dependabot-pub 0.398.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3f347c5026b0a38c8b5dcd1fe34d5bf086c5232a298d8e4ee53a2a2c77675ee
-  data.tar.gz: c63bbc442dd89bd2e88381c1f8636783a96ea1e3ce4dcf8e1107182922e575c3
+  metadata.gz: bccb4cb21417d15087e804ed056b2ff00451cf1c908fd8cdfb40f7709fd02ce8
+  data.tar.gz: 685f8a0c5df291c2be68371b3c798343e61f23cd17ea5745efc879315dd3e178
 SHA512:
-  metadata.gz: 5da945c408909041abb77106389039e7d6131086dc5516411d071a248779d9cdcdd1264680f6f768dac9bb54eb6730cdcfc857537b5bcee8233042a71f4ebae0
-  data.tar.gz: 795b73580e3d48ddf10362fc1e89bc10f8dd964022434eacbeea5f3feb91cb7478ccf9d1edaa8d3d79e132a07e167358d7bae21d119b7e496290f2eec0176688
+  metadata.gz: af4a96a16577145fa0f6c3a9baf56c447f90dbade75678af5e8037faf926da725ecf3e4370dfae19e0f7f923c25aa984fb148aae146be7dacb361628809000a7
+  data.tar.gz: f615713050dddd07821622e4fd15a059b5c0470179d44236b901855c2db0feddc3fcbf89612ab681c71d4966f6ef5b355ccb73f777cc5d09411accb0188d609a

data/lib/dependabot/pub/dependency_services_result.rb

@@ -0,0 +1,167 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/pub/json_value_parser"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module Pub
+    module DependencyServicesResult
+      extend T::Sig
+
+      class ListedDependency < T::ImmutableStruct
+        const :name, String
+        const :version, String
+        const :kind, String
+        const :constraint, T.nilable(String)
+        const :source, T.nilable(JsonValueParser::ObjectHash)
+      end
+
+      class DependencyUpdate < T::ImmutableStruct
+        const :name, String
+        const :version, T.nilable(String)
+        const :kind, String
+        const :previous_version, T.nilable(String)
+        const :previous_constraint, T.nilable(String)
+        const :constraint_bumped, T.nilable(String)
+        const :constraint_bumped_if_needed, T.nilable(String)
+        const :constraint_widened, T.nilable(String)
+      end
+
+      class ReportEntry < T::ImmutableStruct
+        const :name, String
+        const :version, String
+        const :latest, T.nilable(String)
+        const :compatible, T::Array[DependencyUpdate]
+        const :single_breaking, T::Array[DependencyUpdate]
+        const :multi_breaking, T::Array[DependencyUpdate]
+        const :smallest_update, T.nilable(T::Array[DependencyUpdate])
+      end
+
+      class Report < T::ImmutableStruct
+        const :dependencies, T::Array[ReportEntry]
+        const :cache_content, String
+      end
+
+      sig { params(content: String).returns(T::Array[ListedDependency]) }
+      def self.list_from_json(content)
+        context = "dependency_services list"
+        root = JsonValueParser.object(JsonValueParser.parse(content, context), context)
+        JsonValueParser.array(root["dependencies"], "#{context}.dependencies").each_with_index.map do |value, index|
+          entry_context = "#{context}.dependencies[#{index}]"
+          fields = JsonValueParser.object(value, entry_context)
+          ListedDependency.new(
+            name: JsonValueParser.string(fields["name"], "#{entry_context}.name"),
+            version: JsonValueParser.string(fields["version"], "#{entry_context}.version"),
+            kind: JsonValueParser.string(fields["kind"], "#{entry_context}.kind"),
+            constraint: JsonValueParser.optional_string(fields["constraint"], "#{entry_context}.constraint"),
+            source: JsonValueParser.optional_object(fields["source"], "#{entry_context}.source")
+          )
+        end
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services list", e.message)
+      end
+
+      sig { params(content: String).returns(Report) }
+      def self.report_from_json(content)
+        context = "dependency_services report"
+        root = JsonValueParser.object(JsonValueParser.parse(content, context), context)
+        build_report(root["dependencies"], "#{context}.dependencies")
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services report", e.message)
+      end
+
+      sig { params(content: String).returns(Report) }
+      def self.report_from_cache(content)
+        context = "dependency_services report cache"
+        build_report(JsonValueParser.parse(content, context), context)
+      rescue JsonValueParser::InvalidValue => e
+        invalid_result("dependency_services report cache", e.message)
+      end
+
+      sig { params(reports: T::Array[ReportEntry], name: String).returns(ReportEntry) }
+      def self.find_report(reports, name)
+        report = reports.find { |entry| entry.name == name }
+        return report if report
+
+        invalid_result(
+          "dependency_services report",
+          "dependency_services report does not include the requested dependency"
+        )
+      end
+
+      sig { params(context: String, message: String).returns(T.noreturn) }
+      def self.invalid_result(context, message)
+        raise SharedHelpers::HelperSubprocessFailed.new(
+          message: message,
+          error_class: "TypeError",
+          error_context: { function: context }
+        ),
+              cause: nil
+      end
+
+      sig { params(value: Object, context: String).returns(Report) }
+      def self.build_report(value, context)
+        raw_entries = JsonValueParser.array(value, context)
+        entries = raw_entries.each_with_index.map do |entry, index|
+          report_entry(entry, "#{context}[#{index}]")
+        end
+        Report.new(dependencies: entries, cache_content: JSON.generate(raw_entries))
+      end
+      private_class_method :build_report
+
+      sig { params(value: Object, context: String).returns(ReportEntry) }
+      def self.report_entry(value, context)
+        fields = JsonValueParser.object(value, context)
+        ReportEntry.new(
+          name: JsonValueParser.string(fields["name"], "#{context}.name"),
+          version: JsonValueParser.string(fields["version"], "#{context}.version"),
+          latest: JsonValueParser.optional_string(fields["latest"], "#{context}.latest"),
+          compatible: updates(fields["compatible"], "#{context}.compatible"),
+          single_breaking: updates(fields["singleBreaking"], "#{context}.singleBreaking"),
+          multi_breaking: updates(fields["multiBreaking"], "#{context}.multiBreaking"),
+          smallest_update: if fields.key?("smallestUpdate")
+                             updates(
+                               fields["smallestUpdate"],
+                               "#{context}.smallestUpdate"
+                             )
+                           end
+        )
+      end
+      private_class_method :report_entry
+
+      sig { params(value: Object, context: String).returns(T::Array[DependencyUpdate]) }
+      def self.updates(value, context)
+        JsonValueParser.array(value, context).each_with_index.map do |entry, index|
+          entry_context = "#{context}[#{index}]"
+          fields = JsonValueParser.object(entry, entry_context)
+          DependencyUpdate.new(
+            name: JsonValueParser.string(fields["name"], "#{entry_context}.name"),
+            version: JsonValueParser.optional_string(fields["version"], "#{entry_context}.version"),
+            kind: JsonValueParser.string(fields["kind"], "#{entry_context}.kind"),
+            previous_version: JsonValueParser.optional_string(
+              fields["previousVersion"],
+              "#{entry_context}.previousVersion"
+            ),
+            previous_constraint: JsonValueParser.optional_string(
+              fields["previousConstraint"], "#{entry_context}.previousConstraint"
+            ),
+            constraint_bumped: JsonValueParser.optional_string(
+              fields["constraintBumped"],
+              "#{entry_context}.constraintBumped"
+            ),
+            constraint_bumped_if_needed: JsonValueParser.optional_string(
+              fields["constraintBumpedIfNeeded"], "#{entry_context}.constraintBumpedIfNeeded"
+            ),
+            constraint_widened: JsonValueParser.optional_string(
+              fields["constraintWidened"],
+              "#{entry_context}.constraintWidened"
+            )
+          )
+        end
+      end
+      private_class_method :updates
+    end
+  end
+end

data/lib/dependabot/pub/file_parser.rb

@@ -82,9 +82,9 @@ module Dependabot
         raise "No pubspec.yaml!" unless get_original_file("pubspec.yaml")
       end
 
-      sig { returns(T::Array[T::Hash[String, Object]]) }
+      sig { returns(T::Array[DependencyServicesResult::ListedDependency]) }
       def list
-        @list ||= T.let(dependency_services_list, T.nilable(T::Array[T::Hash[String, Object]]))
+        @list ||= T.let(dependency_services_list, T.nilable(T::Array[DependencyServicesResult::ListedDependency]))
       end
     end
   end

data/lib/dependabot/pub/helpers.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "digest"
@@ -8,6 +8,8 @@ require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/logger"
+require "dependabot/pub/dependency_services_result"
+require "dependabot/pub/package/registry_package"
 require "dependabot/pub/requirement"
 require "dependabot/pub/requirement_source"
 require "dependabot/requirements_update_strategy"
@@ -23,13 +25,19 @@ module Dependabot
 
       abstract!
 
+      class SdkVersions < T::ImmutableStruct
+        const :flutter, String
+        const :dart, String
+        const :channel, T.nilable(String), default: nil
+      end
+
       sig { abstract.returns(T::Array[Dependabot::Credential]) }
       def credentials; end
 
       sig { abstract.returns(T::Array[Dependabot::DependencyFile]) }
       def dependency_files; end
 
-      sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+      sig { abstract.returns(T::Hash[Symbol, T.anything]) }
       def options; end
 
       sig { returns(String) }
@@ -42,7 +50,7 @@ module Dependabot
           dir: T.any(Pathname, String),
           url: T.nilable(String)
         )
-          .returns(T.nilable(T::Hash[String, T.untyped]))
+          .returns(T.nilable(SdkVersions))
       end
       def self.run_infer_sdk_versions(dir, url: nil)
         env = {}
@@ -51,24 +59,31 @@ module Dependabot
         stdout, _, status = Open3.capture3(env, cmd, opts, chdir: dir)
         return nil unless status.success?
 
-        JSON.parse(stdout)
+        fields = JsonValueParser.object(JsonValueParser.parse(stdout, "infer_sdk_versions"), "infer_sdk_versions")
+        SdkVersions.new(
+          flutter: JsonValueParser.string(fields["flutter"], "infer_sdk_versions.flutter"),
+          dart: JsonValueParser.string(fields["dart"], "infer_sdk_versions.dart"),
+          channel: JsonValueParser.string(fields["channel"], "infer_sdk_versions.channel")
+        )
+      rescue JsonValueParser::InvalidValue => e
+        DependencyServicesResult.invalid_result("infer_sdk_versions", e.message)
       end
 
       private
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[DependencyServicesResult::ListedDependency]) }
       def dependency_services_list
-        JSON.parse(run_dependency_services("list"))["dependencies"]
+        DependencyServicesResult.list_from_json(run_dependency_services("list"))
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(String) }
       def repository_url(dependency)
         repository_url = RequirementSource.new(dependency.requirements.first).description_string("url") ||
-                         options[:pub_hosted_url] || "https://pub.dev"
+                         option_string(:pub_hosted_url) || "https://pub.dev"
         repository_url.delete_suffix("/")
       end
 
-      sig { params(dependency: Dependabot::Dependency).returns(T::Hash[String, T.untyped]) }
+      sig { params(dependency: Dependabot::Dependency).returns(Package::RegistryPackage) }
       def fetch_package_listing(dependency)
         # Because we get the security_advisories as a set of constraints, we
         # fetch the list of all versions and filter them to a list of vulnerable
@@ -77,17 +92,15 @@ module Dependabot
         # Ideally we would like the helper to be the only one doing requests to
         # the repository. But this should work for now:
         response = Dependabot::RegistryClient.get(url: "#{repository_url(dependency)}/api/packages/#{dependency.name}")
-        JSON.parse(response.body)
+        Package::RegistryPackage.from_json(response.body)
       end
 
       sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Pub::Version]) }
       def available_versions(dependency)
-        fetch_package_listing(dependency)["versions"].map do |v|
-          Dependabot::Pub::Version.new(v["version"])
-        end
+        fetch_package_listing(dependency).versions
       end
 
-      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { returns(T::Array[DependencyServicesResult::ReportEntry]) }
       def dependency_services_report
         sha256 = Digest::SHA256.new
         dependency_files.each do |f|
@@ -96,11 +109,11 @@ module Dependabot
         hash = sha256.hexdigest
 
         cache_file = "/tmp/report-#{hash}-pid-#{Process.pid}.json"
-        return JSON.parse(File.read(cache_file)) if File.file?(cache_file)
+        return DependencyServicesResult.report_from_cache(File.read(cache_file)).dependencies if File.file?(cache_file)
 
-        report = JSON.parse(run_dependency_services("report"))["dependencies"]
-        File.write(cache_file, JSON.generate(report))
-        report
+        report = DependencyServicesResult.report_from_json(run_dependency_services("report"))
+        File.write(cache_file, report.cache_content)
+        report.dependencies
       end
 
       sig do
@@ -177,19 +190,19 @@ module Dependabot
       ## Detects the right flutter release to use for the pubspec.yaml.
       ## Then checks it out if it is not already.
       ## Returns the sdk versions
-      sig { params(dir: T.any(Pathname, String)).returns(T::Hash[String, String]) }
+      sig { params(dir: T.any(Pathname, String)).returns(SdkVersions) }
       def ensure_right_flutter_release(dir)
         versions = Helpers.run_infer_sdk_versions(
-          File.join(dir, dependency_files.first&.directory),
-          url: options[:flutter_releases_url]
+          File.join(dir, T.must(dependency_files.first).directory),
+          url: option_string(:flutter_releases_url)
         )
         flutter_ref =
           if versions
             Dependabot.logger.info(
-              "Installing the Flutter SDK version: #{versions['flutter']} " \
-              "from channel #{versions['channel']} with Dart #{versions['dart']}"
+              "Installing the Flutter SDK version: #{versions.flutter} " \
+              "from channel #{versions.channel} with Dart #{versions.dart}"
             )
-            "refs/tags/#{versions['flutter']}"
+            "refs/tags/#{versions.flutter}"
           else
             Dependabot.logger.info(
               "Failed to infer the flutter version. Attempting to use latest stable release."
@@ -218,7 +231,7 @@ module Dependabot
       end
 
       # Runs `flutter version` and returns the dart and flutter version numbers in a map.
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(SdkVersions) }
       def run_flutter_version
         Dependabot.logger.info "Running `flutter --version`"
         # Run `flutter --version --machine` to get the current flutter version.
@@ -234,20 +247,18 @@ module Dependabot
                 "Running 'flutter --version --machine' failed: #{stderr}"
         end
 
-        parsed = JSON.parse(stdout)
-        flutter_version = parsed["frameworkVersion"]
-        dart_version = parsed["dartSdkVersion"]&.split&.first
-        unless flutter_version && dart_version
-          raise Dependabot::DependabotError,
-                "Bad output from `flutter --version`: #{stdout}"
-        end
+        context = "flutter --version"
+        parsed = JsonValueParser.object(JsonValueParser.parse(stdout, context), context)
+        flutter_version = JsonValueParser.string(parsed["frameworkVersion"], "#{context}.frameworkVersion")
+        dart_version = JsonValueParser.string(parsed["dartSdkVersion"], "#{context}.dartSdkVersion").split.first
+        raise JsonValueParser::InvalidValue, "#{context}.dartSdkVersion must contain a version" unless dart_version
+
         Dependabot.logger.info(
           "Installed the Flutter SDK version: #{flutter_version} with Dart #{dart_version}."
         )
-        {
-          "flutter" => flutter_version,
-          "dart" => dart_version
-        }
+        SdkVersions.new(flutter: flutter_version, dart: dart_version)
+      rescue JsonValueParser::InvalidValue => e
+        DependencyServicesResult.invalid_result("flutter --version", e.message)
       end
 
       sig do
@@ -273,12 +284,12 @@ module Dependabot
               "PUB_ENVIRONMENT" => "dependabot",
               "FLUTTER_ROOT" => "/tmp/flutter",
               "DART_ROOT" => "/tmp/flutter/bin/cache/dart-sdk",
-              "PUB_HOSTED_URL" => options[:pub_hosted_url],
+              "PUB_HOSTED_URL" => option_string(:pub_hosted_url),
               # This variable will make the solver run assuming that Dart SDK version.
               # TODO(sigurdm): Would be nice to have a better handle for fixing the dart sdk version.
-              "_PUB_TEST_SDK_VERSION" => sdk_versions["dart"]
+              "_PUB_TEST_SDK_VERSION" => sdk_versions.dart
             }
-            command_dir = File.join(temp_dir, dependency_files.first&.directory)
+            command_dir = File.join(temp_dir, T.must(dependency_files.first).directory)
 
             stdout, stderr, status = Open3.capture3(
               env.compact,
@@ -311,25 +322,19 @@ module Dependabot
       end
 
       # Parses a dependency as listed by `dependency_services list`.
-      sig { params(json: T::Hash[String, T.untyped]).returns(Dependabot::Dependency) }
-      def parse_listed_dependency(json)
-        params = {
-          name: json["name"],
-          version: json["version"],
-          package_manager: "pub",
-          requirements: []
-        }
+      sig { params(entry: DependencyServicesResult::ListedDependency).returns(Dependabot::Dependency) }
+      def parse_listed_dependency(entry)
+        requirements = []
 
-        if json["kind"] != "transitive" && !json["constraint"].nil?
-          constraint = json["constraint"]
-          params[:requirements] << {
-            requirement: constraint,
-            groups: [json["kind"]],
-            source: json["source"],
+        if entry.kind != "transitive" && !entry.constraint.nil?
+          requirements << {
+            requirement: entry.constraint,
+            groups: [entry.kind],
+            source: entry.source,
             file: "pubspec.yaml"
           }
         end
-        Dependency.new(**params)
+        Dependency.new(name: entry.name, version: entry.version, package_manager: "pub", requirements: requirements)
       end
 
       # Parses the updated dependencies returned by
@@ -339,43 +344,41 @@ module Dependabot
       # used to chose the right updated constraint.
       sig do
         params(
-          json: T::Hash[String, T.untyped],
+          entry: DependencyServicesResult::DependencyUpdate,
           requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
         )
           .returns(Dependabot::Dependency)
       end
-      def parse_updated_dependency(json, requirements_update_strategy)
+      def parse_updated_dependency(entry, requirements_update_strategy)
         requirements = []
-        constraint_field = constraint_field_from_update_strategy(requirements_update_strategy)
+        constraint = constraint_from_update_strategy(entry, requirements_update_strategy)
 
-        if json["kind"] != "transitive" && !json[constraint_field].nil?
-          constraint = json[constraint_field]
+        if entry.kind != "transitive" && !constraint.nil?
           requirements << {
             requirement: constraint,
-            groups: [json["kind"]],
+            groups: [entry.kind],
             source: nil, # TODO: Expose some information about the source
             file: "pubspec.yaml"
           }
         end
 
         previous_requirements = []
-        if json["previousVersion"] && json["kind"] != "transitive" && !json["previousConstraint"].nil?
-          constraint = json["previousConstraint"]
+        if entry.previous_version && entry.kind != "transitive" && !entry.previous_constraint.nil?
           previous_requirements << {
-            requirement: constraint,
-            groups: [json["kind"]],
+            requirement: entry.previous_constraint,
+            groups: [entry.kind],
             source: nil, # TODO: Expose some information about the source
             file: "pubspec.yaml"
           }
         end
 
         Dependency.new(
-          name: json["name"],
-          version: json["version"],
+          name: entry.name,
+          version: entry.version,
           package_manager: "pub",
           requirements: requirements,
-          previous_version: json["previousVersion"],
-          previous_requirements: json["previousVersion"] ? previous_requirements : nil
+          previous_version: entry.previous_version,
+          previous_requirements: entry.previous_version ? previous_requirements : nil
         )
       end
 
@@ -383,23 +386,35 @@ module Dependabot
       # strategies.
       sig do
         params(
+          entry: DependencyServicesResult::DependencyUpdate,
           requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
         )
-          .returns(String)
+          .returns(T.nilable(String))
       end
-      def constraint_field_from_update_strategy(requirements_update_strategy)
+      def constraint_from_update_strategy(entry, requirements_update_strategy)
         case requirements_update_strategy
         when RequirementsUpdateStrategy::WidenRanges
-          "constraintWidened"
+          entry.constraint_widened
         when RequirementsUpdateStrategy::BumpVersions
-          "constraintBumped"
+          entry.constraint_bumped
         when RequirementsUpdateStrategy::BumpVersionsIfNecessary
-          "constraintBumpedIfNeeded"
+          entry.constraint_bumped_if_needed
         else
           raise "Unexpected requirements_update_strategy #{requirements_update_strategy}"
         end
       end
 
+      sig { params(key: Symbol).returns(T.nilable(String)) }
+      def option_string(key)
+        value = options[key]
+
+        case value
+        when String then value
+        when nil then nil
+        else raise TypeError, "Pub option #{key} must be a string or nil"
+        end
+      end
+
       sig do
         params(
           dependencies: T.nilable(T::Array[Dependabot::Dependency])
@@ -407,29 +422,19 @@ module Dependabot
           .returns(T.nilable(String))
       end
       def dependencies_to_json(dependencies)
-        if dependencies.nil?
-          nil
-        else
-          deps = dependencies.map do |d|
-            source = d.requirements.empty? ? nil : d.requirements.first&.[](:source)
-            obj = {
-              "name" => d.name,
-              "version" => d.version,
-              "source" => source
-            }
-
-            unless d.requirements.nil? || d.requirements.empty?
-              obj["constraint"] =
-                d.requirements[0]&.[](:requirement).to_s
-            end
-            obj
-          end
-          JSON.generate(
-            {
-              "dependencyChanges" => deps
-            }
-          )
+        return if dependencies.nil?
+
+        changes = dependencies.map do |dependency|
+          requirement = dependency.requirements.first
+          fields = {
+            "name" => dependency.name,
+            "version" => dependency.version,
+            "source" => requirement&.source
+          }
+          fields["constraint"] = requirement.requirement.to_s if requirement
+          fields
         end
+        JSON.generate("dependencyChanges" => changes)
       end
     end
   end

data/lib/dependabot/pub/json_value_parser.rb

@@ -0,0 +1,65 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+module Dependabot
+  module Pub
+    module JsonValueParser
+      extend T::Sig
+
+      class InvalidValue < TypeError; end
+
+      ObjectHash = T.type_alias { T::Hash[String, Object] }
+
+      sig { params(content: String, context: String).returns(Object) }
+      def self.parse(content, context)
+        T.cast(JSON.parse(content), Object)
+      rescue JSON::ParserError
+        raise InvalidValue.new("#{context} must be valid JSON"), cause: nil
+      end
+
+      sig { params(value: Object, context: String).returns(ObjectHash) }
+      def self.object(value, context)
+        raise InvalidValue, "#{context} must be an object" unless value.is_a?(Hash)
+
+        value.to_h do |raw_key, raw_value|
+          key = T.cast(raw_key, Object)
+          raise InvalidValue, "#{context} keys must be strings" unless key.is_a?(String)
+
+          [key, T.cast(raw_value, Object)]
+        end
+      end
+
+      sig { params(value: Object, context: String).returns(T.nilable(ObjectHash)) }
+      def self.optional_object(value, context)
+        return if value.nil?
+
+        object(value, context)
+      end
+
+      sig { params(value: Object, context: String).returns(T::Array[Object]) }
+      def self.array(value, context)
+        raise InvalidValue, "#{context} must be an array" unless value.is_a?(Array)
+
+        value.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object, context: String).returns(String) }
+      def self.string(value, context)
+        return value if value.is_a?(String)
+
+        raise InvalidValue, "#{context} must be a string"
+      end
+
+      sig { params(value: Object, context: String).returns(T.nilable(String)) }
+      def self.optional_string(value, context)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise InvalidValue, "#{context} must be a string or nil"
+      end
+    end
+  end
+end

data/lib/dependabot/pub/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -6,6 +6,7 @@ require "sorbet-runtime"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/pub/requirement_source"
+require "dependabot/pub/package/registry_package"
 require "dependabot/registry_client"
 
 module Dependabot
@@ -26,20 +27,16 @@ module Dependabot
         end
         repository_url = (source.description_string("url") || "https://pub.dev").delete_suffix("/")
 
-        listing = repository_listing(repository_url)
-        repo = listing.dig("latest", "pubspec", "repository")
-        # The repository field did not always exist in pubspec.yaml, and some
-        # packages specify a git repository in the "homepage" field.
-        repo ||= listing.dig("latest", "pubspec", "homepage")
+        repo = repository_listing(repository_url).source_url
         return nil unless repo
 
         Source.from_url(repo)
       end
 
-      sig { params(repository_url: String).returns(T::Hash[String, T.untyped]) }
+      sig { params(repository_url: String).returns(Package::RegistryPackage) }
       def repository_listing(repository_url)
         response = Dependabot::RegistryClient.get(url: "#{repository_url}/api/packages/#{dependency.name}")
-        JSON.parse(response.body)
+        Package::RegistryPackage.from_json(response.body)
       end
     end
   end

data/lib/dependabot/pub/package/package_details_fetcher.rb

@@ -1,8 +1,6 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "json"
-require "time"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
@@ -29,7 +27,7 @@ module Dependabot
         sig { override.returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { override.returns(T::Hash[Symbol, T.untyped]) }
+        sig { override.returns(T::Hash[Symbol, T.anything]) }
         attr_reader :options
 
         sig { override.returns(T::Array[Dependabot::Credential]) }
@@ -42,7 +40,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
-            options: T::Hash[Symbol, T.untyped]
+            options: T::Hash[Symbol, T.anything]
           )
             .void
         end
@@ -62,55 +60,33 @@ module Dependabot
           @options = options
         end
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[DependencyServicesResult::ReportEntry]) }
         def report
           @report ||= T.let(
             dependency_services_report,
-            T.nilable(T::Array[T::Hash[String, T.untyped]])
+            T.nilable(T::Array[DependencyServicesResult::ReportEntry])
           )
         end
 
-        sig { returns(T.any(T::Array[Dependabot::Package::PackageRelease], T.untyped)) }
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
         def package_details_metadata
           Dependabot.logger.info("Initializing package metadata for \"#{@dependency.name}\"")
 
           response = fetch_package_metadata(dependency)
           return [] if response.status >= 500
 
-          versions = JSON.parse(response.body).fetch("versions", [])
-
           # Build the full list up front. If any release can't be parsed (e.g. a
           # missing or invalid publish date) the partial result is discarded, so
           # callers can treat a non-empty list as a complete, trustworthy snapshot
           # and an empty list as "no usable metadata".
-          versions.map do |v|
-            package_release(
-              version: v["version"],
-              publish_date: Time.parse(v["published"])
-            )
-          end
-        rescue JSON::ParserError
+          RegistryPackage.from_json(response.body).releases
+        rescue JsonValueParser::InvalidValue
           Dependabot.logger.error("Failed to parse package metadata")
           []
         rescue StandardError => e
           Dependabot.logger.error("Failed to fetch package metadata #{e.message}")
           []
         end
-
-        private
-
-        sig do
-          params(
-            version: String,
-            publish_date: T.nilable(Time)
-          ).returns(Dependabot::Package::PackageRelease)
-        end
-        def package_release(version:, publish_date: nil)
-          Dependabot::Package::PackageRelease.new(
-            version: Pub::Version.new(version),
-            released_at: publish_date
-          )
-        end
       end
     end
   end

data/lib/dependabot/pub/package/registry_package.rb

@@ -0,0 +1,67 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "time"
+require "sorbet-runtime"
+require "dependabot/package/package_release"
+require "dependabot/pub/json_value_parser"
+require "dependabot/pub/version"
+
+module Dependabot
+  module Pub
+    module Package
+      class RegistryPackage
+        extend T::Sig
+
+        sig { params(content: String).returns(RegistryPackage) }
+        def self.from_json(content)
+          new(JsonValueParser.object(JsonValueParser.parse(content, "Pub package"), "Pub package"))
+        end
+
+        sig { params(data: JsonValueParser::ObjectHash).void }
+        def initialize(data)
+          @data = data
+        end
+
+        sig { returns(T::Array[Dependabot::Pub::Version]) }
+        def versions
+          version_entries(@data["versions"]).map do |fields|
+            Dependabot::Pub::Version.new(JsonValueParser.string(fields["version"], "Pub package version"))
+          end
+        end
+
+        sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+        def releases
+          version_entries(@data.fetch("versions", [])).map do |fields|
+            Dependabot::Package::PackageRelease.new(
+              version: Dependabot::Pub::Version.new(JsonValueParser.string(fields["version"], "Pub package version")),
+              released_at: Time.parse(JsonValueParser.string(fields["published"], "Pub package published"))
+            )
+          end
+        end
+
+        sig { returns(T.nilable(String)) }
+        def source_url
+          latest = JsonValueParser.optional_object(@data["latest"], "Pub package latest")
+          return unless latest
+
+          pubspec = JsonValueParser.optional_object(latest["pubspec"], "Pub package latest.pubspec")
+          return unless pubspec
+
+          value = pubspec["repository"] || pubspec["homepage"]
+          # Preserve the existing false-as-absent behavior of optional source metadata.
+          JsonValueParser.optional_string(value || nil, "Pub package repository or homepage")
+        end
+
+        private
+
+        sig { params(value: Object).returns(T::Array[JsonValueParser::ObjectHash]) }
+        def version_entries(value)
+          JsonValueParser.array(value, "Pub package versions").each_with_index.map do |entry, index|
+            JsonValueParser.object(entry, "Pub package versions[#{index}]")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pub/update_checker/latest_version_finder.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "excon"
@@ -27,7 +27,7 @@ module Dependabot
             credentials: T::Array[Dependabot::Credential],
             ignored_versions: T::Array[String],
             security_advisories: T::Array[Dependabot::SecurityAdvisory],
-            options: T::Hash[Symbol, T.untyped],
+            options: T::Hash[Symbol, T.anything],
             cooldown_options: T.nilable(Dependabot::Package::ReleaseCooldownOptions)
           ).void
         end
@@ -49,10 +49,10 @@ module Dependabot
           @cooldown_options = cooldown_options
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(DependencyServicesResult::ReportEntry) }
         def current_report
           @current_report ||= T.let(
-            T.must(
+            DependencyServicesResult.find_report(
               PackageDetailsFetcher.new(
                 dependency: dependency,
                 dependency_files: dependency_files,
@@ -60,15 +60,16 @@ module Dependabot
                 ignored_versions: ignored_versions,
                 security_advisories: security_advisories,
                 options: options
-              ).report.find { |d| d["name"] == dependency.name }
+              ).report,
+              dependency.name
             ),
-            T.nilable(T::Hash[String, T.untyped])
+            T.nilable(DependencyServicesResult::ReportEntry)
           )
         end
 
         sig { returns(T.nilable(String)) }
         def latest_version
-          latest_version = current_report["latest"]
+          latest_version = current_report.latest
           return nil unless latest_version
 
           filter_cooldown_versions(latest_version)
@@ -76,36 +77,36 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def latest_resolvable_version
-          latest_resolvable_version = current_report["singleBreaking"]&.find { |d| d["name"] == dependency.name }
-          return nil unless latest_resolvable_version
+          version = latest_resolvable_update&.version
+          return nil unless version
 
-          filter_cooldown_versions(latest_resolvable_version["version"])
+          filter_cooldown_versions(version)
         end
 
         sig { returns(T.nilable(String)) }
         def latest_resolvable_version_with_no_unlock
-          version_with_no_unlock = current_report["compatible"]&.find { |d| d["name"] == dependency.name }
-          return nil unless version_with_no_unlock
+          version = current_report.compatible.find { |entry| entry.name == dependency.name }&.version
+          return nil unless version
 
-          filter_cooldown_versions(version_with_no_unlock["version"])
+          filter_cooldown_versions(version)
         end
 
         sig { returns(T.nilable(String)) }
         def latest_version_resolvable_with_full_unlock
-          version_with_full_unlock = current_report["multiBreaking"]&.find { |d| d["name"] == dependency.name }
-          return nil unless version_with_full_unlock
+          version = full_unlock_updates.find { |entry| entry.name == dependency.name }&.version
+          return nil unless version
 
-          filter_cooldown_versions(version_with_full_unlock["version"])
+          filter_cooldown_versions(version)
         end
 
-        sig { returns(T.untyped) }
-        def latest_version_resolvable_with_full_unlock_hash
-          current_report["multiBreaking"]
+        sig { returns(T::Array[DependencyServicesResult::DependencyUpdate]) }
+        def full_unlock_updates
+          current_report.multi_breaking
         end
 
-        sig { returns(T.untyped) }
-        def latest_resolvable_version_hash
-          current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
+        sig { returns(T.nilable(DependencyServicesResult::DependencyUpdate)) }
+        def latest_resolvable_update
+          current_report.single_breaking.find { |entry| entry.name == dependency.name }
         end
 
         private
@@ -286,7 +287,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { returns(T::Hash[Symbol, T.untyped]) }
+        sig { returns(T::Hash[Symbol, T.anything]) }
         attr_reader :options
 
         sig { returns(T.nilable(Dependabot::Package::ReleaseCooldownOptions)) }

data/lib/dependabot/pub/update_checker.rb

@@ -21,7 +21,10 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_version
-        version = version_unless_ignored(T.must(version_report.latest_version), current_version: dependency.version)
+        candidate = version_report.latest_version
+        return nil unless candidate
+
+        version = version_unless_ignored(candidate, current_version: dependency.version)
 
         raise AllVersionsIgnored if version.nil? && @raise_on_ignored
 
@@ -48,10 +51,12 @@ module Dependabot
         e = dependency_services_smallest_update
         return nil if e.nil?
 
-        upgrade = e.find { |u| u["name"] == dependency.name }
+        upgrade = e.find { |u| u.name == dependency.name }
+
+        version = upgrade&.version
+        return unless version
 
-        version = T.must(upgrade)["version"]
-        T.cast(version_unless_ignored(version), Dependabot::Version)
+        T.cast(version_unless_ignored(version), T.nilable(Dependabot::Version))
       end
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
@@ -80,16 +85,16 @@ module Dependabot
 
                   # Ideally we would like to do any upgrade that migrates away from the vulnerability
                   # but this method can only return a single requirement udate.
-                  breaking_changes = updates&.filter { |d| d["previousConstraint"] != d["constraintBumpedIfNeeded"] }
+                  breaking_changes = updates&.filter { |d| d.previous_constraint != d.constraint_bumped_if_needed }
 
                   # This security update would require unlocking other packages, which is not currently supported.
                   # Because of that, return original requirements, so that no requirements are actually updated and
                   # the error bubbles up as security_update_not_possible to the user.
                   return dependency.requirements if breaking_changes&.size&.> 1
 
-                  updates&.find { |u| u["name"] == dependency.name }
+                  updates&.find { |u| u.name == dependency.name }
                 else
-                  version_report.latest_resolvable_version_hash
+                  version_report.latest_resolvable_update
                 end
         return [] unless entry
 
@@ -100,7 +105,7 @@ module Dependabot
       private
 
       # rubocop:disable Metrics/AbcSize
-      sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      sig { returns(T.nilable(T::Array[DependencyServicesResult::DependencyUpdate])) }
       def dependency_services_smallest_update
         return @smallest_update if @smallest_update
 
@@ -129,10 +134,12 @@ module Dependabot
               }
             ]
         }
-        report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
+        report = DependencyServicesResult.report_from_json(
+          run_dependency_services("report", stdin_data: JSON.generate(input))
+        )
         @smallest_update = T.let(
-          report.find { |d| d["name"] == dependency.name }["smallestUpdate"],
-          T.nilable(T::Array[T::Hash[String, T.untyped]])
+          DependencyServicesResult.find_report(report.dependencies, dependency.name).smallest_update,
+          T.nilable(T::Array[DependencyServicesResult::DependencyUpdate])
         )
       end
       # rubocop:enable Metrics/AbcSize
@@ -184,11 +191,13 @@ module Dependabot
         report_section = if vulnerable?
                            dependency_services_smallest_update
                          else
-                           version_report.latest_version_resolvable_with_full_unlock_hash
+                           version_report.full_unlock_updates
                          end
+        return [] unless report_section
+
         # We only expose non-transitive dependencies here...
         direct_deps = report_section.reject do |d|
-          d["kind"] == "transitive"
+          d.kind == "transitive"
         end
         direct_deps.map do |d|
           parse_updated_dependency(d, resolved_requirements_update_strategy)

data/lib/dependabot/pub/version.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -242,13 +242,16 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/dependabot/pub.rb
+- lib/dependabot/pub/dependency_services_result.rb
 - lib/dependabot/pub/file_fetcher.rb
 - lib/dependabot/pub/file_parser.rb
 - lib/dependabot/pub/file_updater.rb
 - lib/dependabot/pub/helpers.rb
+- lib/dependabot/pub/json_value_parser.rb
 - lib/dependabot/pub/language.rb
 - lib/dependabot/pub/metadata_finder.rb
 - lib/dependabot/pub/package/package_details_fetcher.rb
+- lib/dependabot/pub/package/registry_package.rb
 - lib/dependabot/pub/package_manager.rb
 - lib/dependabot/pub/requirement.rb
 - lib/dependabot/pub/requirement_source.rb
@@ -260,7 +263,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib