dependabot-python 0.302.0 → 0.303.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be5bb8881f630d585a20e8d38c1458020f9a77e369fc44506a996b87da6b47b1
-  data.tar.gz: 327a35b61a9faa2adf137b79d1f49e1b89a8cc3c25e3cc484340d153028cc6dd
+  metadata.gz: 8d0c144294a45d6cd6336b7afbbf9d2fc13692b733af0cd7392f6acea4460bb0
+  data.tar.gz: dc280185471e8a65b47f4397eaa459b1899deace8cb0e9c9fb33a8c3dfb52fdb
 SHA512:
-  metadata.gz: 73a38b119440ef9743235bd9a1b5e68092d822dcb70f0550ac353a9bedc4f64363c40cbbcdadbee50347c199ab2f2b7a7653675bb38c5660f69d68e17f514a6b
-  data.tar.gz: f852a27fcc45ec3b4b79bf4c33d0daf0c7e921c258860d55caf79a52102a340db0ac48ba92dba763d7353930922b6d8d0d56aec6b84cceb54aca0857ef0ad540
+  metadata.gz: 3e79a47e7971783b7b2f0dd3b68eade4cb1998e2f06284d0894d8c4b4e09937bd4d72b5357d4a1d4037a80da9a60c63b624e118e2f820131fc9480fbc188a2e2
+  data.tar.gz: ba0a2021d5c25e29adb8d59e8ba8c8f83db3dbe6518b25913518dc4f46594a28bdcc20a8a8764d39a9c8e3ade19335d555cb1be2960074034c154108d33cfe8a

data/lib/dependabot/python/file_updater/pipfile_file_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "open3"
@@ -10,78 +10,120 @@ require "dependabot/python/language_version_manager"
 require "dependabot/shared_helpers"
 require "dependabot/python/native_helpers"
 require "dependabot/python/pipenv_runner"
+require "sorbet-runtime"
 
 module Dependabot
   module Python
     class FileUpdater
       class PipfileFileUpdater
+        extend T::Sig
         require_relative "pipfile_preparer"
         require_relative "pipfile_manifest_updater"
         require_relative "setup_file_sanitizer"
 
-        DEPENDENCY_TYPES = %w(packages dev-packages).freeze
+        DEPENDENCY_TYPES = T.let(%w(packages dev-packages).freeze, T::Array[String])
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T.nilable(String)) }
         attr_reader :repo_contents_path
 
+        # rubocop:disable Metrics/AbcSize
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            repo_contents_path: T.nilable(String)
+          ).void
+        end
         def initialize(dependencies:, dependency_files:, credentials:, repo_contents_path:)
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
           @repo_contents_path = repo_contents_path
-        end
-
+          @updated_pipfile_content = T.let(nil, T.nilable(String))
+          @updated_lockfile_content = T.let(nil, T.nilable(String))
+          @updated_generated_files = T.let(nil, T.nilable(T::Hash[Symbol, String]))
+          @pipfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @setup_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @setup_cfg_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @requirements_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @updated_pipfile_content = T.let(nil, T.nilable(String))
+          @parsed_lockfile = T.let(nil, T.nilable(T::Hash[String, T::Hash[String, Object]]))
+          @pipenv_runner = T.let(nil, T.nilable(PipenvRunner))
+          @language_version_manager = T.let(nil, T.nilable(LanguageVersionManager))
+          @sanitized_setup_file_content = T.let({}, T.untyped)
+          @python_requirement_parser = T.let(nil, T.nilable(FileParser::PythonRequirementParser))
+        end
+
+        # rubocop:enable Metrics/AbcSize
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def updated_dependency_files
           @updated_dependency_files ||= fetch_updated_dependency_files
         end
 
         private
 
+        sig { returns(T.nilable(Dependabot::Dependency)) }
         def dependency
           # For now, we'll only ever be updating a single dependency
           dependencies.first
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def fetch_updated_dependency_files
           updated_files = []
 
-          if pipfile.content != updated_pipfile_content
+          if pipfile&.content != updated_pipfile_content
             updated_files <<
-              updated_file(file: pipfile, content: updated_pipfile_content)
+              updated_file(file: T.must(pipfile), content: T.must(updated_pipfile_content))
           end
 
           if lockfile
-            raise "Expected Pipfile.lock to change!" if lockfile.content == updated_lockfile_content
+            raise "Expected Pipfile.lock to change!" if lockfile&.content == updated_lockfile_content
 
             updated_files <<
-              updated_file(file: lockfile, content: updated_lockfile_content)
+              updated_file(file: T.must(lockfile), content: updated_lockfile_content)
           end
 
           updated_files += updated_generated_requirements_files
           updated_files
         end
 
+        sig { returns(T.nilable(String)) }
         def updated_pipfile_content
           @updated_pipfile_content ||=
             PipfileManifestUpdater.new(
               dependencies: dependencies,
-              manifest: pipfile
+              manifest: T.must(pipfile)
             ).updated_manifest_content
         end
 
+        sig { returns(String) }
         def updated_lockfile_content
           @updated_lockfile_content ||=
             updated_generated_files.fetch(:lockfile)
         end
 
+        sig { returns(T::Boolean) }
         def generate_updated_requirements_files?
           return true if generated_requirements_files("default").any?
 
           generated_requirements_files("develop").any?
         end
 
+        sig { params(type: String).returns(T::Array[Dependabot::DependencyFile]) }
         def generated_requirements_files(type)
           return [] unless lockfile
 
@@ -95,12 +137,13 @@ module Dependabot
           # generated using `pipenv requirements`
           requirements_files.select do |req_file|
             deps = []
-            req_file.content.scan(regex) { deps << Regexp.last_match }
+            req_file.content&.scan(regex) { deps << Regexp.last_match }
             deps = deps.map { |m| m[:name] }
             deps.sort == pipfile_lock_deps
           end
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def updated_generated_requirements_files
           updated_files = []
 
@@ -121,49 +164,56 @@ module Dependabot
           updated_files
         end
 
+        sig { returns(String) }
         def updated_req_content
           updated_generated_files.fetch(:requirements_txt)
         end
 
+        sig { returns(String) }
         def updated_dev_req_content
           updated_generated_files.fetch(:dev_requirements_txt)
         end
 
+        sig { returns(String) }
         def prepared_pipfile_content
           content = updated_pipfile_content
-          content = add_private_sources(content)
+          content = add_private_sources(content.to_s)
           content = update_python_requirement(content)
-          content = update_ssl_requirement(content, updated_pipfile_content)
+          content = update_ssl_requirement(content, updated_pipfile_content.to_s)
 
           content
         end
 
+        sig { params(pipfile_content: String).returns(String) }
         def update_python_requirement(pipfile_content)
           PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .update_python_requirement(language_version_manager.python_major_minor)
         end
 
+        sig { params(pipfile_content: String, parsed_file: String).returns(String) }
         def update_ssl_requirement(pipfile_content, parsed_file)
           Python::FileUpdater::PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .update_ssl_requirement(parsed_file)
         end
 
+        sig { params(pipfile_content: String).returns(String) }
         def add_private_sources(pipfile_content)
           PipfilePreparer
             .new(pipfile_content: pipfile_content)
             .replace_sources(credentials)
         end
 
+        sig { returns(T::Hash[Symbol, String]) }
         def updated_generated_files
           @updated_generated_files ||=
-            SharedHelpers.in_a_temporary_repo_directory(dependency_files.first.directory, repo_contents_path) do
+            SharedHelpers.in_a_temporary_repo_directory(T.must(dependency_files.first).directory, repo_contents_path) do
               SharedHelpers.with_git_configured(credentials: credentials) do
                 write_temporary_dependency_files(prepared_pipfile_content)
                 install_required_python
 
-                pipenv_runner.run_upgrade("==#{dependency.version}")
+                pipenv_runner&.run_upgrade("==#{dependency&.version}")
 
                 result = { lockfile: File.read("Pipfile.lock") }
                 result[:lockfile] = post_process_lockfile(result[:lockfile])
@@ -181,10 +231,11 @@ module Dependabot
             end
         end
 
+        sig { params(updated_lockfile_content: String).returns(String) }
         def post_process_lockfile(updated_lockfile_content)
-          pipfile_hash = pipfile_hash_for(updated_pipfile_content)
-          original_reqs = parsed_lockfile["_meta"]["requires"]
-          original_source = parsed_lockfile["_meta"]["sources"]
+          pipfile_hash = pipfile_hash_for(updated_pipfile_content.to_s)
+          original_reqs = T.must(parsed_lockfile["_meta"])["requires"]
+          original_source = T.must(parsed_lockfile["_meta"])["sources"]
 
           new_lockfile = updated_lockfile_content.dup
           new_lockfile_json = JSON.parse(new_lockfile)
@@ -197,6 +248,7 @@ module Dependabot
               .gsub(/\}\z/, "}\n")
         end
 
+        sig { returns(Integer) }
         def generate_updated_requirements_files
           req_content = run_pipenv_command(
             "pyenv exec pipenv requirements"
@@ -209,14 +261,17 @@ module Dependabot
           File.write("dev-req.txt", dev_req_content)
         end
 
+        sig { params(command: String).returns(String) }
         def run_command(command)
           SharedHelpers.run_shell_command(command)
         end
 
+        sig { params(command: String).returns(String) }
         def run_pipenv_command(command)
-          pipenv_runner.run(command)
+          T.must(pipenv_runner).run(command)
         end
 
+        sig { params(pipfile_content: Object).returns(Integer) }
         def write_temporary_dependency_files(pipfile_content)
           dependency_files.each do |file|
             path = file.name
@@ -243,6 +298,7 @@ module Dependabot
           File.write("Pipfile", pipfile_content)
         end
 
+        sig { returns(T.nilable(String)) }
         def install_required_python
           # Initialize a git repo to appease pip-tools
           begin
@@ -254,6 +310,7 @@ module Dependabot
           language_version_manager.install_required_python
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(String) }
         def sanitized_setup_file_content(file)
           @sanitized_setup_file_content ||= {}
           return @sanitized_setup_file_content[file.name] if @sanitized_setup_file_content[file.name]
@@ -264,12 +321,24 @@ module Dependabot
             .sanitized_content
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyFile)) }
         def setup_cfg(file)
           dependency_files.find do |f|
             f.name == file.name.sub(/\.py$/, ".cfg")
           end
         end
 
+        sig do
+          params(
+            pipfile_content: String
+          ).returns(
+            T.nilable(
+              T.any(T::Hash[String, T.untyped],
+                    String,
+                    T::Array[T::Hash[String, T.untyped]])
+            )
+          )
+        end
         def pipfile_hash_for(pipfile_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             File.write(File.join(dir, "Pipfile"), pipfile_content)
@@ -281,12 +350,14 @@ module Dependabot
           end
         end
 
+        sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }
         def updated_file(file:, content:)
           updated_file = file.dup
           updated_file.content = content
           updated_file
         end
 
+        sig { returns(FileParser::PythonRequirementParser) }
         def python_requirement_parser
           @python_requirement_parser ||=
             FileParser::PythonRequirementParser.new(
@@ -294,6 +365,7 @@ module Dependabot
             )
         end
 
+        sig { returns(LanguageVersionManager) }
         def language_version_manager
           @language_version_manager ||=
             LanguageVersionManager.new(
@@ -301,35 +373,42 @@ module Dependabot
             )
         end
 
+        sig { returns(T.nilable(PipenvRunner)) }
         def pipenv_runner
           @pipenv_runner ||=
             PipenvRunner.new(
-              dependency: dependency,
+              dependency: T.must(dependency),
               lockfile: lockfile,
               language_version_manager: language_version_manager
             )
         end
 
+        sig { returns(T::Hash[String, T::Hash[String, T.untyped]]) }
         def parsed_lockfile
-          @parsed_lockfile ||= JSON.parse(lockfile.content)
+          @parsed_lockfile ||= JSON.parse(T.must(lockfile&.content))
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pipfile
           @pipfile ||= dependency_files.find { |f| f.name == "Pipfile" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           @lockfile ||= dependency_files.find { |f| f.name == "Pipfile.lock" }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def setup_files
           dependency_files.select { |f| f.name.end_with?("setup.py") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def setup_cfg_files
           dependency_files.select { |f| f.name.end_with?("setup.cfg") }
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def requirements_files
           dependency_files.select { |f| f.name.end_with?(".txt") }
         end

data/lib/dependabot/python/file_updater/pipfile_manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/python/file_updater"
@@ -7,11 +7,15 @@ module Dependabot
   module Python
     class FileUpdater
       class PipfileManifestUpdater
+        extend T::Sig
+
+        sig { params(dependencies: T::Array[Dependency], manifest: DependencyFile).void }
         def initialize(dependencies:, manifest:)
           @dependencies = dependencies
           @manifest = manifest
         end
 
+        sig { returns(T.nilable(String)) }
         def updated_manifest_content
           dependencies
             .select { |dep| requirement_changed?(dep) }
@@ -19,7 +23,7 @@ module Dependabot
               updated_content = content
 
               updated_content = update_requirements(
-                content: updated_content,
+                content: T.must(updated_content),
                 dependency: dep
               )
 
@@ -31,28 +35,31 @@ module Dependabot
 
         private
 
+        sig { returns(T::Array[Dependency]) }
         attr_reader :dependencies
+        sig { returns(DependencyFile) }
         attr_reader :manifest
 
+        sig { params(content: String, dependency: Dependency).returns(String) }
         def update_requirements(content:, dependency:)
           updated_content = content.dup
 
           # The UpdateChecker ensures the order of requirements is preserved
           # when updating, so we can zip them together in new/old pairs.
           reqs = dependency.requirements
-                           .zip(dependency.previous_requirements)
+                           .zip(T.must(dependency.previous_requirements))
                            .reject { |new_req, old_req| new_req == old_req }
 
           # Loop through each changed requirement
           reqs.each do |new_req, old_req|
-            raise "Bad req match" unless new_req[:file] == old_req[:file]
-            next if new_req[:requirement] == old_req[:requirement]
+            raise "Bad req match" unless new_req[:file] == T.must(old_req)[:file]
+            next if new_req[:requirement] == T.must(old_req)[:requirement]
             next unless new_req[:file] == manifest.name
 
             updated_content = update_manifest_req(
               content: updated_content,
               dep: dependency,
-              old_req: old_req.fetch(:requirement),
+              old_req: T.must(old_req).fetch(:requirement),
               new_req: new_req.fetch(:requirement)
             )
           end
@@ -60,33 +67,43 @@ module Dependabot
           updated_content
         end
 
+        sig do
+          params(
+            content: String,
+            dep: Dependency,
+            old_req: String,
+            new_req: String
+          ).returns(String)
+        end
         def update_manifest_req(content:, dep:, old_req:, new_req:)
           simple_declaration = content.scan(declaration_regex(dep))
                                       .find { |m| m.include?(old_req) }
 
           if simple_declaration
             simple_declaration_regex =
-              /(?:^|["'])#{Regexp.escape(simple_declaration)}/
+              /(?:^|["'])#{Regexp.escape(simple_declaration.to_s)}/
             content.gsub(simple_declaration_regex) do |line|
               line.gsub(old_req, new_req)
             end
           elsif content.match?(table_declaration_version_regex(dep))
             content.gsub(table_declaration_version_regex(dep)) do |part|
-              line = content.match(table_declaration_version_regex(dep))
-                            .named_captures.fetch("version_declaration")
-              new_line = line.gsub(old_req, new_req)
-              part.gsub(line, new_line)
+              line = T.must(content.match(table_declaration_version_regex(dep)))
+                      .named_captures.fetch("version_declaration")
+              new_line = T.must(line).gsub(old_req, new_req)
+              part.gsub(T.must(line), new_line)
             end
           else
             content
           end
         end
 
+        sig { params(dep: Dependency).returns(Regexp) }
         def declaration_regex(dep)
           escaped_name = Regexp.escape(dep.name).gsub("\\-", "[-_.]")
           /(?:^|["'])#{escaped_name}["']?\s*=.*$/i
         end
 
+        sig { params(dep: Dependabot::Dependency).returns(Regexp) }
         def table_declaration_version_regex(dep)
           /
             packages\.#{Regexp.quote(dep.name)}\]
@@ -95,9 +112,10 @@ module Dependabot
           /mx
         end
 
+        sig { params(dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == manifest.name }
         end

data/lib/dependabot/python/file_updater/pipfile_preparer.rb

@@ -7,6 +7,7 @@ require "dependabot/dependency"
 require "dependabot/python/file_parser"
 require "dependabot/python/file_updater"
 require "dependabot/python/authed_url_builder"
+require "sorbet-runtime"
 
 module Dependabot
   module Python
@@ -19,7 +20,7 @@ module Dependabot
           @pipfile_content = pipfile_content
         end
 
-        sig { params(credentials: T::Array[T::Hash[String, T.untyped]]).returns(String) }
+        sig { params(credentials: T::Array[Dependabot::Credential]).returns(String) }
         def replace_sources(credentials)
           pipfile_object = TomlRB.parse(pipfile_content)
 
@@ -67,23 +68,23 @@ module Dependabot
         sig { returns(String) }
         attr_reader :pipfile_content
 
-        sig { returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[String, String]]) }
         def pipfile_sources
           @pipfile_sources ||= T.let(TomlRB.parse(pipfile_content).fetch("source", []),
-                                     T.nilable(T::Array[T::Hash[String, T.untyped]]))
+                                     T.nilable(T::Array[T::Hash[String, String]]))
         end
 
         sig do
-          params(source: T::Hash[String, T.untyped],
-                 credentials: T::Array[T::Hash[String, T.untyped]]).returns(T.nilable(T::Hash[String, T.untyped]))
+          params(source: T::Hash[String, String],
+                 credentials: T::Array[Dependabot::Credential]).returns(T.nilable(T::Hash[String, String]))
         end
         def sub_auth_url(source, credentials)
-          if source["url"].include?("${")
-            base_url = source["url"].sub(/\${.*}@/, "")
+          if source["url"]&.include?("${")
+            base_url = source["url"]&.sub(/\${.*}@/, "")
 
             source_cred = credentials
                           .select { |cred| cred["type"] == "python_index" && cred["index-url"] }
-                          .find { |c| c["index-url"].sub(/\${.*}@/, "") == base_url }
+                          .find { |c| T.must(c["index-url"]).sub(/\${.*}@/, "") == base_url }
 
             return nil if source_cred.nil?
 
@@ -93,9 +94,9 @@ module Dependabot
           source
         end
 
-        sig { params(credentials: T::Array[T::Hash[String, T.untyped]]).returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { params(credentials: T::Array[Dependabot::Credential]).returns(T::Array[T::Hash[String, String]]) }
         def config_variable_sources(credentials)
-          @config_variable_sources = T.let([], T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @config_variable_sources = T.let([], T.nilable(T::Array[T::Hash[String, String]]))
           @config_variable_sources =
             credentials.select { |cred| cred["type"] == "python_index" }.map.with_index do |c, i|
               {

data/lib/dependabot/python/file_updater/poetry_file_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "toml-rb"
 require "open3"
 require "dependabot/dependency"
@@ -18,59 +19,86 @@ module Dependabot
     class FileUpdater
       class PoetryFileUpdater
         require_relative "pyproject_preparer"
+        extend T::Sig
 
-        attr_reader :dependencies
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential]
+          ).void
+        end
         def initialize(dependencies:, dependency_files:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
-        end
-
+          @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+          @prepared_pyproject = T.let(nil, T.nilable(String))
+          @pyproject = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @updated_lockfile_content = T.let(nil, T.nilable(String))
+          @language_version_manager = T.let(nil, T.nilable(LanguageVersionManager))
+          @python_requirement_parser = T.let(nil, T.nilable(FileParser::PythonRequirementParser))
+          @updated_pyproject_content = T.let(nil, T.nilable(String))
+          @python_helper_path = T.let(nil, T.nilable(String))
+          @poetry_lock = T.let(nil, T.nilable(Dependabot::DependencyFile))
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def updated_dependency_files
           @updated_dependency_files ||= fetch_updated_dependency_files
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         def dependency
           # For now, we'll only ever be updating a single dependency
-          dependencies.first
+          T.must(dependencies.first)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def fetch_updated_dependency_files
           updated_files = []
 
-          if file_changed?(pyproject)
+          if file_changed?(T.must(pyproject))
             updated_files <<
               updated_file(
-                file: pyproject,
-                content: updated_pyproject_content
+                file: T.must(pyproject),
+                content: T.must(updated_pyproject_content)
               )
           end
 
-          raise "Expected lockfile to change!" if lockfile && lockfile.content == updated_lockfile_content
+          raise "Expected lockfile to change!" if lockfile && lockfile&.content == updated_lockfile_content
 
           if lockfile
             updated_files <<
-              updated_file(file: lockfile, content: updated_lockfile_content)
+              updated_file(file: T.must(lockfile), content: updated_lockfile_content)
           end
 
           updated_files
         end
 
+        sig { returns(T.nilable(String)) }
         def updated_pyproject_content
-          content = pyproject.content
-          return content unless requirement_changed?(pyproject, dependency)
+          content = T.must(pyproject).content
+          return content unless requirement_changed?(T.must(pyproject), dependency)
 
           updated_content = content.dup
 
-          dependency.requirements.zip(dependency.previous_requirements).each do |new_r, old_r|
-            next unless new_r[:file] == pyproject.name && old_r[:file] == pyproject.name
+          dependency.requirements.zip(T.must(dependency.previous_requirements)).each do |new_r, old_r|
+            next unless new_r[:file] == pyproject&.name && T.must(old_r)[:file] == pyproject&.name
 
-            updated_content = replace_dep(dependency, updated_content, new_r, old_r)
+            updated_content = replace_dep(dependency, T.must(updated_content), new_r, T.must(old_r))
           end
 
           raise DependencyFileContentNotChanged, "Content did not change!" if content == updated_content
@@ -78,6 +106,14 @@ module Dependabot
           updated_content
         end
 
+        sig do
+          params(
+            dep: Dependabot::Dependency,
+            content: String,
+            new_r: T::Hash[Symbol, T.untyped],
+            old_r: T::Hash[Symbol, T.untyped]
+          ).returns(String)
+        end
         def replace_dep(dep, content, new_r, old_r)
           new_req = new_r[:requirement]
           old_req = old_r[:requirement]
@@ -86,8 +122,8 @@ module Dependabot
           declaration_match = content.match(declaration_regex)
           if declaration_match
             declaration = declaration_match[:declaration]
-            new_declaration = declaration.sub(old_req, new_req)
-            content.sub(declaration, new_declaration)
+            new_declaration = T.must(declaration).sub(old_req, new_req)
+            content.sub(T.must(declaration), new_declaration)
           else
             content.gsub(table_declaration_regex(dep, new_r)) do |match|
               match.gsub(/(\s*version\s*=\s*["'])#{Regexp.escape(old_req)}/,
@@ -96,12 +132,13 @@ module Dependabot
           end
         end
 
+        sig { returns(String) }
         def updated_lockfile_content
           @updated_lockfile_content ||=
             begin
               new_lockfile = updated_lockfile_content_for(prepared_pyproject)
 
-              original_locked_python = TomlRB.parse(lockfile.content)["metadata"]["python-versions"]
+              original_locked_python = TomlRB.parse(T.must(lockfile).content)["metadata"]["python-versions"]
 
               new_lockfile.gsub!(/\[metadata\]\n.*python-versions[^\n]+\n/m) do |match|
                 match.gsub(/(["']).*(['"])\n\Z/, '\1' + original_locked_python + '\1' + "\n")
@@ -109,17 +146,18 @@ module Dependabot
 
               tmp_hash =
                 TomlRB.parse(new_lockfile)["metadata"]["content-hash"]
-              correct_hash = pyproject_hash_for(updated_pyproject_content)
+              correct_hash = pyproject_hash_for(updated_pyproject_content.to_s)
 
-              new_lockfile.gsub(tmp_hash, correct_hash)
+              new_lockfile.gsub(tmp_hash, T.must(correct_hash).to_s)
             end
         end
 
+        sig { returns(String) }
         def prepared_pyproject
           @prepared_pyproject ||=
             begin
               content = updated_pyproject_content
-              content = sanitize(content)
+              content = sanitize(T.must(content))
               content = freeze_other_dependencies(content)
               content = freeze_dependencies_being_updated(content)
               content = update_python_requirement(content)
@@ -127,18 +165,20 @@ module Dependabot
             end
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def freeze_other_dependencies(pyproject_content)
           PyprojectPreparer
             .new(pyproject_content: pyproject_content, lockfile: lockfile)
             .freeze_top_level_dependencies_except(dependencies)
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def freeze_dependencies_being_updated(pyproject_content)
           pyproject_object = TomlRB.parse(pyproject_content)
           poetry_object = pyproject_object.fetch("tool").fetch("poetry")
 
           dependencies.each do |dep|
-            if dep.requirements.find { |r| r[:file] == pyproject.name }
+            if dep.requirements.find { |r| r[:file] == pyproject&.name }
               lock_declaration_to_new_version!(poetry_object, dep)
             else
               create_declaration_at_new_version!(poetry_object, dep)
@@ -148,12 +188,14 @@ module Dependabot
           TomlRB.dump(pyproject_object)
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def update_python_requirement(pyproject_content)
           PyprojectPreparer
             .new(pyproject_content: pyproject_content)
             .update_python_requirement(language_version_manager.python_version)
         end
 
+        sig { params(poetry_object: T::Hash[String, T.untyped], dep: Dependabot::Dependency).returns(T::Array[String]) }
         def lock_declaration_to_new_version!(poetry_object, dep)
           Dependabot::Python::FileParser::PyprojectFilesParser::POETRY_DEPENDENCY_TYPES.each do |type|
             names = poetry_object[type]&.keys || []
@@ -168,6 +210,7 @@ module Dependabot
           end
         end
 
+        sig { params(poetry_object: T::Hash[String, T.untyped], dep: Dependabot::Dependency).void }
         def create_declaration_at_new_version!(poetry_object, dep)
           subdep_type = dep.production? ? "dependencies" : "dev-dependencies"
 
@@ -175,12 +218,14 @@ module Dependabot
           poetry_object[subdep_type][dep.name] = dep.version
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def sanitize(pyproject_content)
           PyprojectPreparer
             .new(pyproject_content: pyproject_content)
             .sanitize
         end
 
+        sig { params(pyproject_content: String).returns(String) }
         def updated_lockfile_content_for(pyproject_content)
           SharedHelpers.in_a_temporary_directory do
             SharedHelpers.with_git_configured(credentials: credentials) do
@@ -201,6 +246,7 @@ module Dependabot
 
         # Using `--lock` avoids doing an install.
         # Using `--no-interaction` avoids asking for passwords.
+        sig { returns(String) }
         def run_poetry_update_command
           run_poetry_command(
             "pyenv exec poetry update #{dependency.name} --lock --no-interaction",
@@ -208,10 +254,12 @@ module Dependabot
           )
         end
 
+        sig { params(command: String, fingerprint: T.nilable(String)).returns(String) }
         def run_poetry_command(command, fingerprint: nil)
           SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
         end
 
+        sig { params(pyproject_content: Object).returns(Integer) }
         def write_temporary_dependency_files(pyproject_content)
           dependency_files.each do |file|
             path = file.name
@@ -226,12 +274,22 @@ module Dependabot
           File.write("pyproject.toml", pyproject_content)
         end
 
+        sig { void }
         def add_auth_env_vars
           Python::FileUpdater::PyprojectPreparer
-            .new(pyproject_content: pyproject.content)
+            .new(pyproject_content: T.must(pyproject&.content))
             .add_auth_env_vars(credentials)
         end
 
+        sig do
+          params(
+            pyproject_content: String
+          ).returns(T.nilable(T.any(
+                                T::Hash[String, T.untyped],
+                                String,
+                                T::Array[T::Hash[String, T.untyped]]
+                              )))
+        end
         def pyproject_hash_for(pyproject_content)
           SharedHelpers.in_a_temporary_directory do |dir|
             SharedHelpers.with_git_configured(credentials: credentials) do
@@ -246,6 +304,7 @@ module Dependabot
           end
         end
 
+        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
         def declaration_regex(dep, old_req)
           group = old_req[:groups].first
 
@@ -253,35 +312,42 @@ module Dependabot
           /#{header_regex}\n.*?(?<declaration>(?:^\s*|["'])#{escape(dep)}["']?\s*=[^\n]*)$/mi
         end
 
+        sig { params(dep: Dependabot::Dependency, old_req: T::Hash[Symbol, T.untyped]).returns(Regexp) }
         def table_declaration_regex(dep, old_req)
           /tool\.poetry\.#{old_req[:groups].first}\.#{escape(dep)}\]\n.*?\s*version\s* =.*?\n/m
         end
 
+        sig { params(dep: Dependency).returns(String) }
         def escape(dep)
           Regexp.escape(dep.name).gsub("\\-", "[-_.]")
         end
 
+        sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
         def file_changed?(file)
           dependencies.any? { |dep| requirement_changed?(file, dep) }
         end
 
+        sig { params(file: Dependabot::DependencyFile, dependency: Dependabot::Dependency).returns(T::Boolean) }
         def requirement_changed?(file, dependency)
           changed_requirements =
-            dependency.requirements - dependency.previous_requirements
+            dependency.requirements - T.must(dependency.previous_requirements)
 
           changed_requirements.any? { |f| f[:file] == file.name }
         end
 
+        sig { params(file: Dependabot::DependencyFile, content: String).returns(Dependabot::DependencyFile) }
         def updated_file(file:, content:)
           updated_file = file.dup
           updated_file.content = content
           updated_file
         end
 
+        sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)
         end
 
+        sig { returns(FileParser::PythonRequirementParser) }
         def python_requirement_parser
           @python_requirement_parser ||=
             FileParser::PythonRequirementParser.new(
@@ -289,6 +355,7 @@ module Dependabot
             )
         end
 
+        sig { returns(Dependabot::Python::LanguageVersionManager) }
         def language_version_manager
           @language_version_manager ||=
             LanguageVersionManager.new(
@@ -296,19 +363,23 @@ module Dependabot
             )
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def pyproject
           @pyproject ||=
             dependency_files.find { |f| f.name == "pyproject.toml" }
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def lockfile
           @lockfile ||= poetry_lock
         end
 
+        sig { returns(String) }
         def python_helper_path
           NativeHelpers.python_helper_path
         end
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         def poetry_lock
           dependency_files.find { |f| f.name == "poetry.lock" }
         end

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -1,8 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "toml-rb"
-
+require "sorbet-runtime"
 require "dependabot/dependency"
 require "dependabot/python/file_parser"
 require "dependabot/python/file_updater"
@@ -14,13 +14,18 @@ module Dependabot
   module Python
     class FileUpdater
       class PyprojectPreparer
+        extend T::Sig
+
+        sig { params(pyproject_content: String, lockfile: T.nilable(Dependabot::DependencyFile)).void }
         def initialize(pyproject_content:, lockfile: nil)
           @pyproject_content = pyproject_content
           @lockfile = lockfile
+          @parsed_lockfile = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         end
 
         # For hosted Dependabot token will be nil since the credentials aren't present.
         # This is for those running Dependabot themselves and for dry-run.
+        sig { params(credentials: T.nilable(T::Array[Dependabot::Credential])).void }
         def add_auth_env_vars(credentials)
           TomlRB.parse(@pyproject_content).dig("tool", "poetry", "source")&.each do |source|
             cred = credentials&.find { |c| c["index-url"] == source["url"] }
@@ -37,6 +42,7 @@ module Dependabot
           end
         end
 
+        sig { params(requirement: String).returns(String) }
         def update_python_requirement(requirement)
           pyproject_object = TomlRB.parse(@pyproject_content)
           if (python_specification = pyproject_object.dig("tool", "poetry", "dependencies", "python"))
@@ -48,6 +54,7 @@ module Dependabot
           TomlRB.dump(pyproject_object)
         end
 
+        sig { returns(String) }
         def sanitize
           # {{ name }} syntax not allowed
           pyproject_content
@@ -57,6 +64,7 @@ module Dependabot
 
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/AbcSize
+        sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(String) }
         def freeze_top_level_dependencies_except(dependencies)
           return pyproject_content unless lockfile
 
@@ -75,14 +83,14 @@ module Dependabot
 
               next unless (locked_version = locked_details&.fetch("version"))
 
-              next if source_types.include?(locked_details&.dig("source", "type"))
+              next if source_types.include?(locked_details.dig("source", "type"))
 
-              if locked_details&.dig("source", "type") == "git"
+              if locked_details.dig("source", "type") == "git"
                 poetry_object[key][dep_name] = {
-                  "git" => locked_details&.dig("source", "url"),
-                  "rev" => locked_details&.dig("source", "reference")
+                  "git" => locked_details.dig("source", "url"),
+                  "rev" => locked_details.dig("source", "reference")
                 }
-                subdirectory = locked_details&.dig("source", "subdirectory")
+                subdirectory = locked_details.dig("source", "subdirectory")
                 poetry_object[key][dep_name]["subdirectory"] = subdirectory if subdirectory
               elsif poetry_object[key][dep_name].is_a?(Hash)
                 poetry_object[key][dep_name]["version"] = locked_version
@@ -103,20 +111,25 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         attr_reader :pyproject_content
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :lockfile
 
+        sig { params(dep_name: String).returns(T.nilable(T::Hash[String, T.untyped])) }
         def locked_details(dep_name)
           parsed_lockfile.fetch("package")
                          .find { |d| d["name"] == normalise(dep_name) }
         end
 
+        sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)
         end
 
+        sig { returns(T::Hash[String, T.untyped]) }
         def parsed_lockfile
-          @parsed_lockfile ||= TomlRB.parse(lockfile.content)
+          @parsed_lockfile ||= TomlRB.parse(lockfile&.content)
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.302.0
+  version: 0.303.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-20 00:00:00.000000000 Z
+date: 2025-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.302.0
+        version: 0.303.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -156,14 +156,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.5
+        version: 0.8.7
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
 post_install_message:
 rdoc_options: []
 require_paths: