dependabot-npm_and_yarn 0.309.0 → 0.310.0

data/lib/dependabot/npm_and_yarn/metadata_finder.rb

@@ -1,8 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "time"
+require "sorbet-runtime"
 
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
@@ -13,6 +14,9 @@ require "dependabot/npm_and_yarn/version"
 module Dependabot
   module NpmAndYarn
     class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      sig { override.returns(T.nilable(String)) }
       def homepage_url
         # Attempt to use version_listing first, as fetching the entire listing
         # array can be slow (if it's large)
@@ -22,10 +26,11 @@ module Dependabot
         listing&.last&.fetch("homepage", nil) || super
       end
 
+      sig { override.returns(T.nilable(String)) }
       def maintainer_changes
         return unless npm_releaser
         return unless npm_listing.dig("time", dependency.version)
-        return if previous_releasers.include?(npm_releaser)
+        return if previous_releasers&.include?(npm_releaser)
 
         "This version was pushed to npm by " \
           "[#{npm_releaser}](https://www.npmjs.com/~#{npm_releaser}), a new " \
@@ -34,10 +39,11 @@ module Dependabot
 
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         return find_source_from_registry if new_source.nil?
 
-        source_type = new_source[:type] || new_source.fetch("type")
+        source_type = new_source&.[](:type) || new_source&.fetch("type")
 
         case source_type
         when "git" then find_source_from_git_url
@@ -46,12 +52,14 @@ module Dependabot
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def npm_releaser
         all_version_listings
           .find { |v, _| v == dependency.version }
           &.last&.fetch("_npmUser", nil)&.fetch("name", nil)
       end
 
+      sig { returns(T.nilable(T::Array[String])) }
       def previous_releasers
         times = npm_listing.fetch("time")
 
@@ -68,6 +76,7 @@ module Dependabot
           .filter_map { |_, d| d.fetch("_npmUser", nil)&.fetch("name", nil) }
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_registry
         # Attempt to use version_listing first, as fetching the entire listing
         # array can be slow (if it's large)
@@ -92,6 +101,7 @@ module Dependabot
         potential_sources.first
       end
 
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
       def new_source
         sources = dependency.requirements
                             .map { |r| r.fetch(:source) }.uniq.compact
@@ -100,6 +110,12 @@ module Dependabot
         sources.first
       end
 
+      sig do
+        params(
+          details: T.nilable(T.any(String, T::Hash[String, T.untyped]))
+        )
+          .returns(T.nilable(Dependabot::Source))
+      end
       def get_source(details)
         potential_url = get_url(details)
         return unless potential_url
@@ -111,6 +127,12 @@ module Dependabot
         potential_source
       end
 
+      sig do
+        params(
+          details: T.nilable(T.any(String, T::Hash[String, T.untyped]))
+        )
+          .returns(T.nilable(String))
+      end
       def get_url(details)
         url =
           case details
@@ -122,6 +144,12 @@ module Dependabot
         "https://github.com/" + url
       end
 
+      sig do
+        params(
+          details: T.nilable(T.any(String, T::Hash[String, T.untyped]))
+        )
+          .returns(T.nilable(String))
+      end
       def get_directory(details)
         # Only return a directory if it is explicitly specified
         return unless details.is_a?(Hash)
@@ -129,22 +157,27 @@ module Dependabot
         details.fetch("directory", nil)
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        url = new_source[:url] || new_source.fetch("url")
+        url = new_source&.[](:url) || new_source&.fetch("url")
         Source.from_url(url)
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def latest_version_listing
-        return @latest_version_listing if defined?(@latest_version_listing)
+        return @latest_version_listing if defined?(@latest_version_listing) && @latest_version_listing
+
+        @latest_version_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
 
         response = Dependabot::RegistryClient.get(url: "#{dependency_url}/latest", headers: registry_auth_headers)
-        return @latest_version_listing = JSON.parse(response.body) if response.status == 200
+        @latest_version_listing = JSON.parse(response.body) if response.status == 200
 
-        @latest_version_listing = {}
+        @latest_version_listing
       rescue JSON::ParserError, Excon::Error::Timeout
-        @latest_version_listing = {}
+        @latest_version_listing
       end
 
+      sig { returns(T::Array[[String, T::Hash[String, T.untyped]]]) }
       def all_version_listings
         return [] if npm_listing["versions"].nil?
 
@@ -154,28 +187,32 @@ module Dependabot
           .reverse
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def npm_listing
-        return @npm_listing unless @npm_listing.nil?
+        return @npm_listing if defined?(@npm_listing) && @npm_listing
+
+        @npm_listing = T.let({}, T.nilable(T::Hash[String, T.untyped]))
 
         response = Dependabot::RegistryClient.get(url: dependency_url, headers: registry_auth_headers)
-        return @npm_listing = {} if response.status >= 500
+        return T.must(@npm_listing) if response.status >= 500
 
         begin
           @npm_listing = JSON.parse(response.body)
         rescue JSON::ParserError
           raise unless non_standard_registry?
-
-          @npm_listing = {}
         end
+
+        @npm_listing
       rescue Excon::Error::Timeout
-        @npm_listing = {}
+        @npm_listing
       end
 
+      sig { returns(String) }
       def dependency_url
         registry_url =
           if new_source.nil? then "https://registry.npmjs.org"
           else
-            new_source.fetch(:url)
+            new_source&.fetch(:url)
           end
 
         # NPM registries expect slashes to be escaped
@@ -183,19 +220,22 @@ module Dependabot
         "#{registry_url}/#{escaped_dependency_name}"
       end
 
+      sig { returns(T::Hash[String, String]) }
       def registry_auth_headers
         return {} unless auth_token
 
         { "Authorization" => "Bearer #{auth_token}" }
       end
 
+      sig { returns(String) }
       def dependency_registry
         if new_source.nil? then "registry.npmjs.org"
         else
-          new_source.fetch(:url).gsub("https://", "").gsub("http://", "")
+          new_source&.fetch(:url)&.gsub("https://", "")&.gsub("http://", "")
         end
       end
 
+      sig { returns(T.nilable(String)) }
       def auth_token
         credentials
           .select { |cred| cred["type"] == "npm_registry" }
@@ -203,6 +243,7 @@ module Dependabot
           &.fetch("token", nil)
       end
 
+      sig { returns(T::Boolean) }
       def non_standard_registry?
         dependency_registry != "registry.npmjs.org"
       end

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -1,13 +1,19 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module NpmAndYarn
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.helper_path
         "node #{File.join(native_helpers_root, 'run.js')}"
       end
 
+      sig { returns(String) }
       def self.native_helpers_root
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "npm_and_yarn") unless helpers_root.nil?
@@ -15,6 +21,7 @@ module Dependabot
         File.join(__dir__, "../../../helpers")
       end
 
+      sig { params(dependency_names: T::Array[String]).returns(String) }
       def self.run_npm8_subdependency_update_command(dependency_names)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines

data/lib/dependabot/npm_and_yarn/package/registry_finder.rb

@@ -84,7 +84,7 @@ module Dependabot
           end
         end
 
-        sig { params(dependency_name: String).returns(T.nilable(String)) }
+        sig { params(dependency_name: String).returns(String) }
         def registry_from_rc(dependency_name)
           explicit_registry_from_rc(dependency_name) || global_registry
         end

data/lib/dependabot/npm_and_yarn/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -12,16 +12,22 @@ module Dependabot
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
-      AND_SEPARATOR = /(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/
-      OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
+      AND_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/, Regexp)
+      OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
 
       # Override the version pattern to allow a 'v' prefix
       quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
       version_pattern = "v?#{NpmAndYarn::Version::VERSION_PATTERN}"
 
-      PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze
-      PATTERN = /\A#{PATTERN_RAW}\z/
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze, String)
+      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
 
+      sig do
+        params(
+          obj: T.any(String, Gem::Version)
+        )
+          .returns(T::Array[T.any(String, T.nilable(NpmAndYarn::Version))])
+      end
       def self.parse(obj)
         return ["=", nil] if obj.is_a?(String) && Version::VERSION_TAGS.include?(obj.strip)
         return ["=", NpmAndYarn::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
@@ -52,16 +58,18 @@ module Dependabot
         end
       end
 
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
       def initialize(*requirements)
         requirements = requirements.flatten
-                                   .flat_map { |req_string| req_string.split(",").map(&:strip) }
+                                   .flat_map { |req_string| T.must(req_string).split(",").map(&:strip) }
                                    .flat_map { |req_string| convert_js_constraint_to_ruby_constraint(req_string) }
 
-        super(requirements)
+        super
       end
 
       private
 
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
       def convert_js_constraint_to_ruby_constraint(req_string)
         return req_string if req_string.match?(/^([A-Za-uw-z]|v[^\d])/)
 
@@ -79,6 +87,7 @@ module Dependabot
         end
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_tilde_req(req_string)
         version = req_string.gsub(/^~\>?[\s=]*/, "")
         parts = version.split(".")
@@ -86,8 +95,11 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_hyphen_req(req_string)
-        lower_bound, upper_bound = req_string.split(/\s+-\s+/)
+        parts = req_string.split(/\s+-\s+/)
+        lower_bound = T.must(parts[0])
+        upper_bound = T.must(parts[1])
         lower_bound_parts = lower_bound.split(".")
         lower_bound_parts.fill("0", lower_bound_parts.length...3)
 
@@ -105,6 +117,7 @@ module Dependabot
         [">= #{lower_bound_parts.join('.')}", upper_bound_range]
       end
 
+      sig { params(req_string: String).returns(String) }
       def ruby_range(req_string)
         parts = req_string.split(".")
         # If we have three or more parts then this is an exact match
@@ -115,13 +128,14 @@ module Dependabot
         "~> #{parts.join('.')}"
       end
 
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_caret_req(req_string)
         version = req_string.gsub(/^\^[\s=]*/, "")
         parts = version.split(".")
         parts.fill("x", parts.length...3)
         first_non_zero = parts.find { |d| d != "0" }
         first_non_zero_index =
-          first_non_zero ? parts.index(first_non_zero) : parts.count - 1
+          first_non_zero ? T.must(parts.index(first_non_zero)) : parts.count - 1
         # If the requirement has a blank minor or patch version increment the
         # previous index value with 1
         first_non_zero_index -= 1 if first_non_zero == "x"

data/lib/dependabot/npm_and_yarn/update_checker/conflicting_dependency_resolver.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/dependency"
 require "dependabot/errors"
 require "dependabot/logger"
@@ -15,6 +17,15 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       class ConflictingDependencyResolver
+        extend T::Sig
+
+        sig do
+          params(
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependency_files:, credentials:)
           @dependency_files = dependency_files
           @credentials = credentials
@@ -30,6 +41,13 @@ module Dependabot
         #   * name [String] the blocking dependencies name
         #   * version [String] the version of the blocking dependency
         #   * requirement [String] the requirement on the target_dependency
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            target_version: T.nilable(T.any(String, Dependabot::Version))
+          )
+            .returns(T::Array[T::Hash[String, String]])
+        end
         def conflicting_dependencies(dependency:, target_version:)
           SharedHelpers.in_a_temporary_directory do
             dependency_files_builder = DependencyFilesBuilder.new(
@@ -46,16 +64,22 @@ module Dependabot
             # parser doesn't deal with at the moment.
             if dependency_files_builder.package_locks.any? ||
                dependency_files_builder.shrinkwraps.any?
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "npm:findConflictingDependencies",
-                args: [Dir.pwd, dependency.name, target_version.to_s]
+              T.cast(
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "npm:findConflictingDependencies",
+                  args: [Dir.pwd, dependency.name, target_version.to_s]
+                ),
+                T::Array[T::Hash[String, String]]
               )
             else
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "yarn:findConflictingDependencies",
-                args: [Dir.pwd, dependency.name, target_version.to_s]
+              T.cast(
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "yarn:findConflictingDependencies",
+                  args: [Dir.pwd, dependency.name, target_version.to_s]
+                ),
+                T::Array[T::Hash[String, String]]
               )
             end
           end
@@ -65,7 +89,10 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
       end
     end

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater/npmrc_builder"
 require "dependabot/npm_and_yarn/file_updater/package_json_preparer"
 
@@ -8,12 +10,23 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class DependencyFilesBuilder
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependency:, dependency_files:, credentials:)
           @dependency = dependency
           @dependency_files = dependency_files
           @credentials = credentials
         end
 
+        sig { void }
         def write_temporary_dependency_files
           write_lockfiles
 
@@ -31,74 +44,108 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_locks
-          @package_locks ||=
+          @package_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("package-lock.json") }
+            .select { |f| f.name.end_with?("package-lock.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def yarn_locks
-          @yarn_locks ||=
+          @yarn_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("yarn.lock") }
+            .select { |f| f.name.end_with?("yarn.lock") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def pnpm_locks
-          @pnpm_locks ||=
+          @pnpm_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("pnpm-lock.yaml") }
+            .select { |f| f.name.end_with?("pnpm-lock.yaml") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def bun_locks
-          @bun_locks ||=
+          @bun_locks ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("bun.lock") }
+            .select { |f| f.name.end_with?("bun.lock") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def root_yarn_lock
-          @root_yarn_lock ||=
+          @root_yarn_lock ||= T.let(
             dependency_files
-            .find { |f| f.name == "yarn.lock" }
+            .find { |f| f.name == "yarn.lock" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def root_pnpm_lock
-          @root_pnpm_lock ||=
+          @root_pnpm_lock ||= T.let(
             dependency_files
-            .find { |f| f.name == "pnpm-lock.yaml" }
+            .find { |f| f.name == "pnpm-lock.yaml" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def root_bun_lock
-          @root_bun_lock ||=
+          @root_bun_lock ||= T.let(
             dependency_files
-            .find { |f| f.name == "bun.lock" }
+            .find { |f| f.name == "bun.lock" },
+            T.nilable(Dependabot::DependencyFile)
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def shrinkwraps
-          @shrinkwraps ||=
+          @shrinkwraps ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("npm-shrinkwrap.json") }
+            .select { |f| f.name.end_with?("npm-shrinkwrap.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def lockfiles
           [*package_locks, *shrinkwraps, *yarn_locks, *pnpm_locks, *bun_locks]
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_files
-          @package_files ||=
+          @package_files ||= T.let(
             dependency_files
-            .select { |f| f.name.end_with?("package.json") }
+            .select { |f| f.name.end_with?("package.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig { void }
         def write_lockfiles
           yarn_locks.each do |f|
             FileUtils.mkdir_p(Pathname.new(f.name).dirname)
-            File.write(f.name, prepared_yarn_lockfile_content(f.content))
+            File.write(f.name, prepared_yarn_lockfile_content(T.must(f.content)))
           end
 
           [*package_locks, *shrinkwraps, *pnpm_locks, *bun_locks].each do |f|
@@ -107,13 +154,16 @@ module Dependabot
           end
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T::Boolean) }
         def yarnrc_specifies_private_reg?
           return false unless yarnrc_file
 
           regex = Package::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
           yarnrc_global_registry =
-            yarnrc_file.content
-                       .lines.find { |line| line.match?(regex) }
+            yarnrc_file&.content
+                       &.lines
+                       &.find { |line| line.match?(regex) }
                        &.match(regex)
                        &.named_captures
                        &.fetch("registry")
@@ -124,20 +174,24 @@ module Dependabot
             r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         # Duplicated in NpmLockfileUpdater
         # Remove the dependency we want to update from the lockfile and let
         # yarn find the latest resolvable version and fix the lockfile
+        sig { params(content: String).returns(String) }
         def prepared_yarn_lockfile_content(content)
           content.gsub(/^#{Regexp.quote(dependency.name)}\@.*?\n\n/m, "")
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def prepared_package_json_content(file)
           NpmAndYarn::FileUpdater::PackageJsonPreparer.new(
-            package_json_content: file.content
+            package_json_content: T.must(file.content)
           ).prepared_content
         end
 
+        sig { returns(String) }
         def npmrc_content
           NpmAndYarn::FileUpdater::NpmrcBuilder.new(
             credentials: credentials,
@@ -145,10 +199,12 @@ module Dependabot
           ).npmrc_content
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_file
           dependency_files.find { |f| f.name == ".yarnrc" }
         end
 
+        sig { returns(String) }
         def yarnrc_content
           NpmAndYarn::FileUpdater::NpmrcBuilder.new(
             credentials: credentials,
@@ -156,12 +212,14 @@ module Dependabot
           ).yarnrc_content
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def yarnrc_yml_file
           dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
         end
 
+        sig { returns(T.nilable(String)) }
         def yarnrc_yml_content
-          yarnrc_yml_file.content
+          yarnrc_yml_file&.content
         end
       end
     end