dependabot-pub 0.397.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ee93bbe3a567d05c49aa43c3cd6be245a3d297b73dd1299377d55ddcd52d8b6
-  data.tar.gz: 6af10c2f14fdd2e0dc5c324c3a1b0d3af14a82647189c2e92a85b55fcc8cce45
+  metadata.gz: bccb4cb21417d15087e804ed056b2ff00451cf1c908fd8cdfb40f7709fd02ce8
+  data.tar.gz: 685f8a0c5df291c2be68371b3c798343e61f23cd17ea5745efc879315dd3e178
 SHA512:
-  metadata.gz: 9b873c93b89ca23f6eccf6ed6d73829223226b8e86de473ae0f8b106e68d29b68bd23ee8ea42ea10782c7a090c528f8adae34e31d5d99b82693d8d08739df2d3
-  data.tar.gz: 792a68fbdb3cbd1f4a63df868102bb3b86aa6c14746ce877cc32ec37287cf729684d854bef05e2936518596d5aa3f487696f87f2070ce6617d6f1546a623355b
+  metadata.gz: af4a96a16577145fa0f6c3a9baf56c447f90dbade75678af5e8037faf926da725ecf3e4370dfae19e0f7f923c25aa984fb148aae146be7dacb361628809000a7
+  data.tar.gz: f615713050dddd07821622e4fd15a059b5c0470179d44236b901855c2db0feddc3fcbf89612ab681c71d4966f6ef5b355ccb73f777cc5d09411accb0188d609a

data/lib/dependabot/pub/dependency_services_result.rb

@@ -0,0 +1,167 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/pub/json_value_parser"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Pub
+    module DependencyServicesResult
+      extend T::Sig
+
+      class ListedDependency < T::ImmutableStruct
+        const :name, String
+        const :version, String
+        const :kind, String
+        const :constraint, T.nilable(String)
+        const :source, T.nilable(JsonValueParser::ObjectHash)
+      end
+
+      class DependencyUpdate < T::ImmutableStruct
+        const :name, String
+        const :version, T.nilable(String)
+        const :kind, String
+        const :previous_version, T.nilable(String)
+        const :previous_constraint, T.nilable(String)
+        const :constraint_bumped, T.nilable(String)
+        const :constraint_bumped_if_needed, T.nilable(String)
+        const :constraint_widened, T.nilable(String)
+      end
+
+      class ReportEntry < T::ImmutableStruct
+        const :name, String
+        const :version, String
+        const :latest, T.nilable(String)
+        const :compatible, T::Array[DependencyUpdate]
+        const :single_breaking, T::Array[DependencyUpdate]
+        const :multi_breaking, T::Array[DependencyUpdate]
+        const :smallest_update, T.nilable(T::Array[DependencyUpdate])
+      end
+
+      class Report < T::ImmutableStruct
+        const :dependencies, T::Array[ReportEntry]
+        const :cache_content, String
+      end
+
+      sig { params(content: String).returns(T::Array[ListedDependency]) }
+      def self.list_from_json(content)
+        context = "dependency_services list"
+        root = JsonValueParser.object(JsonValueParser.parse(content, context), context)
+        JsonValueParser.array(root["dependencies"], "#{context}.dependencies").each_with_index.map do |value, index|
+          entry_context = "#{context}.dependencies[#{index}]"
+          fields = JsonValueParser.object(value, entry_context)
+          ListedDependency.new(
+            name: JsonValueParser.string(fields["name"], "#{entry_context}.name"),
+            version: JsonValueParser.string(fields["version"], "#{entry_context}.version"),
+            kind: JsonValueParser.string(fields["kind"], "#{entry_context}.kind"),
+            constraint: JsonValueParser.optional_string(fields["constraint"], "#{entry_context}.constraint"),
+            source: JsonValueParser.optional_object(fields["source"], "#{entry_context}.source")
+          )
+        end
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services list", e.message)
+      end
+
+      sig { params(content: String).returns(Report) }
+      def self.report_from_json(content)
+        context = "dependency_services report"
+        root = JsonValueParser.object(JsonValueParser.parse(content, context), context)
+        build_report(root["dependencies"], "#{context}.dependencies")
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services report", e.message)
+      end
+
+      sig { params(content: String).returns(Report) }
+      def self.report_from_cache(content)
+        context = "dependency_services report cache"
+        build_report(JsonValueParser.parse(content, context), context)
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services report cache", e.message)
+      end
+
+      sig { params(reports: T::Array[ReportEntry], name: String).returns(ReportEntry) }
+      def self.find_report(reports, name)
+        report = reports.find { |entry| entry.name == name }
+        return report if report
+
+        invalid_result(
+          "dependency_services report",
+          "dependency_services report does not include the requested dependency"
+        )
+      end
+
+      sig { params(context: String, message: String).returns(T.noreturn) }
+      def self.invalid_result(context, message)
+        raise SharedHelpers::HelperSubprocessFailed.new(
+          message: message,
+          error_class: "TypeError",
+          error_context: { function: context }
+        ),
+              cause: nil
+      end
+
+      sig { params(value: Object, context: String).returns(Report) }
+      def self.build_report(value, context)
+        raw_entries = JsonValueParser.array(value, context)
+        entries = raw_entries.each_with_index.map do |entry, index|
+          report_entry(entry, "#{context}[#{index}]")
+        end
+        Report.new(dependencies: entries, cache_content: JSON.generate(raw_entries))
+      end
+      private_class_method :build_report
+
+      sig { params(value: Object, context: String).returns(ReportEntry) }
+      def self.report_entry(value, context)
+        fields = JsonValueParser.object(value, context)
+        ReportEntry.new(
+          name: JsonValueParser.string(fields["name"], "#{context}.name"),
+          version: JsonValueParser.string(fields["version"], "#{context}.version"),
+          latest: JsonValueParser.optional_string(fields["latest"], "#{context}.latest"),
+          compatible: updates(fields["compatible"], "#{context}.compatible"),
+          single_breaking: updates(fields["singleBreaking"], "#{context}.singleBreaking"),
+          multi_breaking: updates(fields["multiBreaking"], "#{context}.multiBreaking"),
+          smallest_update: if fields.key?("smallestUpdate")
+                             updates(
+                               fields["smallestUpdate"],
+                               "#{context}.smallestUpdate"
+                             )
+                           end
+        )
+      end
+      private_class_method :report_entry
+
+      sig { params(value: Object, context: String).returns(T::Array[DependencyUpdate]) }
+      def self.updates(value, context)
+        JsonValueParser.array(value, context).each_with_index.map do |entry, index|
+          entry_context = "#{context}[#{index}]"
+          fields = JsonValueParser.object(entry, entry_context)
+          DependencyUpdate.new(
+            name: JsonValueParser.string(fields["name"], "#{entry_context}.name"),
+            version: JsonValueParser.optional_string(fields["version"], "#{entry_context}.version"),
+            kind: JsonValueParser.string(fields["kind"], "#{entry_context}.kind"),
+            previous_version: JsonValueParser.optional_string(
+              fields["previousVersion"],
+              "#{entry_context}.previousVersion"
+            ),
+            previous_constraint: JsonValueParser.optional_string(
+              fields["previousConstraint"], "#{entry_context}.previousConstraint"
+            ),
+            constraint_bumped: JsonValueParser.optional_string(
+              fields["constraintBumped"],
+              "#{entry_context}.constraintBumped"
+            ),
+            constraint_bumped_if_needed: JsonValueParser.optional_string(
+              fields["constraintBumpedIfNeeded"], "#{entry_context}.constraintBumpedIfNeeded"
+            ),
+            constraint_widened: JsonValueParser.optional_string(
+              fields["constraintWidened"],
+              "#{entry_context}.constraintWidened"
+            )
+          )
+        end
+      end
+      private_class_method :updates
+    end
+  end
+end

data/lib/dependabot/pub/file_parser.rb

@@ -82,9 +82,9 @@ module Dependabot
         raise "No pubspec.yaml!" unless get_original_file("pubspec.yaml")
       end
 
-      sig { returns(T::Array[T::Hash[String, Object]]) }
+      sig { returns(T::Array[DependencyServicesResult::ListedDependency]) }
       def list
-        @list ||= T.let(dependency_services_list, T.nilable(T::Array[T::Hash[String, Object]]))
+        @list ||= T.let(dependency_services_list, T.nilable(T::Array[DependencyServicesResult::ListedDependency]))
       end
     end
   end

data/lib/dependabot/pub/helpers.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
@@ -8,6 +8,8 @@ require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/logger"
+require "dependabot/pub/dependency_services_result"
+require "dependabot/pub/package/registry_package"
 require "dependabot/pub/requirement"
 require "dependabot/pub/requirement_source"
 require "dependabot/requirements_update_strategy"
@@ -23,13 +25,19 @@ module Dependabot
 
       abstract!
 
+      class SdkVersions < T::ImmutableStruct
+        const :flutter, String
+        const :dart, String
+        const :channel, T.nilable(String), default: nil
+      end
+
       sig { abstract.returns(T::Array[Dependabot::Credential]) }
       def credentials; end
 
       sig { abstract.returns(T::Array[Dependabot::DependencyFile]) }
       def dependency_files; end
 
-      sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+      sig { abstract.returns(T::Hash[Symbol, T.anything]) }
       def options; end
 
       sig { returns(String) }
@@ -42,7 +50,7 @@ module Dependabot
           dir: T.any(Pathname, String),
           url: T.nilable(String)
         )
-          .returns(T.nilable(T::Hash[String, T.untyped]))
+          .returns(T.nilable(SdkVersions))
       end
       def self.run_infer_sdk_versions(dir, url: nil)
         env = {}
@@ -51,23 +59,31 @@ module Dependabot
         stdout, _, status = Open3.capture3(env, cmd, opts, chdir: dir)
         return nil unless status.success?
 
-        JSON.parse(stdout)
+        fields = JsonValueParser.object(JsonValueParser.parse(stdout, "infer_sdk_versions"), "infer_sdk_versions")
+        SdkVersions.new(
+          flutter: JsonValueParser.string(fields["flutter"], "infer_sdk_versions.flutter"),
+          dart: JsonValueParser.string(fields["dart"], "infer_sdk_versions.dart"),
+          channel: JsonValueParser.string(fields["channel"], "infer_sdk_versions.channel")
+        )
+      rescue JsonValueParser::InvalidValue => e
+        DependencyServicesResult.invalid_result("infer_sdk_versions", e.message)
       end
 
       private
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[DependencyServicesResult::ListedDependency]) }
       def dependency_services_list
-        JSON.parse(run_dependency_services("list"))["dependencies"]
+        DependencyServicesResult.list_from_json(run_dependency_services("list"))
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(String) }
       def repository_url(dependency)
-        RequirementSource.new(dependency.requirements.first).description_string("url") || options[:pub_hosted_url] ||
-          "https://pub.dev"
+        repository_url = RequirementSource.new(dependency.requirements.first).description_string("url") ||
+                         option_string(:pub_hosted_url) || "https://pub.dev"
+        repository_url.delete_suffix("/")
       end
 
-      sig { params(dependency: Dependabot::Dependency).returns(T::Hash[String, T.untyped]) }
+      sig { params(dependency: Dependabot::Dependency).returns(Package::RegistryPackage) }
       def fetch_package_listing(dependency)
         # Because we get the security_advisories as a set of constraints, we
         # fetch the list of all versions and filter them to a list of vulnerable
@@ -76,17 +92,15 @@ module Dependabot
         # Ideally we would like the helper to be the only one doing requests to
         # the repository. But this should work for now:
         response = Dependabot::RegistryClient.get(url: "#{repository_url(dependency)}/api/packages/#{dependency.name}")
-        JSON.parse(response.body)
+        Package::RegistryPackage.from_json(response.body)
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Pub::Version]) }
       def available_versions(dependency)
-        fetch_package_listing(dependency)["versions"].map do |v|
-          Dependabot::Pub::Version.new(v["version"])
-        end
+        fetch_package_listing(dependency).versions
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[DependencyServicesResult::ReportEntry]) }
       def dependency_services_report
         sha256 = Digest::SHA256.new
         dependency_files.each do |f|
@@ -95,11 +109,11 @@ module Dependabot
         hash = sha256.hexdigest
 
         cache_file = "/tmp/report-#{hash}-pid-#{Process.pid}.json"
-        return JSON.parse(File.read(cache_file)) if File.file?(cache_file)
+        return DependencyServicesResult.report_from_cache(File.read(cache_file)).dependencies if File.file?(cache_file)
 
-        report = JSON.parse(run_dependency_services("report"))["dependencies"]
-        File.write(cache_file, JSON.generate(report))
-        report
+        report = DependencyServicesResult.report_from_json(run_dependency_services("report"))
+        File.write(cache_file, report.cache_content)
+        report.dependencies
       end
 
       sig do
@@ -176,19 +190,19 @@ module Dependabot
       ## Detects the right flutter release to use for the pubspec.yaml.
       ## Then checks it out if it is not already.
       ## Returns the sdk versions
-      sig { params(dir: T.any(Pathname, String)).returns(T::Hash[String, String]) }
+      sig { params(dir: T.any(Pathname, String)).returns(SdkVersions) }
       def ensure_right_flutter_release(dir)
         versions = Helpers.run_infer_sdk_versions(
-          File.join(dir, dependency_files.first&.directory),
-          url: options[:flutter_releases_url]
+          File.join(dir, T.must(dependency_files.first).directory),
+          url: option_string(:flutter_releases_url)
         )
         flutter_ref =
           if versions
             Dependabot.logger.info(
-              "Installing the Flutter SDK version: #{versions['flutter']} " \
-              "from channel #{versions['channel']} with Dart #{versions['dart']}"
+              "Installing the Flutter SDK version: #{versions.flutter} " \
+              "from channel #{versions.channel} with Dart #{versions.dart}"
             )
-            "refs/tags/#{versions['flutter']}"
+            "refs/tags/#{versions.flutter}"
           else
             Dependabot.logger.info(
               "Failed to infer the flutter version. Attempting to use latest stable release."
@@ -217,7 +231,7 @@ module Dependabot
       end
 
       # Runs `flutter version` and returns the dart and flutter version numbers in a map.
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(SdkVersions) }
       def run_flutter_version
         Dependabot.logger.info "Running `flutter --version`"
         # Run `flutter --version --machine` to get the current flutter version.
@@ -233,20 +247,18 @@ module Dependabot
                 "Running 'flutter --version --machine' failed: #{stderr}"
         end
 
-        parsed = JSON.parse(stdout)
-        flutter_version = parsed["frameworkVersion"]
-        dart_version = parsed["dartSdkVersion"]&.split&.first
-        unless flutter_version && dart_version
-          raise Dependabot::DependabotError,
-                "Bad output from `flutter --version`: #{stdout}"
-        end
+        context = "flutter --version"
+        parsed = JsonValueParser.object(JsonValueParser.parse(stdout, context), context)
+        flutter_version = JsonValueParser.string(parsed["frameworkVersion"], "#{context}.frameworkVersion")
+        dart_version = JsonValueParser.string(parsed["dartSdkVersion"], "#{context}.dartSdkVersion").split.first
+        raise JsonValueParser::InvalidValue, "#{context}.dartSdkVersion must contain a version" unless dart_version
+
         Dependabot.logger.info(
           "Installed the Flutter SDK version: #{flutter_version} with Dart #{dart_version}."
         )
-        {
-          "flutter" => flutter_version,
-          "dart" => dart_version
-        }
+        SdkVersions.new(flutter: flutter_version, dart: dart_version)
+      rescue JsonValueParser::InvalidValue => e
+        DependencyServicesResult.invalid_result("flutter --version", e.message)
       end
 
       sig do
@@ -272,12 +284,12 @@ module Dependabot
               "PUB_ENVIRONMENT" => "dependabot",
               "FLUTTER_ROOT" => "/tmp/flutter",
               "DART_ROOT" => "/tmp/flutter/bin/cache/dart-sdk",
-              "PUB_HOSTED_URL" => options[:pub_hosted_url],
+              "PUB_HOSTED_URL" => option_string(:pub_hosted_url),
               # This variable will make the solver run assuming that Dart SDK version.
               # TODO(sigurdm): Would be nice to have a better handle for fixing the dart sdk version.
-              "_PUB_TEST_SDK_VERSION" => sdk_versions["dart"]
+              "_PUB_TEST_SDK_VERSION" => sdk_versions.dart
             }
-            command_dir = File.join(temp_dir, dependency_files.first&.directory)
+            command_dir = File.join(temp_dir, T.must(dependency_files.first).directory)
 
             stdout, stderr, status = Open3.capture3(
               env.compact,
@@ -310,25 +322,19 @@ module Dependabot
       end
 
       # Parses a dependency as listed by `dependency_services list`.
-      sig { params(json: T::Hash[String, T.untyped]).returns(Dependabot::Dependency) }
-      def parse_listed_dependency(json)
-        params = {
-          name: json["name"],
-          version: json["version"],
-          package_manager: "pub",
-          requirements: []
-        }
+      sig { params(entry: DependencyServicesResult::ListedDependency).returns(Dependabot::Dependency) }
+      def parse_listed_dependency(entry)
+        requirements = []
 
-        if json["kind"] != "transitive" && !json["constraint"].nil?
-          constraint = json["constraint"]
-          params[:requirements] << {
-            requirement: constraint,
-            groups: [json["kind"]],
-            source: json["source"],
+        if entry.kind != "transitive" && !entry.constraint.nil?
+          requirements << {
+            requirement: entry.constraint,
+            groups: [entry.kind],
+            source: entry.source,
             file: "pubspec.yaml"
           }
         end
-        Dependency.new(**params)
+        Dependency.new(name: entry.name, version: entry.version, package_manager: "pub", requirements: requirements)
       end
 
       # Parses the updated dependencies returned by
@@ -338,43 +344,41 @@ module Dependabot
       # used to chose the right updated constraint.
       sig do
         params(
-          json: T::Hash[String, T.untyped],
+          entry: DependencyServicesResult::DependencyUpdate,
           requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
         )
           .returns(Dependabot::Dependency)
       end
-      def parse_updated_dependency(json, requirements_update_strategy)
+      def parse_updated_dependency(entry, requirements_update_strategy)
         requirements = []
-        constraint_field = constraint_field_from_update_strategy(requirements_update_strategy)
+        constraint = constraint_from_update_strategy(entry, requirements_update_strategy)
 
-        if json["kind"] != "transitive" && !json[constraint_field].nil?
-          constraint = json[constraint_field]
+        if entry.kind != "transitive" && !constraint.nil?
           requirements << {
             requirement: constraint,
-            groups: [json["kind"]],
+            groups: [entry.kind],
             source: nil, # TODO: Expose some information about the source
             file: "pubspec.yaml"
           }
         end
 
         previous_requirements = []
-        if json["previousVersion"] && json["kind"] != "transitive" && !json["previousConstraint"].nil?
-          constraint = json["previousConstraint"]
+        if entry.previous_version && entry.kind != "transitive" && !entry.previous_constraint.nil?
           previous_requirements << {
-            requirement: constraint,
-            groups: [json["kind"]],
+            requirement: entry.previous_constraint,
+            groups: [entry.kind],
             source: nil, # TODO: Expose some information about the source
             file: "pubspec.yaml"
           }
         end
 
         Dependency.new(
-          name: json["name"],
-          version: json["version"],
+          name: entry.name,
+          version: entry.version,
           package_manager: "pub",
           requirements: requirements,
-          previous_version: json["previousVersion"],
-          previous_requirements: json["previousVersion"] ? previous_requirements : nil
+          previous_version: entry.previous_version,
+          previous_requirements: entry.previous_version ? previous_requirements : nil
         )
       end
 
@@ -382,23 +386,35 @@ module Dependabot
       # strategies.
       sig do
         params(
+          entry: DependencyServicesResult::DependencyUpdate,
           requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
         )
-          .returns(String)
+          .returns(T.nilable(String))
       end
-      def constraint_field_from_update_strategy(requirements_update_strategy)
+      def constraint_from_update_strategy(entry, requirements_update_strategy)
         case requirements_update_strategy
         when RequirementsUpdateStrategy::WidenRanges
-          "constraintWidened"
+          entry.constraint_widened
         when RequirementsUpdateStrategy::BumpVersions
-          "constraintBumped"
+          entry.constraint_bumped
         when RequirementsUpdateStrategy::BumpVersionsIfNecessary
-          "constraintBumpedIfNeeded"
+          entry.constraint_bumped_if_needed
         else
           raise "Unexpected requirements_update_strategy #{requirements_update_strategy}"
         end
       end
 
+      sig { params(key: Symbol).returns(T.nilable(String)) }
+      def option_string(key)
+        value = options[key]
+
+        case value
+        when String then value
+        when nil then nil
+        else raise TypeError, "Pub option #{key} must be a string or nil"
+        end
+      end
+
       sig do
         params(
           dependencies: T.nilable(T::Array[Dependabot::Dependency])
@@ -406,29 +422,19 @@ module Dependabot
           .returns(T.nilable(String))
       end
       def dependencies_to_json(dependencies)
-        if dependencies.nil?
-          nil
-        else
-          deps = dependencies.map do |d|
-            source = d.requirements.empty? ? nil : d.requirements.first&.[](:source)
-            obj = {
-              "name" => d.name,
-              "version" => d.version,
-              "source" => source
-            }
-
-            unless d.requirements.nil? || d.requirements.empty?
-              obj["constraint"] =
-                d.requirements[0]&.[](:requirement).to_s
-            end
-            obj
-          end
-          JSON.generate(
-            {
-              "dependencyChanges" => deps
-            }
-          )
+        return if dependencies.nil?
+
+        changes = dependencies.map do |dependency|
+          requirement = dependency.requirements.first
+          fields = {
+            "name" => dependency.name,
+            "version" => dependency.version,
+            "source" => requirement&.source
+          }
+          fields["constraint"] = requirement.requirement.to_s if requirement
+          fields
         end
+        JSON.generate("dependencyChanges" => changes)
       end
     end
   end

data/lib/dependabot/pub/json_value_parser.rb

@@ -0,0 +1,65 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+module Dependabot
+  module Pub
+    module JsonValueParser
+      extend T::Sig
+
+      class InvalidValue < TypeError; end
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      sig { params(content: String, context: String).returns(Object) }
+      def self.parse(content, context)
+        T.cast(JSON.parse(content), Object)
+      rescue JSON::ParserError
+        raise InvalidValue.new("#{context} must be valid JSON"), cause: nil
+      end
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object(value, context)
+        raise InvalidValue, "#{context} must be an object" unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise InvalidValue, "#{context} keys must be strings" unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+
+      sig { params(value: Object, context: String).returns(T.nilable(ObjectHash)) }
+      def self.optional_object(value, context)
+        return if value.nil?
+
+        object(value, context)
+      end
+
+      sig { params(value: Object, context: String).returns(T::Array[Object]) }
+      def self.array(value, context)
+        raise InvalidValue, "#{context} must be an array" unless value.is_a?(Array)
+
+        value.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object, context: String).returns(String) }
+      def self.string(value, context)
+        return value if value.is_a?(String)
+
+        raise InvalidValue, "#{context} must be a string"
+      end
+
+      sig { params(value: Object, context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise InvalidValue, "#{context} must be a string or nil"
+      end
+    end
+  end
+end

data/lib/dependabot/pub/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/pub/requirement_source"
+require "dependabot/pub/package/registry_package"
 require "dependabot/registry_client"
 
 module Dependabot
@@ -24,22 +25,18 @@ module Dependabot
           result.commit = source.description_string("resolved-ref")
           return result
         end
-        repository_url = source.description_string("url") || "https://pub.dev"
+        repository_url = (source.description_string("url") || "https://pub.dev").delete_suffix("/")
 
-        listing = repository_listing(repository_url)
-        repo = listing.dig("latest", "pubspec", "repository")
-        # The repository field did not always exist in pubspec.yaml, and some
-        # packages specify a git repository in the "homepage" field.
-        repo ||= listing.dig("latest", "pubspec", "homepage")
+        repo = repository_listing(repository_url).source_url
         return nil unless repo
 
         Source.from_url(repo)
       end
 
-      sig { params(repository_url: String).returns(T::Hash[String, T.untyped]) }
+      sig { params(repository_url: String).returns(Package::RegistryPackage) }
       def repository_listing(repository_url)
         response = Dependabot::RegistryClient.get(url: "#{repository_url}/api/packages/#{dependency.name}")
-        JSON.parse(response.body)
+        Package::RegistryPackage.from_json(response.body)
       end
     end
   end

data/lib/dependabot/pub/package/package_details_fetcher.rb

@@ -1,8 +1,6 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "json"
-require "time"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
@@ -29,7 +27,7 @@ module Dependabot
         sig { override.returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        sig { override.returns(T::Hash[Symbol, T.anything]) }
         attr_reader :options
 
         sig { override.returns(T::Array[Dependabot::Credential]) }
@@ -42,7 +40,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
-            options: T::Hash[Symbol, T.untyped]
+            options: T::Hash[Symbol, T.anything]
           )
             .void
         end
@@ -62,57 +60,32 @@ module Dependabot
           @options = options
         end
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[DependencyServicesResult::ReportEntry]) }
         def report
           @report ||= T.let(
             dependency_services_report,
-            T.nilable(T::Array[T::Hash[String, T.untyped]])
+            T.nilable(T::Array[DependencyServicesResult::ReportEntry])
           )
         end
 
-        sig { returns(T.any(T::Array[Dependabot::Package::PackageRelease], T.untyped)) }
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
         def package_details_metadata
-          package_releases = []
-          T.let({}, T::Hash[String, T.untyped])
-
-          Dependabot.logger.error("Initializing package metadata for \"#{@dependency.name}\"")
+          Dependabot.logger.info("Initializing package metadata for \"#{@dependency.name}\"")
 
           response = fetch_package_metadata(dependency)
-          return package_releases if response.status >= 500
-
-          begin
-            package_details_metadata = JSON.parse(response.body)
-
-            package_details_metadata["versions"].select do |v|
-              package_releases << package_release(
-                version: v["version"],
-                publish_date: Time.parse(v["published"])
-              )
-            end
-
-            package_releases
-          rescue JSON::ParserError
-            Dependabot.logger.error("Failed to parse package metadata")
-            package_releases
-          end
+          return [] if response.status >= 500
+
+          # Build the full list up front. If any release can't be parsed (e.g. a
+          # missing or invalid publish date) the partial result is discarded, so
+          # callers can treat a non-empty list as a complete, trustworthy snapshot
+          # and an empty list as "no usable metadata".
+          RegistryPackage.from_json(response.body).releases
+        rescue JsonValueParser::InvalidValue
+          Dependabot.logger.error("Failed to parse package metadata")
+          []
         rescue StandardError => e
           Dependabot.logger.error("Failed to fetch package metadata #{e.message}")
-          package_releases
-        end
-
-        private
-
-        sig do
-          params(
-            version: String,
-            publish_date: T.nilable(Time)
-          ).returns(Dependabot::Package::PackageRelease)
-        end
-        def package_release(version:, publish_date: nil)
-          Dependabot::Package::PackageRelease.new(
-            version: Pub::Version.new(version),
-            released_at: publish_date
-          )
+          []
         end
       end
     end

data/lib/dependabot/pub/package/registry_package.rb

@@ -0,0 +1,67 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "time"
+require "sorbet-runtime"
+require "dependabot/package/package_release"
+require "dependabot/pub/json_value_parser"
+require "dependabot/pub/version"
+
+module Dependabot
+  module Pub
+    module Package
+      class RegistryPackage
+        extend T::Sig
+
+        sig { params(content: String).returns(RegistryPackage) }
+        def self.from_json(content)
+          new(JsonValueParser.object(JsonValueParser.parse(content, "Pub package"), "Pub package"))
+        end
+
+        sig { params(data: JsonValueParser::ObjectHash).void }
+        def initialize(data)
+          @data = data
+        end
+
+        sig { returns(T::Array[Dependabot::Pub::Version]) }
+        def versions
+          version_entries(@data["versions"]).map do |fields|
+            Dependabot::Pub::Version.new(JsonValueParser.string(fields["version"], "Pub package version"))
+          end
+        end
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def releases
+          version_entries(@data.fetch("versions", [])).map do |fields|
+            Dependabot::Package::PackageRelease.new(
+              version: Dependabot::Pub::Version.new(JsonValueParser.string(fields["version"], "Pub package version")),
+              released_at: Time.parse(JsonValueParser.string(fields["published"], "Pub package published"))
+            )
+          end
+        end
+
+        sig { returns(T.nilable(String)) }
+        def source_url
+          latest = JsonValueParser.optional_object(@data["latest"], "Pub package latest")
+          return unless latest
+
+          pubspec = JsonValueParser.optional_object(latest["pubspec"], "Pub package latest.pubspec")
+          return unless pubspec
+
+          value = pubspec["repository"] || pubspec["homepage"]
+          # Preserve the existing false-as-absent behavior of optional source metadata.
+          JsonValueParser.optional_string(value || nil, "Pub package repository or homepage")
+        end
+
+        private
+
+        sig { params(value: Object).returns(T::Array[JsonValueParser::ObjectHash]) }
+        def version_entries(value)
+          JsonValueParser.array(value, "Pub package versions").each_with_index.map do |entry, index|
+            JsonValueParser.object(entry, "Pub package versions[#{index}]")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pub/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -7,6 +7,7 @@ require "dependabot/update_checkers/version_filters"
 require "dependabot/registry_client"
 require "dependabot/pub/package/package_details_fetcher"
 require "dependabot/package/package_latest_version_finder"
+require "dependabot/update_checkers/cooldown_calculation"
 require "sorbet-runtime"
 
 module Dependabot
@@ -26,7 +27,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
-            options: T::Hash[Symbol, T.untyped],
+            options: T::Hash[Symbol, T.anything],
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
@@ -48,10 +49,10 @@ module Dependabot
           @cooldown_options = cooldown_options
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(DependencyServicesResult::ReportEntry) }
         def current_report
           @current_report ||= T.let(
-            T.must(
+            DependencyServicesResult.find_report(
               PackageDetailsFetcher.new(
                 dependency: dependency,
                 dependency_files: dependency_files,
@@ -59,15 +60,16 @@ module Dependabot
                 ignored_versions: ignored_versions,
                 security_advisories: security_advisories,
                 options: options
-              ).report.find { |d| d["name"] == dependency.name }
+              ).report,
+              dependency.name
             ),
-            T.nilable(T::Hash[String, T.untyped])
+            T.nilable(DependencyServicesResult::ReportEntry)
           )
         end
 
         sig { returns(T.nilable(String)) }
         def latest_version
-          latest_version = current_report["latest"]
+          latest_version = current_report.latest
           return nil unless latest_version
 
           filter_cooldown_versions(latest_version)
@@ -75,36 +77,36 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def latest_resolvable_version
-          latest_resolvable_version = current_report["singleBreaking"]&.find { |d| d["name"] == dependency.name }
-          return nil unless latest_resolvable_version
+          version = latest_resolvable_update&.version
+          return nil unless version
 
-          filter_cooldown_versions(latest_resolvable_version["version"])
+          filter_cooldown_versions(version)
         end
 
         sig { returns(T.nilable(String)) }
         def latest_resolvable_version_with_no_unlock
-          version_with_no_unlock = current_report["compatible"]&.find { |d| d["name"] == dependency.name }
-          return nil unless version_with_no_unlock
+          version = current_report.compatible.find { |entry| entry.name == dependency.name }&.version
+          return nil unless version
 
-          filter_cooldown_versions(version_with_no_unlock["version"])
+          filter_cooldown_versions(version)
         end
 
         sig { returns(T.nilable(String)) }
         def latest_version_resolvable_with_full_unlock
-          version_with_full_unlock = current_report["multiBreaking"]&.find { |d| d["name"] == dependency.name }
-          return nil unless version_with_full_unlock
+          version = full_unlock_updates.find { |entry| entry.name == dependency.name }&.version
+          return nil unless version
 
-          filter_cooldown_versions(version_with_full_unlock["version"])
+          filter_cooldown_versions(version)
         end
 
-        sig { returns(T.untyped) }
-        def latest_version_resolvable_with_full_unlock_hash
-          current_report["multiBreaking"]
+        sig { returns(T::Array[DependencyServicesResult::DependencyUpdate]) }
+        def full_unlock_updates
+          current_report.multi_breaking
         end
 
-        sig { returns(T.untyped) }
-        def latest_resolvable_version_hash
-          current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
+        sig { returns(T.nilable(DependencyServicesResult::DependencyUpdate)) }
+        def latest_resolvable_update
+          current_report.single_breaking.find { |entry| entry.name == dependency.name }
         end
 
         private
@@ -119,6 +121,47 @@ module Dependabot
           return unparsed_version unless cooldown_options
 
           @package_details ||= T.let(
+            package_details_fetcher.package_details_metadata,
+            T.nilable(T::Array[Dependabot::Package::PackageRelease])
+          )
+
+          version_release = @package_details.find do |release|
+            release.version.to_s == unparsed_version
+          end
+
+          if version_release&.released_at
+            return unparsed_version unless in_cooldown_period?(version_release)
+
+            return dependency.version
+          end
+
+          # No dated release for this candidate. A Pub release always carries a
+          # publication date, so a candidate is only missing here for one of two
+          # reasons, handled differently:
+          #
+          #   metadata present, candidate absent -> the date source is healthy and the
+          #     candidate simply isn't published on pub.dev (the resolver and registry
+          #     listings diverge). Skip cooldown quietly.
+          #
+          #   metadata empty -> we have no dates at all, so cooldown can't be applied.
+          #     Surface the shared "cooldown not applied" notice, matching docker/common.
+          unless @package_details.empty?
+            Dependabot.logger.info(
+              "No matching release metadata for #{dependency.name} #{unparsed_version}; skipping cooldown"
+            )
+            return unparsed_version
+          end
+
+          record_cooldown_date_unavailable(unparsed_version)
+          unparsed_version
+        rescue StandardError => e
+          Dependabot.logger.error("Failed to filter cooldown versions for \"#{dependency.name}\": #{e.backtrace}")
+          unparsed_version
+        end
+
+        sig { returns(PackageDetailsFetcher) }
+        def package_details_fetcher
+          @package_details_fetcher ||= T.let(
             PackageDetailsFetcher.new(
               dependency: dependency,
               dependency_files: dependency_files,
@@ -126,27 +169,46 @@ module Dependabot
               ignored_versions: ignored_versions,
               security_advisories: security_advisories,
               options: options
-            ).package_details_metadata,
-            T.nilable(T::Array[Dependabot::Package::PackageRelease])
+            ),
+            T.nilable(PackageDetailsFetcher)
           )
+        end
 
-          return unparsed_version unless @package_details.any?
+        sig { params(unparsed_version: String).void }
+        def record_cooldown_date_unavailable(unparsed_version)
+          return unless version_class.correct?(unparsed_version)
 
-          version_release = @package_details.find do |release|
-            release.version == unparsed_version
-          end
+          new_version = version_class.new(unparsed_version)
+          current_version = version_class.correct?(dependency.version) ? version_class.new(dependency.version) : nil
 
-          return unparsed_version unless in_cooldown_period?(version_release)
+          # Nothing to cool down when the candidate isn't an upgrade, or when it is
+          # ignored and would be discarded anyway; mirrors the common cooldown
+          # tracker's relevance check and avoids job-wide warnings when no update can
+          # be produced.
+          return if current_version && new_version <= current_version
+          return if ignored?(new_version)
 
-          dependency.version
-        rescue StandardError => e
-          Dependabot.logger.error("Failed to filter cooldown versions for \"#{dependency.name}\": #{e.backtrace}")
-          unparsed_version
+          Dependabot.logger.info(
+            "No publication date available for #{dependency.name} #{unparsed_version}; cooldown not applied"
+          )
+          Dependabot::UpdateCheckers::CooldownCalculation.mark_cooldown_date_unavailable(
+            dependency,
+            cooldown_days: cooldown_days_for(current_version, new_version)
+          )
+        end
+
+        sig { params(version: Dependabot::Version).returns(T::Boolean) }
+        def ignored?(version)
+          requirements = ignored_versions.flat_map do |requirement|
+            dependency.requirement_class.requirements_array(requirement)
+          end
+          requirements.any? { |requirement| requirement.satisfied_by?(version) }
         end
 
         sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
         def in_cooldown_period?(release)
-          unless release.released_at
+          released_at = release.released_at
+          unless released_at
             Dependabot.logger.info("Release date not available for version #{release.version}")
             return false
           end
@@ -155,7 +217,7 @@ module Dependabot
           days = cooldown_days_for(current_version, release.version)
 
           # Calculate the number of seconds passed since the release
-          passed_seconds = Time.now.to_i - release.released_at.to_i
+          passed_seconds = Time.now.to_i - released_at.to_i
           passed_days = passed_seconds / DAY_IN_SECONDS
 
           if passed_days < days
@@ -225,7 +287,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { returns(T::Hash[Symbol, T.untyped]) }
+        sig { returns(T::Hash[Symbol, T.anything]) }
         attr_reader :options
 
         sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }

data/lib/dependabot/pub/update_checker.rb

@@ -21,7 +21,10 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_version
-        version = version_unless_ignored(T.must(version_report.latest_version), current_version: dependency.version)
+        candidate = version_report.latest_version
+        return nil unless candidate
+
+        version = version_unless_ignored(candidate, current_version: dependency.version)
 
         raise AllVersionsIgnored if version.nil? && @raise_on_ignored
 
@@ -48,10 +51,12 @@ module Dependabot
         e = dependency_services_smallest_update
         return nil if e.nil?
 
-        upgrade = e.find { |u| u["name"] == dependency.name }
+        upgrade = e.find { |u| u.name == dependency.name }
+
+        version = upgrade&.version
+        return unless version
 
-        version = T.must(upgrade)["version"]
-        T.cast(version_unless_ignored(version), Dependabot::Version)
+        T.cast(version_unless_ignored(version), T.nilable(Dependabot::Version))
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -80,16 +85,16 @@ module Dependabot
 
                   # Ideally we would like to do any upgrade that migrates away from the vulnerability
                   # but this method can only return a single requirement udate.
-                  breaking_changes = updates&.filter { |d| d["previousConstraint"] != d["constraintBumpedIfNeeded"] }
+                  breaking_changes = updates&.filter { |d| d.previous_constraint != d.constraint_bumped_if_needed }
 
                   # This security update would require unlocking other packages, which is not currently supported.
                   # Because of that, return original requirements, so that no requirements are actually updated and
                   # the error bubbles up as security_update_not_possible to the user.
                   return dependency.requirements if breaking_changes&.size&.> 1
 
-                  updates&.find { |u| u["name"] == dependency.name }
+                  updates&.find { |u| u.name == dependency.name }
                 else
-                  version_report.latest_resolvable_version_hash
+                  version_report.latest_resolvable_update
                 end
         return [] unless entry
 
@@ -100,7 +105,7 @@ module Dependabot
       private
 
       # rubocop:disable Metrics/AbcSize
-      sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { returns(T.nilable(T::Array[DependencyServicesResult::DependencyUpdate])) }
       def dependency_services_smallest_update
         return @smallest_update if @smallest_update
 
@@ -129,10 +134,12 @@ module Dependabot
               }
             ]
         }
-        report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
+        report = DependencyServicesResult.report_from_json(
+          run_dependency_services("report", stdin_data: JSON.generate(input))
+        )
         @smallest_update = T.let(
-          report.find { |d| d["name"] == dependency.name }["smallestUpdate"],
-          T.nilable(T::Array[T::Hash[String, T.untyped]])
+          DependencyServicesResult.find_report(report.dependencies, dependency.name).smallest_update,
+          T.nilable(T::Array[DependencyServicesResult::DependencyUpdate])
         )
       end
       # rubocop:enable Metrics/AbcSize
@@ -184,11 +191,13 @@ module Dependabot
         report_section = if vulnerable?
                            dependency_services_smallest_update
                          else
-                           version_report.latest_version_resolvable_with_full_unlock_hash
+                           version_report.full_unlock_updates
                          end
+        return [] unless report_section
+
         # We only expose non-transitive dependencies here...
         direct_deps = report_section.reject do |d|
-          d["kind"] == "transitive"
+          d.kind == "transitive"
         end
         direct_deps.map do |d|
           parse_updated_dependency(d, resolved_requirements_update_strategy)

data/lib/dependabot/pub/version.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.397.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.397.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -242,13 +242,16 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/dependabot/pub.rb
+- lib/dependabot/pub/dependency_services_result.rb
 - lib/dependabot/pub/file_fetcher.rb
 - lib/dependabot/pub/file_parser.rb
 - lib/dependabot/pub/file_updater.rb
 - lib/dependabot/pub/helpers.rb
+- lib/dependabot/pub/json_value_parser.rb
 - lib/dependabot/pub/language.rb
 - lib/dependabot/pub/metadata_finder.rb
 - lib/dependabot/pub/package/package_details_fetcher.rb
+- lib/dependabot/pub/package/registry_package.rb
 - lib/dependabot/pub/package_manager.rb
 - lib/dependabot/pub/requirement.rb
 - lib/dependabot/pub/requirement_source.rb
@@ -260,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib