dependabot-nuget 0.247.0 → 0.248.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e8dda5e47b38dec152ba8797986aaaca62fde7dbed194960864b779932d6ff7
-  data.tar.gz: 4f1cb76b3dafc332d90ddf7acec0b39c6295d2d9749741e3229af6ad7d7e363d
+  metadata.gz: 60679d8e50f3e96aa05400b03ccc9e0dd491c1a7cf340c4c7a39bcb48675c3f6
+  data.tar.gz: 235eb5b57423534578945568766179c2805c6c1e19b5bdb806cc4fd5a5e78dc7
 SHA512:
-  metadata.gz: c350131e183da643b7caf57a76acc2cb954e9d7f0a4532b340db90a064f0e1b7d735a531d2bea8efea6ee483060b3dbb8efb4a8e1567d2c9d30d88bc907848f2
-  data.tar.gz: 9f2a6505e1eca5a2fbe8369e8e21ce0b5eabc4c658bec9d628b5250c16f78f40a7c8b19bc0778b2b7fe6e0c3b215a71b2282407544eb0f6808bdfde3da35d8e0
+  metadata.gz: 1976d20f2b23920eb44176098e89109ee5e969f7e12eaa959e06948e543b9383dcf08c7521eeb9f69602fab37f17ffaafc937e203cce68439327d9735590e1b9
+  data.tar.gz: d240a0489a0ab0dc72283ea736a55965cb13a2fe375cb7eb5a98beb473f9e227bf6ec52a07fba05f2177ee228c716197f60d5fe35d3170b1687aaa07648915eb

data/lib/dependabot/nuget/file_fetcher.rb

@@ -25,7 +25,7 @@ module Dependabot
         return true if filenames.any? { |f| f.match?("^src$") }
         return true if filenames.any? { |f| f.end_with?(".proj") }
 
-        filenames.any? { |name| name.match?(/\.[a-z]{2}proj$/) }
+        filenames.any? { |name| name.match?(/\.(cs|vb|fs)proj$/) }
       end
 
       sig { override.returns(String) }
@@ -53,7 +53,7 @@ module Dependabot
       end
 
       sig { override.returns(T::Array[DependencyFile]) }
-      def fetch_files # rubocop:disable Metrics/AbcSize
+      def fetch_files
         fetched_files = []
         fetched_files += project_files
         fetched_files += directory_build_files
@@ -73,10 +73,7 @@ module Dependabot
         if project_files.none? && packages_config_files.none?
           raise T.must(@missing_sln_project_file_errors.first) if @missing_sln_project_file_errors&.any?
 
-          raise(
-            Dependabot::DependencyFileNotFound,
-            File.join(directory, "<anything>.(cs|vb|fs)proj")
-          )
+          raise_dependency_file_not_found
         end
 
         fetched_files
@@ -102,9 +99,16 @@ module Dependabot
             project_files
           end
       rescue Octokit::NotFound, Gitlab::Error::NotFound
+        raise_dependency_file_not_found
+      end
+
+      sig { returns(T.noreturn) }
+      def raise_dependency_file_not_found
         raise(
-          Dependabot::DependencyFileNotFound,
-          File.join(directory, "<anything>.(cs|vb|fs)proj")
+          Dependabot::DependencyFileNotFound.new(
+            File.join(directory, "*.(sln|csproj|vbproj|fsproj|proj)"),
+            "Unable to find `*.sln`, `*.(cs|vb|fs)proj`, or `*.proj` in directory `#{directory}`"
+          )
         )
       end
 

data/lib/dependabot/nuget/file_parser.rb

@@ -44,6 +44,16 @@ module Dependabot
           Dependabot.logger.warn "Dependency '#{d.name}' excluded due to unparsable version: #{d.version}"
         end
 
+        dependency_info = dependencies.map do |d|
+          requirements_info = d.requirements.filter_map { |r| "    file: #{r[:file]}, metadata: #{r[:metadata]}" }
+                               .join("\n")
+          "  name: #{d.name}, version: #{d.version}\n#{requirements_info}"
+        end.join("\n")
+
+        if dependencies.length.positive?
+          Dependabot.logger.info "The following dependencies were found:\n#{dependency_info}"
+        end
+
         dependencies
       end
 

data/lib/dependabot/nuget/nuget_config_credential_helpers.rb

@@ -1,18 +1,25 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Nuget
     module NuGetConfigCredentialHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.user_nuget_config_path
         home_directory = Dir.home
         File.join(home_directory, ".nuget", "NuGet", "NuGet.Config")
       end
 
+      sig { returns(String) }
       def self.temporary_nuget_config_path
         user_nuget_config_path + "_ORIGINAL"
       end
 
+      sig { params(credentials: T::Array[Dependabot::Credential]).void }
       def self.add_credentials_to_nuget_config(credentials)
         return unless File.exist?(user_nuget_config_path)
 
@@ -48,6 +55,7 @@ module Dependabot
         File.write(user_nuget_config_path, nuget_config)
       end
 
+      sig { void }
       def self.restore_user_nuget_config
         return unless File.exist?(temporary_nuget_config_path)
 
@@ -55,6 +63,7 @@ module Dependabot
         File.rename(temporary_nuget_config_path, user_nuget_config_path)
       end
 
+      sig { params(credentials: T::Array[Dependabot::Credential], _block: T.proc.void).void }
       def self.patch_nuget_config_for_action(credentials, &_block)
         add_credentials_to_nuget_config(credentials)
         begin

data/lib/dependabot/nuget/requirement.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -12,6 +12,9 @@ require "dependabot/nuget/version"
 module Dependabot
   module Nuget
     class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
       def self.parse(obj)
         return ["=", Nuget::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
 
@@ -28,11 +31,12 @@ module Dependabot
       # For consistency with other languages, we define a requirements array.
       # Dotnet doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
-      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Dependabot::Requirement]) }
       def self.requirements_array(requirement_string)
         [new(requirement_string)]
       end
 
+      sig { params(requirements: T.any(T.nilable(String), T::Array[T.nilable(String)])).void }
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
           convert_dotnet_constraint_to_ruby_constraint(req_string)
@@ -41,6 +45,7 @@ module Dependabot
         super(requirements)
       end
 
+      sig { override.params(version: Gem::Version).returns(T::Boolean) }
       def satisfied_by?(version)
         version = Nuget::Version.new(version.to_s)
         super
@@ -48,10 +53,11 @@ module Dependabot
 
       private
 
+      sig { params(req_string: T.nilable(String)).returns(T.nilable(T.any(String, T::Array[String]))) }
       def convert_dotnet_constraint_to_ruby_constraint(req_string)
         return unless req_string
 
-        return convert_dotnet_range_to_ruby_range(req_string) if req_string&.start_with?("(", "[")
+        return convert_dotnet_range_to_ruby_range(req_string) if req_string.start_with?("(", "[")
 
         return req_string.split(",").map(&:strip) if req_string.include?(",")
 
@@ -61,6 +67,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/PerceivedComplexity
+      sig { params(req_string: String).returns(T::Array[String]) }
       def convert_dotnet_range_to_ruby_range(req_string)
         lower_b, upper_b = req_string.split(",").map(&:strip).map do |bound|
           next convert_range_wildcard_req(bound) if bound.include?("*")
@@ -70,9 +77,9 @@ module Dependabot
 
         lower_b =
           if ["(", "["].include?(lower_b) then nil
-          elsif lower_b.start_with?("(") then "> #{lower_b.sub(/\(\s*/, '')}"
+          elsif T.must(lower_b).start_with?("(") then "> #{T.must(lower_b).sub(/\(\s*/, '')}"
           else
-            ">= #{lower_b.sub(/\[\s*/, '').strip}"
+            ">= #{T.must(lower_b).sub(/\[\s*/, '').strip}"
           end
 
         upper_b =
@@ -87,20 +94,22 @@ module Dependabot
       end
       # rubocop:enable Metrics/PerceivedComplexity
 
+      sig { params(req_string: String).returns(String) }
       def convert_range_wildcard_req(req_string)
-        range_end = req_string[-1]
-        defined_part = req_string.split("*").first
+        range_end = T.must(req_string[-1])
+        defined_part = T.must(req_string.split("*").first)
         version = defined_part + "0"
         version += range_end if [")", "]"].include?(range_end)
         version
       end
 
+      sig { params(req_string: String).returns(String) }
       def convert_wildcard_req(req_string)
         return ">= 0-a" if req_string == "*-*"
 
         return ">= 0" if req_string.start_with?("*")
 
-        defined_part = req_string.split("*").first
+        defined_part = T.must(req_string.split("*").first)
         suffix = defined_part.end_with?(".") ? "0" : "a"
         version = defined_part + suffix
         "~> #{version}"

data/lib/dependabot/nuget/update_checker/nupkg_fetcher.rb

@@ -1,23 +1,43 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
-require "zip"
 require "stringio"
+require "sorbet-runtime"
+require "zip"
+
 require "dependabot/nuget/http_response_helpers"
 
 module Dependabot
   module Nuget
     class NupkgFetcher
+      extend T::Sig
+
       require_relative "repository_finder"
 
+      sig do
+        params(
+          dependency_urls: T::Array[T::Hash[Symbol, String]],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(String))
+      end
       def self.fetch_nupkg_buffer(dependency_urls, package_id, package_version)
         # check all repositories for the first one that has the nupkg
-        dependency_urls.reduce(nil) do |nupkg_buffer, repository_details|
+        dependency_urls.reduce(T.let(nil, T.nilable(String))) do |nupkg_buffer, repository_details|
           nupkg_buffer || fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
         end
       end
 
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: T.nilable(String),
+          package_version: T.nilable(String)
+        )
+          .returns(T.nilable(String))
+      end
       def self.fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
         return unless package_id && package_version && !package_version.empty?
 
@@ -35,6 +55,14 @@ module Dependabot
         package_url
       end
 
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(String))
+      end
       def self.fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
         package_url = fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
         return unless package_url
@@ -43,6 +71,14 @@ module Dependabot
         fetch_stream(package_url, auth_header)
       end
 
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(String))
+      end
       def self.get_nuget_v3_package_url(repository_details, package_id, package_version)
         base_url = repository_details[:base_url]
         unless base_url
@@ -57,15 +93,23 @@ module Dependabot
 
       # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(String))
+      end
       def self.get_nuget_v3_package_url_from_search(repository_details, package_id, package_version)
         search_url = repository_details[:search_url]
         return nil unless search_url
 
         # get search result
         search_result_response = fetch_url(search_url, repository_details)
-        return nil unless search_result_response.status == 200
+        return nil unless search_result_response&.status == 200
 
-        search_response_body = HttpResponseHelpers.remove_wrapping_zero_width_chars(search_result_response.body)
+        search_response_body = HttpResponseHelpers.remove_wrapping_zero_width_chars(T.must(search_result_response).body)
         search_results = JSON.parse(search_response_body)
 
         # find matching package and version
@@ -90,15 +134,23 @@ module Dependabot
       # rubocop:enable Metrics/PerceivedComplexity
       # rubocop:enable Metrics/CyclomaticComplexity
 
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(String))
+      end
       def self.get_nuget_v2_package_url(repository_details, package_id, package_version)
         # get package XML
         base_url = repository_details[:base_url].delete_suffix("/")
         package_url = "#{base_url}/Packages(Id='#{package_id}',Version='#{package_version}')"
         response = fetch_url(package_url, repository_details)
-        return nil unless response.status == 200
+        return nil unless response&.status == 200
 
         # find relevant element
-        doc = Nokogiri::XML(response.body)
+        doc = Nokogiri::XML(T.must(response).body)
         doc.remove_namespaces!
 
         content_element = doc.xpath("/entry/content")
@@ -106,6 +158,14 @@ module Dependabot
         nupkg_url
       end
 
+      sig do
+        params(
+          stream_url: String,
+          auth_header: T::Hash[String, String],
+          max_redirects: Integer
+        )
+          .returns(T.nilable(String))
+      end
       def self.fetch_stream(stream_url, auth_header, max_redirects = 5)
         current_url = stream_url
         current_redirects = 0
@@ -128,17 +188,25 @@ module Dependabot
             current_redirects += 1
             return nil if current_redirects > max_redirects
 
-            current_url = response.headers["Location"]
+            current_url = T.must(response.headers["Location"])
           else
             return nil
           end
         end
       end
 
+      sig do
+        params(
+          url: String,
+          repository_details: T::Hash[Symbol, T.untyped]
+        )
+          .returns(T.nilable(Excon::Response))
+      end
       def self.fetch_url(url, repository_details)
         fetch_url_with_auth(url, repository_details.fetch(:auth_header))
       end
 
+      sig { params(url: String, auth_header: T::Hash[T.any(String, Symbol), T.untyped]).returns(Excon::Response) }
       def self.fetch_url_with_auth(url, auth_header)
         cache = CacheManager.cache("nupkg_fetcher_cache")
         cache[url] ||= Dependabot::RegistryClient.get(

data/lib/dependabot/nuget/update_checker/nuspec_fetcher.rb

@@ -1,23 +1,42 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "nokogiri"
-require "zip"
 require "stringio"
+require "sorbet-runtime"
+require "zip"
 
 module Dependabot
   module Nuget
     class NuspecFetcher
+      extend T::Sig
+
       require_relative "nupkg_fetcher"
       require_relative "repository_finder"
 
+      sig do
+        params(
+          dependency_urls: T::Array[T::Hash[Symbol, String]],
+          package_id: String,
+          package_version: String
+        )
+          .returns(T.nilable(Nokogiri::XML::Document))
+      end
       def self.fetch_nuspec(dependency_urls, package_id, package_version)
         # check all repositories for the first one that has the nuspec
-        dependency_urls.reduce(nil) do |nuspec_xml, repository_details|
+        dependency_urls.reduce(T.let(nil, T.nilable(Nokogiri::XML::Document))) do |nuspec_xml, repository_details|
           nuspec_xml || fetch_nuspec_from_repository(repository_details, package_id, package_version)
         end
       end
 
+      sig do
+        params(
+          repository_details: T::Hash[Symbol, T.untyped],
+          package_id: T.nilable(String),
+          package_version: T.nilable(String)
+        )
+          .returns(T.nilable(Nokogiri::XML::Document))
+      end
       def self.fetch_nuspec_from_repository(repository_details, package_id, package_version)
         return unless package_id && package_version && !package_version.empty?
 
@@ -55,6 +74,7 @@ module Dependabot
         nuspec_xml
       end
 
+      sig { params(feed_url: String).returns(T::Boolean) }
       def self.feed_supports_nuspec_download?(feed_url)
         feed_regexs = [
           # nuget
@@ -67,6 +87,7 @@ module Dependabot
         feed_regexs.any? { |reg| reg.match(feed_url) }
       end
 
+      sig { params(zip_stream: String, package_id: String).returns(T.nilable(String)) }
       def self.extract_nuspec(zip_stream, package_id)
         Zip::File.open_buffer(zip_stream) do |zip|
           nuspec_entry = zip.find { |entry| entry.name == "#{package_id}.nuspec" }
@@ -75,6 +96,7 @@ module Dependabot
         nil
       end
 
+      sig { params(string: String).returns(String) }
       def self.remove_invalid_characters(string)
         string.dup
               .force_encoding(Encoding::UTF_8)

data/lib/dependabot/nuget/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 #######################################################################
@@ -6,6 +6,8 @@
 # https://docs.microsoft.com/en-us/nuget/reference/package-versioning #
 #######################################################################
 
+require "sorbet-runtime"
+
 require "dependabot/update_checkers/base"
 require "dependabot/nuget/version"
 
@@ -13,14 +15,25 @@ module Dependabot
   module Nuget
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       class RequirementsUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            latest_version: T.nilable(T.any(String, Dependabot::Nuget::Version)),
+            source_details: T.nilable(T::Hash[Symbol, T.untyped])
+          )
+            .void
+        end
         def initialize(requirements:, latest_version:, source_details:)
           @requirements = requirements
           @source_details = source_details
           return unless latest_version
 
-          @latest_version = version_class.new(latest_version)
+          @latest_version = T.let(version_class.new(latest_version), Dependabot::Nuget::Version)
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements unless latest_version
 
@@ -52,32 +65,42 @@ module Dependabot
 
         private
 
-        attr_reader :requirements, :latest_version, :source_details
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        attr_reader :requirements
+
+        sig { returns(T.nilable(Dependabot::Nuget::Version)) }
+        attr_reader :latest_version
+
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        attr_reader :source_details
 
+        sig { returns(T.class_of(Dependabot::Nuget::Version)) }
         def version_class
-          Nuget::Version
+          Dependabot::Nuget::Version
         end
 
+        sig { params(req_string: String).returns(String) }
         def update_wildcard_requirement(req_string)
           return req_string if req_string == "*-*"
 
           return req_string if req_string == "*"
 
-          precision = req_string.split("*").first.split(/\.|\-/).count
+          precision = T.must(req_string.split("*").first).split(/\.|\-/).count
           wildcard_section = req_string.partition(/(?=[.\-]\*)/).last
 
-          version_parts = latest_version.segments.first(precision)
+          version_parts = T.must(latest_version).segments.first(precision)
           version = version_parts.join(".")
 
           version + wildcard_section
         end
 
+        sig { returns(T::Hash[Symbol, T.untyped]) }
         def updated_source
           {
             type: "nuget_repo",
-            url: source_details.fetch(:repo_url),
-            nuspec_url: source_details.fetch(:nuspec_url),
-            source_url: source_details.fetch(:source_url)
+            url: source_details&.fetch(:repo_url),
+            nuspec_url: source_details&.fetch(:nuspec_url),
+            source_url: source_details&.fetch(:source_url)
           }
         end
       end

data/lib/dependabot/nuget/update_checker/version_finder.rb

@@ -1,16 +1,18 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/nuget/version"
 require "dependabot/nuget/requirement"
 require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/version_filters"
 require "dependabot/nuget/nuget_client"
-require "sorbet-runtime"
 
 module Dependabot
   module Nuget
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      # rubocop:disable Metrics/ClassLength
       class VersionFinder
         extend T::Sig
 
@@ -19,10 +21,24 @@ module Dependabot
 
         NUGET_RANGE_REGEX = /[\(\[].*,.*[\)\]]/
 
-        def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, raise_on_ignored: false,
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            repo_contents_path: T.nilable(String),
+            raise_on_ignored: T::Boolean
+          ).void
+        end
+        def initialize(dependency:,
+                       dependency_files:,
+                       credentials:,
+                       ignored_versions:,
                        security_advisories:,
-                       repo_contents_path:)
+                       repo_contents_path:,
+                       raise_on_ignored: false)
           @dependency          = dependency
           @dependency_files    = dependency_files
           @credentials         = credentials
@@ -32,53 +48,89 @@ module Dependabot
           @repo_contents_path  = repo_contents_path
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def latest_version_details
           @latest_version_details ||=
-            begin
-              possible_versions = versions
-              possible_versions = filter_prereleases(possible_versions)
-              possible_versions = filter_ignored_versions(possible_versions)
-
-              find_highest_compatible_version(possible_versions)
-            end
+            T.let(
+              begin
+                possible_versions = versions
+                possible_versions = filter_prereleases(possible_versions)
+                possible_versions = filter_ignored_versions(possible_versions)
+
+                find_highest_compatible_version(possible_versions)
+              end,
+              T.nilable(T::Hash[Symbol, T.untyped])
+            )
         end
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
         def lowest_security_fix_version_details
           @lowest_security_fix_version_details ||=
-            begin
-              possible_versions = versions
-              possible_versions = filter_prereleases(possible_versions)
-              possible_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
-                possible_versions, security_advisories
-              )
-              possible_versions = filter_ignored_versions(possible_versions)
-              possible_versions = filter_lower_versions(possible_versions)
-
-              find_lowest_compatible_version(possible_versions)
-            end
+            T.let(
+              begin
+                possible_versions = versions
+                possible_versions = filter_prereleases(possible_versions)
+                possible_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+                  possible_versions, security_advisories
+                )
+                possible_versions = filter_ignored_versions(possible_versions)
+                possible_versions = filter_lower_versions(possible_versions)
+
+                find_lowest_compatible_version(possible_versions)
+              end,
+              T.nilable(T::Hash[Symbol, T.untyped])
+            )
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.nilable(T.any(Dependabot::Version, String))]]) }
         def versions
           available_v3_versions + available_v2_versions
         end
 
-        attr_reader :dependency, :dependency_files, :credentials,
-                    :ignored_versions, :security_advisories, :repo_contents_path
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+
+        sig { returns(T.nilable(String)) }
+        attr_reader :repo_contents_path
 
         private
 
+        sig do
+          params(possible_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def find_highest_compatible_version(possible_versions)
           # sorted versions descending
           sorted_versions = possible_versions.sort_by { |v| v.fetch(:version) }.reverse
           find_compatible_version(sorted_versions)
         end
 
+        sig do
+          params(possible_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def find_lowest_compatible_version(possible_versions)
           # sorted versions ascending
           sorted_versions = possible_versions.sort_by { |v| v.fetch(:version) }
           find_compatible_version(sorted_versions)
         end
 
+        sig do
+          params(sorted_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
         def find_compatible_version(sorted_versions)
           # By checking the first version separately, we can avoid additional network requests
           first_version = sorted_versions.first
@@ -92,27 +144,37 @@ module Dependabot
           sorted_versions.find { |v| version_compatible?(v.fetch(:version)) }
         end
 
+        sig { params(version: T.nilable(T.any(Dependabot::Version, String))).returns(T::Boolean) }
         def version_compatible?(version)
           str_version_compatible?(version.to_s)
         end
 
+        sig { params(version: String).returns(T::Boolean) }
         def str_version_compatible?(version)
           compatibility_checker.compatible?(version)
         end
 
+        sig { returns(Dependabot::Nuget::CompatibilityChecker) }
         def compatibility_checker
-          @compatibility_checker ||= CompatibilityChecker.new(
-            dependency_urls: dependency_urls,
-            dependency: dependency,
-            tfm_finder: TfmFinder.new(
-              dependency_files: dependency_files,
-              credentials: credentials,
-              repo_contents_path: repo_contents_path
+          @compatibility_checker ||=
+            T.let(
+              CompatibilityChecker.new(
+                dependency_urls: dependency_urls,
+                dependency: dependency,
+                tfm_finder: TfmFinder.new(
+                  dependency_files: dependency_files,
+                  credentials: credentials,
+                  repo_contents_path: repo_contents_path
+                )
+              ),
+              T.nilable(Dependabot::Nuget::CompatibilityChecker)
             )
-          )
         end
 
-        sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
+        sig do
+          params(possible_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
         def filter_prereleases(possible_versions)
           filtered = possible_versions.reject do |d|
             version = d.fetch(:version)
@@ -124,7 +186,10 @@ module Dependabot
           filtered
         end
 
-        sig { params(possible_versions: T::Array[T.untyped]).returns(T::Array[T.untyped]) }
+        sig do
+          params(possible_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
         def filter_ignored_versions(possible_versions)
           filtered = possible_versions
 
@@ -147,6 +212,10 @@ module Dependabot
           filtered
         end
 
+        sig do
+          params(possible_versions: T::Array[T::Hash[Symbol, T.untyped]])
+            .returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
         def filter_lower_versions(possible_versions)
           return possible_versions unless dependency.numeric_version
 
@@ -155,12 +224,14 @@ module Dependabot
           end
         end
 
+        sig { params(string: String).returns(T::Array[String]) }
         def parse_requirement_string(string)
           return [string] if string.match?(NUGET_RANGE_REGEX)
 
           string.split(",").map(&:strip)
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.any(Dependabot::Version, String, NilClass)]]) }
         def available_v3_versions
           v3_nuget_listings.flat_map do |listing|
             listing
@@ -181,6 +252,7 @@ module Dependabot
           end
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.any(Dependabot::Version, String, NilClass)]]) }
         def available_v2_versions
           v2_nuget_listings.flat_map do |listing|
             body = listing.fetch("xml_body", [])
@@ -200,6 +272,10 @@ module Dependabot
           end
         end
 
+        sig do
+          params(entry: Nokogiri::XML::Element)
+            .returns(T::Hash[Symbol, T.any(Dependabot::Version, String, NilClass)])
+        end
         def dependency_details_from_v2_entry(entry)
           version = entry.at_xpath("./properties/Version").content.strip
           source_urls = []
@@ -221,10 +297,11 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(version: Dependabot::Version).returns(T::Boolean) }
         def related_to_current_pre?(version)
           current_version = dependency.numeric_version
           if current_version&.prerelease? &&
-             current_version&.release == version.release
+             current_version.release == version.release
             return true
           end
 
@@ -242,36 +319,50 @@ module Dependabot
             false
           end
         end
-
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def v3_nuget_listings
           @v3_nuget_listings ||=
-            dependency_urls
-            .select { |details| details.fetch(:repository_type) == "v3" }
-            .filter_map do |url_details|
-              versions = NugetClient.get_package_versions(dependency.name, url_details)
-              next unless versions
-
-              { "versions" => versions, "listing_details" => url_details }
-            end
+            T.let(
+              dependency_urls
+              .select { |details| details.fetch(:repository_type) == "v3" }
+              .filter_map do |url_details|
+                versions = NugetClient.get_package_versions(dependency.name, url_details)
+                next unless versions
+
+                { "versions" => versions, "listing_details" => url_details }
+              end,
+              T.nilable(T::Array[T::Hash[String, T.untyped]])
+            )
         end
 
+        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
         def v2_nuget_listings
           @v2_nuget_listings ||=
-            dependency_urls
-            .select { |details| details.fetch(:repository_type) == "v2" }
-            .flat_map { |url_details| fetch_paginated_v2_nuget_listings(url_details) }
-            .filter_map do |url_details, response|
-              next unless response.status == 200
-
-              {
-                "xml_body" => response.body,
-                "listing_details" => url_details
-              }
-            end
+            T.let(
+              dependency_urls
+              .select { |details| details.fetch(:repository_type) == "v2" }
+              .flat_map { |url_details| fetch_paginated_v2_nuget_listings(url_details) }
+              .filter_map do |url_details, response|
+                next unless response.status == 200
+
+                {
+                  "xml_body" => response.body,
+                  "listing_details" => url_details
+                }
+              end,
+              T.nilable(T::Array[T::Hash[String, T.untyped]])
+            )
         end
 
+        sig do
+          params(
+            url_details: T::Hash[Symbol, T.untyped],
+            results: T::Hash[T::Hash[Symbol, T.untyped], Excon::Response]
+          )
+            .returns(T::Array[T::Array[T.untyped]])
+        end
         def fetch_paginated_v2_nuget_listings(url_details, results = {})
           response = Dependabot::RegistryClient.get(
             url: url_details[:versions_url],
@@ -295,6 +386,7 @@ module Dependabot
           results.to_a
         end
 
+        sig { params(xml_body: String).returns(T.nilable(String)) }
         def fetch_v2_next_link_href(xml_body)
           doc = Nokogiri::XML(xml_body)
           doc.remove_namespaces!
@@ -307,32 +399,44 @@ module Dependabot
           nil
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def dependency_urls
           @dependency_urls ||=
-            RepositoryFinder.new(
-              dependency: dependency,
-              credentials: credentials,
-              config_files: nuget_configs
-            ).dependency_urls
+            T.let(
+              RepositoryFinder.new(
+                dependency: dependency,
+                credentials: credentials,
+                config_files: nuget_configs
+              ).dependency_urls,
+              T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+            )
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def nuget_configs
           @nuget_configs ||=
-            dependency_files.select { |f| f.name.match?(/nuget\.config$/i) }
+            T.let(
+              dependency_files.select { |f| f.name.match?(/nuget\.config$/i) },
+              T.nilable(T::Array[Dependabot::DependencyFile])
+            )
         end
 
+        sig { returns(String) }
         def sanitized_name
           dependency.name.downcase
         end
 
+        sig { returns(T.class_of(Gem::Version)) }
         def version_class
           dependency.version_class
         end
 
+        sig { returns(T.class_of(Dependabot::Requirement)) }
         def requirement_class
           dependency.requirement_class
         end
 
+        sig { returns(T::Hash[Symbol, Integer]) }
         def excon_options
           # For large JSON files we sometimes need a little longer than for
           # other languages. For example, see:
@@ -345,6 +449,7 @@ module Dependabot
           }
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/nuget/update_checker.rb

@@ -1,47 +1,59 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/nuget/file_parser"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
+require "sorbet-runtime"
 
 module Dependabot
   module Nuget
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
       require_relative "update_checker/version_finder"
       require_relative "update_checker/property_updater"
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/dependency_finder"
 
+      sig { override.returns(T.nilable(String)) }
       def latest_version
         # No need to find latest version for transitive dependencies unless they have a vulnerability.
         return dependency.version if !dependency.top_level? && !vulnerable?
 
         # if no update sources have the requisite package, then we can only assume that the current version is correct
-        @latest_version = latest_version_details&.fetch(:version) || dependency.version
+        @latest_version = T.let(
+          latest_version_details&.fetch(:version)&.to_s || dependency.version,
+          T.nilable(String)
+        )
       end
 
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
         # We always want a full unlock since any package update could update peer dependencies as well.
         # To force a full unlock instead of an own unlock, we return nil.
         nil
       end
 
+      sig { override.returns(Dependabot::Nuget::Version) }
       def lowest_security_fix_version
         lowest_security_fix_version_details&.fetch(:version)
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         return nil if version_comes_from_multi_dependency_property?
 
         lowest_security_fix_version
       end
 
+      sig { override.returns(NilClass) }
       def latest_resolvable_version_with_no_unlock
         # Irrelevant, since Nuget has a single dependency file
         nil
       end
 
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         RequirementsUpdater.new(
           requirements: dependency.requirements,
@@ -50,6 +62,7 @@ module Dependabot
         ).updated_requirements
       end
 
+      sig { returns(T::Boolean) }
       def up_to_date?
         # No need to update transitive dependencies unless they have a vulnerability.
         return true if !dependency.top_level? && !vulnerable?
@@ -62,6 +75,7 @@ module Dependabot
         super
       end
 
+      sig { returns(T::Boolean) }
       def requirements_unlocked_or_can_be?
         # If any requirements have an uninterpolated property in them then
         # that property couldn't be found, and the requirement therefore
@@ -73,6 +87,7 @@ module Dependabot
 
       private
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def preferred_resolvable_version_details
         # If this dependency is vulnerable, prefer trying to update to the
         # lowest_resolvable_security_fix_version. Otherwise update all the way
@@ -82,6 +97,7 @@ module Dependabot
         latest_version_details
       end
 
+      sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
         # We always want a full unlock since any package update could update peer dependencies as well.
         return true unless version_comes_from_multi_dependency_property?
@@ -89,6 +105,7 @@ module Dependabot
         property_updater.update_possible?
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         return property_updater.updated_dependencies if version_comes_from_multi_dependency_property?
 
@@ -96,7 +113,7 @@ module Dependabot
 
         updated_dependency = Dependency.new(
           name: dependency.name,
-          version: latest_version&.to_s,
+          version: latest_version,
           requirements: updated_requirements,
           previous_version: dependency.version,
           previous_requirements: dependency.requirements,
@@ -112,47 +129,66 @@ module Dependabot
         updated_dependencies
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def preferred_version_details
         return lowest_security_fix_version_details if vulnerable?
 
         latest_version_details
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def latest_version_details
-        @latest_version_details ||= version_finder.latest_version_details
+        @latest_version_details ||=
+          T.let(
+            version_finder.latest_version_details,
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
       end
 
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def lowest_security_fix_version_details
         @lowest_security_fix_version_details ||=
-          version_finder.lowest_security_fix_version_details
+          T.let(
+            version_finder.lowest_security_fix_version_details,
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
       end
 
+      sig { returns(Dependabot::Nuget::UpdateChecker::VersionFinder) }
       def version_finder
         @version_finder ||=
-          VersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: @raise_on_ignored,
-            security_advisories: security_advisories,
-            repo_contents_path: @repo_contents_path
+          T.let(
+            VersionFinder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: @raise_on_ignored,
+              security_advisories: security_advisories,
+              repo_contents_path: @repo_contents_path
+            ),
+            T.nilable(Dependabot::Nuget::UpdateChecker::VersionFinder)
           )
       end
 
+      sig { returns(Dependabot::Nuget::UpdateChecker::PropertyUpdater) }
       def property_updater
         @property_updater ||=
-          PropertyUpdater.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            target_version_details: latest_version_details,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: @raise_on_ignored,
-            repo_contents_path: @repo_contents_path
+          T.let(
+            PropertyUpdater.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              target_version_details: latest_version_details,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: @raise_on_ignored,
+              repo_contents_path: @repo_contents_path
+            ),
+            T.nilable(Dependabot::Nuget::UpdateChecker::PropertyUpdater)
           )
       end
 
+      sig { returns(T::Boolean) }
       def version_comes_from_multi_dependency_property?
         declarations_using_a_property.any? do |requirement|
           property_name = requirement.fetch(:metadata).fetch(:property_name)
@@ -167,20 +203,28 @@ module Dependabot
         end
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def declarations_using_a_property
         @declarations_using_a_property ||=
-          dependency.requirements
-                    .select { |req| req.dig(:metadata, :property_name) }
+          T.let(
+            dependency.requirements
+                      .select { |req| req.dig(:metadata, :property_name) },
+            T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+          )
       end
 
+      sig { returns(T::Array[Dependabot::Dependency]) }
       def all_property_based_dependencies
         @all_property_based_dependencies ||=
-          Nuget::FileParser.new(
-            dependency_files: dependency_files,
-            source: nil
-          ).parse.select do |dep|
-            dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
-          end
+          T.let(
+            Nuget::FileParser.new(
+              dependency_files: dependency_files,
+              source: nil
+            ).parse.select do |dep|
+              dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
+            end,
+            T.nilable(T::Array[Dependabot::Dependency])
+          )
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.247.0
+  version: 0.248.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-14 00:00:00.000000000 Z
+date: 2024-03-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.247.0
+        version: 0.248.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.247.0
+        version: 0.248.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -385,7 +385,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.247.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.248.0
 post_install_message: 
 rdoc_options: []
 require_paths: