dependabot-python 0.320.0 → 0.320.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0702ead6e162d8ab1c6c3312b16620169ce2dd6cd30c04fa937e3909d22a245
-  data.tar.gz: 365947fe59fd061e56a5426029ed48380eafa2b23aa7ded3e9695d815ef74ee9
+  metadata.gz: 00d45a37835e5785c9841a4475f87a754fb3f2800daaf89d15e34d78e5e416c5
+  data.tar.gz: dac9639715dc1660dc9d9c50b3e08b4e22ac8f655046c7a991e4f53e3351ef60
 SHA512:
-  metadata.gz: 8166aafb40a4af86a00f166bc19b7cf24557d960a91e7415e4d26ef30447308fcd6c7e17fd9076fdce46e34a7f51a90c6a9161af9daf40a4fe34500a22fa4dfa
-  data.tar.gz: 424b4db8fd30478428bbc18c7031e61724d1daec06179b5cc1c1c0f695f6c142beef4b70e5544be9ef0a8a60bc82293690b1e3c5b216c6fe39865c1e52a567fd
+  metadata.gz: 2b33c038c1cee0219c806f572586163fc96b18d3492be731cf700b94fa6e6e65794be0b7e4fb2055ca9e27307f43468a2ed21fad3d7a404bdddf6370bf4cf5c7
+  data.tar.gz: 994c93fb24321b05f54c0d15434421123c7ef735ec59c945e059fd76e60aba447dd291a496e4f1db930b14086434f984309c0483fffcee9d4d511cec96d34af7

data/lib/dependabot/python/authed_url_builder.rb

@@ -1,12 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 module Dependabot
   module Python
     class AuthedUrlBuilder
+      extend T::Sig
+
+      sig { params(credential: Credential).returns(String) }
       def self.authed_url(credential:)
-        token = credential.fetch("token", nil)
-        url = credential.fetch("index-url", nil)
+        token = T.let(credential.fetch("token", nil), T.nilable(String))
+        url = T.let(credential.fetch("index-url", nil), T.nilable(String))
         return "" unless url
         return url unless token
 

data/lib/dependabot/python/file_updater/pip_compile_file_updater.rb

@@ -48,13 +48,13 @@ module Dependabot
             dependencies: T::Array[Dependabot::Dependency],
             dependency_files: T::Array[Dependabot::DependencyFile],
             credentials: T::Array[Dependabot::Credential],
-            index_urls: T.nilable(T::Array[String])
+            index_urls: T.nilable(T::Array[T.nilable(String)])
           ).void
         end
-        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
+        def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil) # rubocop:disable Metrics/AbcSize
           @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
           @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
-          @index_urls = T.let(index_urls, T.nilable(T::Array[String]))
+          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
           @build_isolation = T.let(true, T::Boolean)
           @sanitized_setup_file_content = T.let({}, T::Hash[String, String])
           @requirement_map = T.let(nil, T.nilable(T::Hash[String, T::Array[String]]))
@@ -312,7 +312,7 @@ module Dependabot
           return file.content if old_req == "==#{T.must(dependency).version}"
 
           RequirementReplacer.new(
-            content: file.content,
+            content: T.must(file.content),
             dependency_name: T.must(dependency).name,
             old_requirement: old_req[:requirement],
             new_requirement: "==#{T.must(dependency).version}",
@@ -332,7 +332,7 @@ module Dependabot
           return file.content if old_req == new_req
 
           RequirementReplacer.new(
-            content: file.content,
+            content: T.must(file.content),
             dependency_name: T.must(dependency).name,
             old_requirement: old_req[:requirement],
             new_requirement: T.must(new_req)[:requirement],

data/lib/dependabot/python/file_updater/requirement_file_updater.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_updater"
 require "dependabot/shared_helpers"
@@ -10,37 +11,56 @@ module Dependabot
   module Python
     class FileUpdater
       class RequirementFileUpdater
+        extend T::Sig
+
         require_relative "requirement_replacer"
 
+        sig { returns(T::Array[Dependabot::Dependency]) }
         attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig do
+          params(
+            dependencies: T::Array[Dependabot::Dependency],
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            index_urls: T.nilable(T::Array[T.nilable(String)])
+          ).void
+        end
         def initialize(dependencies:, dependency_files:, credentials:, index_urls: nil)
-          @dependencies = dependencies
-          @dependency_files = dependency_files
-          @credentials = credentials
-          @index_urls = index_urls
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials = T.let(credentials, T::Array[Dependabot::Credential])
+          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
+          @updated_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def updated_dependency_files
           @updated_dependency_files ||= fetch_updated_dependency_files
         end
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         def dependency
           # For now, we'll only ever be updating a single dependency
-          dependencies.first
+          T.must(dependencies.first)
         end
 
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         def fetch_updated_dependency_files
-          reqs = dependency.requirements.zip(dependency.previous_requirements)
+          reqs = dependency.requirements.zip(dependency.previous_requirements || [])
 
           reqs.filter_map do |(new_req, old_req)|
             next if new_req == old_req
 
-            file = get_original_file(new_req.fetch(:file)).dup
+            file = T.must(get_original_file(new_req.fetch(:file))).dup
             updated_content =
               updated_requirement_or_setup_file_content(new_req, old_req)
             next if updated_content == file.content
@@ -50,20 +70,27 @@ module Dependabot
           end
         end
 
+        sig do
+          params(
+            new_req: T::Hash[Symbol, T.untyped],
+            old_req: T.nilable(T::Hash[Symbol, T.untyped])
+          ).returns(String)
+        end
         def updated_requirement_or_setup_file_content(new_req, old_req)
           original_file = get_original_file(new_req.fetch(:file))
           raise "Could not find a dependency file for #{new_req}" unless original_file
 
           RequirementReplacer.new(
-            content: original_file.content,
+            content: T.must(original_file.content),
             dependency_name: dependency.name,
-            old_requirement: old_req.fetch(:requirement),
+            old_requirement: old_req&.fetch(:requirement),
             new_requirement: new_req.fetch(:requirement),
             new_hash_version: dependency.version,
             index_urls: @index_urls
           ).updated_content
         end
 
+        sig { params(filename: String).returns(T.nilable(Dependabot::DependencyFile)) }
         def get_original_file(filename)
           dependency_files.find { |f| f.name == filename }
         end

data/lib/dependabot/python/file_updater/requirement_replacer.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/dependency"
 require "dependabot/python/requirement_parser"
 require "dependabot/python/file_updater"
@@ -12,20 +13,33 @@ module Dependabot
   module Python
     class FileUpdater
       class RequirementReplacer
+        extend T::Sig
+
         PACKAGE_NOT_FOUND_ERROR = "PackageNotFoundError"
 
         CERTIFICATE_VERIFY_FAILED = /CERTIFICATE_VERIFY_FAILED/
 
+        sig do
+          params(
+            content: String,
+            dependency_name: String,
+            old_requirement: T.nilable(String),
+            new_requirement: T.nilable(String),
+            new_hash_version: T.nilable(String),
+            index_urls: T.nilable(T::Array[T.nilable(String)])
+          ).void
+        end
         def initialize(content:, dependency_name:, old_requirement:,
                        new_requirement:, new_hash_version: nil, index_urls: nil)
-          @content          = content
-          @dependency_name  = normalise(dependency_name)
-          @old_requirement  = old_requirement
-          @new_requirement  = new_requirement
-          @new_hash_version = new_hash_version
-          @index_urls = index_urls
+          @content = T.let(content, String)
+          @dependency_name = T.let(normalise(dependency_name), String)
+          @old_requirement = T.let(old_requirement, T.nilable(String))
+          @new_requirement = T.let(new_requirement, T.nilable(String))
+          @new_hash_version = T.let(new_hash_version, T.nilable(String))
+          @index_urls = T.let(index_urls, T.nilable(T::Array[T.nilable(String)]))
         end
 
+        sig { returns(String) }
         def updated_content
           updated_content =
             content.gsub(original_declaration_replacement_regex) do |mtch|
@@ -43,40 +57,52 @@ module Dependabot
 
         private
 
+        sig { returns(String) }
         attr_reader :content
+
+        sig { returns(String) }
         attr_reader :dependency_name
+
+        sig { returns(T.nilable(String)) }
         attr_reader :old_requirement
+
+        sig { returns(T.nilable(String)) }
         attr_reader :new_requirement
+
+        sig { returns(T.nilable(String)) }
         attr_reader :new_hash_version
 
+        sig { returns(T::Boolean) }
         def update_hashes?
           !new_hash_version.nil?
         end
 
+        sig { returns(T.nilable(String)) }
         def updated_requirement_string
           new_req_string = new_requirement
 
-          new_req_string = new_req_string.gsub(/,\s*/, ", ") if add_space_after_commas?
+          new_req_string = new_req_string&.gsub(/,\s*/, ", ") if add_space_after_commas?
 
           if add_space_after_operators?
             new_req_string =
               new_req_string
-              .gsub(/(#{RequirementParser::COMPARISON})\s*(?=\d)/o, '\1 ')
+              &.gsub(/(#{RequirementParser::COMPARISON})\s*(?=\d)/o, '\1 ')
           end
 
           new_req_string
         end
 
+        sig { returns(String) }
         def updated_dependency_declaration_string
           old_req = old_requirement
           updated_string =
             if old_req
               original_dependency_declaration_string(old_req)
-                .sub(RequirementParser::REQUIREMENTS, updated_requirement_string)
+                .sub(RequirementParser::REQUIREMENTS, updated_requirement_string || "")
             else
               original_dependency_declaration_string(old_req)
                 .sub(RequirementParser::NAME_WITH_EXTRAS) do |nm|
-                  nm + updated_requirement_string
+                  (nm + (updated_requirement_string || ""))
                 end
             end
 
@@ -92,55 +118,59 @@ module Dependabot
           )
         end
 
+        sig { returns(T::Boolean) }
         def add_space_after_commas?
           original_dependency_declaration_string(old_requirement)
             .match(RequirementParser::REQUIREMENTS)
             .to_s.include?(", ")
         end
 
+        sig { returns(T::Boolean) }
         def add_space_after_operators?
           original_dependency_declaration_string(old_requirement)
             .match(RequirementParser::REQUIREMENTS)
             .to_s.match?(/#{RequirementParser::COMPARISON}\s+\d/o)
         end
 
+        sig { returns(Regexp) }
         def original_declaration_replacement_regex
           original_string =
             original_dependency_declaration_string(old_requirement)
           /(?<![\-\w\.\[])#{Regexp.escape(original_string)}(?![\-\w\.])/
         end
 
+        sig { params(requirement: T.nilable(String)).returns(T::Boolean) }
         def requirement_includes_hashes?(requirement)
           original_dependency_declaration_string(requirement)
             .match?(RequirementParser::HASHES)
         end
 
+        sig { params(requirement: T.nilable(String)).returns(T.nilable(String)) }
         def hash_algorithm(requirement)
           return unless requirement_includes_hashes?(requirement)
 
-          original_dependency_declaration_string(requirement)
-            .match(RequirementParser::HASHES)
-            .named_captures.fetch("algorithm")
+          matches = T.must(original_dependency_declaration_string(requirement).match(RequirementParser::HASHES))
+          matches.named_captures.fetch("algorithm")
         end
 
+        sig { params(requirement: T.nilable(String)).returns(String) }
         def hash_separator(requirement)
-          return unless requirement_includes_hashes?(requirement)
+          return "" unless requirement_includes_hashes?(requirement)
 
           hash_regex = RequirementParser::HASH
-          current_separator =
-            original_dependency_declaration_string(requirement)
-            .match(/#{hash_regex}((?<separator>\s*\\?\s*?)#{hash_regex})*/)
-            .named_captures.fetch("separator")
+          matches = T.must(original_dependency_declaration_string(requirement)
+            .match(/#{hash_regex}((?<separator>\s*\\?\s*?)#{hash_regex})*/))
+          current_separator = matches.named_captures.fetch("separator")
 
-          default_separator =
-            original_dependency_declaration_string(requirement)
-            .match(RequirementParser::HASH)
-            .pre_match.match(/(?<separator>\s*\\?\s*?)\z/)
-            .named_captures.fetch("separator")
+          hash_matches = T.must(T.must(original_dependency_declaration_string(requirement)
+            .match(RequirementParser::HASH)).pre_match.match(/(?<separator>\s*\\?\s*?)\z/))
+          default_separator = hash_matches
+                              .named_captures.fetch("separator")
 
-          current_separator || default_separator
+          current_separator || default_separator || ""
         end
 
+        sig { params(name: String, version: T.nilable(String), algorithm: T.nilable(String)).returns(T::Array[String]) }
         def package_hashes_for(name:, version:, algorithm:)
           index_urls = @index_urls || [nil]
 
@@ -168,6 +198,7 @@ module Dependabot
           raise Dependabot::DependencyFileNotResolvable, "Unable to find hashes for package #{name}"
         end
 
+        sig { params(old_req: T.nilable(String)).returns(String) }
         def original_dependency_declaration_string(old_req)
           matches = []
 
@@ -189,10 +220,12 @@ module Dependabot
           dec.to_s.strip
         end
 
+        sig { params(name: String).returns(String) }
         def normalise(name)
           NameNormaliser.normalise(name)
         end
 
+        sig { params(req1: T.nilable(String), req2: T.nilable(String)).returns(T::Boolean) }
         def requirements_match(req1, req2)
           req1&.split(",")&.map { |r| r.gsub(/\s/, "") }&.sort ==
             req2&.split(",")&.map { |r| r.gsub(/\s/, "") }&.sort
@@ -200,6 +233,7 @@ module Dependabot
 
         public
 
+        sig { params(error: Exception).void }
         def requirement_error_handler(error)
           Dependabot.logger.warn(error.message)
 

data/lib/dependabot/python/file_updater/setup_file_sanitizer.rb

@@ -1,6 +1,7 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
 require "dependabot/python/file_updater"
 require "dependabot/python/file_parser/setup_file_parser"
 
@@ -10,11 +11,24 @@ module Dependabot
       # Take a setup.py, parses it (carefully!) and then create a new, clean
       # setup.py using only the information which will appear in the lockfile.
       class SetupFileSanitizer
+        extend T::Sig
+
+        sig do
+          params(
+            setup_file: T.nilable(Dependabot::DependencyFile),
+            setup_cfg: T.nilable(Dependabot::DependencyFile)
+          ).void
+        end
         def initialize(setup_file:, setup_cfg:)
-          @setup_file = setup_file
-          @setup_cfg = setup_cfg
+          @setup_file = T.let(setup_file, T.nilable(Dependabot::DependencyFile))
+          @setup_cfg = T.let(setup_cfg, T.nilable(Dependabot::DependencyFile))
+          @install_requires_array = T.let(nil, T.nilable(T::Array[String]))
+          @setup_requires_array = T.let(nil, T.nilable(T::Array[String]))
+          @extras_require_hash = T.let(nil, T.nilable(T::Hash[String, T::Array[String]]))
+          @parsed_setup_file = T.let(nil, T.nilable(Dependabot::FileParsers::Base::DependencySet))
         end
 
+        sig { returns(String) }
         def sanitized_content
           # The part of the setup.py that Pipenv cares about appears to be the
           # install_requires. A name and version are required by don't end up
@@ -31,44 +45,54 @@ module Dependabot
 
         private
 
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :setup_file
+
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :setup_cfg
 
+        sig { returns(T::Boolean) }
         def include_pbr?
           setup_requires_array.any? { |d| d.start_with?("pbr") }
         end
 
+        sig { returns(T::Array[String]) }
         def install_requires_array
           @install_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
-              next unless dep.requirements.first[:groups]
-                             .include?("install_requires")
+              first = T.must(dep.requirements.first)
+              next unless first[:groups]
+                          .include?("install_requires")
 
-              dep.name + dep.requirements.first[:requirement].to_s
+              dep.name + first[:requirement].to_s
             end
         end
 
+        sig { returns(T::Array[String]) }
         def setup_requires_array
           @setup_requires_array ||=
             parsed_setup_file.dependencies.filter_map do |dep|
-              next unless dep.requirements.first[:groups]
-                             .include?("setup_requires")
+              first = T.must(dep.requirements.first)
+              next unless first[:groups]
+                          .include?("setup_requires")
 
-              dep.name + dep.requirements.first[:requirement].to_s
+              dep.name + first[:requirement].to_s
             end
         end
 
+        sig { returns(T::Hash[String, T::Array[String]]) }
         def extras_require_hash
           @extras_require_hash ||=
             begin
               hash = {}
               parsed_setup_file.dependencies.each do |dep|
-                dep.requirements.first[:groups].each do |group|
+                first = T.must(dep.requirements.first)
+                first[:groups].each do |group|
                   next unless group.start_with?("extras_require:")
 
                   hash[group.split(":").last] ||= []
                   hash[group.split(":").last] <<
-                    (dep.name + dep.requirements.first[:requirement].to_s)
+                    (dep.name + first[:requirement].to_s)
                 end
               end
 
@@ -76,6 +100,7 @@ module Dependabot
             end
         end
 
+        sig { returns(Dependabot::FileParsers::Base::DependencySet) }
         def parsed_setup_file
           @parsed_setup_file ||=
             Python::FileParser::SetupFileParser.new(
@@ -86,10 +111,11 @@ module Dependabot
             ).dependency_set
         end
 
+        sig { returns(String) }
         def package_name
-          content = setup_file.content
+          content = T.must(T.must(setup_file).content)
           match = content.match(/name\s*=\s*['"](?<package_name>[^'"]+)['"]/)
-          match ? match[:package_name] : "default_package_name"
+          match ? T.must(match[:package_name]) : "default_package_name"
         end
       end
     end

data/lib/dependabot/python/file_updater.rb

@@ -132,7 +132,7 @@ module Dependabot
         ).updated_dependency_files
       end
 
-      sig { returns(T::Array[String]) }
+      sig { returns(T::Array[T.nilable(String)]) }
       def pip_compile_index_urls
         if credentials.any?(&:replaces_base?)
           credentials.select(&:replaces_base?).map { |cred| AuthedUrlBuilder.authed_url(credential: cred) }