dependabot-npm_and_yarn 0.309.0 → 0.310.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 654bda07376dec9e868f07e36470b6cf1a972402825d7b1c38ac526b3ffe2c97
-  data.tar.gz: 640ee97a0a8b68227d475b511866578ddbabc4300b65153f9d793e44816c3c8d
+  metadata.gz: 9a5cb78b6d6b57d7c62cd5ab60e63db0848277800d48ce32d3a6ea35d06955e9
+  data.tar.gz: 5180f0822f3bc3588db82562bc9273841651748b92a216aae5e94670e2efe916
 SHA512:
-  metadata.gz: 7d90cf279e19ce426628c3f7296f5178794bafd7c8d681235aee2bbf6c7f7d7b1ff84483cc18f9faf47943b9ccab25bb77504977f458f3423a0e2101716b2ba6
-  data.tar.gz: bf955d3e9b54a5b99de7a1d7bb8f4c03cdfd8efed54cbf06c19977e083cfe1f3a2e6f72b8b72fd42df3f8e382f5359c5e910c011a0ac0a85a15a13a1442701dc
+  metadata.gz: 53a449f37470153cd80797d0fa6e6a8f48eb2eb3908d89e9b3f2e0f6217ec2eeca704638022525c2b1454919ee439c17221dc707a288628f398d1a43a84fb3d3
+  data.tar.gz: 60886b10224dcb526953f150f591e814c5333be22747cad39c8b2bee03122b64b252b8846b580d83493de5d9bc0dbd3bb8a80efbb21cc65737eb24dd0da31ab7

data/lib/dependabot/npm_and_yarn/file_parser/pnpm_lock.rb

@@ -1,42 +1,61 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/errors"
+require "dependabot/dependency"
+require "dependabot/file_parsers/base"
+require "dependabot/npm_and_yarn/native_helpers"
+require "dependabot/shared_helpers"
 
 module Dependabot
   module NpmAndYarn
     class FileParser < Dependabot::FileParsers::Base
       class PnpmLock
+        extend T::Sig
+
+        sig { params(dependency_file: Dependabot::DependencyFile).void }
         def initialize(dependency_file)
           @dependency_file = dependency_file
         end
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def parsed
-          @parsed ||= SharedHelpers.in_a_temporary_directory do
-            File.write("pnpm-lock.yaml", @dependency_file.content)
-
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
-              function: "pnpm:parseLockfile",
-              args: [Dir.pwd]
-            )
-          rescue SharedHelpers::HelperSubprocessFailed
-            raise Dependabot::DependencyFileNotParseable, @dependency_file.path
-          end
+          @parsed ||= T.let(
+            T.cast(
+              SharedHelpers.in_a_temporary_directory do
+                File.write("pnpm-lock.yaml", @dependency_file.content)
+
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "pnpm:parseLockfile",
+                  args: [Dir.pwd]
+                )
+              rescue SharedHelpers::HelperSubprocessFailed
+                raise Dependabot::DependencyFileNotParseable, @dependency_file.path
+              end,
+              T::Array[T::Hash[String, T.untyped]]
+            ),
+            T.nilable(T::Array[T::Hash[String, T.untyped]])
+          )
         end
 
+        # rubocop:disable Metrics/MethodLength
+        # rubocop:disable Metrics/AbcSize
+        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
           # Separate dependencies into two categories: with specifiers and without specifiers.
-          dependencies_with_specifiers = [] # Main dependencies with specifiers.
-          dependencies_without_specifiers = [] # Subdependencies without specifiers.
+          dependencies_with_specifiers = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
+          dependencies_without_specifiers = T.let([], T::Array[T::Hash[Symbol, T.untyped]])
 
           parsed.each do |details|
             next if details["aliased"]
 
-            name = details["name"]
-            version = details["version"]
+            name = T.cast(details["name"], String)
+            version = T.cast(details["version"], T.nilable(String))
 
             dependency_args = {
               name: name,
@@ -58,16 +77,38 @@ module Dependabot
 
           # Add prioritized dependencies to the dependency set.
           dependencies_with_specifiers.each do |dependency_args|
-            dependency_set << Dependency.new(**dependency_args)
+            dependency_set << Dependency.new(
+              name: dependency_args[:name],
+              version: dependency_args[:version],
+              package_manager: dependency_args[:package_manager],
+              requirements: dependency_args[:requirements],
+              subdependency_metadata: dependency_args[:subdependency_metadata]
+            )
           end
 
           dependencies_without_specifiers.each do |dependency_args|
-            dependency_set << Dependency.new(**dependency_args)
+            dependency_set << Dependency.new(
+              name: dependency_args[:name],
+              version: dependency_args[:version],
+              package_manager: dependency_args[:package_manager],
+              requirements: dependency_args[:requirements],
+              subdependency_metadata: dependency_args[:subdependency_metadata]
+            )
           end
 
           dependency_set
         end
-
+        # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/MethodLength
+
+        sig do
+          params(
+            dependency_name: String,
+            requirement: T.nilable(String),
+            _manifest_name: T.nilable(String)
+          )
+            .returns(T.nilable(T::Hash[String, T.untyped]))
+        end
         def details(dependency_name, requirement, _manifest_name)
           details_candidates = parsed.select { |info| info["name"] == dependency_name }
 

data/lib/dependabot/npm_and_yarn/file_parser/yarn_lock.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/shared_helpers"
@@ -10,28 +10,39 @@ module Dependabot
   module NpmAndYarn
     class FileParser < Dependabot::FileParsers::Base
       class YarnLock
+        extend T::Sig
+
+        sig { params(dependency_file: Dependabot::DependencyFile).void }
         def initialize(dependency_file)
           @dependency_file = dependency_file
         end
 
+        sig { returns(T::Hash[String, T::Hash[String, T.untyped]]) }
         def parsed
-          @parsed ||= SharedHelpers.in_a_temporary_directory do
-            File.write("yarn.lock", @dependency_file.content)
+          @parsed ||= T.let(
+            T.cast(
+              SharedHelpers.in_a_temporary_directory do
+                File.write("yarn.lock", @dependency_file.content)
 
-            SharedHelpers.run_helper_subprocess(
-              command: NativeHelpers.helper_path,
-              function: "yarn:parseLockfile",
-              args: [Dir.pwd]
-            )
-          rescue SharedHelpers::HelperSubprocessFailed => e
-            raise Dependabot::OutOfDisk, e.message if e.message.end_with?("No space left on device")
-            raise Dependabot::OutOfDisk, e.message if e.message.end_with?("Out of diskspace")
-            raise Dependabot::OutOfMemory, e.message if e.message.end_with?("MemoryError")
+                SharedHelpers.run_helper_subprocess(
+                  command: NativeHelpers.helper_path,
+                  function: "yarn:parseLockfile",
+                  args: [Dir.pwd]
+                )
+              rescue SharedHelpers::HelperSubprocessFailed => e
+                raise Dependabot::OutOfDisk, e.message if e.message.end_with?("No space left on device")
+                raise Dependabot::OutOfDisk, e.message if e.message.end_with?("Out of diskspace")
+                raise Dependabot::OutOfMemory, e.message if e.message.end_with?("MemoryError")
 
-            raise Dependabot::DependencyFileNotParseable, @dependency_file.path
-          end
+                raise Dependabot::DependencyFileNotParseable, @dependency_file.path
+              end,
+              T::Hash[String, T::Hash[String, T.untyped]]
+            ),
+            T.nilable(T::Hash[String, T::Hash[String, T.untyped]])
+          )
         end
 
+        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def dependencies
           dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
@@ -44,7 +55,7 @@ module Dependabot
               next if req == "__metadata"
 
               dependency_set << Dependency.new(
-                name: req.split(/(?<=\w)\@/).first,
+                name: T.must(req.split(/(?<=\w)\@/).first),
                 version: version.to_s,
                 package_manager: "npm_and_yarn",
                 requirements: []
@@ -55,6 +66,14 @@ module Dependabot
           dependency_set
         end
 
+        sig do
+          params(
+            dependency_name: String,
+            requirement: T.nilable(String),
+            _manifest_name: T.untyped
+          )
+            .returns(T.nilable(T::Hash[String, T.untyped]))
+        end
         def details(dependency_name, requirement, _manifest_name)
           details_candidates =
             parsed
@@ -63,7 +82,7 @@ module Dependabot
           # If there's only one entry for this dependency, use it, even if
           # the requirement in the lockfile doesn't match
           if details_candidates.one?
-            details_candidates.first.last
+            T.must(details_candidates.first).last
           else
             details_candidates.find do |k, _|
               k.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
@@ -73,10 +92,12 @@ module Dependabot
 
         private
 
+        sig { params(requirement: String).returns(T::Boolean) }
         def alias_package?(requirement)
           requirement.match?(/@npm:(.+@(?!npm))/)
         end
 
+        sig { params(requirement: String).returns(T::Boolean) }
         def workspace_package?(requirement)
           requirement.include?("@workspace:")
         end

data/lib/dependabot/npm_and_yarn/file_updater/bun_lockfile_updater.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
@@ -10,9 +12,20 @@ module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
       class BunLockfileUpdater
+        extend T::Sig
+
         require_relative "npmrc_builder"
         require_relative "package_json_updater"
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            repo_contents_path: String,
+            credentials: T::Array[Dependabot::Credential]
+          )
+            .void
+        end
         def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
@@ -20,9 +33,10 @@ module Dependabot
           @credentials = credentials
         end
 
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def updated_bun_lock_content(bun_lock)
-          @updated_bun_lock_content ||= {}
-          return @updated_bun_lock_content[bun_lock.name] if @updated_bun_lock_content[bun_lock.name]
+          @updated_bun_lock_content ||= T.let({}, T.nilable(T::Hash[String, String]))
+          return T.must(@updated_bun_lock_content[bun_lock.name]) if @updated_bun_lock_content[bun_lock.name]
 
           new_content = run_bun_update(bun_lock: bun_lock)
           @updated_bun_lock_content[bun_lock.name] = new_content
@@ -32,19 +46,30 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(String) }
         attr_reader :repo_contents_path
-        attr_reader :credentials
 
-        ERR_PATTERNS = {
-          /get .* 404/i => Dependabot::DependencyNotFound,
-          /installfailed cloning repository/i => Dependabot::DependencyNotFound,
-          /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
-          /no version matching/i => Dependabot::DependencyFileNotResolvable,
-          /failed to resolve/i => Dependabot::DependencyFileNotResolvable
-        }.freeze
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
 
+        ERR_PATTERNS = T.let(
+          {
+            /get .* 404/i => Dependabot::DependencyNotFound,
+            /installfailed cloning repository/i => Dependabot::DependencyNotFound,
+            /file:.* failed to resolve/i => Dependabot::DependencyNotFound,
+            /no version matching/i => Dependabot::DependencyFileNotResolvable,
+            /failed to resolve/i => Dependabot::DependencyFileNotResolvable
+          }.freeze,
+          T::Hash[Regexp, Dependabot::DependabotError]
+        )
+
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def run_bun_update(bun_lock:)
           SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             File.write(".npmrc", npmrc_content(bun_lock))
@@ -61,6 +86,7 @@ module Dependabot
           end
         end
 
+        sig { void }
         def run_bun_updater
           dependency_updates = dependencies.map do |d|
             "#{d.name}@#{d.version}"
@@ -72,14 +98,16 @@ module Dependabot
           )
         end
 
+        sig { void }
         def run_bun_install
           Helpers.run_bun_command(
             "install --save-text-lockfile"
           )
         end
 
+        sig { params(lockfile: Dependabot::DependencyFile).returns(T::Array[Dependabot::Dependency]) }
         def lockfile_dependencies(lockfile)
-          @lockfile_dependencies ||= {}
+          @lockfile_dependencies ||= T.let({}, T.nilable(T::Hash[String, T::Array[Dependabot::Dependency]]))
           @lockfile_dependencies[lockfile.name] ||=
             NpmAndYarn::FileParser.new(
               dependency_files: [lockfile, *package_files],
@@ -88,6 +116,7 @@ module Dependabot
             ).parse
         end
 
+        sig { params(error: Dependabot::DependabotError, _bun_lock: Dependabot::DependencyFile).returns(T.noreturn) }
         def handle_bun_lock_updater_error(error, _bun_lock)
           error_message = error.message
 
@@ -98,6 +127,7 @@ module Dependabot
           raise error
         end
 
+        sig { void }
         def write_final_package_json_files
           package_files.each do |file|
             path = file.name
@@ -106,6 +136,7 @@ module Dependabot
           end
         end
 
+        sig { params(bun_lock: Dependabot::DependencyFile).returns(String) }
         def npmrc_content(bun_lock)
           NpmrcBuilder.new(
             credentials: credentials,
@@ -114,27 +145,37 @@ module Dependabot
           ).npmrc_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def updated_package_json_content(file)
-          @updated_package_json_content ||= {}
+          @updated_package_json_content ||= T.let({}, T.nilable(T::Hash[String, String]))
           @updated_package_json_content[file.name] ||=
-            PackageJsonUpdater.new(
-              package_json: file,
-              dependencies: dependencies
-            ).updated_package_json.content
+            T.must(
+              PackageJsonUpdater.new(
+                package_json: file,
+                dependencies: dependencies
+              ).updated_package_json.content
+            )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def package_files
-          @package_files ||= dependency_files.select { |f| f.name.end_with?("package.json") }
+          @package_files ||= T.let(
+            dependency_files.select { |f| f.name.end_with?("package.json") },
+            T.nilable(T::Array[Dependabot::DependencyFile])
+          )
         end
 
+        sig { returns(String) }
         def base_dir
-          dependency_files.first.directory
+          T.must(dependency_files.first).directory
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def npmrc_file
           dependency_files.find { |f| f.name == ".npmrc" }
         end
 
+        sig { params(message: String).returns(String) }
         def sanitize_message(message)
           message.gsub(/"|\[|\]|\}|\{/, "")
         end

data/lib/dependabot/npm_and_yarn/file_updater/package_json_preparer.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/file_parser"
 
@@ -8,10 +10,14 @@ module Dependabot
   module NpmAndYarn
     class FileUpdater < Dependabot::FileUpdaters::Base
       class PackageJsonPreparer
+        extend T::Sig
+
+        sig { params(package_json_content: String).void }
         def initialize(package_json_content:)
           @package_json_content = package_json_content
         end
 
+        sig { returns(String) }
         def prepared_content
           content = package_json_content
           content = replace_ssh_sources(content)
@@ -20,6 +26,7 @@ module Dependabot
           content
         end
 
+        sig { params(content: String).returns(String) }
         def replace_ssh_sources(content)
           updated_content = content
 
@@ -33,6 +40,7 @@ module Dependabot
 
         # A bug prevents Yarn recognising that a directory is part of a
         # workspace if it is specified with a `./` prefix.
+        sig { params(content: String).returns(String) }
         def remove_workspace_path_prefixes(content)
           json = JSON.parse(content)
           return content unless json.key?("workspaces")
@@ -52,6 +60,7 @@ module Dependabot
           JSON.pretty_generate(json)
         end
 
+        sig { params(content: String).returns(String) }
         def remove_invalid_characters(content)
           content
             .gsub(/\{\{[^\}]*?\}\}/, "something") # {{ nm }} syntax not allowed
@@ -59,28 +68,31 @@ module Dependabot
             .gsub(%r{^\s*//.*}, " ") # comments are not allowed
         end
 
+        sig { returns(T::Array[String]) }
         def swapped_ssh_requirements
           git_ssh_requirements_to_swap
         end
 
         private
 
+        sig { returns(String) }
         attr_reader :package_json_content
 
+        sig { returns(T::Array[String]) }
         def git_ssh_requirements_to_swap
           return @git_ssh_requirements_to_swap if @git_ssh_requirements_to_swap
 
-          @git_ssh_requirements_to_swap = []
+          @git_ssh_requirements_to_swap = T.let([], T.nilable(T::Array[String]))
 
           NpmAndYarn::FileParser.each_dependency(JSON.parse(package_json_content)) do |_, req, _t|
             next unless req.is_a?(String)
             next unless req.start_with?("git+ssh:")
 
             req = req.split("#").first
-            @git_ssh_requirements_to_swap << req
+            T.must(@git_ssh_requirements_to_swap) << T.must(req)
           end
 
-          @git_ssh_requirements_to_swap
+          T.must(@git_ssh_requirements_to_swap)
         end
       end
     end