dependabot-pre_commit 0.385.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03bc6af6648e9b7de6aaa99e65db23be65615658a8756d1508e139b9541d774f
-  data.tar.gz: 59fb6fe620e22cdf60ae7a725a89c08bb81be1872c747855b2b2f975b982dd0f
+  metadata.gz: a2cfb0b6385ba550ad4b96e0f8a67066b88d6b0eeeca6c6bdb8326e416e759b3
+  data.tar.gz: d2cf43e22ab7b7e792949243c8ad026c5978e518c31ea9afe0674b03dc699fe5
 SHA512:
-  metadata.gz: e47764192a3d912d269c9e82e103a930edd7537f0f9a0948da2efd2b152bdda9ed50f3b3a123900fc6e1663987480bf4ab43c9ebd4a1359db0eeabc380c558f0
-  data.tar.gz: 8c4b2f0cc14473646bb6d210f9410a4da060be712308e250542bf19f344a57795114ef276a1dca9f4a522b7bac2f36048c9fff24c31702ffea23b3bef79b0767
+  metadata.gz: 2ba7d16160da8e821a5b50c277173329e788e09180fc32c4a64d0b2f8c40c454eb4d87b59af578b02d98588979918497b7b0414a5617b71054e98f3c312adfdf
+  data.tar.gz: bf2094a249ae2611c42058f176dab2ae835845417016ceb54542b92c7df3bd985af2353350c61ebc883c6f7f7edc1563feee2f67b0d6404a38d14b2a50043868

data/lib/dependabot/pre_commit/additional_dependency_checkers/base.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -41,9 +41,9 @@ module Dependabot
 
         sig do
           params(
-            source: T::Hash[Symbol, T.untyped],
+            source: T::Hash[Symbol, Object],
             credentials: T::Array[Dependabot::Credential],
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[T::Hash[Symbol, Object]],
             current_version: T.nilable(String),
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
@@ -65,18 +65,18 @@ module Dependabot
         # Generate updated requirements for the new version
         # Should preserve the original version constraint operator (>=, ~=, etc.)
         # and update the source hash with the new original_string
-        sig { abstract.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { abstract.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version); end
 
         private
 
-        sig { returns(T::Hash[Symbol, T.untyped]) }
+        sig { returns(T::Hash[Symbol, Object]) }
         attr_reader :source
 
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         attr_reader :requirements
 
         sig { returns(T.nilable(String)) }
@@ -89,6 +89,12 @@ module Dependabot
         def package_name
           source[:package_name]&.to_s
         end
+
+        sig { params(requirement: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
+        def requirement_string(requirement)
+          value = requirement&.dig(:requirement)
+          value if value.is_a?(String)
+        end
       end
     end
   end

data/lib/dependabot/pre_commit/additional_dependency_checkers/dart.rb

@@ -24,14 +24,14 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]
             next original_req unless original_source.is_a?(Hash)
             next original_req unless original_source[:type] == "additional_dependency"
 
-            original_requirement = original_req[:requirement]
+            original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(

data/lib/dependabot/pre_commit/additional_dependency_checkers/go.rb

@@ -24,7 +24,7 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]

data/lib/dependabot/pre_commit/additional_dependency_checkers/node.rb

@@ -25,14 +25,14 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]
             next original_req unless original_source.is_a?(Hash)
             next original_req unless original_source[:type] == "additional_dependency"
 
-            original_requirement = original_req[:requirement]
+            original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
@@ -112,7 +112,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_version_from_requirement
-          req_string = requirements.first&.dig(:requirement)
+          req_string = requirement_string(requirements.first)
           return nil unless req_string
 
           version_part = req_string.sub(/\A[~^]|[><=]+\s*/, "")

data/lib/dependabot/pre_commit/additional_dependency_checkers/python.rb

@@ -26,14 +26,14 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]
             next original_req unless original_source.is_a?(Hash)
             next original_req unless original_source[:type] == "additional_dependency"
 
-            original_requirement = original_req[:requirement]
+            original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
@@ -126,7 +126,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_version_from_requirement
-          req_string = requirements.first&.dig(:requirement)
+          req_string = requirement_string(requirements.first)
           return nil unless req_string
 
           match = req_string.match(/[\d]+(?:\.[\d]+)*(?:\.?\w+)*/)

data/lib/dependabot/pre_commit/additional_dependency_checkers/ruby.rb

@@ -25,14 +25,14 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]
             next original_req unless original_source.is_a?(Hash)
             next original_req unless original_source[:type] == "additional_dependency"
 
-            original_requirement = original_req[:requirement]
+            original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
@@ -112,7 +112,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_version_from_requirement
-          req_string = requirements.first&.dig(:requirement)
+          req_string = requirement_string(requirements.first)
           return nil unless req_string
 
           version_part = req_string.sub(/\A[~><=!]+\s*/, "").strip

data/lib/dependabot/pre_commit/additional_dependency_checkers/rust.rb

@@ -25,14 +25,14 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
         def updated_requirements(latest_version)
           requirements.map do |original_req|
             original_source = original_req[:source]
             next original_req unless original_source.is_a?(Hash)
             next original_req unless original_source[:type] == "additional_dependency"
 
-            original_requirement = original_req[:requirement]
+            original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
@@ -113,7 +113,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def extract_version_from_requirement
-          req_string = requirements.first&.dig(:requirement)
+          req_string = requirement_string(requirements.first)
           return nil unless req_string
 
           version_part = req_string.sub(/\A(?:[~^]|[><=]+)\s*/, "")

data/lib/dependabot/pre_commit/file_fetcher.rb

@@ -33,7 +33,7 @@ module Dependabot
         end
       end
 
-      sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { override.returns(T.nilable(T::Hash[Symbol, Object])) }
       def ecosystem_versions
         nil
       end

data/lib/dependabot/pre_commit/file_parser/hook_language_fetcher.rb

@@ -29,7 +29,7 @@ module Dependabot
         end
         def initialize(credentials:)
           @credentials = credentials
-          @hooks_cache = T.let({}, T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])])
+          @hooks_cache = T.let({}, T::Hash[String, T.nilable(T::Array[T::Hash[String, Object]])])
         end
 
         # Fetches the language for a specific hook from the hook source repository.
@@ -64,7 +64,7 @@ module Dependabot
           params(
             repo_url: String,
             revision: String
-          ).returns(T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
         end
         def fetch_hooks_from_repo(repo_url, revision)
           cache_key = "#{repo_url}@#{revision}"
@@ -79,7 +79,7 @@ module Dependabot
           params(
             repo_url: String,
             revision: String
-          ).returns(T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
         end
         def fetch_hooks_internal(repo_url, revision)
           source = Source.from_url(repo_url)
@@ -96,7 +96,7 @@ module Dependabot
           params(
             source: Dependabot::Source,
             revision: String
-          ).returns(T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
         end
         def fetch_from_github(source, revision)
           response = github_client.send(
@@ -121,7 +121,7 @@ module Dependabot
           params(
             repo_url: String,
             revision: String
-          ).returns(T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
         end
         def fetch_via_git_clone(repo_url, revision)
           source = Source.from_url(repo_url)
@@ -157,7 +157,7 @@ module Dependabot
           nil
         end
 
-        sig { params(content: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+        sig { params(content: String).returns(T.nilable(T::Array[T::Hash[String, Object]])) }
         def parse_hooks_yaml(content)
           yaml = YAML.safe_load(content, aliases: true)
           return nil unless yaml.is_a?(Array)

data/lib/dependabot/pre_commit/file_parser.rb

@@ -37,7 +37,7 @@ module Dependabot
           "ruby" => ->(dep_string) { Dependabot::Bundler::Requirement.parse_dep_string(dep_string) },
           "dart" => ->(dep_string) { Dependabot::Pub::Requirement.parse_dep_string(dep_string) }
         }.freeze,
-        T::Hash[String, T.proc.params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped]))]
+        T::Hash[String, T.proc.params(dep_string: String).returns(T.nilable(T::Hash[Symbol, Object]))]
       )
 
       sig { override.returns(Ecosystem) }
@@ -77,6 +77,8 @@ module Dependabot
         return dependency_set unless yaml.is_a?(Hash)
 
         repos = yaml.fetch("repos", [])
+        return dependency_set unless repos.is_a?(Array)
+
         repos.each do |repo|
           next unless repo.is_a?(Hash)
 
@@ -94,7 +96,7 @@ module Dependabot
 
       sig do
         params(
-          repo: T::Hash[String, T.untyped],
+          repo: T::Hash[String, Object],
           file: Dependabot::DependencyFile
         ).returns(T.nilable(Dependency))
       end
@@ -102,7 +104,7 @@ module Dependabot
         repo_url = repo["repo"]
         rev = repo["rev"]
 
-        return nil if repo_url.nil? || rev.nil?
+        return nil unless repo_url.is_a?(String) && rev.is_a?(String)
         return nil if %w(local meta).include?(repo_url)
 
         comment = rev_line_comment(file, repo_url)
@@ -128,7 +130,7 @@ module Dependabot
 
       sig do
         params(
-          repo: T::Hash[String, T.untyped],
+          repo: T::Hash[String, Object],
           file: Dependabot::DependencyFile
         ).returns(T::Array[Dependabot::Dependency])
       end
@@ -137,9 +139,14 @@ module Dependabot
         repo_url = repo["repo"]
         revision = repo["rev"]
 
-        return dependencies if repo_url.nil? || %w(local meta).include?(repo_url)
+        return dependencies unless repo_url.is_a?(String)
+        return dependencies if %w(local meta).include?(repo_url)
+
+        revision = nil unless revision.is_a?(String)
 
         hooks = repo.fetch("hooks", [])
+        return dependencies unless hooks.is_a?(Array)
+
         hooks.each do |hook|
           next unless hook.is_a?(Hash)
 
@@ -152,7 +159,7 @@ module Dependabot
 
       sig do
         params(
-          hook: T::Hash[String, T.untyped],
+          hook: T::Hash[String, Object],
           repo_url: String,
           revision: T.nilable(String),
           file: Dependabot::DependencyFile
@@ -162,9 +169,10 @@ module Dependabot
         dependencies = []
         hook_id = hook["id"]
 
-        return dependencies unless hook_id
+        return dependencies unless hook_id.is_a?(String)
 
         additional_deps = hook.fetch("additional_dependencies", [])
+        return dependencies unless additional_deps.is_a?(Array)
         return dependencies if additional_deps.empty?
 
         # Get language from local config first, then try fetching from hook source repo
@@ -178,28 +186,9 @@ module Dependabot
           next unless dep_string.is_a?(String)
 
           parsed = parser.call(dep_string)
-          next unless parsed
-
-          dependencies << Dependabot::Dependency.new(
-            name: parsed[:normalised_name],
-            version: parsed[:version],
-            requirements: [{
-              requirement: parsed[:requirement],
-              groups: ["additional_dependencies"],
-              file: file.name,
-              source: {
-                type: "additional_dependency",
-                language: language,
-                package_name: parsed[:normalised_name],
-                original_name: parsed[:name],
-                hook_id: hook_id,
-                hook_repo: repo_url,
-                extras: parsed[:extras],
-                original_string: dep_string
-              }
-            }],
-            package_manager: ECOSYSTEM
-          )
+          source_details = { language: language, hook_id: hook_id, repo_url: repo_url }
+          dependency = parsed && build_additional_dependency(parsed, dep_string, source_details, file)
+          dependencies << dependency if dependency
         end
 
         dependencies
@@ -207,7 +196,56 @@ module Dependabot
 
       sig do
         params(
-          hook: T::Hash[String, T.untyped],
+          parsed: T::Hash[Symbol, Object],
+          dep_string: String,
+          source_details: T::Hash[Symbol, String],
+          file: Dependabot::DependencyFile
+        ).returns(T.nilable(Dependabot::Dependency))
+      end
+      def build_additional_dependency(parsed, dep_string, source_details, file)
+        normalised_name = parsed[:normalised_name]
+        return unless normalised_name.is_a?(String)
+
+        version = parsed[:version]
+        return unless version.nil? || version.is_a?(String) || version.is_a?(Dependabot::Version)
+
+        Dependabot::Dependency.new(
+          name: normalised_name,
+          version: version,
+          requirements: [additional_dependency_requirement(parsed, dep_string, source_details, file)],
+          package_manager: ECOSYSTEM
+        )
+      end
+
+      sig do
+        params(
+          parsed: T::Hash[Symbol, Object],
+          dep_string: String,
+          source_details: T::Hash[Symbol, String],
+          file: Dependabot::DependencyFile
+        ).returns(T::Hash[Symbol, Object])
+      end
+      def additional_dependency_requirement(parsed, dep_string, source_details, file)
+        {
+          requirement: parsed[:requirement],
+          groups: ["additional_dependencies"],
+          file: file.name,
+          source: {
+            type: "additional_dependency",
+            language: source_details.fetch(:language),
+            package_name: parsed[:normalised_name],
+            original_name: parsed[:name],
+            hook_id: source_details.fetch(:hook_id),
+            hook_repo: source_details.fetch(:repo_url),
+            extras: parsed[:extras],
+            original_string: dep_string
+          }
+        }
+      end
+
+      sig do
+        params(
+          hook: T::Hash[String, Object],
           repo_url: String,
           revision: T.nilable(String),
           hook_id: String
@@ -216,7 +254,7 @@ module Dependabot
       def resolve_hook_language(hook, repo_url, revision, hook_id)
         # Use local language if explicitly specified
         local_language = hook["language"]
-        return local_language if local_language
+        return local_language if local_language.is_a?(String)
 
         # Otherwise fetch from the hook source repository
         return nil unless revision

data/lib/dependabot/pre_commit/file_updater.rb

@@ -60,7 +60,7 @@ module Dependabot
 
       sig do
         params(file: Dependabot::DependencyFile)
-          .returns(T::Array[[T::Hash[Symbol, T.untyped], T::Hash[Symbol, T.untyped]]])
+          .returns(T::Array[[T::Hash[Symbol, Object], T::Hash[Symbol, Object]]])
       end
       def requirement_pairs_for_file(file)
         pairs = dependency.requirements.zip(T.must(dependency.previous_requirements))
@@ -70,8 +70,8 @@ module Dependabot
           file_name = T.cast(new_req[:file], T.nilable(String))
           next true if file_name != file.name
 
-          new_source = T.cast(new_req[:source], T.nilable(T::Hash[Symbol, T.untyped]))
-          old_source = T.cast(old_req[:source], T.nilable(T::Hash[Symbol, T.untyped]))
+          new_source = T.cast(new_req[:source], T.nilable(T::Hash[Symbol, Object]))
+          old_source = T.cast(old_req[:source], T.nilable(T::Hash[Symbol, Object]))
           new_source == old_source
         end
 
@@ -81,12 +81,12 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, T.untyped],
-          old_req: T::Hash[Symbol, T.untyped]
+          new_req: T::Hash[Symbol, Object],
+          old_req: T::Hash[Symbol, Object]
         ).returns(String)
       end
       def apply_requirement_update(content, new_req, old_req)
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, T.untyped])
+        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
         source_type = T.cast(new_source.fetch(:type), String)
 
         case source_type
@@ -102,18 +102,18 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, T.untyped],
-          old_req: T::Hash[Symbol, T.untyped]
+          new_req: T::Hash[Symbol, Object],
+          old_req: T::Hash[Symbol, Object]
         ).returns(String)
       end
       def apply_git_requirement_update(content, new_req, old_req)
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, T.untyped])
-        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, T.untyped])
+        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
+        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, Object])
         repo_url = T.cast(old_source.fetch(:url), String)
         old_ref = T.cast(old_source.fetch(:ref), String)
         new_ref = T.cast(new_source.fetch(:ref), String)
 
-        new_metadata = T.cast(new_req.fetch(:metadata, {}), T::Hash[Symbol, T.untyped])
+        new_metadata = T.cast(new_req.fetch(:metadata, {}), T::Hash[Symbol, Object])
         old_version = T.cast(new_metadata[:comment_version], T.nilable(String))
         new_version = T.cast(new_metadata[:new_comment_version], T.nilable(String))
 
@@ -130,13 +130,13 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, T.untyped],
-          old_req: T::Hash[Symbol, T.untyped]
+          new_req: T::Hash[Symbol, Object],
+          old_req: T::Hash[Symbol, Object]
         ).returns(String)
       end
       def apply_additional_dependency_update(content, new_req, old_req)
-        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, T.untyped])
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, T.untyped])
+        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, Object])
+        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
 
         old_string = T.cast(old_source.fetch(:original_string), String)
         new_string = T.cast(new_source.fetch(:original_string), String)

data/lib/dependabot/pre_commit/helpers.rb

@@ -20,7 +20,7 @@ module Dependabot
             ignored_versions: T::Array[String],
             raise_on_ignored: T::Boolean,
             consider_version_branches_pinned: T::Boolean,
-            dependency_source_details: T.nilable(T::Hash[Symbol, String])
+            dependency_source_details: T.nilable(T::Hash[Symbol, Object])
           )
             .void
         end
@@ -60,11 +60,11 @@ module Dependabot
           )
         end
 
-        sig { params(source: T.nilable(T::Hash[Symbol, String])).returns(Dependabot::GitCommitChecker) }
+        sig { params(source: T.nilable(T::Hash[Symbol, Object])).returns(Dependabot::GitCommitChecker) }
         def git_commit_checker_for(source)
           @git_commit_checkers ||= T.let(
             {},
-            T.nilable(T::Hash[T.nilable(T::Hash[Symbol, String]), Dependabot::GitCommitChecker])
+            T.nilable(T::Hash[T.nilable(T::Hash[Symbol, Object]), Dependabot::GitCommitChecker])
           )
 
           @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(

data/lib/dependabot/pre_commit/package/package_details_fetcher.rb

@@ -62,7 +62,9 @@ module Dependabot
         def version_tag_release
           return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
 
-          latest_version = latest_version_tag&.fetch(:version)
+          latest_version = pre_commit_version(latest_version_tag&.fetch(:version))
+          return unless latest_version
+
           return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
 
           latest_version
@@ -74,7 +76,7 @@ module Dependabot
 
           if latest_version_tag
             if git_commit_checker.local_tag_for_pinned_sha || version_comment?
-              return T.must(latest_version_tag).fetch(:version)
+              return pre_commit_version(T.must(latest_version_tag).fetch(:version))
             end
 
             return latest_commit_for_pinned_ref
@@ -83,7 +85,7 @@ module Dependabot
           latest_commit_for_pinned_ref
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_version_tag
           @latest_version_tag ||= T.let(
             begin
@@ -96,13 +98,20 @@ module Dependabot
 
               git_commit_checker.local_ref_for_latest_version_lower_precision
             end,
-            T.nilable(T::Hash[Symbol, T.untyped])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
         private
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { params(version: Object).returns(T.nilable(Dependabot::Version)) }
+        def pre_commit_version(version)
+          return unless version.is_a?(String) || version.is_a?(Gem::Version)
+
+          Dependabot::PreCommit::Version.new(version.to_s)
+        end
+
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def constrained_latest_version_tag
           frozen_ref = frozen_comment_ref
           return nil unless frozen_ref
@@ -199,7 +208,7 @@ module Dependabot
               if head_commit_for_ref_sha
                 head_commit_for_ref_sha
               else
-                url = git_commit_checker.dependency_source_details&.fetch(:url)
+                url = git_commit_checker.dependency_source_details&.url
                 source = T.must(Source.from_url(url))
 
                 SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
@@ -208,7 +217,7 @@ module Dependabot
                   SharedHelpers.run_shell_command("git clone --no-recurse-submodules #{url} #{repo_contents_path}")
 
                   Dir.chdir(repo_contents_path) do
-                    ref_branch = find_container_branch(git_commit_checker.dependency_source_details&.fetch(:ref))
+                    ref_branch = find_container_branch(T.must(git_commit_checker.dependency_source_details&.ref))
                     git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
                   end
                 end
@@ -238,12 +247,15 @@ module Dependabot
         end
 
         sig do
-          params(tags_array: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[T::Hash[Symbol, T.untyped]])
+          params(tags_array: T::Array[T::Hash[Symbol, Object]]).returns(T::Array[T::Hash[Symbol, Object]])
         end
         def filter_lower_tags(tags_array)
           return tags_array unless current_version
 
-          tags_array.select { |tag| tag.fetch(:version) > current_version }
+          tags_array.select do |tag|
+            version = tag.fetch(:version)
+            version.is_a?(Gem::Version) && version > current_version
+          end
         end
 
         sig { returns(T::Boolean) }

data/lib/dependabot/pre_commit/update_checker/latest_version_finder.rb

@@ -30,7 +30,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             raise_on_ignored: T::Boolean,
-            options: T::Hash[Symbol, T.untyped],
+            options: T::Hash[Symbol, Object],
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
@@ -50,7 +50,7 @@ module Dependabot
           @raise_on_ignored    = raise_on_ignored
           @options             = options
           @cooldown_options = cooldown_options
-          @cooldown_selected_tag = T.let(nil, T.nilable(T::Hash[Symbol, T.untyped]))
+          @cooldown_selected_tag = T.let(nil, T.nilable(T::Hash[Symbol, Object]))
           @cooldown_rejected_all = T.let(false, T::Boolean)
 
           @git_helper = T.let(git_helper, Dependabot::PreCommit::Helpers::Githelper)
@@ -94,7 +94,7 @@ module Dependabot
           filter_release_with_cooldown(release)
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_version_tag
           return nil if @cooldown_rejected_all
 
@@ -103,7 +103,7 @@ module Dependabot
 
         sig { override.returns(T.nilable(String)) }
         def cooldown_source_url
-          @git_helper.git_commit_checker.dependency_source_details&.fetch(:url)
+          @git_helper.git_commit_checker.dependency_source_details&.url
         end
 
         sig { override.returns(T::Array[Dependabot::Credential]) }
@@ -155,11 +155,11 @@ module Dependabot
           )
         end
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def available_latest_version_tag
           @latest_version_tag = T.let(
             T.must(package_details_fetcher).latest_version_tag,
-            T.nilable(T::Hash[Symbol, T.untyped])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
@@ -193,7 +193,7 @@ module Dependabot
         # - current_version when ALL candidates have releases and all are in cooldown
         # - nil when no releases exist or some candidates lack releases (triggers git fallback)
         sig do
-          params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
+          params(candidates: T::Array[T::Hash[Symbol, Object]])
             .returns(T.nilable(Dependabot::Version))
         end
         def check_candidates_via_github_releases(candidates)
@@ -204,7 +204,7 @@ module Dependabot
           all_have_releases = T.let(true, T::Boolean)
 
           candidates.each do |tag|
-            tag_name = normalize_tag_name(tag[:tag] || "v#{tag[:version]}")
+            tag_name = normalize_tag_name((tag[:tag] || "v#{tag[:version]}").to_s)
             release = releases.find { |r| r.tag_name == tag_name }
 
             unless release&.published_at
@@ -215,7 +215,7 @@ module Dependabot
             unless release_in_cooldown_period?(release.published_at)
               log_cooldown_result(filtered_count, tag[:version], release.published_at)
               @cooldown_selected_tag = tag
-              return T.cast(tag[:version], Dependabot::Version)
+              return version_from_tag(tag)
             end
 
             filtered_count += 1
@@ -238,7 +238,7 @@ module Dependabot
         # Checks candidate tags inside a bare clone directory, returning the first
         # version whose tag creation date falls outside the cooldown window.
         sig do
-          params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
+          params(candidates: T::Array[T::Hash[Symbol, Object]])
             .returns(T.nilable(Dependabot::Version))
         end
         def check_candidates_via_git_clone(candidates)
@@ -260,7 +260,7 @@ module Dependabot
         # Prefers GitHub Release published_at when available for a candidate,
         # falling back to tag creation date from the cloned repo.
         sig do
-          params(candidates: T::Array[T::Hash[Symbol, T.untyped]])
+          params(candidates: T::Array[T::Hash[Symbol, Object]])
             .returns(T.nilable(Dependabot::Version))
         end
         def check_candidates_cooldown(candidates)
@@ -268,9 +268,9 @@ module Dependabot
 
           candidates.each do |tag|
             commit_sha = tag[:commit_sha]
-            next unless commit_sha
+            next unless commit_sha.is_a?(String)
 
-            tag_name = normalize_tag_name(tag[:tag] || "v#{tag[:version]}")
+            tag_name = normalize_tag_name((tag[:tag] || "v#{tag[:version]}").to_s)
             release_date = resolve_candidate_date(tag_name, commit_sha)
 
             if release_in_cooldown_period?(release_date)
@@ -278,7 +278,7 @@ module Dependabot
             else
               log_cooldown_result(filtered_count, tag[:version], release_date)
               @cooldown_selected_tag = tag
-              return T.cast(tag[:version], Dependabot::Version)
+              return version_from_tag(tag)
             end
           end
 
@@ -290,7 +290,7 @@ module Dependabot
         end
 
         sig do
-          params(filtered_count: Integer, version: T.untyped, release_date: Time).void
+          params(filtered_count: Integer, version: Object, release_date: Time).void
         end
         def log_cooldown_result(filtered_count, version, release_date)
           if filtered_count.positive?
@@ -301,9 +301,17 @@ module Dependabot
           Dependabot.logger.info("Selected version #{version} (released #{release_date})")
         end
 
+        sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Dependabot::Version)) }
+        def version_from_tag(tag)
+          version = tag[:version]
+          return unless version.is_a?(String) || version.is_a?(Gem::Version)
+
+          Dependabot::PreCommit::Version.new(version.to_s)
+        end
+
         # Returns all version tags > current_version, sorted descending (latest first).
         # This ensures we evaluate from the newest candidate downward.
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def version_candidates_descending
           # When pinned to a SHA, precision matching against the SHA is meaningless
           # (a SHA has no dots, so precision=1 matches nothing useful).
@@ -315,11 +323,12 @@ module Dependabot
                      end
           cur_version = current_version
 
-          all_tags
-            .select { |tag| tag[:version].is_a?(Gem::Version) }
-            .select { |tag| cur_version.nil? || tag[:version] > cur_version }
-            .sort_by { |tag| tag[:version] }
-            .reverse
+          candidates = all_tags.select do |tag|
+            version = version_from_tag(tag)
+            version && (cur_version.nil? || version > cur_version)
+          end
+
+          candidates.sort_by { |tag| T.must(version_from_tag(tag)) }.reverse
         end
 
         sig { params(release_date: Time).returns(T::Boolean) }

data/lib/dependabot/pre_commit/update_checker.rb

@@ -50,7 +50,7 @@ module Dependabot
         return wrap_requirements(additional_dependency_updated_requirements) if additional_dependency?
 
         updated_reqs = dependency.requirements.map do |req|
-          source = T.cast(req[:source], T.nilable(T::Hash[Symbol, T.untyped]))
+          source = T.cast(req[:source], T.nilable(T::Hash[Symbol, Object]))
           updated = updated_ref(source)
           next req unless updated
 
@@ -146,7 +146,7 @@ module Dependabot
             if head_commit_for_ref_sha
               head_commit_for_ref_sha
             else
-              url = T.cast(git_commit_checker.dependency_source_details&.fetch(:url), T.nilable(String))
+              url = git_commit_checker.dependency_source_details&.url
               source = T.must(Source.from_url(T.must(url)))
 
               SharedHelpers.in_a_temporary_directory(File.dirname(source.repo)) do |temp_dir|
@@ -155,7 +155,7 @@ module Dependabot
                 SharedHelpers.run_shell_command("git clone --no-recurse-submodules #{url} #{repo_contents_path}")
 
                 Dir.chdir(repo_contents_path) do
-                  ref = T.cast(git_commit_checker.dependency_source_details&.fetch(:ref), T.nilable(String))
+                  ref = git_commit_checker.dependency_source_details&.ref
                   ref_branch = find_container_branch(T.must(ref))
                   git_commit_checker.head_commit_for_local_branch(ref_branch) if ref_branch
                 end
@@ -166,7 +166,7 @@ module Dependabot
         )
       end
 
-      sig { params(source: T.nilable(T::Hash[Symbol, T.untyped])).returns(T.nilable(String)) }
+      sig { params(source: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
       def updated_ref(source)
         return unless git_commit_checker.git_dependency?
 
@@ -213,12 +213,12 @@ module Dependabot
 
       sig do
         params(
-          req: T::Hash[Symbol, T.untyped],
+          req: T::Hash[Symbol, Object],
           new_ref: String
-        ).returns(T::Hash[Symbol, T.untyped])
+        ).returns(T::Hash[Symbol, Object])
       end
       def updated_comment_version_metadata(req, new_ref)
-        existing_metadata = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, T.untyped])
+        existing_metadata = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, Object])
         comment = T.cast(existing_metadata[:comment], T.nilable(String))
         return existing_metadata unless comment
 
@@ -244,7 +244,7 @@ module Dependabot
             comment = T.let(
               @dependency.requirements
                 .filter_map do |req|
-                  val = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, T.untyped])[:comment]
+                  val = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, Object])[:comment]
                   T.cast(val, T.nilable(String))
                 end
                 .first,
@@ -310,7 +310,7 @@ module Dependabot
         requirement = dependency.requirements.first
         return false unless requirement
 
-        source = T.cast(requirement[:source], T.nilable(T::Hash[Symbol, T.untyped]))
+        source = T.cast(requirement[:source], T.nilable(T::Hash[Symbol, Object]))
         return false unless source
 
         T.cast(source[:type], T.nilable(String)) == "additional_dependency"
@@ -318,7 +318,7 @@ module Dependabot
 
       sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def additional_dependency_latest_version
-        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, T.untyped])
+        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, Object])
         language = T.cast(source[:language], T.nilable(String))
         return nil unless language && AdditionalDependencyCheckers.supported?(language)
 
@@ -331,9 +331,9 @@ module Dependabot
         latest
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
       def additional_dependency_updated_requirements
-        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, T.untyped])
+        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, Object])
         language = T.cast(source[:language], T.nilable(String))
         return dependency.requirements unless language && AdditionalDependencyCheckers.supported?(language)
 
@@ -349,7 +349,7 @@ module Dependabot
       sig do
         params(
           language: String,
-          source: T::Hash[Symbol, T.untyped]
+          source: T::Hash[Symbol, Object]
         ).returns(T.nilable(Dependabot::PreCommit::AdditionalDependencyCheckers::Base))
       end
       def additional_dependency_checker(language, source)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pre_commit
 version: !ruby/object:Gem::Version
-  version: 0.385.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,84 +15,84 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-cargo
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-common
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-go_modules
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-npm_and_yarn
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.385.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -338,7 +338,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib