dependabot-python 0.320.0 → 0.320.1

data/lib/dependabot/python/update_checker/requirements_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/requirement"
 require "dependabot/python/update_checker"
@@ -11,28 +12,46 @@ module Dependabot
   module Python
     class UpdateChecker
       class RequirementsUpdater
-        PYPROJECT_OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
-        PYPROJECT_SEPARATOR = /#{PYPROJECT_OR_SEPARATOR}|,/
+        extend T::Sig
+
+        PYPROJECT_OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
+        PYPROJECT_SEPARATOR = T.let(/#{PYPROJECT_OR_SEPARATOR}|,/, Regexp)
 
         class UnfixableRequirement < StandardError; end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         attr_reader :requirements
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T::Boolean) }
         attr_reader :has_lockfile
+
+        sig { returns(T.nilable(Dependabot::Python::Version)) }
         attr_reader :latest_resolvable_version
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            has_lockfile: T::Boolean,
+            latest_resolvable_version: T.nilable(String)
+          ).void
+        end
         def initialize(requirements:, update_strategy:, has_lockfile:,
                        latest_resolvable_version:)
-          @requirements = requirements
-          @update_strategy = update_strategy
-          @has_lockfile = has_lockfile
+          @requirements = T.let(requirements, T::Array[T::Hash[Symbol, T.untyped]])
+          @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
+          @has_lockfile = T.let(has_lockfile, T::Boolean)
+          @latest_resolvable_version = T.let(nil, T.nilable(Dependabot::Python::Version))
 
           return unless latest_resolvable_version
 
-          @latest_resolvable_version =
-            Python::Version.new(latest_resolvable_version)
+          @latest_resolvable_version = Python::Version.new(latest_resolvable_version)
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -50,6 +69,7 @@ module Dependabot
         private
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -62,7 +82,7 @@ module Dependabot
               find_and_update_equality_match(req_strings)
             elsif req_strings.any? { |r| r.start_with?("~=", "==") }
               tw_req = req_strings.find { |r| r.start_with?("~=", "==") }
-              convert_to_range(tw_req, latest_resolvable_version)
+              convert_to_range(tw_req, T.must(latest_resolvable_version))
             else
               update_requirements_range(req_strings)
             end
@@ -73,12 +93,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_pipfile_requirement(req)
           # For now, we just proxy to updated_requirement. In future this
           # method may treat Pipfile requirements differently.
           updated_requirement(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -101,12 +123,14 @@ module Dependabot
           req.merge(requirement: :unfixable)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_pyproject_version(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -132,6 +156,7 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -145,9 +170,10 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req_string: String).returns(String) }
         def add_new_requirement_option(req_string)
-          option_to_copy = req_string.split(PYPROJECT_OR_SEPARATOR).last
-                                     .split(PYPROJECT_SEPARATOR).first.strip
+          option_to_copy = T.must(T.must(req_string.split(PYPROJECT_OR_SEPARATOR).last)
+                                     .split(PYPROJECT_SEPARATOR).first).strip
           operator       = option_to_copy.gsub(/\d.*/, "").strip
 
           new_option =
@@ -167,6 +193,7 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req_string: String).returns(String) }
         def widen_requirement_range(req_string)
           requirement_strings = req_string.split(",").map(&:strip)
 
@@ -180,7 +207,7 @@ module Dependabot
             # range to include the new version
             v_req = requirement_strings
                     .find { |r| r.start_with?("~", "^") || r.include?("*") }
-            convert_to_range(v_req, latest_resolvable_version)
+            convert_to_range(T.must(v_req), T.must(latest_resolvable_version))
           else
             # Otherwise we have a range, and need to update the upper bound
             update_requirements_range(requirement_strings)
@@ -188,6 +215,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -204,12 +232,14 @@ module Dependabot
           end
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_requirement_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_requirement(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_requirement(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -229,6 +259,7 @@ module Dependabot
           req.merge(requirement: :unfixable)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -237,29 +268,32 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
             .requirements_array(req.fetch(:requirement))
-            .any? { |r| r.satisfied_by?(latest_resolvable_version) }
+            .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 
+        sig { params(requirement_strings: T::Array[String]).returns(String) }
         def find_and_update_equality_match(requirement_strings)
           if requirement_strings.any? { |r| requirement_class.new(r).exact? }
             # True equality match
-            requirement_strings.find { |r| requirement_class.new(r).exact? }
-                               .sub(
-                                 RequirementParser::VERSION,
-                                 latest_resolvable_version.to_s
-                               )
+            T.must(requirement_strings.find { |r| requirement_class.new(r).exact? })
+             .sub(
+               RequirementParser::VERSION,
+               T.must(latest_resolvable_version).to_s
+             )
           else
             # Prefix match
-            requirement_strings.find { |r| r.match?(/^(=+|\d)/) }
-                               .sub(RequirementParser::VERSION) do |v|
-              at_same_precision(latest_resolvable_version.to_s, v)
+            T.must(requirement_strings.find { |r| r.match?(/^(=+|\d)/) })
+             .sub(RequirementParser::VERSION) do |v|
+              at_same_precision(T.must(latest_resolvable_version).to_s, v)
             end
           end
         end
 
+        sig { params(new_version: String, old_version: String).returns(String) }
         def at_same_precision(new_version, old_version)
           # return new_version unless old_version.include?("*")
 
@@ -273,18 +307,19 @@ module Dependabot
             .join(".")
         end
 
-        def update_requirements_range(requirement_strings)
+        sig { params(requirement_strings: T::Array[String]).returns(String) }
+        def update_requirements_range(requirement_strings) # rubocop:disable Metrics/AbcSize
           ruby_requirements =
             requirement_strings.map { |r| requirement_class.new(r) }
 
           updated_requirement_strings = ruby_requirements.flat_map do |r|
-            next r.to_s if r.satisfied_by?(latest_resolvable_version)
+            next r.to_s if r.satisfied_by?(T.must(latest_resolvable_version))
 
             case op = r.requirements.first.first
             when "<"
-              "<" + update_greatest_version(r.requirements.first.last, latest_resolvable_version)
+              "<" + update_greatest_version(r.requirements.first.last, T.must(latest_resolvable_version))
             when "<="
-              "<=" + latest_resolvable_version.to_s
+              "<=" + T.must(latest_resolvable_version).to_s
             when "!=", ">", ">="
               raise UnfixableRequirement
             else
@@ -298,10 +333,11 @@ module Dependabot
         end
 
         # Updates the version in a constraint to be the given version
+        sig { params(req_string: String, version_to_be_permitted: String).returns(String) }
         def bump_version(req_string, version_to_be_permitted)
-          old_version = req_string
-                        .match(/(#{RequirementParser::VERSION})/o)
-                        .captures.first
+          old_version = T.must(T.must(req_string
+                        .match(/(#{RequirementParser::VERSION})/o))
+                        .captures.first)
 
           req_string.sub(
             old_version,
@@ -309,14 +345,15 @@ module Dependabot
           )
         end
 
+        sig { params(req_string: String, version_to_be_permitted: Dependabot::Python::Version).returns(String) }
         def convert_to_range(req_string, version_to_be_permitted)
           # Construct an upper bound at the same precision that the original
           # requirement was at (taking into account ~ dynamics)
           index_to_update = index_to_update_for(req_string)
-          ub_segments = version_to_be_permitted.segments
-          ub_segments << 0 while ub_segments.count <= index_to_update
-          ub_segments = ub_segments[0..index_to_update]
-          ub_segments[index_to_update] += 1
+          ub_segments = T.let(version_to_be_permitted.segments, T::Array[T.any(String, Integer)])
+          ub_segments << "0" while ub_segments.count <= index_to_update
+          ub_segments = T.must(ub_segments[0..index_to_update])
+          ub_segments[index_to_update] = T.must(ub_segments[index_to_update]).to_i + 1
 
           lb_segments = lower_bound_segments_for_req(req_string)
 
@@ -328,6 +365,7 @@ module Dependabot
           ">=#{lb_segments.join('.')},<#{ub_segments.join('.')}"
         end
 
+        sig { params(req_string: String).returns(T::Array[Integer]) }
         def lower_bound_segments_for_req(req_string)
           requirement = requirement_class.new(req_string)
           version = requirement.requirements.first.last
@@ -339,6 +377,7 @@ module Dependabot
           lb_segments
         end
 
+        sig { params(req_string: String).returns(Integer) }
         def index_to_update_for(req_string)
           req = requirement_class.new(req_string.split(/[.\-]\*/).first)
           version = req.requirements.first.last.release
@@ -357,6 +396,12 @@ module Dependabot
         end
 
         # Updates the version in a "<" constraint to allow the given version
+        sig do
+          params(
+            version: Gem::Version,
+            version_to_be_permitted: T.any(String, Dependabot::Python::Version)
+          ).returns(String)
+        end
         def update_greatest_version(version, version_to_be_permitted)
           if version_to_be_permitted.is_a?(String)
             version_to_be_permitted =
@@ -365,7 +410,7 @@ module Dependabot
           version = version.release if version.prerelease?
 
           index_to_update = [
-            version.segments.map.with_index { |n, i| n.zero? ? 0 : i }.max,
+            version.segments.map.with_index { |n, i| n.to_i.zero? ? 0 : i }.max,
             version_to_be_permitted.segments.count - 1
           ].min
 
@@ -373,7 +418,7 @@ module Dependabot
             if index < index_to_update
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
+              version_to_be_permitted.segments[index].to_i + 1
             else
               0
             end
@@ -382,6 +427,7 @@ module Dependabot
           new_segments.join(".")
         end
 
+        sig { returns(T.class_of(Dependabot::Python::Requirement)) }
         def requirement_class
           Python::Requirement
         end

data/lib/dependabot/python/version.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/version"
 require "dependabot/utils"
 
@@ -9,6 +10,8 @@ require "dependabot/utils"
 module Dependabot
   module Python
     class Version < Dependabot::Version
+      extend T::Sig
+
       sig { returns(Integer) }
       attr_reader :epoch
 
@@ -27,8 +30,8 @@ module Dependabot
       sig { returns(T.nilable(T::Array[T.any(String, Integer)])) }
       attr_reader :local
 
-      INFINITY = 1000
-      NEGATIVE_INFINITY = -INFINITY
+      INFINITY = T.let(1000, Integer)
+      NEGATIVE_INFINITY = T.let(-INFINITY, Integer)
 
       # See https://peps.python.org/pep-0440/#appendix-b-parsing-version-strings-with-regular-expressions
       VERSION_PATTERN = /
@@ -72,10 +75,10 @@ module Dependabot
       end
 
       sig { override.params(version: VersionParameter).void }
-      def initialize(version)
+      def initialize(version) # rubocop:disable Metrics/AbcSize
         raise Dependabot::BadRequirementError, "Malformed version string - string is nil" if version.nil?
 
-        @version_string = version.to_s
+        @version_string = T.let(version.to_s, String)
 
         raise Dependabot::BadRequirementError, "Malformed version string - string is empty" if @version_string.empty?
 
@@ -86,12 +89,17 @@ module Dependabot
                 "Malformed version string - #{@version_string} does not match regex"
         end
 
-        @epoch = matches["epoch"].to_i
-        @release_segment = matches["release"]&.split(".")&.map(&:to_i) || []
-        @pre = parse_letter_version(matches["pre_l"], matches["pre_n"])
-        @post = parse_letter_version(matches["post_l"], matches["post_n1"] || matches["post_n2"])
-        @dev = parse_letter_version(matches["dev_l"], matches["dev_n"])
-        @local = parse_local_version(matches["local"])
+        @epoch = T.let(matches["epoch"].to_i, Integer)
+        @release_segment = T.let(matches["release"]&.split(".")&.map(&:to_i) || [], T::Array[Integer])
+        @pre = T.let(parse_letter_version(matches["pre_l"], matches["pre_n"]),
+                     T.nilable(T::Array[T.any(String, Integer)]))
+        @post = T.let(
+          parse_letter_version(matches["post_l"], matches["post_n1"] || matches["post_n2"]),
+          T.nilable(T::Array[T.any(String, Integer)])
+        )
+        @dev = T.let(parse_letter_version(matches["dev_l"], matches["dev_n"]),
+                     T.nilable(T::Array[T.any(String, Integer)]))
+        @local = T.let(parse_local_version(matches["local"]), T.nilable(T::Array[T.any(String, Integer)]))
         super(matches["release"] || "")
       end
 
@@ -123,7 +131,6 @@ module Dependabot
       sig { params(other: VersionParameter).returns(Integer) }
       def <=>(other)
         other = Dependabot::Python::Version.new(other.to_s) unless other.is_a?(Dependabot::Python::Version)
-        other = T.cast(other, Dependabot::Python::Version)
 
         epoch_comparison = epoch <=> other.epoch
         return epoch_comparison unless epoch_comparison.zero?
@@ -183,13 +190,13 @@ module Dependabot
           # - Alphanumeric segments sort lexicographically
           # - Numeric segments sort numerically
           # - Shorter versions sort before longer versions when the prefixes match exactly
-          local&.map do |token|
+          T.must(local).map do |token|
             if token.is_a?(Integer)
               [token, ""]
             else
               [NEGATIVE_INFINITY, token]
             end
-          end
+          end.flatten
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.320.0
+  version: 0.320.1
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.320.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.320.0
+        version: 0.320.1
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -290,7 +290,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.320.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.320.1
 rdoc_options: []
 require_paths:
 - lib