dependabot-pub 0.302.0 → 0.303.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f9d69bec956faff99d343a05f507bcb8dd8c2dbc5f7f6f502b01ff7672ee23c
-  data.tar.gz: 97b580459e1d84e7ed26966d6aac38ac40bddc709ecd56de1b9aa29a65b60dae
+  metadata.gz: ee3ce64f8c3efda439b7a169413fc09d861625a9ed887d613d9bbbc35cb96959
+  data.tar.gz: 9d31a4d135baf055ab65e9663d9dee167fffda235f2676320e1de9f3da6ac90e
 SHA512:
-  metadata.gz: dc9d8fe10834b8cf980c56aa0b4fdb75fa6a01cdd780805dc6d5b48f14c15b1900b4163ac6ae874d1c176f6d52060dd098c907fbfd186cae5b9998e7a4f0c826
-  data.tar.gz: 6bd0e195e8e9584e0d87c52d851083b9026c0193f2301f08d278a6173473c2a95169f74c603ffaa2671aea53249464fe3d614ac0b6c189c02087ecb56280c315
+  metadata.gz: 96546864aa8653e4ee0b401583f665c26fcecd36f9a6acae53988450f9cc509e5da636843814b831bc78ae0bf06810d2307fa1a02ac662a475c03db6c3639487
+  data.tar.gz: b18bdfbf7c22667ce566b7f94fe566e395c14d40d424a88771bb8e1f433e3f8dd71e2cb1743e843786f440c3193eeff25eac2e862b743371443b900824dfa1a2

data/lib/dependabot/pub/file_parser.rb

@@ -1,6 +1,8 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/dependency"
@@ -8,7 +10,6 @@ require "dependabot/pub/version"
 require "dependabot/pub/helpers"
 require "dependabot/pub/package_manager"
 require "dependabot/pub/language"
-require "sorbet-runtime"
 
 module Dependabot
   module Pub
@@ -78,9 +79,9 @@ module Dependabot
         raise "No pubspec.yaml!" unless get_original_file("pubspec.yaml")
       end
 
-      sig { returns(T::Array[Dependabot::Dependency]) }
+      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def list
-        @list ||= T.let(dependency_services_list, T.nilable(T::Array[Dependabot::Dependency]))
+        @list ||= T.let(dependency_services_list, T.nilable(T::Array[T::Hash[String, T.untyped]]))
       end
     end
   end

data/lib/dependabot/pub/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"

data/lib/dependabot/pub/helpers.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "digest"
@@ -22,19 +22,27 @@ module Dependabot
 
       abstract!
 
-      sig { returns(T::Array[Dependabot::Credential]) }
-      attr_reader :credentials
+      sig { abstract.returns(T::Array[Dependabot::Credential]) }
+      def credentials; end
 
-      sig { returns(T::Array[Dependabot::DependencyFile]) }
-      attr_reader :dependency_files
+      sig { abstract.returns(T::Array[Dependabot::DependencyFile]) }
+      def dependency_files; end
 
-      sig { returns(T::Hash[Symbol, T.untyped]) }
-      attr_reader :options
+      sig { abstract.returns(T::Hash[Symbol, T.untyped]) }
+      def options; end
 
+      sig { returns(String) }
       def self.pub_helpers_path
         File.join(ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil), "pub")
       end
 
+      sig do
+        params(
+          dir: T.any(Pathname, String),
+          url: T.nilable(String)
+        )
+          .returns(T.nilable(T::Hash[String, T.untyped]))
+      end
       def self.run_infer_sdk_versions(dir, url: nil)
         env = {}
         cmd = File.join(pub_helpers_path, "infer_sdk_versions")
@@ -47,15 +55,18 @@ module Dependabot
 
       private
 
+      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def dependency_services_list
         JSON.parse(run_dependency_services("list"))["dependencies"]
       end
 
+      sig { params(dependency: Dependabot::Dependency).returns(String) }
       def repository_url(dependency)
-        source = dependency.requirements&.first&.dig(:source)
+        source = dependency.requirements.first&.dig(:source)
         source&.dig("description", "url") || options[:pub_hosted_url] || "https://pub.dev"
       end
 
+      sig { params(dependency: Dependabot::Dependency).returns(T::Hash[String, T.untyped]) }
       def fetch_package_listing(dependency)
         # Because we get the security_advisories as a set of constraints, we
         # fetch the list of all versions and filter them to a list of vulnerable
@@ -67,12 +78,14 @@ module Dependabot
         JSON.parse(response.body)
       end
 
+      sig { params(dependency: Dependabot::Dependency).returns(T::Array[Dependabot::Pub::Version]) }
       def available_versions(dependency)
         fetch_package_listing(dependency)["versions"].map do |v|
           Dependabot::Pub::Version.new(v["version"])
         end
       end
 
+      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def dependency_services_report
         sha256 = Digest::SHA256.new
         dependency_files.each do |f|
@@ -83,22 +96,32 @@ module Dependabot
         cache_file = "/tmp/report-#{hash}-pid-#{Process.pid}.json"
         return JSON.parse(File.read(cache_file)) if File.file?(cache_file)
 
-        report = JSON.parse(run_dependency_services("report", stdin_data: ""))["dependencies"]
+        report = JSON.parse(run_dependency_services("report"))["dependencies"]
         File.write(cache_file, JSON.generate(report))
         report
       end
 
+      sig do
+        params(
+          dependency_changes: T.nilable(T::Array[Dependabot::Dependency])
+        )
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
       def dependency_services_apply(dependency_changes)
-        run_dependency_services("apply", stdin_data: dependencies_to_json(dependency_changes)) do |temp_dir|
-          dependency_files.map do |f|
-            updated_file = f.dup
-            updated_file.content = File.read(File.join(temp_dir, f.name))
-            updated_file
-          end
-        end
+        T.cast(
+          run_dependency_services("apply", stdin_data: dependencies_to_json(dependency_changes)) do |temp_dir|
+            dependency_files.map do |f|
+              updated_file = f.dup
+              updated_file.content = File.read(File.join(temp_dir, f.name))
+              updated_file
+            end
+          end,
+          T::Array[Dependabot::DependencyFile]
+        )
       end
 
       # Clones the flutter repo into /tmp/flutter if needed
+      sig { void }
       def ensure_flutter_repo
         return if File.directory?("/tmp/flutter/.git")
 
@@ -116,6 +139,7 @@ module Dependabot
       end
 
       # Will ensure that /tmp/flutter contains the flutter repo checked out at `ref`.
+      sig { params(ref: String).void }
       def check_out_flutter_ref(ref)
         ensure_flutter_repo
         Dependabot.logger.info "Checking out Flutter version #{ref}"
@@ -146,6 +170,7 @@ module Dependabot
       ## Detects the right flutter release to use for the pubspec.yaml.
       ## Then checks it out if it is not already.
       ## Returns the sdk versions
+      sig { params(dir: T.any(Pathname, String)).returns(T::Hash[String, String]) }
       def ensure_right_flutter_release(dir)
         versions = Helpers.run_infer_sdk_versions(
           File.join(dir, dependency_files.first&.directory),
@@ -171,6 +196,7 @@ module Dependabot
         run_flutter_version
       end
 
+      sig { void }
       def run_flutter_doctor
         Dependabot.logger.info(
           "Running `flutter doctor` to install artifacts and create flutter/version."
@@ -185,6 +211,7 @@ module Dependabot
       end
 
       # Runs `flutter version` and returns the dart and flutter version numbers in a map.
+      sig { returns(T::Hash[String, String]) }
       def run_flutter_version
         Dependabot.logger.info "Running `flutter --version`"
         # Run `flutter --version --machine` to get the current flutter version.
@@ -216,7 +243,16 @@ module Dependabot
         }
       end
 
-      def run_dependency_services(command, stdin_data: nil)
+      sig do
+        type_parameters(:T)
+          .params(
+            command: String,
+            stdin_data: T.nilable(String),
+            blk: T.nilable(T.proc.params(arg0: String).returns(T.type_parameter(:T)))
+          )
+          .returns(T.any(String, T.type_parameter(:T)))
+      end
+      def run_dependency_services(command, stdin_data: nil, &blk)
         SharedHelpers.in_a_temporary_directory do |temp_dir|
           dependency_files.each do |f|
             in_path_name = File.join(temp_dir, f.directory, f.name)
@@ -245,13 +281,14 @@ module Dependabot
               chdir: command_dir
             )
             raise_error(stderr) unless status.success?
-            return stdout unless block_given?
+            return stdout unless blk
 
             yield command_dir
           end
         end
       end
 
+      sig { params(stderr: String).returns(T.noreturn) }
       def raise_error(stderr)
         if stderr.include?("Failed parsing lock file") || stderr.include?("Unsupported operation")
           raise DependencyFileNotEvaluatable, "dependency_services failed: #{stderr}"
@@ -267,6 +304,7 @@ module Dependabot
       end
 
       # Parses a dependency as listed by `dependency_services list`.
+      sig { params(json: T::Hash[String, T.untyped]).returns(Dependabot::Dependency) }
       def parse_listed_dependency(json)
         params = {
           name: json["name"],
@@ -292,7 +330,14 @@ module Dependabot
       #
       # The `requirements_update_strategy`` is
       # used to chose the right updated constraint.
-      def parse_updated_dependency(json, requirements_update_strategy: nil)
+      sig do
+        params(
+          json: T::Hash[String, T.untyped],
+          requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
+        )
+          .returns(Dependabot::Dependency)
+      end
+      def parse_updated_dependency(json, requirements_update_strategy)
         params = {
           name: json["name"],
           version: json["version"],
@@ -332,6 +377,12 @@ module Dependabot
 
       # expects "auto" to already have been resolved to one of the other
       # strategies.
+      sig do
+        params(
+          requirements_update_strategy: Dependabot::RequirementsUpdateStrategy
+        )
+          .returns(String)
+      end
       def constraint_field_from_update_strategy(requirements_update_strategy)
         case requirements_update_strategy
         when RequirementsUpdateStrategy::WidenRanges
@@ -340,22 +391,33 @@ module Dependabot
           "constraintBumped"
         when RequirementsUpdateStrategy::BumpVersionsIfNecessary
           "constraintBumpedIfNeeded"
+        else
+          raise "Unexpected requirements_update_strategy #{requirements_update_strategy}"
         end
       end
 
+      sig do
+        params(
+          dependencies: T.nilable(T::Array[Dependabot::Dependency])
+        )
+          .returns(T.nilable(String))
+      end
       def dependencies_to_json(dependencies)
         if dependencies.nil?
           nil
         else
           deps = dependencies.map do |d|
-            source = d.requirements.empty? ? nil : d.requirements.first[:source]
+            source = d.requirements.empty? ? nil : d.requirements.first&.[](:source)
             obj = {
               "name" => d.name,
               "version" => d.version,
               "source" => source
             }
 
-            obj["constraint"] = d.requirements[0][:requirement].to_s unless d.requirements.nil? || d.requirements.empty?
+            unless d.requirements.nil? || d.requirements.empty?
+              obj["constraint"] =
+                d.requirements[0]&.[](:requirement).to_s
+            end
             obj
           end
           JSON.generate({

data/lib/dependabot/pub/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -17,6 +17,7 @@ module Dependabot
 
       include Dependabot::Pub::Helpers
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_version
         version = version_unless_ignored(current_report["latest"], current_version: dependency.version)
         raise AllVersionsIgnored if version.nil? && @raise_on_ignored
@@ -24,6 +25,7 @@ module Dependabot
         version
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version_with_no_unlock
         # Version we can get if we're not allowed to change pubspec.yaml, but we
         # allow changes in the pubspec.lock file.
@@ -33,6 +35,7 @@ module Dependabot
         version_unless_ignored(entry["version"])
       end
 
+      sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_resolvable_version
         # Latest version we can get if we're allowed to unlock the current
         # package in pubspec.yaml
@@ -42,27 +45,31 @@ module Dependabot
         version_unless_ignored(entry["version"])
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_resolvable_security_fix_version
         raise "Dependency not vulnerable!" unless vulnerable?
 
         lowest_security_fix_version
       end
 
+      sig { override.returns(T.nilable(Dependabot::Version)) }
       def lowest_security_fix_version
         # Don't attempt to do security updates for git dependencies.
-        return nil if git_revision? dependency.version
+        return nil if git_revision? T.must(dependency.version)
         # If the current version is not vulnerable, we stay on it.
-        return version_unless_ignored dependency.version unless vulnerable?
+        return T.cast(version_unless_ignored(T.must(dependency.version)), Dependabot::Version) unless vulnerable?
 
         e = dependency_services_smallest_update
         return nil if e.nil?
 
         upgrade = e.find { |u| u["name"] == dependency.name }
 
-        version = upgrade["version"]
-        version_unless_ignored(version)
+        version = T.must(upgrade)["version"]
+        T.cast(version_unless_ignored(version), Dependabot::Version)
       end
 
+      # rubocop:disable Metrics/PerceivedComplexity
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
         # Requirements that need to be changed, if obtain:
         # latest_resolvable_version or lowest_security_fix_version
@@ -71,25 +78,28 @@ module Dependabot
 
                   # Ideally we would like to do any upgrade that migrates away from the vulnerability
                   # but this method can only return a single requirement udate.
-                  breaking_changes = updates.filter { |d| d["previousConstraint"] != d["constraintBumpedIfNeeded"] }
+                  breaking_changes = updates&.filter { |d| d["previousConstraint"] != d["constraintBumpedIfNeeded"] }
 
                   # This security update would require unlocking other packages, which is not currently supported.
                   # Because of that, return original requirements, so that no requirements are actually updated and
                   # the error bubbles up as security_update_not_possible to the user.
-                  return dependency.requirements if breaking_changes.size > 1
+                  return dependency.requirements if breaking_changes&.size&. > 1
 
-                  updates.find { |u| u["name"] == dependency.name }
+                  updates&.find { |u| u["name"] == dependency.name }
                 else
                   current_report["singleBreaking"].find { |d| d["name"] == dependency.name }
                 end
-        return unless entry
+        return [] unless entry
 
-        parse_updated_dependency(entry, requirements_update_strategy: resolved_requirements_update_strategy)
+        parse_updated_dependency(entry, resolved_requirements_update_strategy)
           .requirements
       end
+      # rubocop:enable Metrics/PerceivedComplexity
 
       private
 
+      # rubocop:disable Metrics/AbcSize
+      sig { returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
       def dependency_services_smallest_update
         return @smallest_update if @smallest_update
 
@@ -119,8 +129,12 @@ module Dependabot
             ]
         }
         report = JSON.parse(run_dependency_services("report", stdin_data: JSON.generate(input)))["dependencies"]
-        @smallest_update = report.find { |d| d["name"] == dependency.name }["smallestUpdate"]
+        @smallest_update = T.let(
+          report.find { |d| d["name"] == dependency.name }["smallestUpdate"],
+          T.nilable(T::Array[T::Hash[String, T.untyped]])
+        )
       end
+      # rubocop:enable Metrics/AbcSize
 
       # Returns unparsed_version if it looks like a git-revision.
       #
@@ -131,6 +145,13 @@ module Dependabot
       # * If current_version is non-nil and the parsed version is the same it
       #   will be returned.
       # * Otherwise returns nil
+      sig do
+        params(
+          unparsed_version: String,
+          current_version: T.nilable(String)
+        )
+          .returns(T.nilable(T.any(String, Dependabot::Version)))
+      end
       def version_unless_ignored(unparsed_version, current_version: nil)
         if git_revision?(unparsed_version)
           unparsed_version
@@ -146,6 +167,7 @@ module Dependabot
         end
       end
 
+      sig { params(version_string: String).returns(T::Boolean) }
       def git_revision?(version_string)
         version_string.match?(/^[0-9a-f]{6,}$/)
       end
@@ -161,6 +183,7 @@ module Dependabot
           latest_version == entry["version"]
       end
 
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         report_section = if vulnerable?
                            dependency_services_smallest_update
@@ -172,22 +195,32 @@ module Dependabot
           d["kind"] == "transitive"
         end
         direct_deps.map do |d|
-          parse_updated_dependency(d, requirements_update_strategy: resolved_requirements_update_strategy)
+          parse_updated_dependency(d, resolved_requirements_update_strategy)
         end
       end
 
+      sig { returns(T::Array[T::Hash[String, T.untyped]]) }
       def report
-        @report ||= dependency_services_report
+        @report ||= T.let(
+          dependency_services_report,
+          T.nilable(T::Array[T::Hash[String, T.untyped]])
+        )
       end
 
+      sig { returns(T::Hash[String, T.untyped]) }
       def current_report
-        report.find { |d| d["name"] == dependency.name }
+        T.must(report.find { |d| d["name"] == dependency.name })
       end
 
+      sig { returns(Dependabot::RequirementsUpdateStrategy) }
       def resolved_requirements_update_strategy
-        @resolved_requirements_update_strategy ||= resolve_requirements_update_strategy
+        @resolved_requirements_update_strategy ||= T.let(
+          resolve_requirements_update_strategy,
+          T.nilable(Dependabot::RequirementsUpdateStrategy)
+        )
       end
 
+      sig { returns(Dependabot::RequirementsUpdateStrategy) }
       def resolve_requirements_update_strategy
         raise "Unexpected requirements_update_strategy #{requirements_update_strategy}" unless
           [nil, RequirementsUpdateStrategy::WidenRanges, RequirementsUpdateStrategy::BumpVersions,
@@ -210,7 +243,7 @@ module Dependabot
             RequirementsUpdateStrategy::WidenRanges
           end
         else
-          requirements_update_strategy
+          T.must(requirements_update_strategy)
         end
       end
     end

data/lib/dependabot/pub/version.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -22,12 +24,14 @@ module Dependabot
       VERSION_PATTERN = T.let(Gem::Version::VERSION_PATTERN + "(\\+[0-9a-zA-Z\\-.]+)?", String)
       ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
-      sig { returns(String) }
+      sig { returns(T.nilable(String)) }
       attr_reader :build_info
 
       sig { override.params(version: VersionParameter).void }
       def initialize(version)
         @version_string = T.let(version.to_s, String)
+        @build_info = T.let(nil, T.nilable(String))
+
         version, @build_info = version.to_s.split("+") if version.to_s.include?("+")
 
         super(T.must(version))

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-pub
 version: !ruby/object:Gem::Version
-  version: 0.302.0
+  version: 0.303.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-20 00:00:00.000000000 Z
+date: 2025-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -258,7 +258,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
 post_install_message:
 rdoc_options: []
 require_paths: