dependabot-npm_and_yarn 0.249.0 → 0.250.0

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -1,14 +1,22 @@
 # typed: true
 # frozen_string_literal: true
 
+require "dependabot/dependency"
+require "dependabot/file_parsers"
+require "dependabot/file_parsers/base"
+require "sorbet-runtime"
+
 module Dependabot
   module NpmAndYarn
     module Helpers
+      extend T::Sig
+
       YARN_PATH_NOT_FOUND =
         /^.*(?<error>The "yarn-path" option has been set \(in [^)]+\), but the specified location doesn't exist)/
 
+      sig { params(lockfile: DependencyFile).returns(Integer) }
       def self.npm_version_numeric(lockfile)
-        lockfile_content = lockfile.content
+        lockfile_content = T.must(lockfile.content)
         return 8 if JSON.parse(lockfile_content)["lockfileVersion"].to_i >= 2
 
         6
@@ -16,6 +24,7 @@ module Dependabot
         6
       end
 
+      sig { params(yarn_lock: DependencyFile).returns(Integer) }
       def self.yarn_version_numeric(yarn_lock)
         if yarn_berry?(yarn_lock)
           3
@@ -26,6 +35,8 @@ module Dependabot
 
       # Mapping from lockfile versions to PNPM versions is at
       # https://github.com/pnpm/spec/tree/274ff02de23376ad59773a9f25ecfedd03a41f64/lockfile, but simplify it for now.
+
+      sig { params(pnpm_lock: DependencyFile).returns(Integer) }
       def self.pnpm_version_numeric(pnpm_lock)
         if pnpm_lockfile_version(pnpm_lock).to_f >= 6.0
           8
@@ -44,19 +55,24 @@ module Dependabot
         end
       end
 
+      sig { params(package_lock: T.nilable(DependencyFile)).returns(T::Boolean) }
       def self.npm8?(package_lock)
         return true unless package_lock
 
         npm_version_numeric(package_lock) == 8
       end
 
+      sig { params(yarn_lock: T.nilable(DependencyFile)).returns(T::Boolean) }
       def self.yarn_berry?(yarn_lock)
-        yaml = YAML.safe_load(yarn_lock.content)
+        return false if yarn_lock.nil? || yarn_lock.content.nil?
+
+        yaml = YAML.safe_load(T.must(yarn_lock.content))
         yaml.key?("__metadata")
       rescue StandardError
         false
       end
 
+      sig { returns(Integer) }
       def self.yarn_major_version
         retries = 0
         output = run_single_yarn_command("--version")
@@ -96,15 +112,18 @@ module Dependabot
         raise
       end
 
+      sig { returns(T::Boolean) }
       def self.yarn_zero_install?
         File.exist?(".pnp.cjs")
       end
 
+      sig { returns(T::Boolean) }
       def self.yarn_offline_cache?
         yarn_cache_dir = fetch_yarnrc_yml_value("cacheFolder", ".yarn/cache")
         File.exist?(yarn_cache_dir) && (fetch_yarnrc_yml_value("nodeLinker", "") == "node-modules")
       end
 
+      sig { returns(String) }
       def self.yarn_berry_args
         if yarn_major_version == 2
           ""
@@ -117,14 +136,17 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Boolean) }
       def self.yarn_berry_skip_build?
         yarn_major_version >= 3 && (yarn_zero_install? || yarn_offline_cache?)
       end
 
+      sig { returns(T::Boolean) }
       def self.yarn_berry_disable_scripts?
         yarn_major_version == 2 || !yarn_zero_install?
       end
 
+      sig { returns(T::Boolean) }
       def self.yarn_4_or_higher?
         yarn_major_version >= 4
       end
@@ -190,6 +212,7 @@ module Dependabot
         pnpm_lock.content.match(/^lockfileVersion: ['"]?(?<version>[\d.]+)/)[:version]
       end
 
+      sig { params(dependency_set: Dependabot::FileParsers::Base::DependencySet).returns(T::Array[Dependency]) }
       def self.dependencies_with_all_versions_metadata(dependency_set)
         dependency_set.dependencies.map do |dependency|
           dependency.metadata[:all_versions] = dependency_set.all_versions_for_name(dependency.name)

data/lib/dependabot/npm_and_yarn/package_name.rb

@@ -1,9 +1,13 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module NpmAndYarn
     class PackageName
+      extend T::Sig
+
       # NPM package naming rules are defined by the following projects:
       # - https://github.com/npm/npm-user-validate
       # - https://github.com/npm/validate-npm-package-name
@@ -31,14 +35,16 @@ module Dependabot
 
       class InvalidPackageName < StandardError; end
 
+      sig { params(string: String).void }
       def initialize(string)
         match = PACKAGE_NAME_REGEX.match(string.to_s)
         raise InvalidPackageName unless match
 
-        @scope = match[:scope]
-        @name  = match[:name]
+        @scope = T.let(match[:scope], T.nilable(String))
+        @name = T.let(match[:name], T.nilable(String))
       end
 
+      sig { returns(String) }
       def to_s
         if scoped?
           "@#{@scope}/#{@name}"
@@ -47,49 +53,60 @@ module Dependabot
         end
       end
 
+      sig { params(other: PackageName).returns(T::Boolean) }
       def eql?(other)
         self.class == other.class && to_s == other.to_s
       end
 
+      sig { returns(Integer) }
       def hash
         to_s.downcase.hash
       end
 
+      sig { params(other: PackageName).returns(T.nilable(Integer)) }
       def <=>(other)
         to_s.casecmp(other.to_s)
       end
 
+      sig { returns(T.nilable(PackageName)) }
       def library_name
         return unless types_package?
+        return @library_name if defined?(@library_name)
 
-        @library_name ||=
+        lib_name =
           begin
-            match = TYPES_PACKAGE_NAME_REGEX.match(to_s)
+            match = T.must(TYPES_PACKAGE_NAME_REGEX.match(to_s))
             if match[:scope]
               self.class.new("@#{match[:scope]}/#{match[:name]}")
             else
               self.class.new(match[:name].to_s)
             end
           end
+
+        @library_name ||= T.let(lib_name, T.nilable(PackageName))
       end
 
+      sig { returns(T.nilable(PackageName)) }
       def types_package_name
         return if types_package?
 
-        @types_package_name ||=
+        @types_package_name ||= T.let(
           if scoped?
             self.class.new("@types/#{@scope}__#{@name}")
           else
             self.class.new("@types/#{@name}")
-          end
+          end, T.nilable(PackageName)
+        )
       end
 
       private
 
+      sig { returns(T::Boolean) }
       def scoped?
         !@scope.nil?
       end
 
+      sig { returns(T.nilable(T::Boolean)) }
       def types_package?
         "types".casecmp?(@scope)
       end

data/lib/dependabot/npm_and_yarn/registry_parser.rb

@@ -1,14 +1,20 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module NpmAndYarn
     class RegistryParser
+      extend T::Sig
+
+      sig { params(resolved_url: String, credentials: T::Array[Dependabot::Credential]).void }
       def initialize(resolved_url:, credentials:)
         @resolved_url = resolved_url
         @credentials = credentials
       end
 
+      sig { params(name: String).returns(T::Hash[Symbol, T.untyped]) }
       def registry_source_for(name)
         url =
           if resolved_url.include?("/~/")
@@ -16,8 +22,8 @@ module Dependabot
             resolved_url.split("/~/").first
           elsif resolved_url.include?("/#{name}/-/#{name}")
             # MyGet / Bintray format
-            resolved_url.split("/#{name}/-/#{name}").first
-                        .gsub("dl.bintray.com//", "api.bintray.com/npm/").
+            T.must(resolved_url.split("/#{name}/-/#{name}").first)
+             .gsub("dl.bintray.com//", "api.bintray.com/npm/").
               # GitLab format
               gsub(%r{\/projects\/\d+}, "")
           elsif resolved_url.include?("/#{name}/-/#{name.split('/').last}")
@@ -25,51 +31,56 @@ module Dependabot
             resolved_url.split("/#{name}/-/#{name.split('/').last}").first
           elsif (cred_url = url_for_relevant_cred) then cred_url
           else
-            resolved_url.split("/")[0..2].join("/")
+            T.must(resolved_url.split("/")[0..2]).join("/")
           end
 
         { type: "registry", url: url }
       end
 
+      sig { returns(String) }
       def dependency_name
         url_base = if resolved_url.include?("/-/")
-                     resolved_url.split("/-/").first
+                     T.must(resolved_url.split("/-/").first)
                    else
                      resolved_url
                    end
 
-        url_base[/@.*/].gsub("%2F", "/").split("/")[0..1].join("/")
+        T.must(T.must(url_base[/@.*/]).gsub("%2F", "/").split("/")[0..1]).join("/")
       end
 
       private
 
+      sig { returns(String) }
       attr_reader :resolved_url
+
+      sig { returns(T::Array[Dependabot::Credential]) }
       attr_reader :credentials
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { returns(T.nilable(String)) }
       def url_for_relevant_cred
         resolved_url_host = URI(resolved_url).host
 
         credential_matching_url =
           credentials
           .select { |cred| cred["type"] == "npm_registry" && cred["registry"] }
-          .sort_by { |cred| cred["registry"].length }
+          .sort_by { |cred| cred.fetch("registry").length }
           .find do |details|
             next true if resolved_url_host == details["registry"]
 
             uri = if details["registry"]&.include?("://")
-                    URI(details["registry"])
+                    URI(details.fetch("registry"))
                   else
                     URI("https://#{details['registry']}")
                   end
-            resolved_url_host == uri.host && resolved_url.include?(details["registry"])
+            resolved_url_host == uri.host && resolved_url.include?(details.fetch("registry"))
           end
 
         return unless credential_matching_url
 
         # Trim the resolved URL so that it ends at the same point as the
         # credential registry
-        reg = credential_matching_url["registry"]
+        reg = credential_matching_url.fetch("registry")
         resolved_url.gsub(/#{Regexp.quote(reg)}.*/, "") + reg
       end
       # rubocop:enable Metrics/PerceivedComplexity

data/lib/dependabot/npm_and_yarn/sub_dependency_files_filterer.rb

@@ -1,9 +1,10 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/utils"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
+require "sorbet-runtime"
 
 # Used in the sub dependency version resolver and file updater to only run
 # yarn/npm helpers on dependency files that require updates. This is useful for
@@ -12,13 +13,19 @@ require "dependabot/npm_and_yarn/file_parser/lockfile_parser"
 module Dependabot
   module NpmAndYarn
     class SubDependencyFilesFilterer
+      extend T::Sig
+
+      sig { params(dependency_files: T::Array[DependencyFile], updated_dependencies: T::Array[Dependency]).void }
       def initialize(dependency_files:, updated_dependencies:)
         @dependency_files = dependency_files
         @updated_dependencies = updated_dependencies
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def files_requiring_update
-        @files_requiring_update ||=
+        return T.must(@files_requiring_update) if defined? @files_requiring_update
+
+        files_requiring_update =
           lockfiles.select do |lockfile|
             lockfile_dependencies(lockfile).any? do |sub_dep|
               updated_dependencies.any? do |updated_dep|
@@ -29,25 +36,33 @@ module Dependabot
               end
             end
           end
+
+        @files_requiring_update ||= T.let(files_requiring_update, T.nilable(T::Array[DependencyFile]))
       end
 
       private
 
+      sig { returns(T::Array[DependencyFile]) }
       attr_reader :dependency_files
+
+      sig { returns(T::Array[Dependency]) }
       attr_reader :updated_dependencies
 
+      sig { params(lockfile: DependencyFile).returns(T::Array[Dependabot::Dependency]) }
       def lockfile_dependencies(lockfile)
-        @lockfile_dependencies ||= {}
+        @lockfile_dependencies ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependency]]))
         @lockfile_dependencies[lockfile.name] ||=
           NpmAndYarn::FileParser::LockfileParser.new(
             dependency_files: [lockfile]
           ).parse
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
       def lockfiles
         dependency_files.select { |file| lockfile?(file) }
       end
 
+      sig { params(file: DependencyFile).returns(T::Boolean) }
       def lockfile?(file)
         file.name.end_with?(
           "package-lock.json",
@@ -57,6 +72,7 @@ module Dependabot
         )
       end
 
+      sig { returns(T.class_of(Dependabot::NpmAndYarn::Version)) }
       def version_class
         NpmAndYarn::Version
       end

data/lib/dependabot/npm_and_yarn/version.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/version"
 require "dependabot/utils"
+require "sorbet-runtime"
 
 # JavaScript pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
 # converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
@@ -15,7 +16,7 @@ module Dependabot
     class Version < Dependabot::Version
       extend T::Sig
 
-      sig { returns(String) }
+      sig { returns(T.nilable(String)) }
       attr_reader :build_info
 
       VERSION_PATTERN = T.let(Gem::Version::VERSION_PATTERN + '(\+[0-9a-zA-Z\-.]+)?', String)
@@ -46,6 +47,7 @@ module Dependabot
       def initialize(version)
         @version_string = T.let(version.to_s, String)
         version = version.gsub(/^v/, "") if version.is_a?(String)
+        @build_info = T.let(nil, T.nilable(String))
 
         version, @build_info = version.to_s.split("+") if version.to_s.include?("+")
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.249.0
+  version: 0.250.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-28 00:00:00.000000000 Z
+date: 2024-04-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.249.0
+        version: 0.250.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.249.0
+        version: 0.250.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -338,7 +338,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.249.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.250.0
 post_install_message: 
 rdoc_options: []
 require_paths: