dependabot-pre_commit 0.391.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9441e66480f1aea2a7e43207c74d5178202caed571c30028cbd96a0c5cbb288
-  data.tar.gz: 67b88470726c62075fd8f0241596f10b1f739c6c2f9cf5896fdb8b2fb99abc5e
+  metadata.gz: 2bfe9bb22dc185a3f722c6fdcbe055916d6f397b93056d5f7bb82f38a6d1722e
+  data.tar.gz: 14564e38830155479234245206f051bbed756090da8eae6f20d8757d41188471
 SHA512:
-  metadata.gz: d65531a2e9e8ed53dae84924607b6fc810cce99fde8cf8074ecae41c16e1a3f4ef12d561957deb996deba4fb96cf25953d5fe7d74930f895cdba1a2b6a877fec
-  data.tar.gz: b1722f3541c5a4d4fed125d4a3d5018099d09d33fa39fdd73917bc7dcea60d436c9c41970ab16ddddd1657557c7ee7599b1d94b60cb89c62007b3e9d22186220
+  metadata.gz: 0a978739dd13991e522432c9ce44186414a713b4366dfa9f023199e3b54413ffc86e850d21c9544235435980bd0419f8aa97c7e96ed7a31a6d789318ba50028b
+  data.tar.gz: da754260a6103bfc2575d468c92c9313e93ddccd78215d524e85f9537461709f1186e2d0b6fa833ddaf4279edd73dc305f893c3eb28d6baf381c55d6d63f6216

data/lib/dependabot/pre_commit/additional_dependency_checkers/base.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/dependency_requirement"
 require "dependabot/package/release_cooldown_options"
 
 module Dependabot
@@ -41,9 +42,9 @@ module Dependabot
 
         sig do
           params(
-            source: T::Hash[Symbol, Object],
+            source: Dependabot::DependencyRequirement::ObjectHash,
             credentials: T::Array[Dependabot::Credential],
-            requirements: T::Array[T::Hash[Symbol, Object]],
+            requirements: T::Array[Dependabot::DependencyRequirement],
             current_version: T.nilable(String),
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
@@ -51,7 +52,10 @@ module Dependabot
         def initialize(source:, credentials:, requirements:, current_version:, cooldown_options: nil)
           @source = source
           @credentials = credentials
-          @requirements = requirements
+          @requirements = T.let(
+            requirements.map { |requirement| Dependabot::DependencyRequirement.create(requirement) },
+            T::Array[Dependabot::DependencyRequirement]
+          )
           @current_version = current_version
           @cooldown_options = cooldown_options
         end
@@ -65,18 +69,21 @@ module Dependabot
         # Generate updated requirements for the new version
         # Should preserve the original version constraint operator (>=, ~=, etc.)
         # and update the source hash with the new original_string
-        sig { abstract.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          abstract.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version); end
 
         private
 
-        sig { returns(T::Hash[Symbol, Object]) }
+        sig { returns(Dependabot::DependencyRequirement::ObjectHash) }
         attr_reader :source
 
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
         sig { returns(T.nilable(String)) }
@@ -87,13 +94,80 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def package_name
-          source[:package_name]&.to_s
+          source_string(source, "package_name")
         end
 
-        sig { params(requirement: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
+        sig do
+          params(requirement: T.nilable(Dependabot::DependencyRequirement))
+            .returns(T.nilable(String))
+        end
         def requirement_string(requirement)
-          value = requirement&.dig(:requirement)
-          value if value.is_a?(String)
+          requirement&.requirement_string
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::DependencyRequirement
+          ).returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash))
+        end
+        def additional_dependency_source(requirement)
+          details = requirement.source_hash
+          return unless details
+          return unless source_string(details, "type") == "additional_dependency"
+
+          details
+        end
+
+        sig do
+          params(
+            requirement: Dependabot::DependencyRequirement,
+            new_requirement: T.nilable(String),
+            original_string: String
+          ).returns(Dependabot::DependencyRequirement)
+        end
+        def build_requirement_entry(requirement, new_requirement:, original_string:)
+          original_source = T.must(additional_dependency_source(requirement))
+          new_source = source_with_value(original_source, "original_string", original_string)
+
+          Dependabot::DependencyRequirement.create(
+            requirement.merge(requirement: new_requirement, source: new_source)
+          )
+        end
+
+        sig do
+          params(
+            details: Dependabot::DependencyRequirement::ObjectHash,
+            key: String
+          ).returns(T.nilable(String))
+        end
+        def source_string(details, key)
+          value = details.key?(key.to_sym) ? details[key.to_sym] : details[key]
+          return if value.nil?
+          return value if value.is_a?(String)
+
+          raise TypeError, "source #{key} must be a string or nil"
+        end
+
+        sig do
+          params(
+            details: Dependabot::DependencyRequirement::ObjectHash,
+            key: String,
+            value: Object
+          ).returns(Dependabot::DependencyRequirement::ObjectHash)
+        end
+        def source_with_value(details, key, value)
+          updated = details.dup
+          actual_key = if details.key?(key.to_sym)
+                         key.to_sym
+                       elsif details.key?(key)
+                         key
+                       elsif details.keys.any?(Symbol)
+                         key.to_sym
+                       else
+                         key
+                       end
+          updated[actual_key] = value
+          updated
         end
       end
     end

data/lib/dependabot/pre_commit/additional_dependency_checkers/dart.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -24,26 +24,28 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
-              package_name: original_source[:original_name] || original_source[:package_name],
+              package_name: source_string(original_source, "original_name") ||
+                            source_string(original_source, "package_name"),
               requirement: new_requirement
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end

data/lib/dependabot/pre_commit/additional_dependency_checkers/go.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -24,25 +24,27 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             new_requirement = "v#{latest_version}"
 
             new_original_string = build_original_string(
-              original_name: original_source[:original_name] || original_source[:package_name],
+              original_name: source_string(original_source, "original_name") ||
+                             source_string(original_source, "package_name"),
               requirement: new_requirement
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end

data/lib/dependabot/pre_commit/additional_dependency_checkers/node.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -25,26 +25,28 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
-              package_name: original_source[:original_name] || original_source[:package_name],
+              package_name: source_string(original_source, "original_name") ||
+                            source_string(original_source, "package_name"),
               requirement: new_requirement
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end

data/lib/dependabot/pre_commit/additional_dependency_checkers/python.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -26,27 +26,29 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
-              original_name: original_source[:original_name] || original_source[:package_name],
-              extras: original_source[:extras],
+              original_name: source_string(original_source, "original_name") ||
+                             source_string(original_source, "package_name"),
+              extras: source_string(original_source, "extras"),
               requirement: new_requirement
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end
@@ -180,14 +182,15 @@ module Dependabot
           )
 
           updated_reqs = updater.updated_requirements
-          updated_req = updated_reqs.first&.fetch(:requirement, nil)
+          updated_req = updated_reqs.first&.requirement
 
           return ">=#{new_version}" if updated_req == :unfixable
 
-          if updated_req == original_requirement
+          updated_req_string = T.cast(updated_req, T.nilable(String))
+          if updated_req_string == original_requirement
             force_bump_lower_bounds(original_requirement, new_version)
           else
-            updated_req || ">=#{new_version}"
+            updated_req_string || ">=#{new_version}"
           end
         end
 

data/lib/dependabot/pre_commit/additional_dependency_checkers/ruby.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -25,26 +25,28 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
-              package_name: original_source[:original_name] || original_source[:package_name],
+              package_name: source_string(original_source, "original_name") ||
+                            source_string(original_source, "package_name"),
               requirement: new_requirement
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end

data/lib/dependabot/pre_commit/additional_dependency_checkers/rust.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -25,27 +25,29 @@ module Dependabot
           )
         end
 
-        sig { override.params(latest_version: String).returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig do
+          override.params(latest_version: String)
+                  .returns(T::Array[Dependabot::DependencyRequirement])
+        end
         def updated_requirements(latest_version)
           requirements.map do |original_req|
-            original_source = original_req[:source]
-            next original_req unless original_source.is_a?(Hash)
-            next original_req unless original_source[:type] == "additional_dependency"
+            original_source = additional_dependency_source(original_req)
+            next original_req unless original_source
 
             original_requirement = requirement_string(original_req)
             new_requirement = build_updated_requirement(original_requirement, latest_version)
 
             new_original_string = build_original_string(
-              package_name: original_source[:original_name] || original_source[:package_name],
+              package_name: source_string(original_source, "original_name") ||
+                            source_string(original_source, "package_name"),
               requirement: new_requirement,
-              cli: original_source[:extras] == "cli"
+              cli: source_string(original_source, "extras") == "cli"
             )
 
-            new_source = original_source.merge(original_string: new_original_string)
-
-            original_req.merge(
-              requirement: new_requirement,
-              source: new_source
+            build_requirement_entry(
+              original_req,
+              new_requirement: new_requirement,
+              original_string: new_original_string
             )
           end
         end

data/lib/dependabot/pre_commit/file_parser/hook_language_fetcher.rb

@@ -99,15 +99,14 @@ module Dependabot
           ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
         end
         def fetch_from_github(source, revision)
-          response = github_client.send(
-            :contents,
+          response = github_client.contents(
             source.repo,
             path: HOOKS_FILE,
             ref: revision
           )
-          return nil unless response
 
-          content = Base64.decode64(response.content)
+          resource = T.cast(response, Sawyer::Resource)
+          content = Base64.decode64(T.cast(resource[:content], String))
           parse_hooks_yaml(content)
         rescue Octokit::NotFound
           Dependabot.logger.debug("#{HOOKS_FILE} not found in #{source.repo}@#{revision}")

data/lib/dependabot/pre_commit/file_updater.rb

@@ -60,19 +60,21 @@ module Dependabot
 
       sig do
         params(file: Dependabot::DependencyFile)
-          .returns(T::Array[[T::Hash[Symbol, Object], T::Hash[Symbol, Object]]])
+          .returns(
+            T::Array[
+              [Dependabot::DependencyRequirement, Dependabot::DependencyRequirement]
+            ]
+          )
       end
       def requirement_pairs_for_file(file)
         pairs = dependency.requirements.zip(T.must(dependency.previous_requirements))
         filtered_pairs = pairs.reject do |new_req, old_req|
           next true unless old_req
 
-          file_name = T.cast(new_req[:file], T.nilable(String))
+          file_name = new_req.file
           next true if file_name != file.name
 
-          new_source = T.cast(new_req[:source], T.nilable(T::Hash[Symbol, Object]))
-          old_source = T.cast(old_req[:source], T.nilable(T::Hash[Symbol, Object]))
-          new_source == old_source
+          new_req.source == old_req.source
         end
 
         filtered_pairs.map { |new_req, old_req| [new_req, T.must(old_req)] }
@@ -81,15 +83,12 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, Object],
-          old_req: T::Hash[Symbol, Object]
+          new_req: Dependabot::DependencyRequirement,
+          old_req: Dependabot::DependencyRequirement
         ).returns(String)
       end
       def apply_requirement_update(content, new_req, old_req)
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
-        source_type = T.cast(new_source.fetch(:type), String)
-
-        case source_type
+        case new_req.source_string("type")
         when "git"
           apply_git_requirement_update(content, new_req, old_req)
         when "additional_dependency"
@@ -102,20 +101,16 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, Object],
-          old_req: T::Hash[Symbol, Object]
+          new_req: Dependabot::DependencyRequirement,
+          old_req: Dependabot::DependencyRequirement
         ).returns(String)
       end
       def apply_git_requirement_update(content, new_req, old_req)
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
-        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, Object])
-        repo_url = T.cast(old_source.fetch(:url), String)
-        old_ref = T.cast(old_source.fetch(:ref), String)
-        new_ref = T.cast(new_source.fetch(:ref), String)
-
-        new_metadata = T.cast(new_req.fetch(:metadata, {}), T::Hash[Symbol, Object])
-        old_version = T.cast(new_metadata[:comment_version], T.nilable(String))
-        new_version = T.cast(new_metadata[:new_comment_version], T.nilable(String))
+        repo_url = T.must(old_req.source_string("url"))
+        old_ref = T.must(old_req.source_string("ref"))
+        new_ref = T.must(new_req.source_string("ref"))
+        old_version = new_req.metadata_string("comment_version")
+        new_version = new_req.metadata_string("new_comment_version")
 
         replace_ref_in_content(
           content,
@@ -130,16 +125,13 @@ module Dependabot
       sig do
         params(
           content: String,
-          new_req: T::Hash[Symbol, Object],
-          old_req: T::Hash[Symbol, Object]
+          new_req: Dependabot::DependencyRequirement,
+          old_req: Dependabot::DependencyRequirement
         ).returns(String)
       end
       def apply_additional_dependency_update(content, new_req, old_req)
-        old_source = T.cast(old_req.fetch(:source), T::Hash[Symbol, Object])
-        new_source = T.cast(new_req.fetch(:source), T::Hash[Symbol, Object])
-
-        old_string = T.cast(old_source.fetch(:original_string), String)
-        new_string = T.cast(new_source.fetch(:original_string), String)
+        old_string = T.must(old_req.source_string("original_string"))
+        new_string = T.must(new_req.source_string("original_string"))
 
         replace_additional_dependency_in_content(content, old_string, new_string)
       end

data/lib/dependabot/pre_commit/helpers.rb

@@ -60,11 +60,19 @@ module Dependabot
           )
         end
 
-        sig { params(source: T.nilable(T::Hash[Symbol, Object])).returns(Dependabot::GitCommitChecker) }
+        sig do
+          params(source: T.nilable(Dependabot::DependencyRequirement::ObjectHash))
+            .returns(Dependabot::GitCommitChecker)
+        end
         def git_commit_checker_for(source)
           @git_commit_checkers ||= T.let(
             {},
-            T.nilable(T::Hash[T.nilable(T::Hash[Symbol, Object]), Dependabot::GitCommitChecker])
+            T.nilable(
+              T::Hash[
+                T.nilable(Dependabot::DependencyRequirement::ObjectHash),
+                Dependabot::GitCommitChecker
+              ]
+            )
           )
 
           @git_commit_checkers[source] ||= Dependabot::GitCommitChecker.new(
@@ -73,9 +81,17 @@ module Dependabot
             ignored_versions: ignored_versions,
             raise_on_ignored: raise_on_ignored,
             consider_version_branches_pinned: @consider_version_branches_pinned,
-            dependency_source_details: source || @dependency_source_details
+            dependency_source_details: source ? symbolize_source(source) : @dependency_source_details
           )
         end
+
+        sig do
+          params(source: Dependabot::DependencyRequirement::ObjectHash)
+            .returns(T::Hash[Symbol, Object])
+        end
+        def symbolize_source(source)
+          source.to_h { |key, value| [key.to_sym, value] }
+        end
       end
     end
   end

data/lib/dependabot/pre_commit/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -14,14 +14,10 @@ module Dependabot
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-
-        url =
-          if info.nil?
-            dependency.name
-          else
-            info[:url] || info[:repo_url] || info["url"] || dependency.name
-          end
+        requirement = dependency.requirements.find(&:source_hash)
+        url = requirement&.source_string("url") ||
+              requirement&.source_string("repo_url") ||
+              dependency.name
         Source.from_url(url)
       end
     end

data/lib/dependabot/pre_commit/package/package_details_fetcher.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -62,7 +62,7 @@ module Dependabot
         def version_tag_release
           return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
 
-          latest_version = pre_commit_version(latest_version_tag&.fetch(:version))
+          latest_version = pre_commit_version(tag_version(T.must(latest_version_tag)))
           return unless latest_version
 
           return current_version if shortened_semver_eq?(dependency.version, latest_version.to_s)
@@ -76,7 +76,7 @@ module Dependabot
 
           if latest_version_tag
             if git_commit_checker.local_tag_for_pinned_sha || version_comment?
-              return pre_commit_version(T.must(latest_version_tag).fetch(:version))
+              return pre_commit_version(tag_version(T.must(latest_version_tag)))
             end
 
             return latest_commit_for_pinned_ref
@@ -94,7 +94,7 @@ module Dependabot
               end
 
               ref = git_commit_checker.local_ref_for_latest_version_matching_existing_precision
-              return ref if ref && current_version && ref.fetch(:version) > current_version
+              return ref if ref && current_version && tag_version(ref) && T.must(tag_version(ref)) > current_version
 
               git_commit_checker.local_ref_for_latest_version_lower_precision
             end,
@@ -126,6 +126,14 @@ module Dependabot
           git_commit_checker.max_local_tag(matching)
         end
 
+        sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Gem::Version)) }
+        def tag_version(tag)
+          return tag.version if tag.is_a?(Dependabot::GitTagDetails)
+
+          version = tag[:version]
+          version if version.is_a?(Gem::Version)
+        end
+
         sig do
           params(
             prefix: String,
@@ -159,7 +167,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def frozen_comment_ref
-          comment = dependency.requirements.first&.dig(:metadata, :comment)
+          comment = dependency.requirements.first&.metadata_string("comment")
           return nil unless comment
 
           match = comment.match(CommentVersionHelper::FROZEN_COMMENT_REF_PATTERN)
@@ -173,7 +181,7 @@ module Dependabot
 
         sig { returns(T::Boolean) }
         def version_comment?
-          comment = dependency.requirements.first&.dig(:metadata, :comment)
+          comment = dependency.requirements.first&.metadata_string("comment")
           return false unless comment
 
           comment.match?(CommentVersionHelper::COMMENT_VERSION_PATTERN)

data/lib/dependabot/pre_commit/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -384,13 +384,13 @@ module Dependabot
         # when the dependency's stored version is a commit SHA.
         sig { returns(T.nilable(Dependabot::Version)) }
         def version_from_frozen_comment
-          comment = dependency.requirements.first&.dig(:metadata, :comment)
+          comment = dependency.requirements.first&.metadata_string("comment")
           return nil unless comment
 
           match = comment.match(CommentVersionHelper::FROZEN_COMMENT_REF_PATTERN)
           return nil unless match
 
-          version_str = match[1].sub(/\Av/i, "")
+          version_str = T.must(match[1]).sub(/\Av/i, "")
           return nil unless Dependabot::PreCommit::Version.correct?(version_str)
 
           Dependabot::PreCommit::Version.new(version_str)

data/lib/dependabot/pre_commit/update_checker.rb

@@ -50,23 +50,17 @@ module Dependabot
         return wrap_requirements(additional_dependency_updated_requirements) if additional_dependency?
 
         updated_reqs = dependency.requirements.map do |req|
-          source = T.cast(req[:source], T.nilable(T::Hash[Symbol, Object]))
+          source = req.source_hash
+          next req unless source
+
           updated = updated_ref(source)
           next req unless updated
 
-          current = T.cast(source&.[](:ref), T.nilable(String))
-
-          # Maintain short git hash when the updated SHA starts with the current SHA
-          if T.cast(req[:type], T.nilable(String)) == "git" &&
-             git_commit_checker.ref_looks_like_commit_sha?(updated) &&
-             current && git_commit_checker.ref_looks_like_commit_sha?(current) &&
-             updated.start_with?(current)
-            next req
-          end
-
-          new_source = T.must(source).merge(ref: updated)
+          new_source = hash_with_value(source, "ref", updated)
           new_metadata = updated_comment_version_metadata(req, updated)
-          req.merge(source: new_source, metadata: new_metadata)
+          Dependabot::DependencyRequirement.create(
+            req.merge(source: new_source, metadata: new_metadata)
+          )
         end
         wrap_requirements(updated_reqs)
       end
@@ -166,7 +160,10 @@ module Dependabot
         )
       end
 
-      sig { params(source: T.nilable(T::Hash[Symbol, Object])).returns(T.nilable(String)) }
+      sig do
+        params(source: T.nilable(Dependabot::DependencyRequirement::ObjectHash))
+          .returns(T.nilable(String))
+      end
       def updated_ref(source)
         return unless git_commit_checker.git_dependency?
 
@@ -175,7 +172,7 @@ module Dependabot
         # Return the git tag if updating a pinned version
         if source_git_commit_checker.pinned_ref_looks_like_version? &&
            (new_tag = T.must(latest_version_finder).latest_version_tag)
-          return T.cast(new_tag.fetch(:tag), String)
+          return tag_name(new_tag)
         end
 
         # Return the pinned git commit if one is available
@@ -192,9 +189,7 @@ module Dependabot
         new_tag = T.must(latest_version_finder).latest_version_tag
 
         if new_tag
-          if version_from_comment || git_commit_checker.local_tag_for_pinned_sha
-            return T.cast(new_tag.fetch(:commit_sha), String)
-          end
+          return tag_commit_sha(new_tag) if version_from_comment || git_commit_checker.local_tag_for_pinned_sha
 
           return latest_commit_for_pinned_ref
         end
@@ -206,6 +201,20 @@ module Dependabot
         nil
       end
 
+      sig { params(tag: T::Hash[Symbol, Object]).returns(String) }
+      def tag_name(tag)
+        return tag.tag if tag.is_a?(Dependabot::GitTagDetails)
+
+        T.cast(tag.fetch(:tag), String)
+      end
+
+      sig { params(tag: T::Hash[Symbol, Object]).returns(String) }
+      def tag_commit_sha(tag)
+        return T.must(tag.commit_sha) if tag.is_a?(Dependabot::GitTagDetails)
+
+        T.cast(tag.fetch(:commit_sha), String)
+      end
+
       sig { returns(Dependabot::GitCommitChecker) }
       def git_commit_checker
         @git_commit_checker ||= T.let(git_helper.git_commit_checker, T.nilable(Dependabot::GitCommitChecker))
@@ -213,13 +222,13 @@ module Dependabot
 
       sig do
         params(
-          req: T::Hash[Symbol, Object],
+          req: Dependabot::DependencyRequirement,
           new_ref: String
-        ).returns(T::Hash[Symbol, Object])
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
       end
       def updated_comment_version_metadata(req, new_ref)
-        existing_metadata = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, Object])
-        comment = T.cast(existing_metadata[:comment], T.nilable(String))
+        existing_metadata = req.metadata || {}
+        comment = req.metadata_string("comment")
         return existing_metadata unless comment
 
         old_version = extract_version_from_comment(comment)
@@ -228,7 +237,8 @@ module Dependabot
         new_version = resolve_new_comment_version(new_ref)
         return existing_metadata unless new_version
 
-        existing_metadata.merge(comment_version: old_version, new_comment_version: new_version)
+        updated = hash_with_value(existing_metadata, "comment_version", old_version)
+        hash_with_value(updated, "new_comment_version", new_version)
       end
 
       sig { params(comment: String).returns(T.nilable(String)) }
@@ -243,10 +253,7 @@ module Dependabot
           begin
             comment = T.let(
               @dependency.requirements
-                .filter_map do |req|
-                  val = T.cast(req.fetch(:metadata, {}), T::Hash[Symbol, Object])[:comment]
-                  T.cast(val, T.nilable(String))
-                end
+                .filter_map { |req| req.metadata_string("comment") }
                 .first,
               T.nilable(String)
             )
@@ -310,16 +317,14 @@ module Dependabot
         requirement = dependency.requirements.first
         return false unless requirement
 
-        source = T.cast(requirement[:source], T.nilable(T::Hash[Symbol, Object]))
-        return false unless source
-
-        T.cast(source[:type], T.nilable(String)) == "additional_dependency"
+        requirement.source_string("type") == "additional_dependency"
       end
 
       sig { returns(T.nilable(T.any(String, Gem::Version))) }
       def additional_dependency_latest_version
-        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, Object])
-        language = T.cast(source[:language], T.nilable(String))
+        requirement = T.must(dependency.requirements.first)
+        source = T.must(requirement.source_hash)
+        language = requirement.source_string("language")
         return nil unless language && AdditionalDependencyCheckers.supported?(language)
 
         checker = additional_dependency_checker(language, source)
@@ -331,10 +336,11 @@ module Dependabot
         latest
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def additional_dependency_updated_requirements
-        source = T.cast(dependency.requirements.first&.dig(:source), T::Hash[Symbol, Object])
-        language = T.cast(source[:language], T.nilable(String))
+        requirement = T.must(dependency.requirements.first)
+        source = T.must(requirement.source_hash)
+        language = requirement.source_string("language")
         return dependency.requirements unless language && AdditionalDependencyCheckers.supported?(language)
 
         checker = additional_dependency_checker(language, source)
@@ -349,7 +355,7 @@ module Dependabot
       sig do
         params(
           language: String,
-          source: T::Hash[Symbol, Object]
+          source: Dependabot::DependencyRequirement::ObjectHash
         ).returns(T.nilable(Dependabot::PreCommit::AdditionalDependencyCheckers::Base))
       end
       def additional_dependency_checker(language, source)
@@ -365,6 +371,28 @@ module Dependabot
         Dependabot.logger.error("Error creating checker for #{language}: #{e.message}")
         nil
       end
+
+      sig do
+        params(
+          hash: Dependabot::DependencyRequirement::ObjectHash,
+          key: String,
+          value: Object
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def hash_with_value(hash, key, value)
+        updated = hash.dup
+        actual_key = if hash.key?(key.to_sym)
+                       key.to_sym
+                     elsif hash.key?(key)
+                       key
+                     elsif hash.keys.any?(Symbol)
+                       key.to_sym
+                     else
+                       key
+                     end
+        updated[actual_key] = value
+        updated
+      end
     end
   end
 end

data/lib/dependabot/pre_commit.rb

@@ -29,7 +29,7 @@ Dependabot::Dependency.register_humanized_previous_version_builder(
     return nil unless previous_reqs
 
     comment = previous_reqs
-              .filter_map { |r| r.dig(:metadata, :comment) }
+              .filter_map { |requirement| requirement.metadata_string("comment") }
               .first
     return nil unless comment
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pre_commit
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,84 +15,84 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-cargo
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-common
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-go_modules
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-npm_and_yarn
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: dependabot-python
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -338,7 +338,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib