dependabot-pub 0.260.0 → 0.261.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa93debc9fbe0474b06a5ec0c7737ea8485b06d77a65d12caed267240f333963
-  data.tar.gz: a40474d2d19f54354883dfc49be83a0fd8fcb3cecdad24b060574119c2fa79b4
+  metadata.gz: 2cf81b6bb26d12ae3892697200ad7587f46721de4e02f6c8356a32fc03ea2983
+  data.tar.gz: 3ffc7ae3afe4a9cdeea18701aa4a07d33c2c27df3487f6f65a61e0a59a2f1a25
 SHA512:
-  metadata.gz: b11909f266e36adb2d59138ddb466f1f5575066b924b5106fa881d05a2a9c6d6711a49f66783460d213c563683101dc52128d69a6d5817e9da827584a5c8c8d5
-  data.tar.gz: 7b57e879839453308554ba57d49dddae75198b14828a8636924d0ceb331596f38d4dfc04800e4d18c8792cd6880e0b8a6d0b5dea8eea9cec5adb974cff3c61de
+  metadata.gz: 75c025a9d3e3c640efd69915fc274cc38c4e3deb01ccfd155b2ef816eed232678db52613922094aa9daee5c6a2bc6f0abaee8565a5f80bab3856feab0469b3fa
+  data.tar.gz: fe2b94562c43fcc97642c5e4e9ad22df18b17f8f4c5d5b3c5136b4d75fd8ff439f94eb1212ebba4dcb3aa6ea934e8e013c6195dacd72cb19930b273c14b743ba

data/lib/dependabot/pub/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_parsers"
@@ -6,13 +6,17 @@ require "dependabot/file_parsers/base"
 require "dependabot/dependency"
 require "dependabot/pub/version"
 require "dependabot/pub/helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Pub
     class FileParser < Dependabot::FileParsers::Base
+      extend T::Sig
+
       require "dependabot/file_parsers/base/dependency_set"
       include Dependabot::Pub::Helpers
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
         dependency_set = DependencySet.new
         list.map do |d|
@@ -23,12 +27,14 @@ module Dependabot
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No pubspec.yaml!" unless get_original_file("pubspec.yaml")
       end
 
+      sig { returns(T::Array[Dependabot::Dependency]) }
       def list
-        @list ||= dependency_services_list
+        @list ||= T.let(dependency_services_list, T.nilable(T::Array[Dependabot::Dependency]))
       end
     end
   end

data/lib/dependabot/pub/file_updater.rb

@@ -1,15 +1,19 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/pub/helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Pub
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       include Dependabot::Pub::Helpers
 
+      sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [
           /^pubspec\.yaml$/,
@@ -17,12 +21,14 @@ module Dependabot
         ]
       end
 
+      sig { override.returns(T::Array[DependencyFile]) }
       def updated_dependency_files
         dependency_services_apply(@dependencies)
       end
 
       private
 
+      sig { override.void }
       def check_required_files
         raise "No pubspec.yaml!" unless get_original_file("pubspec.yaml")
       end

data/lib/dependabot/pub/helpers.rb

@@ -1,9 +1,10 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
+require "digest"
 require "json"
 require "open3"
-require "digest"
+require "sorbet-runtime"
 
 require "dependabot/errors"
 require "dependabot/logger"
@@ -14,17 +15,31 @@ require "dependabot/shared_helpers"
 module Dependabot
   module Pub
     module Helpers
+      include Kernel
+
+      extend T::Sig
+      extend T::Helpers
+
+      abstract!
+
+      sig { returns(T::Array[Dependabot::Credential]) }
+      attr_reader :credentials
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      attr_reader :dependency_files
+
+      sig { returns(T::Hash[Symbol, T.untyped]) }
+      attr_reader :options
+
       def self.pub_helpers_path
         File.join(ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil), "pub")
       end
 
       def self.run_infer_sdk_versions(dir, url: nil)
-        stdout, _, status = Open3.capture3(
-          {},
-          File.join(pub_helpers_path, "infer_sdk_versions"),
-          *("--flutter-releases-url=#{url}" if url),
-          chdir: dir
-        )
+        env = {}
+        cmd = File.join(pub_helpers_path, "infer_sdk_versions")
+        opts = url ? "--flutter-releases-url=#{url}" : ""
+        stdout, _, status = Open3.capture3(env, cmd, opts, chdir: dir)
         return nil unless status.success?
 
         JSON.parse(stdout)
@@ -58,42 +73,10 @@ module Dependabot
         end
       end
 
-      def dependency_services_smallest_update
-        return @smallest_update if @smallest_update
-
-        security_advisories.each do |a|
-          # Sanity check, that we only get the advisories for a single package
-          # at a time. If we got all advisories for all current dependencies,
-          # the helper would be able to handle it, but we would need a better
-          # way to find the repository url.
-          if a.dependency_name != dependency.name
-            raise "Only expected advisories for #{dependency.name} got for #{a.dependency_name}"
-          end
-        end
-        vulnerable_versions = available_versions(dependency).select do |v|
-          security_advisories.any? { |a| a.vulnerable?(v) }
-        end
-        input = {
-          # For "smallest update" we don't cache the report to be shared between
-          # dependencies, but run a specific report for the current dependency.
-          target: dependency.name,
-          disallowed:
-            [
-              {
-                name: dependency.name,
-                url: repository_url(dependency),
-                versions: vulnerable_versions.map { |v| { range: v.to_s } }
-              }
-            ]
-        }
-        report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
-        @smallest_update = report.find { |d| d["name"] == dependency.name }["smallestUpdate"]
-      end
-
       def dependency_services_report
         sha256 = Digest::SHA256.new
         dependency_files.each do |f|
-          sha256 << (f.path + "\n" + f.content + "\n")
+          sha256 << (f.path + "\n" + T.must(f.content) + "\n")
         end
         hash = sha256.hexdigest
 
@@ -165,7 +148,7 @@ module Dependabot
       ## Returns the sdk versions
       def ensure_right_flutter_release(dir)
         versions = Helpers.run_infer_sdk_versions(
-          File.join(dir, dependency_files.first.directory),
+          File.join(dir, dependency_files.first&.directory),
           url: options[:flutter_releases_url]
         )
         flutter_ref =
@@ -251,7 +234,7 @@ module Dependabot
               # TODO(sigurdm): Would be nice to have a better handle for fixing the dart sdk version.
               "_PUB_TEST_SDK_VERSION" => sdk_versions["dart"]
             }
-            command_dir = File.join(temp_dir, dependency_files.first.directory)
+            command_dir = File.join(temp_dir, dependency_files.first&.directory)
 
             stdout, stderr, status = Open3.capture3(
               env.compact,
@@ -329,7 +312,7 @@ module Dependabot
             }
           end
         end
-        Dependency.new(**params)
+        Dependency.new(**T.unsafe(params))
       end
 
       # expects "auto" to already have been resolved to one of the other

data/lib/dependabot/pub/metadata_finder.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
@@ -14,6 +14,7 @@ module Dependabot
     class MetadataFinder < Dependabot::MetadataFinders::Base
       private
 
+      sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
         source = dependency.requirements.first&.dig(:source)
         if source&.dig("type") == "git"
@@ -34,6 +35,7 @@ module Dependabot
         Source.from_url(repo)
       end
 
+      sig { params(repository_url: String).returns(T::Hash[String, T.untyped]) }
       def repository_listing(repository_url)
         response = Dependabot::RegistryClient.get(url: "#{repository_url}/api/packages/#{dependency.name}")
         JSON.parse(response.body)

data/lib/dependabot/pub/update_checker.rb

@@ -90,6 +90,38 @@ module Dependabot
 
       private
 
+      def dependency_services_smallest_update
+        return @smallest_update if @smallest_update
+
+        security_advisories.each do |a|
+          # Sanity check, that we only get the advisories for a single package
+          # at a time. If we got all advisories for all current dependencies,
+          # the helper would be able to handle it, but we would need a better
+          # way to find the repository url.
+          if a.dependency_name != dependency.name
+            raise "Only expected advisories for #{dependency.name} got for #{a.dependency_name}"
+          end
+        end
+        vulnerable_versions = available_versions(dependency).select do |v|
+          security_advisories.any? { |a| a.vulnerable?(v) }
+        end
+        input = {
+          # For "smallest update" we don't cache the report to be shared between
+          # dependencies, but run a specific report for the current dependency.
+          target: dependency.name,
+          disallowed:
+            [
+              {
+                name: dependency.name,
+                url: repository_url(dependency),
+                versions: vulnerable_versions.map { |v| { range: v.to_s } }
+              }
+            ]
+        }
+        report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
+        @smallest_update = report.find { |d| d["name"] == dependency.name }["smallestUpdate"]
+      end
+
       # Returns unparsed_version if it looks like a git-revision.
       #
       # Otherwise it will be parsed with Dependabot::Pub::Version.new and

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.260.0
+  version: 0.261.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-06 00:00:00.000000000 Z
+date: 2024-06-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.260.0
+        version: 0.261.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -256,7 +256,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.260.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.261.0
 post_install_message: 
 rdoc_options: []
 require_paths: