dependabot-npm_and_yarn 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1481759eec408f64e482e4e1bceaafa4aa734e83b2460268619b621f839e1c5d
-  data.tar.gz: b24446bf888aaf2aa608de5c691a52a6b2b6baf7c55e44e6f25cf34f9bc3e235
+  metadata.gz: 3d36a6e6eb18ebce010518361fb49966de62ff78dd9da7a13f14c59aaedf5e7a
+  data.tar.gz: 7ed614ce2517bd8a198deb502ab46635a5019a810224ec0bbaed0066fc9e51c9
 SHA512:
-  metadata.gz: 72c68a5ce7135a4b460124b84bfdfd0fa4c4a8d936e6f2047c1f83ae12563d8f86d3ac713e34abf8c800e637453d191262f414dad8c2b9bb00525e8131b257cd
-  data.tar.gz: 567ca2b4fa3395a62554d4ab8a06e9e37377e681e3d4f91b16b52bce7fafbf58c5723c2be443246fa89e691cbddb466fe05d89564af384a2605da685a0d83ce8
+  metadata.gz: 58cf8b10de32b220cd9d72785b267d4f2d1a4d629d24cbe5c718c42b88354b1e42d75ecce54ed339394427ff9be8a99c3302db44aabd21f09df21a73c1b7158a
+  data.tar.gz: f4a98484a049955ae19f3db664bb7a760e345a14c7db2452f179dedbd242e1925afe6efdc2b1bc51607442e571d06f245644a78eca68fbc9772b244fbbacde1f

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -104,8 +104,7 @@ module Dependabot
 
         # Filter excluded files from final collection
         filtered_files = fetched_files.uniq.reject do |file|
-          Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-            !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(file.name, @exclude_paths)
+          !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(file.name, @exclude_paths)
         end
 
         filtered_files
@@ -486,8 +485,7 @@ module Dependabot
           next if fetched_files.map(&:name).include?(cleaned_name)
 
           # Skip excluded path dependencies
-          if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-             !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(cleaned_name, @exclude_paths)
+          if !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(cleaned_name, @exclude_paths)
             Dependabot.logger.warn(
               "Skipping excluded path dependency '#{cleaned_name}' for package '#{name}'. " \
               "This file is excluded by exclude_paths configuration: #{@exclude_paths}"
@@ -727,8 +725,7 @@ module Dependabot
         file = File.join(workspace, MANIFEST_FILENAME)
 
         # Skip excluded workspace packages
-        if Dependabot::Experiments.enabled?(:enable_exclude_paths_subdirectory_manifest_files) &&
-           !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(file, @exclude_paths)
+        if !@exclude_paths.empty? && Dependabot::FileFiltering.exclude_path?(file, @exclude_paths)
           Dependabot.logger.info(
             "Skipping excluded workspace package '#{file}' from workspace '#{workspace}'. " \
             "This file is excluded by exclude_paths configuration: #{@exclude_paths}"

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -229,45 +229,31 @@ module Dependabot
         PNPM_FALLBACK_VERSION
       end
 
-      # The concrete pnpm version that will run for this update — resolved via
-      # Corepack when the corepack experiment is enabled (honouring the repo's
-      # `packageManager` pin), otherwise the pnpm on PATH. Returns nil when the
-      # version can't be determined. Used to gate version-specific config such as
+      # The concrete pnpm version that will run for this update. Returns nil when
+      # the version can't be determined. Used to gate version-specific config such as
       # `minimumReleaseAge` (added in pnpm 10.16) and `minimumReleaseAgeStrict`
       # (added in pnpm 11.0), which older pnpm versions silently ignore.
       sig { returns(T.nilable(Dependabot::Version)) }
       def self.pnpm_version
-        raw = if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-                package_manager_version(PNPMPackageManager::NAME, env: merge_corepack_env(nil))
-              else
-                local_package_manager_version(PNPMPackageManager::NAME)
-              end
+        raw = local_package_manager_version(PNPMPackageManager::NAME)
         Version.new(raw)
       rescue StandardError => e
         Dependabot.logger.warn("Could not determine pnpm version to gate release-age settings: #{e.message}")
         nil
       end
 
-      # The concrete npm version that will run — via Corepack when the corepack
-      # experiment is enabled (honouring the repo's `packageManager` pin, which can
-      # select npm 7-11), otherwise the npm on PATH. Returns nil when it can't be
-      # determined. Used to gate `--min-release-age`, added in npm 11.10.
+      # The concrete npm version that will run. Returns nil when it can't be determined.
+      # Used to gate `--min-release-age`, added in npm 11.10.
       sig { returns(T.nilable(Dependabot::Version)) }
       def self.npm_version
-        raw = if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-                package_manager_version(NpmPackageManager::NAME, env: merge_corepack_env(nil))
-              else
-                local_package_manager_version(NpmPackageManager::NAME)
-              end
+        raw = local_package_manager_version(NpmPackageManager::NAME)
         Version.new(raw)
       rescue StandardError => e
         Dependabot.logger.warn("Could not determine npm version to gate release-age settings: #{e.message}")
         nil
       end
 
-      # True when the running npm supports `--min-release-age` (npm 11.10+). Because
-      # npm runs through Corepack, a repo pinned to an older npm via `packageManager`
-      # would reject the flag, so the cooldown gate must be skipped for it.
+      # True when the running npm supports `--min-release-age` (npm 11.10+).
       sig { returns(T::Boolean) }
       def self.npm_supports_min_release_age?
         version = npm_version
@@ -452,10 +438,6 @@ module Dependabot
       end
 
       # Run single npm command returning stdout/stderr.
-      #
-      # NOTE: Needs to be explicitly run through corepack to respect the
-      # `packageManager` setting in `package.json`, because corepack does not
-      # add shims for NPM.
       sig do
         params(
           command: String,
@@ -464,22 +446,12 @@ module Dependabot
         ).returns(String)
       end
       def self.run_npm_command(command, fingerprint: command, env: nil)
-        merged_env = merge_corepack_env(env)
-        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          package_manager_run_command(
-            NpmPackageManager::NAME,
-            command,
-            fingerprint: fingerprint,
-            output_observer: ->(output) { command_observer(output) },
-            env: merged_env
-          )
-        else
-          Dependabot::SharedHelpers.run_shell_command(
-            "npm #{command}",
-            fingerprint: "npm #{fingerprint}",
-            output_observer: ->(output) { command_observer(output) }
-          )
-        end
+        Dependabot::SharedHelpers.run_shell_command(
+          "npm #{command}",
+          fingerprint: "npm #{fingerprint}",
+          output_observer: ->(output) { command_observer(output) },
+          env: env
+        )
       end
 
       sig do
@@ -551,15 +523,11 @@ module Dependabot
         ).returns(String)
       end
       def self.run_pnpm_command(command, fingerprint: nil, env: nil)
-        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          merged_env = merge_corepack_env(env)
-          package_manager_run_command(PNPMPackageManager::NAME, command, fingerprint: fingerprint, env: merged_env)
-        else
-          Dependabot::SharedHelpers.run_shell_command(
-            "pnpm #{command}",
-            fingerprint: "pnpm #{fingerprint || command}"
-          )
-        end
+        Dependabot::SharedHelpers.run_shell_command(
+          "pnpm #{command}",
+          fingerprint: "pnpm #{fingerprint || command}",
+          env: env
+        )
       end
 
       # Run single yarn command returning stdout/stderr
@@ -571,16 +539,11 @@ module Dependabot
         ).returns(String)
       end
       def self.run_single_yarn_command(command, fingerprint: nil, env: nil)
-        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          merged_env = merge_corepack_env(env)
-          package_manager_run_command(YarnPackageManager::NAME, command, fingerprint: fingerprint, env: merged_env)
-        else
-          Dependabot::SharedHelpers.run_shell_command(
-            "yarn #{command}",
-            fingerprint: "yarn #{fingerprint || command}",
-            env: env
-          )
-        end
+        Dependabot::SharedHelpers.run_shell_command(
+          "yarn #{command}",
+          fingerprint: "yarn #{fingerprint || command}",
+          env: env
+        )
       end
 
       # Activate the package manager for specified version by using corepack
@@ -768,7 +731,6 @@ module Dependabot
 
       sig { returns(T.nilable(T::Hash[String, String])) }
       def self.build_corepack_env_variables
-        return nil unless Dependabot::Experiments.enabled?(:enable_private_registry_for_corepack)
         return nil if dependency_files.nil? || credentials.nil?
 
         files = T.must(dependency_files)

data/lib/dependabot/npm_and_yarn/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "json"
@@ -6,6 +6,7 @@ require "excon"
 require "time"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
+require "dependabot/package/npm_registry_package"
 require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/package/registry_credential_helpers"
 
@@ -23,17 +24,8 @@ module Dependabot
         API_AUTHORIZATION_VALUE_BASIC_PREFIX = "Basic"
         API_RESPONSE_STATUS_SUCCESS_PREFIX = "2"
 
-        RELEASE_TIME_KEY = "time"
-        RELEASE_VERSIONS_KEY = "versions"
-        RELEASE_DIST_TAGS_KEY = "dist-tags"
         RELEASE_DIST_TAGS_LATEST_KEY = "latest"
-        RELEASE_ENGINES_KEY = "engines"
         RELEASE_LANGUAGE_KEY = "node"
-        RELEASE_DEPRECATION_KEY = "deprecated"
-        RELEASE_REPOSITORY_KEY = "repository"
-        RELEASE_PACKAGE_TYPE_KEY = "type"
-        RELEASE_PACKAGE_TYPE_GIT = "git"
-        RELEASE_PACKAGE_TYPE_NPM = "npm"
 
         REGISTRY_FILE_NPMRC = ".npmrc"
         REGISTRY_FILE_YARNRC = ".yarnrc"
@@ -55,7 +47,7 @@ module Dependabot
           @dependency_files = dependency_files
           @credentials = credentials
 
-          @npm_details = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+          @npm_details = T.let(nil, T.nilable(Dependabot::Package::NpmRegistryPackage))
           @dist_tags = T.let(nil, T.nilable(T::Hash[String, String]))
           @registry_finder = T.let(nil, T.nilable(Package::RegistryFinder))
           @version_endpoint_working = T.let(nil, T.nilable(T::Boolean))
@@ -86,7 +78,7 @@ module Dependabot
           !dist_tags.nil?
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def npm_details
           @npm_details ||= fetch_npm_details
         end
@@ -165,32 +157,26 @@ module Dependabot
 
         sig do
           params(
-            npm_data: T::Hash[String, T.untyped]
+            npm_data: Dependabot::Package::NpmRegistryPackage
           ).returns(T::Array[Dependabot::Package::PackageRelease])
         end
         def parse_versions(npm_data)
-          time_data = fetch_value_from_hash(npm_data, RELEASE_TIME_KEY) || {}
-          versions_data = fetch_value_from_hash(npm_data, RELEASE_VERSIONS_KEY) || {}
+          latest_version = npm_data.dist_tags&.[](RELEASE_DIST_TAGS_LATEST_KEY)
 
-          dist_tags = fetch_value_from_hash(npm_data, RELEASE_DIST_TAGS_KEY)
-          latest_version = fetch_value_from_hash(dist_tags, RELEASE_DIST_TAGS_LATEST_KEY)
-
-          versions_data.filter_map do |version, details|
-            next unless Dependabot::NpmAndYarn::Version.correct?(version)
-
-            package_type = infer_package_type(details)
+          npm_data.releases.values.filter_map do |release|
+            next unless Dependabot::NpmAndYarn::Version.correct?(release.version)
 
             Dependabot::Package::PackageRelease.new(
-              version: Version.new(version),
-              released_at: time_data[version] ? Time.parse(time_data[version]) : nil,
+              version: Version.new(release.version),
+              released_at: release.released_at,
               yanked: false,
               yanked_reason: nil,
               downloads: nil,
-              latest: latest_version.to_s == version,
-              url: package_version_url(version),
-              package_type: package_type,
-              language: package_language(details),
-              details: details
+              latest: latest_version == release.version,
+              url: package_version_url(release.version),
+              package_type: release.package_type,
+              language: package_language(release.node_requirement),
+              details: release.details
             )
           end.sort_by(&:version).reverse
         end
@@ -200,39 +186,31 @@ module Dependabot
           "#{dependency_registry}/#{@dependency.name}/v/#{version}"
         end
 
-        sig do
-          params(version_details: T::Hash[String, T.untyped])
-            .returns(T.nilable(Dependabot::Package::PackageLanguage))
-        end
-        def package_language(version_details)
-          # Fetch the engines hash from the version details
-          engines = version_details.is_a?(Hash) ? version_details[RELEASE_ENGINES_KEY] : nil
-          # Check if engines is a hash and fetch the node requirement
-          node_requirement = engines.is_a?(Hash) ? engines.fetch(RELEASE_LANGUAGE_KEY, nil) : nil
-
+        sig { params(node_requirement: T.nilable(String)).returns(T.nilable(Dependabot::Package::PackageLanguage)) }
+        def package_language(node_requirement)
           return nil unless node_requirement
 
-          if node_requirement
-            Dependabot::Package::PackageLanguage.new(
-              name: RELEASE_LANGUAGE_KEY,
-              version: nil,
-              requirement: Requirement.new(node_requirement)
-            )
-          end
+          Dependabot::Package::PackageLanguage.new(
+            name: RELEASE_LANGUAGE_KEY,
+            version: nil,
+            requirement: Requirement.new(node_requirement)
+          )
         rescue Gem::Requirement::BadRequirementError
           nil
         end
 
         sig { returns(T.nilable(T::Hash[String, String])) }
         def dist_tags
-          @dist_tags ||= fetch_value_from_hash(npm_details, RELEASE_DIST_TAGS_KEY)
+          @dist_tags ||= npm_details&.dist_tags
         end
 
-        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+        sig { returns(T.nilable(Dependabot::Package::NpmRegistryPackage)) }
         def fetch_npm_details
           npm_response = fetch_npm_response
           check_npm_response(npm_response) if npm_response
-          JSON.parse(npm_response.body)
+          Dependabot::Package::NpmRegistryPackage.from_json(npm_response.body) do |version|
+            Dependabot::NpmAndYarn::Version.correct?(version)
+          end
         rescue JSON::ParserError, Excon::Error::Timeout, Excon::Error::Socket, RegistryError => e
           if git_dependency?
             nil
@@ -257,10 +235,10 @@ module Dependabot
           # If a private registry returns a 500 error, check authentication
           return response unless response.status == 500
 
-          auth = fetch_value_from_hash(registry_auth_headers, API_AUTHORIZATION_KEY)
+          auth = registry_auth_headers[API_AUTHORIZATION_KEY]
           return response unless auth
 
-          return response unless auth&.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
+          return response unless auth.start_with?(API_AUTHORIZATION_VALUE_BASIC_PREFIX)
 
           decoded_token = Base64.decode64(auth.gsub("#{API_AUTHORIZATION_VALUE_BASIC_PREFIX} ", "")).strip
 
@@ -282,29 +260,6 @@ module Dependabot
           raise DependencyFileNotResolvable, e.message
         end
 
-        sig do
-          params(
-            details: T::Hash[String, T.untyped],
-            git_dependency: T::Boolean
-          )
-            .returns(String)
-        end
-        def infer_package_type(details, git_dependency: false)
-          return RELEASE_PACKAGE_TYPE_GIT if git_dependency
-
-          repository = fetch_value_from_hash(details, RELEASE_REPOSITORY_KEY)
-
-          case repository
-          when String
-            return repository.start_with?("git+") ? RELEASE_PACKAGE_TYPE_GIT : RELEASE_PACKAGE_TYPE_NPM
-          when Hash
-            type = fetch_value_from_hash(repository, RELEASE_PACKAGE_TYPE_KEY)
-            return RELEASE_PACKAGE_TYPE_GIT if type == RELEASE_PACKAGE_TYPE_GIT
-          end
-
-          RELEASE_PACKAGE_TYPE_NPM
-        end
-
         sig { params(npm_response: Excon::Response).void }
         def check_npm_response(npm_response)
           return if git_dependency?
@@ -339,7 +294,7 @@ module Dependabot
           raise RegistryError.new(status, msg)
         end
 
-        sig { params(error: StandardError).void }
+        sig { params(error: StandardError).returns(T.noreturn) }
         def raise_npm_details_error(error)
           raise if dependency_registry == GLOBAL_REGISTRY
           raise unless error.is_a?(Excon::Error::Timeout) || error.is_a?(Excon::Error::Socket)
@@ -379,8 +334,7 @@ module Dependabot
 
         sig { params(npm_response: Excon::Response).returns(T::Boolean) }
         def response_invalid_json?(npm_response)
-          result = JSON.parse(npm_response.body)
-          result.is_a?(Hash) || result.is_a?(Array)
+          T.cast(JSON.parse(npm_response.body), Object)
           false
         rescue JSON::ParserError, TypeError
           true
@@ -438,15 +392,6 @@ module Dependabot
             credentials: credentials
           ).git_dependency?
         end
-
-        # This function safely retrieves a value for a given key from a Hash.
-        # If the hash is valid and the key exists, it will return the value, otherwise nil.
-        sig { params(hash: T.untyped, key: T.untyped).returns(T.untyped) }
-        def fetch_value_from_hash(hash, key)
-          return nil unless hash.is_a?(Hash) # Return nil if the hash is not a Hash
-
-          hash.fetch(key, nil) # Fetch the value for the given key, defaulting to nil if not found
-        end
       end
     end
   end

data/lib/dependabot/npm_and_yarn/package_manager.rb

@@ -289,9 +289,7 @@ module Dependabot
               :current_engine_version
 
       # rubocop:disable Metrics/CyclomaticComplexity
-      # rubocop:disable Metrics/AbcSize
       # rubocop:disable Metrics/PerceivedComplexity
-      # rubocop:disable Metrics/MethodLength
       sig { params(name: String).returns(T.nilable(T.any(Integer, String))) }
       def setup(name)
         # we prioritize version mentioned in "packageManager" instead of "engines"
@@ -325,36 +323,23 @@ module Dependabot
           )
         end
 
-        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          version ||= requested_version(name) || guessed_version(name)
+        version ||= requested_version(name)
 
-          if version
-            raise_if_unsupported!(name, version.to_s)
-            install(name, version.to_s)
-          end
+        if version
+          raise_if_unsupported!(name, version.to_s)
+          install(name, version)
         else
-          version ||= requested_version(name)
+          version = guessed_version(name)
 
           if version
             raise_if_unsupported!(name, version.to_s)
-
-            install(name, version)
-          else
-            version = guessed_version(name)
-
-            if version
-              raise_if_unsupported!(name, version.to_s)
-
-              install(name, version.to_s) if name == PNPMPackageManager::NAME
-            end
+            install(name, version.to_s) if name == PNPMPackageManager::NAME
           end
         end
         version
       end
       # rubocop:enable Metrics/CyclomaticComplexity
-      # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
-      # rubocop:enable Metrics/MethodLength
 
       sig { params(name: String).returns(T.nilable(String)) }
       def detect_version(name)
@@ -457,15 +442,6 @@ module Dependabot
 
       sig { params(name: String, version: T.nilable(String)).void }
       def install(name, version)
-        if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-          env = {}
-          if Dependabot::Experiments.enabled?(:enable_private_registry_for_corepack)
-            env = @registry_helper.find_corepack_env_variables
-          end
-          # Use the Helpers.install method to install the package manager
-          return Helpers.install(name, version.to_s, env: env)
-        end
-
         Dependabot.logger.info("Installing \"#{name}@#{version}\"")
 
         begin

data/lib/dependabot/npm_and_yarn/update_checker/version_resolver.rb

@@ -971,10 +971,9 @@ module Dependabot
           ).returns(T.nilable(T.any(T::Hash[String, T.untyped], String, T::Array[T::Hash[String, T.untyped]])))
         end
         def run_npm8_checker(version:)
-          env = corepack_registry_override_env
           cmd =
             "install #{version_install_arg(version: version)} --package-lock-only --dry-run=true --ignore-scripts"
-          output = Helpers.run_npm_command(cmd, env: env)
+          output = Helpers.run_npm_command(cmd)
           if output.match?(NPM8_PEER_DEP_ERROR_REGEX)
             error_context = { command: cmd, process_exit_value: 1 }
             raise SharedHelpers::HelperSubprocessFailed.new(message: output, error_context: error_context)
@@ -983,19 +982,6 @@ module Dependabot
           raise if e.message.match?(NPM8_PEER_DEP_ERROR_REGEX)
         end
 
-        sig { returns(T.nilable(T::Hash[String, String])) }
-        def corepack_registry_override_env
-          return nil unless Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
-
-          replaces_base_cred = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
-          registry_url = replaces_base_cred&.[]("registry")
-          return nil unless registry_url
-
-          registry_url = Dependabot::NpmAndYarn::RegistryHelper.normalize_registry_url(registry_url)
-
-          { "npm_config_registry" => registry_url }
-        end
-
         sig do
           params(
             version: T.nilable(T.any(String, Gem::Version))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.393.0
+  version: 0.394.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.393.0
+        version: 0.394.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -388,7 +388,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
 rdoc_options: []
 require_paths:
 - lib