dependabot-npm_and_yarn 0.258.0 → 0.260.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfae5fcd34c7159db44bdc832e687cafe0705df351e72d40ecce5d9c0857a8b4
-  data.tar.gz: d95fc294357c49a90e1c450971f939fb8354a6dcb0274bd022e18209123d06bb
+  metadata.gz: a9f2b9570a88347b5fbfb66edf9fc031b9301e30a7ab86e41b3017cd1b8e2a8c
+  data.tar.gz: 7278b7d2adb8fbe5f0e9cd6162b825836883268731a35b30f38f772a6d8d288a
 SHA512:
-  metadata.gz: f267519493c1c2cfc85d0419bbc5cbd6ef7508f7dade5eb043d30457d59f2e660cd2d207931b1465fb5fba4128067f36062094f0ac1145619ca50f2a631e7093
-  data.tar.gz: 6a7531b3e26ce9542eb154258a3fef029aa86860d43415df58da00dbf1a1ca2216e74bb90b98e295e32da2074ce4a7885c8dbb4acb3b6e12ee6a28a446babf52
+  metadata.gz: a09574f2190bd8434293521c983b350cbc5bc754d302652545a424147ea515f0f6fc80d574ca2d287e35e44f629c3ab1fd9f8d0615ee6ce312289942bc61520f
+  data.tar.gz: d7e37d49b38a0a73c7d6049e3ac71027285287b1d800eb99a1e03673df80469c2461447b4c2131b98938393309dd0e2b01b3e56024efb7842382435faee764ac

data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb

@@ -1,17 +1,28 @@
-# typed: false
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater"
 
 module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
       class PackageJsonUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            package_json: Dependabot::DependencyFile,
+            dependencies: T::Array[Dependabot::Dependency]
+          ) .void
+        end
         def initialize(package_json:, dependencies:)
           @package_json = package_json
           @dependencies = dependencies
         end
 
+        sig { returns(Dependabot::DependencyFile) }
         def updated_package_json
           updated_file = package_json.dup
           updated_file.content = updated_package_json_content
@@ -20,16 +31,20 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :package_json
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
 
+        sig { returns(T.nilable(String)) }
         def updated_package_json_content
           dependencies.reduce(package_json.content.dup) do |content, dep|
-            updated_requirements(dep).each do |new_req|
+            updated_requirements(dep)&.each do |new_req|
               old_req = old_requirement(dep, new_req)
 
               new_content = update_package_json_declaration(
-                package_json_content: content,
+                package_json_content: T.must(content),
                 dependency_name: dep.name,
                 old_req: old_req,
                 new_req: new_req
@@ -44,7 +59,7 @@ module Dependabot
               old_req = old_requirement(dep, new_req)
 
               content = update_package_json_resolutions(
-                package_json_content: content,
+                package_json_content: T.must(content),
                 new_req: new_req,
                 dependency: dep,
                 old_req: old_req
@@ -55,24 +70,35 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            new_requirement: T::Hash[Symbol, T.untyped]
+          )
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def old_requirement(dependency, new_requirement)
-          dependency.previous_requirements
-                    .select { |r| r[:file] == package_json.name }
-                    .find { |r| r[:groups] == new_requirement[:groups] }
+          T.must(dependency.previous_requirements)
+           .select { |r| r[:file] == package_json.name }
+           .find { |r| r[:groups] == new_requirement[:groups] }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def new_requirements(dependency)
           dependency.requirements.select { |r| r[:file] == package_json.name }
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T.nilable(T::Array[T::Hash[Symbol, T.untyped]])) }
         def updated_requirements(dependency)
+          return unless dependency.previous_requirements
+
           updated_requirement_pairs =
-            dependency.requirements.zip(dependency.previous_requirements)
+            dependency.requirements.zip(T.must(dependency.previous_requirements))
                       .reject do |new_req, old_req|
               next true if new_req == old_req
-              next false unless old_req[:source].nil?
+              next false unless old_req&.fetch(:source).nil?
 
-              new_req[:requirement] == old_req[:requirement]
+              new_req[:requirement] == old_req&.fetch(:requirement)
             end
 
           updated_requirement_pairs
@@ -80,8 +106,16 @@ module Dependabot
             .select { |r| r[:file] == package_json.name }
         end
 
-        def update_package_json_declaration(package_json_content:, new_req:,
-                                            dependency_name:, old_req:)
+        sig do
+          params(
+            package_json_content: String,
+            new_req: T::Hash[Symbol, T.untyped],
+            dependency_name: String,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+          )
+            .returns(String)
+        end
+        def update_package_json_declaration(package_json_content:, new_req:, dependency_name:, old_req:)
           original_line = declaration_line(
             dependency_name: dependency_name,
             dependency_req: old_req,
@@ -107,8 +141,16 @@ module Dependabot
         # For full details on how Yarn resolutions work, see
         # https://github.com/yarnpkg/rfcs/blob/master/implemented/
         # 0000-selective-versions-resolutions.md
-        def update_package_json_resolutions(package_json_content:, new_req:,
-                                            dependency:, old_req:)
+        sig do
+          params(
+            package_json_content: String,
+            new_req: T::Hash[Symbol, T.untyped],
+            dependency: Dependabot::Dependency,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+          )
+            .returns(String)
+        end
+        def update_package_json_resolutions(package_json_content:, new_req:, dependency:, old_req:)
           dep = dependency
           parsed_json_content = JSON.parse(package_json_content)
           resolutions =
@@ -141,17 +183,25 @@ module Dependabot
           content
         end
 
+        sig do
+          params(
+            dependency_name: String,
+            dependency_req: T.nilable(T::Hash[Symbol, T.untyped]),
+            content: String
+          )
+            .returns(String)
+        end
         def declaration_line(dependency_name:, dependency_req:, content:)
-          git_dependency = dependency_req.dig(:source, :type) == "git"
+          git_dependency = dependency_req&.dig(:source, :type) == "git"
 
           unless git_dependency
-            requirement = dependency_req.fetch(:requirement)
+            requirement = dependency_req&.fetch(:requirement)
             return content.match(/"#{Regexp.escape(dependency_name)}"\s*:\s*
                                   "#{Regexp.escape(requirement)}"/x).to_s
           end
 
           username, repo =
-            dependency_req.dig(:source, :url).split("/").last(2)
+            dependency_req&.dig(:source, :url)&.split("/")&.last(2)
 
           content.match(
             %r{"#{Regexp.escape(dependency_name)}"\s*:\s*
@@ -159,13 +209,21 @@ module Dependabot
           ).to_s
         end
 
+        sig do
+          params(
+            original_line: String,
+            old_req: T.nilable(T::Hash[Symbol, T.untyped]),
+            new_req: T::Hash[Symbol, T.untyped]
+          )
+            .returns(String)
+        end
         def replacement_declaration_line(original_line:, old_req:, new_req:)
-          was_git_dependency = old_req.dig(:source, :type) == "git"
+          was_git_dependency = old_req&.dig(:source, :type) == "git"
           now_git_dependency = new_req.dig(:source, :type) == "git"
 
           unless was_git_dependency
             return original_line.gsub(
-              %("#{old_req.fetch(:requirement)}"),
+              %("#{old_req&.fetch(:requirement)}"),
               %("#{new_req.fetch(:requirement)}")
             )
           end
@@ -186,15 +244,23 @@ module Dependabot
           end
 
           original_line.gsub(
-            %(##{old_req.dig(:source, :ref)}"),
+            %(##{old_req&.dig(:source, :ref)}"),
             %(##{new_req.dig(:source, :ref)}")
           )
         end
 
+        sig do
+          params(
+            original_line: String,
+            old_req: T.nilable(T::Hash[Symbol, String]),
+            new_req: T::Hash[Symbol, String]
+          )
+            .returns(String)
+        end
         def update_git_semver_requirement(original_line:, old_req:, new_req:)
           if original_line.include?("semver:")
             return original_line.gsub(
-              %(semver:#{old_req.fetch(:requirement)}"),
+              %(semver:#{old_req&.fetch(:requirement)}"),
               %(semver:#{new_req.fetch(:requirement)}")
             )
           end
@@ -202,13 +268,21 @@ module Dependabot
           raise "Not a semver req!" unless original_line.match?(/#[\^~=<>]/)
 
           original_line.gsub(
-            %(##{old_req.fetch(:requirement)}"),
+            %(##{old_req&.fetch(:requirement)}"),
             %(##{new_req.fetch(:requirement)}")
           )
         end
 
-        def update_package_json_sections(sections, content, old_line,
-                                         new_line)
+        sig do
+          params(
+            sections: T::Array[String],
+            content: String,
+            old_line: String,
+            new_line: String
+          )
+            .returns(String)
+        end
+        def update_package_json_sections(sections, content, old_line, new_line)
           # Currently, Dependabot doesn't update peerDependencies. However,
           # if a development dependency is being updated and its requirement
           # matches the requirement on a peer dependency we probably want to
@@ -218,21 +292,21 @@ module Dependabot
           sections += ["peerDependencies"]
           sections_regex = /#{sections.join('|')}/
 
-          declaration_blocks = []
+          declaration_blocks = T.let([], T::Array[String])
 
           content.scan(/['"]#{sections_regex}['"]\s*:\s*\{/m) do
-            mtch = Regexp.last_match
+            mtch = T.must(Regexp.last_match)
             declaration_blocks <<
-              (mtch.to_s +
-              mtch.post_match[0..closing_bracket_index(mtch.post_match)])
+              (mtch.to_s + T.must(mtch.post_match[0..closing_bracket_index(mtch.post_match)]))
           end
 
           declaration_blocks.reduce(content.dup) do |new_content, block|
             updated_block = block.sub(old_line, new_line)
-            new_content.sub!(block, updated_block)
+            new_content.sub(block, updated_block)
           end
         end
 
+        sig { params(string: String).returns(Integer) }
         def closing_bracket_index(string)
           closes_required = 1
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "uri"
@@ -147,7 +147,8 @@ module Dependabot
           retry_count += 1
           raise if retry_count > 2
 
-          sleep(rand(3.0..10.0)) && retry
+          sleep(rand(3.0..10.0))
+          retry
         end
 
         # rubocop:enable Metrics/PerceivedComplexity

data/lib/dependabot/npm_and_yarn/update_checker/registry_finder.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "excon"
@@ -174,14 +174,14 @@ module Dependabot
 
           registries = []
           npmrc_file.content.scan(NPM_AUTH_TOKEN_REGEX) do
-            next if Regexp.last_match[:registry].include?("${")
+            next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            registry = Regexp.last_match[:registry]
-            token = Regexp.last_match[:token]&.strip
+            registry = T.must(Regexp.last_match)[:registry]
+            token = T.must(Regexp.last_match)[:token]&.strip
 
             registries << {
               "type" => "npm_registry",
-              "registry" => registry.gsub(/\s+/, "%20"),
+              "registry" => registry&.gsub(/\s+/, "%20"),
               "token" => token
             }
           end
@@ -260,9 +260,9 @@ module Dependabot
           registries = []
 
           file.content.scan(syntax) do
-            next if Regexp.last_match[:registry].include?("${")
+            next if Regexp.last_match&.[](:registry)&.include?("${")
 
-            url = Regexp.last_match[:registry].strip
+            url = T.must(T.must(Regexp.last_match)[:registry]).strip
             registry = normalize_configured_registry(url)
             registries << {
               "type" => "npm_registry",
@@ -277,9 +277,9 @@ module Dependabot
 
         def scoped_rc_registry(file, syntax:, scope:)
           file&.content.to_s.scan(syntax) do
-            next if Regexp.last_match[:registry].include?("${") || Regexp.last_match[:scope] != scope
+            next if Regexp.last_match&.[](:registry)&.include?("${") || Regexp.last_match&.[](:scope) != scope
 
-            return Regexp.last_match[:registry].strip
+            return T.must(T.must(Regexp.last_match)[:registry]).strip
           end
 
           nil

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -115,7 +115,8 @@ module Dependabot
           retry_count += 1
           raise if retry_count > 2
 
-          sleep(rand(3.0..10.0)) && retry
+          sleep(rand(3.0..10.0))
+          retry
         end
 
         def run_yarn_berry_updater(path, lockfile_name)

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -1,6 +1,8 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/errors"
 require "dependabot/git_commit_checker"
 require "dependabot/logger"
@@ -21,6 +23,8 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class VersionResolver
+        extend T::Sig
+
         require_relative "latest_version_finder"
 
         TIGHTLY_COUPLED_MONOREPOS = {
@@ -162,6 +166,7 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
         attr_reader :credentials
         attr_reader :dependency_files
@@ -356,32 +361,34 @@ module Dependabot
           []
         end
 
+        # rubocop:disable Metrics/AbcSize
+        sig { params(message: String).returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def handle_peer_dependency_errors(message)
           errors = []
           if message.match?(NPM6_PEER_DEP_ERROR_REGEX)
             message.scan(NPM6_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << Regexp.last_match&.named_captures
             end
           elsif message.match?(NPM8_PEER_DEP_ERROR_REGEX)
             message.scan(NPM8_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_BERRY_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_BERRY_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX)
             message.scan(YARN_BERRY_V4_PEER_DEP_ERROR_REGEX) do
-              errors << Regexp.last_match.named_captures
+              errors << T.must(Regexp.last_match).named_captures
             end
           elsif message.match?(PNPM_PEER_DEP_ERROR_REGEX)
             message.scan(PNPM_PEER_DEP_ERROR_REGEX) do
-              captures = Regexp.last_match.named_captures
-              captures["requiring_dep"].tr!(" ", "@")
+              captures = T.must(Regexp.last_match).named_captures
+              T.must(captures["requiring_dep"]).tr!(" ", "@")
               errors << captures
             end
           else
@@ -389,6 +396,7 @@ module Dependabot
           end
           errors
         end
+        # rubocop:enable Metrics/AbcSize
 
         def unmet_peer_dependencies
           peer_dependency_errors
@@ -650,7 +658,7 @@ module Dependabot
           git_source = dependency.requirements.find { |req| req[:source] && req[:source][:type] == "git" }
 
           if git_source
-            "#{dependency.name}@#{git_req[:source][:url]}##{version}"
+            "#{dependency.name}@#{git_source[:source][:url]}##{version}"
           else
             "#{dependency.name}@#{version}"
           end
@@ -715,7 +723,7 @@ module Dependabot
         end
 
         def version_regex
-          version_class::VERSION_PATTERN
+          Dependabot::NpmAndYarn::Version::VERSION_PATTERN
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.258.0
+  version: 0.260.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-05-16 00:00:00.000000000 Z
+date: 2024-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.258.0
+        version: 0.260.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.258.0
+        version: 0.260.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.258.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.260.0
 post_install_message: 
 rdoc_options: []
 require_paths: