+          details
         end
 
         private
 
+        sig { returns(T::Array[DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { params(manifest_filename: String).returns(T::Array[DependencyFile]) }
         def potential_lockfiles_for_manifest(manifest_filename)
           dir_name = File.dirname(manifest_filename)
           possible_lockfile_names =
@@ -61,12 +74,9 @@ module Dependabot
                                  .filter_map { |nm| dependency_files.find { |f| f.name == nm } }
         end
 
-        def parsed_lockfile(file)
-          lockfile_for(file).parsed
-        end
-
+        sig { params(file: DependencyFile).returns(T.any(JsonLock, YarnLock, PnpmLock)) }
         def lockfile_for(file)
-          @lockfiles ||= {}
+          @lockfiles ||= T.let({}, T.nilable(T::Hash[String, T.any(JsonLock, YarnLock, PnpmLock)]))
           @lockfiles[file.name] ||= if [*package_locks, *shrinkwraps].include?(file)
                                       JsonLock.new(file)
                                     elsif yarn_locks.include?(file)
@@ -76,30 +86,39 @@ module Dependabot
                                     end
         end
 
+        sig { returns(T::Array[DependencyFile]) }
         def package_locks
-          @package_locks ||=
+          @package_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("package-lock.json") }
+            .select { |f| f.name.end_with?("package-lock.json") }, T.nilable(T::Array[DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[DependencyFile]) }
         def pnpm_locks
-          @pnpm_locks ||=
+          @pnpm_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("pnpm-lock.yaml") }
+            .select { |f| f.name.end_with?("pnpm-lock.yaml") }, T.nilable(T::Array[DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[DependencyFile]) }
         def yarn_locks
-          @yarn_locks ||=
+          @yarn_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("yarn.lock") }
+            .select { |f| f.name.end_with?("yarn.lock") }, T.nilable(T::Array[DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[DependencyFile]) }
         def shrinkwraps
-          @shrinkwraps ||=
+          @shrinkwraps ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+            .select { |f| f.name.end_with?("npm-shrinkwrap.json") }, T.nilable(T::Array[DependencyFile])
+          )
         end
 
+        sig { returns(T.class_of(Dependabot::NpmAndYarn::Version)) }
         def version_class
           NpmAndYarn::Version
         end

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -1,9 +1,10 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
 require "dependabot/errors"
 require "dependabot/npm_and_yarn/native_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
@@ -44,7 +45,7 @@ module Dependabot
 
               dependency_set << Dependency.new(
                 name: req.split(/(?<=\w)\@/).first,
-                version: version,
+                version: version.to_s,
                 package_manager: "npm_and_yarn",
                 requirements: []
               )

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
 # See https://docs.npmjs.com/files/package.json for package.json format docs.
@@ -15,15 +15,17 @@ require "dependabot/npm_and_yarn/registry_parser"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_commit_checker"
 require "dependabot/errors"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
       require "dependabot/file_parsers/base/dependency_set"
       require_relative "file_parser/lockfile_parser"
 
-      DEPENDENCY_TYPES =
-        %w(dependencies devDependencies optionalDependencies).freeze
+      DEPENDENCY_TYPES = T.let(%w(dependencies devDependencies optionalDependencies).freeze, T::Array[String])
       GIT_URL_REGEX = %r{
         (?<git_prefix>^|^git.*?|^github:|^bitbucket:|^gitlab:|github\.com/)
         (?<username>[a-z0-9-]+)/
@@ -35,15 +37,23 @@ module Dependabot
         )?$
       }ix
 
-      def self.each_dependency(json)
+      sig do
+        params(
+          json: T::Hash[String, T.untyped],
+          _block: T.proc.params(arg0: String, arg1: String, arg2: String).void
+        )
+          .void
+      end
+      def self.each_dependency(json, &_block)
         DEPENDENCY_TYPES.each do |type|
           deps = json[type] || {}
           deps.each do |name, requirement|
-            yield name, requirement, type
+            yield(name, requirement, type)
           end
         end
       end
 
+      sig { override.returns(T::Array[Dependency]) }
       def parse
         dependency_set = DependencySet.new
         dependency_set += manifest_dependencies
@@ -70,11 +80,12 @@ module Dependabot
 
       private
 
+      sig { returns(Dependabot::FileParsers::Base::DependencySet) }
       def manifest_dependencies
         dependency_set = DependencySet.new
 
         package_files.each do |file|
-          json = JSON.parse(file.content)
+          json = JSON.parse(T.must(file.content))
 
           # TODO: Currently, Dependabot can't handle flat dependency files
           # (and will error at the FileUpdater stage, because the
@@ -98,16 +109,22 @@ module Dependabot
         dependency_set
       end
 
+      sig { returns(LockfileParser) }
       def lockfile_parser
-        @lockfile_parser ||= LockfileParser.new(
-          dependency_files: dependency_files
-        )
+        @lockfile_parser ||= T.let(LockfileParser.new(
+                                     dependency_files: dependency_files
+                                   ), T.nilable(Dependabot::NpmAndYarn::FileParser::LockfileParser))
       end
 
+      sig { returns(Dependabot::FileParsers::Base::DependencySet) }
       def lockfile_dependencies
         lockfile_parser.parse_set
       end
 
+      sig do
+        params(file: DependencyFile, type: T.untyped, name: String, requirement: String)
+          .returns(T.nilable(Dependency))
+      end
       def build_dependency(file:, type:, name:, requirement:)
         lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
@@ -115,6 +132,13 @@ module Dependabot
           manifest_name: file.name
         )
         version = version_for(requirement, lockfile_details)
+        converted_version = T.let(if version.nil?
+                                    nil
+                                  elsif version.is_a?(String)
+                                    version
+                                  else
+                                    Dependabot::Version.new(version)
+                                  end, T.nilable(T.any(String, Dependabot::Version)))
 
         return if lockfile_details && !version
         return if ignore_requirement?(requirement)
@@ -129,7 +153,7 @@ module Dependabot
 
         Dependency.new(
           name: name,
-          version: version,
+          version: converted_version,
           package_manager: "npm_and_yarn",
           requirements: [{
             requirement: requirement_for(requirement),
@@ -140,10 +164,12 @@ module Dependabot
         )
       end
 
+      sig { override.void }
       def check_required_files
         raise "No package.json!" unless get_original_file("package.json")
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def ignore_requirement?(requirement)
         return true if local_path?(requirement)
         return true if non_git_url?(requirement)
@@ -153,37 +179,49 @@ module Dependabot
         alias_package?(requirement)
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def local_path?(requirement)
         requirement.start_with?("link:", "file:", "/", "./", "../", "~/")
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def alias_package?(requirement)
         requirement.start_with?("npm:")
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def non_git_url?(requirement)
         requirement.include?("://") && !git_url?(requirement)
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def git_url?(requirement)
         requirement.match?(GIT_URL_REGEX)
       end
 
+      sig { params(requirement: String).returns(T::Boolean) }
       def git_url_with_semver?(requirement)
         return false unless git_url?(requirement)
 
-        !requirement.match(GIT_URL_REGEX).named_captures.fetch("semver").nil?
+        !T.must(requirement.match(GIT_URL_REGEX)).named_captures.fetch("semver").nil?
       end
 
+      sig { params(name: String).returns(T::Boolean) }
       def aliased_package_name?(name)
         name.include?("@npm:")
       end
 
+      sig { returns(T::Array[String]) }
       def workspace_package_names
-        @workspace_package_names ||=
-          package_files.filter_map { |f| JSON.parse(f.content)["name"] }
+        @workspace_package_names ||= T.let(package_files.filter_map do |f|
+          JSON.parse(T.must(f.content))["name"]
+        end, T.nilable(T::Array[String]))
       end
 
+      sig do
+        params(requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+          .returns(T.nilable(T.any(String, Integer, Gem::Version)))
+      end
       def version_for(requirement, lockfile_details)
         if git_url_with_semver?(requirement)
           semver_version = lockfile_version_for(lockfile_details)
@@ -203,20 +241,25 @@ module Dependabot
         end
       end
 
+      sig { params(lockfile_details: T.nilable(T::Hash[String, T.untyped])).returns(T.nilable(String)) }
       def git_revision_for(lockfile_details)
+        version = T.cast(lockfile_details&.fetch("version", nil), T.nilable(String))
+        resolved = T.cast(lockfile_details&.fetch("resolved", nil), T.nilable(String))
         [
-          lockfile_details&.fetch("version", nil)&.split("#")&.last,
-          lockfile_details&.fetch("resolved", nil)&.split("#")&.last,
-          lockfile_details&.fetch("resolved", nil)&.split("/")&.last
+          version&.split("#")&.last,
+          resolved&.split("#")&.last,
+          resolved&.split("/")&.last
         ].find { |str| commit_sha?(str) }
       end
 
+      sig { params(string: T.nilable(String)).returns(T::Boolean) }
       def commit_sha?(string)
         return false unless string.is_a?(String)
 
         string.match?(/^[0-9a-f]{40}$/)
       end
 
+      sig { params(requirement: String, git_revision: T.nilable(String)).returns(T.nilable(String)) }
       def version_from_git_revision(requirement, git_revision)
         tags =
           Dependabot::GitMetadataFetcher.new(
@@ -228,7 +271,7 @@ module Dependabot
         tags.each do |t|
           next unless t.name.match?(Dependabot::GitCommitChecker::VERSION_REGEX)
 
-          version = t.name.match(Dependabot::GitCommitChecker::VERSION_REGEX)
+          version = T.must(t.name.match(Dependabot::GitCommitChecker::VERSION_REGEX))
                      .named_captures.fetch("version")
           next unless version_class.correct?(version)
 
@@ -240,14 +283,20 @@ module Dependabot
         nil
       end
 
+      sig do
+        params(lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+          .returns(T.nilable(T.any(String, Integer, Gem::Version)))
+      end
       def lockfile_version_for(lockfile_details)
         semver_version_for(lockfile_details&.fetch("version", ""))
       end
 
+      sig { params(version: String).returns(T.nilable(T.any(String, Integer, Gem::Version))) }
       def semver_version_for(version)
         version_class.semver_for(version)
       end
 
+      sig { params(requirement: String).returns(T.nilable(String)) }
       def exact_version_for(requirement)
         req = requirement_class.new(requirement)
         return unless req.exact?
@@ -257,6 +306,10 @@ module Dependabot
         # If it doesn't parse, it's definitely not exact
       end
 
+      sig do
+        params(name: String, requirement: String, lockfile_details: T.nilable(T::Hash[String, T.untyped]))
+          .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+      end
       def source_for(name, requirement, lockfile_details)
         return git_source_for(requirement) if git_url?(requirement)
 
@@ -276,22 +329,24 @@ module Dependabot
         ).registry_source_for(name)
       end
 
+      sig { params(requirement: String).returns(T.nilable(String)) }
       def requirement_for(requirement)
         return requirement unless git_url?(requirement)
 
-        details = requirement.match(GIT_URL_REGEX).named_captures
+        details = T.must(requirement.match(GIT_URL_REGEX)).named_captures
         details["semver"]
       end
 
+      sig { params(requirement: String).returns(T::Hash[Symbol, T.untyped]) }
       def git_source_for(requirement)
-        details = requirement.match(GIT_URL_REGEX).named_captures
-        prefix = details.fetch("git_prefix")
+        details = T.must(requirement.match(GIT_URL_REGEX)).named_captures
+        prefix = T.must(details.fetch("git_prefix"))
 
         host = if prefix.include?("git@") || prefix.include?("://")
-                 prefix.split("git@").last
-                       .sub(%r{.*?://}, "")
-                       .sub(%r{[:/]$}, "")
-                       .split("#").first
+                 T.must(prefix.split("git@").last)
+                  .sub(%r{.*?://}, "")
+                  .sub(%r{[:/]$}, "")
+                  .split("#").first
                elsif prefix.include?("bitbucket") then "bitbucket.org"
                elsif prefix.include?("gitlab") then "gitlab.com"
                else
@@ -306,29 +361,37 @@ module Dependabot
         }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def support_package_files
-        @support_package_files ||= sub_package_files.select(&:support_file?)
+        @support_package_files ||= T.let(sub_package_files.select(&:support_file?), T.nilable(T::Array[DependencyFile]))
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def sub_package_files
-        @sub_package_files ||=
-          dependency_files.select { |f| f.name.end_with?("package.json") }
-                          .reject { |f| f.name == "package.json" }
-                          .reject { |f| f.name.include?("node_modules/") }
+        return T.must(@sub_package_files) if defined?(@sub_package_files)
+
+        files = dependency_files.select { |f| f.name.end_with?("package.json") }
+                                .reject { |f| f.name == "package.json" }
+                                .reject { |f| f.name.include?("node_modules/") }
+        @sub_package_files ||= T.let(files, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def package_files
-        @package_files ||=
+        @package_files ||= T.let(
           [
             dependency_files.find { |f| f.name == "package.json" },
             *sub_package_files
-          ].compact
+          ].compact, T.nilable(T::Array[DependencyFile])
+        )
       end
 
+      sig { returns(T.class_of(Dependabot::NpmAndYarn::Version)) }
       def version_class
         NpmAndYarn::Version
       end
 
+      sig { returns(T.class_of(Dependabot::NpmAndYarn::Requirement)) }
       def requirement_class
         NpmAndYarn::Requirement
       end

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -7,10 +7,13 @@ require "dependabot/file_updaters/vendor_updater"
 require "dependabot/file_updaters/artifact_updater"
 require "dependabot/npm_and_yarn/dependency_files_filterer"
 require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/package_json_updater"
       require_relative "file_updater/npm_lockfile_updater"
       require_relative "file_updater/yarn_lockfile_updater"
@@ -27,6 +30,7 @@ module Dependabot
         end
       end
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^package\.json$/,
@@ -37,8 +41,9 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[DependencyFile]) }
       def updated_dependency_files
-        updated_files = []
+        updated_files = T.let([], T::Array[DependencyFile])
 
         updated_files += updated_manifest_files
         updated_files += updated_lockfiles
@@ -68,7 +73,9 @@ module Dependabot
         pnp_updater.updated_files(base_directory: base_dir, only_paths: [".pnp.cjs", ".pnp.data.json"]).each do |file|
           updated_files << file
         end
-        vendor_updater.updated_vendor_cache_files(base_directory: base_dir).each { |file| updated_files << file }
+        T.unsafe(vendor_updater).updated_vendor_cache_files(base_directory: base_dir).each do |file|
+          updated_files << file
+        end
         install_state_updater.updated_files(base_directory: base_dir).each do |file|
           updated_files << file
         end
@@ -89,6 +96,7 @@ module Dependabot
         @install_state_path = Helpers.fetch_yarnrc_yml_value("installStatePath", "./.yarn/install-state.gz")
       end
 
+      sig { returns(Dependabot::FileUpdaters::VendorUpdater) }
       def vendor_updater
         Dependabot::FileUpdaters::VendorUpdater.new(
           repo_contents_path: repo_contents_path,
@@ -96,6 +104,7 @@ module Dependabot
         )
       end
 
+      sig { returns(Dependabot::FileUpdaters::ArtifactUpdater) }
       def install_state_updater
         Dependabot::FileUpdaters::ArtifactUpdater.new(
           repo_contents_path: repo_contents_path,
@@ -103,6 +112,7 @@ module Dependabot
         )
       end
 
+      sig { returns(Dependabot::FileUpdaters::ArtifactUpdater) }
       def pnp_updater
         Dependabot::FileUpdaters::ArtifactUpdater.new(
           repo_contents_path: repo_contents_path,
@@ -110,8 +120,9 @@ module Dependabot
         )
       end
 
+      sig { returns(T::Array[DependencyFile]) }
       def filtered_dependency_files
-        @filtered_dependency_files ||=
+        @filtered_dependency_files ||= T.let(
           if dependencies.any?(&:top_level?)
             DependencyFilesFilterer.new(
               dependency_files: dependency_files,
@@ -122,13 +133,16 @@ module Dependabot
               dependency_files: dependency_files,
               updated_dependencies: dependencies
             ).files_requiring_update
-          end
+          end, T.nilable(T::Array[DependencyFile])
+        )
       end
 
+      sig { override.void }
       def check_required_files
         raise "No package.json!" unless get_original_file("package.json")
       end
 
+      sig { params(updated_files: T::Array[DependencyFile]).returns(T::Hash[Symbol, T.untyped]) }
       def error_context(updated_files:)
         {
           dependencies: dependencies.map(&:to_h),
@@ -161,11 +175,13 @@ module Dependabot
           .select { |f| f.name.end_with?("npm-shrinkwrap.json") }
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def package_files
-        @package_files ||=
+        @package_files ||= T.let(
           filtered_dependency_files.select do |f|
             f.name.end_with?("package.json")
-          end
+          end, T.nilable(T::Array[DependencyFile])
+        )
       end
 
       def yarn_lock_changed?(yarn_lock)
@@ -184,6 +200,7 @@ module Dependabot
         shrinkwrap.content != updated_lockfile_content(shrinkwrap)
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def updated_manifest_files
         package_files.filter_map do |file|
           updated_content = updated_package_json_content(file)