dependabot-npm_and_yarn 0.309.0 → 0.311.0

data/lib/dependabot/npm_and_yarn/update_checker/library_detector.rb

@@ -1,7 +1,9 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/shared_helpers"
 
@@ -9,12 +11,23 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class LibraryDetector
+        extend T::Sig
+
+        sig do
+          params(
+            package_json_file: Dependabot::DependencyFile,
+            credentials: T::Array[Dependabot::Credential],
+            dependency_files: T::Array[Dependabot::DependencyFile]
+          )
+            .void
+        end
         def initialize(package_json_file:, credentials:, dependency_files:)
           @package_json_file = package_json_file
           @credentials = credentials
           @dependency_files = dependency_files
         end
 
+        sig { returns(T::Boolean) }
         def library?
           return false unless package_json_may_be_for_library?
 
@@ -23,26 +36,36 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::DependencyFile) }
         attr_reader :package_json_file
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
+        sig { returns(T::Boolean) }
         def package_json_may_be_for_library?
           return false unless project_name
-          return false if project_name.match?(/\{\{.*\}\}/)
+          return false if T.must(project_name).match?(/\{\{.*\}\}/)
           return false unless parsed_package_json["version"]
           return false if parsed_package_json["private"]
 
           true
         end
 
+        sig { returns(T::Boolean) }
         def npm_response_matches_package_json?
           project_description = parsed_package_json["description"]
           return false unless project_description
 
           # Check if the project is listed on npm. If it is, it's a library
           url = "#{registry.chomp('/')}/#{escaped_project_name}"
-          @project_npm_response ||= Dependabot::RegistryClient.get(url: url)
+          @project_npm_response ||= T.let(
+            Dependabot::RegistryClient.get(url: url),
+            T.nilable(Excon::Response)
+          )
           return false unless @project_npm_response.status == 200
 
           @project_npm_response.body.dup.force_encoding("UTF-8").encode
@@ -51,18 +74,25 @@ module Dependabot
           false
         end
 
+        sig { returns(T.nilable(String)) }
         def project_name
           parsed_package_json.fetch("name", nil)
         end
 
+        sig { returns(T.nilable(String)) }
         def escaped_project_name
           project_name&.gsub("/", "%2F")
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_package_json
-          @parsed_package_json ||= JSON.parse(package_json_file.content)
+          @parsed_package_json ||= T.let(
+            JSON.parse(T.must(package_json_file.content)),
+            T.nilable(T::Hash[String, T.untyped])
+          )
         end
 
+        sig { returns(String) }
         def registry
           Package::RegistryFinder.new(
             dependency: nil,
@@ -70,7 +100,7 @@ module Dependabot
             npmrc_file: dependency_files.find { |f| f.name.end_with?(".npmrc") },
             yarnrc_file: dependency_files.find { |f| f.name.end_with?(".yarnrc") },
             yarnrc_yml_file: dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
-          ).registry_from_rc(project_name)
+          ).registry_from_rc(T.must(project_name))
         end
       end
     end

data/lib/dependabot/npm_and_yarn/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 ################################################################################
@@ -6,6 +6,8 @@
 # https://docs.npmjs.com/misc/semver                                           #
 ################################################################################
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/requirement"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/version"
@@ -15,6 +17,8 @@ module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class RequirementsUpdater
+        extend T::Sig
+
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/
         SEPARATOR = /(?<=[a-zA-Z0-9*])[\s|]+(?![\s|-])/
         ALLOWED_UPDATE_STRATEGIES = T.let(
@@ -27,8 +31,16 @@ module Dependabot
           T::Array[Dependabot::RequirementsUpdateStrategy]
         )
 
-        def initialize(requirements:, updated_source:, update_strategy:,
-                       latest_resolvable_version:)
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            updated_source: T.nilable(T::Hash[Symbol, T.untyped]),
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            latest_resolvable_version: T.nilable(T.any(String, Gem::Version))
+          )
+            .void
+        end
+        def initialize(requirements:, updated_source:, update_strategy:, latest_resolvable_version:)
           @requirements = requirements
           @updated_source = updated_source
           @update_strategy = update_strategy
@@ -37,10 +49,13 @@ module Dependabot
 
           return unless latest_resolvable_version
 
-          @latest_resolvable_version =
-            version_class.new(latest_resolvable_version)
+          @latest_resolvable_version = T.let(
+            version_class.new(latest_resolvable_version),
+            NpmAndYarn::Version
+          )
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -62,17 +77,26 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         attr_reader :requirements
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         attr_reader :updated_source
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T.nilable(NpmAndYarn::Version)) }
         attr_reader :latest_resolvable_version
 
+        sig { void }
         def check_update_strategy
           return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
 
           raise "Unknown update strategy: #{update_strategy}"
         end
 
+        sig { returns(T::Boolean) }
         def updating_from_git_to_npm?
           return false unless updated_source.nil?
 
@@ -80,6 +104,7 @@ module Dependabot
           original_source&.fetch(:type) == "git"
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def initial_req_after_source_change(req)
           return req unless updating_from_git_to_npm?
           return req unless req[:requirement].nil?
@@ -87,12 +112,13 @@ module Dependabot
           req.merge(requirement: "^#{latest_resolvable_version}")
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_version_requirement(req)
           current_requirement = req[:requirement]
 
           if current_requirement.match?(/(<|-\s)/i)
             ruby_req = ruby_requirements(current_requirement).first
-            return req if ruby_req.satisfied_by?(latest_resolvable_version)
+            return req if ruby_req&.satisfied_by?(latest_resolvable_version)
 
             updated_req = update_range_requirement(current_requirement)
             return req.merge(requirement: updated_req)
@@ -102,6 +128,7 @@ module Dependabot
           req.merge(requirement: update_version_string(reqs.first))
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_version_requirement_if_needed(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -113,6 +140,7 @@ module Dependabot
           update_version_requirement(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_requirement(req)
           current_requirement = req[:requirement]
           version = latest_resolvable_version
@@ -135,22 +163,25 @@ module Dependabot
           req.merge(requirement: updated_requirement)
         end
 
+        sig { params(requirement_string: String).returns(T::Array[NpmAndYarn::Requirement]) }
         def ruby_requirements(requirement_string)
           NpmAndYarn::Requirement
             .requirements_array(requirement_string)
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_range_requirement(req_string)
           range_requirements =
             req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s+-\s+)/) }
 
           if range_requirements.count == 1
-            range_requirement = range_requirements.first
+            range_requirement = T.must(range_requirements.first)
             versions = range_requirement.scan(VERSION_REGEX)
-            upper_bound = versions.map { |v| version_class.new(v) }.max
+            version_objects = versions.map { |v| version_class.new(v.to_s) }
+            upper_bound = T.must(version_objects.max)
             new_upper_bound = update_greatest_version(
-              upper_bound,
-              latest_resolvable_version
+              upper_bound.to_s,
+              T.must(latest_resolvable_version)
             )
 
             req_string.sub(
@@ -158,45 +189,51 @@ module Dependabot
               new_upper_bound.to_s
             )
           else
-            req_string + " || ^#{latest_resolvable_version}"
+            req_string + " || ^#{T.must(latest_resolvable_version)}"
           end
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_version_string(req_string)
           req_string
             .sub(VERSION_REGEX) do |old_version|
               if old_version.match?(/\d-/) ||
-                 latest_resolvable_version.to_s.match?(/\d-/)
-                latest_resolvable_version.to_s
+                 T.must(latest_resolvable_version).to_s.match?(/\d-/)
+                T.must(latest_resolvable_version).to_s
               else
                 old_parts = old_version.split(".")
-                new_parts = latest_resolvable_version.to_s.split(".")
-                                                     .first(old_parts.count)
+                new_parts = T.must(latest_resolvable_version).to_s.split(".")
+                             .first(old_parts.count)
                 new_parts.map.with_index do |part, i|
-                  old_parts[i].match?(/^x\b/) ? "x" : part
+                  old_parts[i]&.match?(/^x\b/) ? "x" : part
                 end.join(".")
               end
             end
         end
 
+        sig { params(old_version: String, version_to_be_permitted: NpmAndYarn::Version).returns(String) }
         def update_greatest_version(old_version, version_to_be_permitted)
           version = version_class.new(old_version)
           version = version.release if version.prerelease?
 
           index_to_update =
-            version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+            version.segments.map.with_index { |seg, i| T.cast(seg, Integer).zero? ? 0 : i }.max || 0
 
           version.segments.map.with_index do |_, index|
-            if index < index_to_update
-              version_to_be_permitted.segments[index]
-            elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
-            else
-              0
-            end
+            segment_value =
+              if index < index_to_update
+                T.cast(version_to_be_permitted.segments[index], Integer)
+              elsif index == index_to_update
+                # Cast to Integer before adding 1 to ensure correct type
+                T.cast(version_to_be_permitted.segments[index], Integer) + 1
+              else
+                0
+              end
+            segment_value.to_s
           end.join(".")
         end
 
+        sig { returns(T.class_of(NpmAndYarn::Version)) }
         def version_class
           NpmAndYarn::Version
         end

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -12,11 +12,42 @@ require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/npm_and_yarn/update_checker/dependency_files_builder"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/shared_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
     class UpdateChecker
       class SubdependencyVersionResolver
+        extend T::Sig
+
+        sig { returns(Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
+        attr_reader :latest_allowable_version
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
+
+        sig do
+          params(
+            dependency: Dependency,
+            credentials: T::Array[Dependabot::Credential],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            ignored_versions: T::Array[String],
+            latest_allowable_version: T.nilable(T.any(String, Gem::Version)),
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
         def initialize(dependency:, credentials:, dependency_files:,
                        ignored_versions:, latest_allowable_version:, repo_contents_path:)
           @dependency = dependency
@@ -27,11 +58,12 @@ module Dependabot
           @repo_contents_path = repo_contents_path
         end
 
+        sig { returns(T.nilable(T.any(String, Gem::Version))) }
         def latest_resolvable_version
           raise "Not a subdependency!" if dependency.requirements.any?
           return if bundled_dependency?
 
-          base_dir = dependency_files.first.directory
+          base_dir = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             dependency_files_builder.write_temporary_dependency_files
 
@@ -53,13 +85,7 @@ module Dependabot
 
         private
 
-        attr_reader :dependency
-        attr_reader :credentials
-        attr_reader :dependency_files
-        attr_reader :ignored_versions
-        attr_reader :latest_allowable_version
-        attr_reader :repo_contents_path
-
+        sig { params(lockfile: Dependabot::DependencyFile).returns(String) }
         def update_subdependency_in_lockfile(lockfile)
           lockfile_name = Pathname.new(lockfile.name).basename.to_s
           path = Pathname.new(lockfile.name).dirname.to_s
@@ -72,7 +98,7 @@ module Dependabot
                             run_pnpm_updater(path, lockfile_name)
                           elsif lockfile.name.end_with?("bun.lock")
                             run_bun_updater(path, lockfile_name)
-                          elsif !Helpers.npm8?(lockfile)
+                          elsif !Helpers.parse_npm8?(lockfile)
                             run_npm6_updater(path, lockfile_name)
                           else
                             run_npm_updater(path, lockfile_name)
@@ -81,6 +107,7 @@ module Dependabot
           updated_files.fetch(lockfile_name)
         end
 
+        sig { params(updated_lockfiles: T::Array[Dependabot::DependencyFile]).returns(T.nilable(Gem::Version)) }
         def version_from_updated_lockfiles(updated_lockfiles)
           updated_files = dependency_files -
                           dependency_files_builder.lockfiles +
@@ -96,13 +123,17 @@ module Dependabot
           version_class.new(updated_version)
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_yarn_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
-              SharedHelpers.run_helper_subprocess(
-                command: NativeHelpers.helper_path,
-                function: "yarn:updateSubdependency",
-                args: [Dir.pwd, lockfile_name, [dependency.to_h]]
+              T.cast(
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "yarn:updateSubdependency",
+                  args: [Dir.pwd, lockfile_name, [dependency.to_h]]
+                ),
+                T::Hash[String, String]
               )
             end
           end
@@ -121,6 +152,7 @@ module Dependabot
           retry
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_yarn_berry_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -133,6 +165,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_pnpm_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -145,6 +178,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_npm_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -155,6 +189,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_bun_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -167,6 +202,7 @@ module Dependabot
           end
         end
 
+        sig { params(path: String, lockfile_name: String).returns(T::Hash[String, String]) }
         def run_npm6_updater(path, lockfile_name)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
@@ -179,53 +215,46 @@ module Dependabot
           end
         end
 
+        sig { returns(T.class_of(Dependabot::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(Dependabot::Dependency) }
         def updated_dependency
           Dependabot::Dependency.new(
             name: dependency.name,
-            version: latest_allowable_version,
+            version: T.cast(latest_allowable_version, T.nilable(T.any(String, Dependabot::Version))),
             previous_version: dependency.version,
             requirements: [],
             package_manager: dependency.package_manager
           )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def filtered_lockfiles
-          @filtered_lockfiles ||=
+          @filtered_lockfiles ||= T.let(
             SubDependencyFilesFilterer.new(
               dependency_files: dependency_files,
               updated_dependencies: [updated_dependency]
-            ).files_requiring_update
+            ).files_requiring_update,
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(Dependabot::NpmAndYarn::UpdateChecker::DependencyFilesBuilder) }
         def dependency_files_builder
-          @dependency_files_builder ||=
+          @dependency_files_builder ||= T.let(
             DependencyFilesBuilder.new(
               dependency: dependency,
               dependency_files: dependency_files,
               credentials: credentials
-            )
-        end
-
-        # TODO: We should try and fix this by updating the parent that's not
-        # bundled. For this case: `chokidar > fsevents > node-pre-gyp > tar` we
-        # would need to update `fsevents`
-        #
-        # We shouldn't update bundled sub-dependencies as they have been bundled
-        # into the release at an exact version by a parent using
-        # `bundledDependencies`.
-        #
-        # For example, fsevents < 2 bundles node-pre-gyp meaning all it's
-        # sub-dependencies get bundled into the release tarball at publish time
-        # so you always get the same sub-dependency versions if you re-install a
-        # specific version of fsevents.
-        #
-        # Updating the sub-dependency by deleting the entry works but it gets
-        # removed from the bundled set of dependencies and moved top level
-        # resulting in a bunch of package duplication which is pretty confusing.
+            ),
+            T.nilable(Dependabot::NpmAndYarn::UpdateChecker::DependencyFilesBuilder)
+          )
+        end
+
+        sig { returns(T::Boolean) }
         def bundled_dependency?
           dependency.subdependency_metadata
                     &.any? { |h| h.fetch(:npm_bundled, false) } ||

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -825,7 +825,7 @@ module Dependabot
                 f.name == [path, "package-lock.json"].join("/").sub(%r{\A.?\/}, "")
               end
 
-              return run_npm8_checker(version: version) if Dependabot::NpmAndYarn::Helpers.npm8?(package_lock)
+              return run_npm8_checker(version: version) if Dependabot::NpmAndYarn::Helpers.parse_npm8?(package_lock)
 
               SharedHelpers.run_helper_subprocess(
                 command: NativeHelpers.helper_path,