dependabot-uv 0.331.0 → 0.333.0

data/lib/dependabot/uv/update_checker/pip_version_resolver.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/uv/language_version_manager"
 require "dependabot/uv/update_checker"
 require "dependabot/uv/update_checker/latest_version_finder"
@@ -10,27 +12,42 @@ module Dependabot
   module Uv
     class UpdateChecker
       class PipVersionResolver
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            dependency_files: T::Array[Dependabot::DependencyFile],
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            security_advisories: T::Array[Dependabot::SecurityAdvisory],
+            update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+            raise_on_ignored: T::Boolean
+          ).void
+        end
         def initialize(dependency:, dependency_files:, credentials:,
-                       ignored_versions:, update_cooldown: nil, raise_on_ignored: false,
-                       security_advisories:)
-          @dependency = dependency
-          @dependency_files    = dependency_files
-          @credentials         = credentials
-          @ignored_versions    = ignored_versions
-          @update_cooldown = update_cooldown
-          @raise_on_ignored    = raise_on_ignored
-          @security_advisories = security_advisories
+                       ignored_versions:, security_advisories:, update_cooldown: nil, raise_on_ignored: false)
+          @dependency = T.let(dependency, Dependabot::Dependency)
+          @dependency_files    = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
+          @credentials         = T.let(credentials, T::Array[Dependabot::Credential])
+          @ignored_versions    = T.let(ignored_versions, T::Array[String])
+          @update_cooldown = T.let(update_cooldown, T.nilable(Dependabot::Package::ReleaseCooldownOptions))
+          @raise_on_ignored    = T.let(raise_on_ignored, T::Boolean)
+          @security_advisories = T.let(security_advisories, T::Array[Dependabot::SecurityAdvisory])
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version
           latest_version_finder.latest_version(language_version: language_version_manager.python_version)
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version_with_no_unlock
           latest_version_finder
             .latest_version_with_no_unlock(language_version: language_version_manager.python_version)
         end
 
+        sig { returns(T.nilable(Dependabot::Version)) }
         def lowest_resolvable_security_fix_version
           latest_version_finder
             .lowest_security_fix_version(language_version: language_version_manager.python_version)
@@ -38,36 +55,55 @@ module Dependabot
 
         private
 
+        sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(LatestVersionFinder) }
         def latest_version_finder
-          @latest_version_finder ||= LatestVersionFinder.new(
-            dependency: dependency,
-            dependency_files: dependency_files,
-            credentials: credentials,
-            ignored_versions: ignored_versions,
-            raise_on_ignored: @raise_on_ignored,
-            cooldown_options: @update_cooldown,
-            security_advisories: security_advisories
+          @latest_version_finder ||= T.let(
+            LatestVersionFinder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: @raise_on_ignored,
+              cooldown_options: @update_cooldown,
+              security_advisories: security_advisories
+            ),
+            T.nilable(LatestVersionFinder)
           )
         end
 
+        sig { returns(FileParser::PythonRequirementParser) }
         def python_requirement_parser
-          @python_requirement_parser ||=
+          @python_requirement_parser ||= T.let(
             FileParser::PythonRequirementParser.new(
               dependency_files: dependency_files
-            )
+            ),
+            T.nilable(FileParser::PythonRequirementParser)
+          )
         end
 
+        sig { returns(LanguageVersionManager) }
         def language_version_manager
-          @language_version_manager ||=
+          @language_version_manager ||= T.let(
             LanguageVersionManager.new(
               python_requirement_parser: python_requirement_parser
-            )
+            ),
+            T.nilable(LanguageVersionManager)
+          )
         end
       end
     end

data/lib/dependabot/uv/update_checker/requirements_updater.rb

@@ -1,6 +1,8 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/uv/requirement_parser"
 require "dependabot/uv/requirement"
 require "dependabot/uv/update_checker"
@@ -11,21 +13,39 @@ module Dependabot
   module Uv
     class UpdateChecker
       class RequirementsUpdater
-        PYPROJECT_OR_SEPARATOR = /(?<=[a-zA-Z0-9*])\s*\|+/
-        PYPROJECT_SEPARATOR = /#{PYPROJECT_OR_SEPARATOR}|,/
+        extend T::Sig
+
+        PYPROJECT_OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
+        PYPROJECT_SEPARATOR = T.let(/#{PYPROJECT_OR_SEPARATOR}|,/, Regexp)
 
         class UnfixableRequirement < StandardError; end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         attr_reader :requirements
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
         attr_reader :update_strategy
+
+        sig { returns(T::Boolean) }
         attr_reader :has_lockfile
+
+        sig { returns(T.nilable(Dependabot::Uv::Version)) }
         attr_reader :latest_resolvable_version
 
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            has_lockfile: T::Boolean,
+            latest_resolvable_version: T.nilable(String)
+          ).void
+        end
         def initialize(requirements:, update_strategy:, has_lockfile:,
                        latest_resolvable_version:)
-          @requirements = requirements
-          @update_strategy = update_strategy
-          @has_lockfile = has_lockfile
+          @requirements = T.let(requirements, T::Array[T::Hash[Symbol, T.untyped]])
+          @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
+          @has_lockfile = T.let(has_lockfile, T::Boolean)
+          @latest_resolvable_version = T.let(nil, T.nilable(Dependabot::Uv::Version))
 
           return unless latest_resolvable_version
 
@@ -33,6 +53,7 @@ module Dependabot
             Uv::Version.new(latest_resolvable_version)
         end
 
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
           return requirements if update_strategy.lockfile_only?
 
@@ -50,6 +71,7 @@ module Dependabot
         private
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_setup_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -62,7 +84,7 @@ module Dependabot
               find_and_update_equality_match(req_strings)
             elsif req_strings.any? { |r| r.start_with?("~=", "==") }
               tw_req = req_strings.find { |r| r.start_with?("~=", "==") }
-              convert_to_range(tw_req, latest_resolvable_version)
+              convert_to_range(tw_req, T.must(latest_resolvable_version))
             else
               update_requirements_range(req_strings)
             end
@@ -73,12 +95,14 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_pipfile_requirement(req)
           # For now, we just proxy to updated_requirement. In future this
           # method may treat Pipfile requirements differently.
           updated_requirement(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_pyproject_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -101,12 +125,14 @@ module Dependabot
           req.merge(requirement: :unfixable)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_pyproject_version(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_pyproject_version(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -132,6 +158,7 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_pyproject_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -145,9 +172,10 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req_string: String).returns(String) }
         def add_new_requirement_option(req_string)
-          option_to_copy = req_string.split(PYPROJECT_OR_SEPARATOR).last
-                                     .split(PYPROJECT_SEPARATOR).first.strip
+          option_to_copy = T.must(T.must(req_string.split(PYPROJECT_OR_SEPARATOR).last)
+                                     .split(PYPROJECT_SEPARATOR).first).strip
           operator       = option_to_copy.gsub(/\d.*/, "").strip
 
           new_option =
@@ -167,6 +195,7 @@ module Dependabot
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { params(req_string: String).returns(String) }
         def widen_requirement_range(req_string)
           requirement_strings = req_string.split(",").map(&:strip)
 
@@ -180,7 +209,7 @@ module Dependabot
             # range to include the new version
             v_req = requirement_strings
                     .find { |r| r.start_with?("~", "^") || r.include?("*") }
-            convert_to_range(v_req, latest_resolvable_version)
+            convert_to_range(T.must(v_req), T.must(latest_resolvable_version))
           else
             # Otherwise we have a range, and need to update the upper bound
             update_requirements_range(requirement_strings)
@@ -188,6 +217,7 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def updated_requirement(req)
           return req unless latest_resolvable_version
           return req unless req.fetch(:requirement)
@@ -204,12 +234,14 @@ module Dependabot
           end
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_requirement_if_needed(req)
           return req if new_version_satisfies?(req)
 
           update_requirement(req)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def update_requirement(req)
           requirement_strings = req[:requirement].split(",").map(&:strip)
 
@@ -229,6 +261,7 @@ module Dependabot
           req.merge(requirement: :unfixable)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def widen_requirement(req)
           return req if new_version_satisfies?(req)
 
@@ -237,29 +270,32 @@ module Dependabot
           req.merge(requirement: new_requirement)
         end
 
+        sig { params(req: T::Hash[Symbol, T.untyped]).returns(T::Boolean) }
         def new_version_satisfies?(req)
           requirement_class
             .requirements_array(req.fetch(:requirement))
-            .any? { |r| r.satisfied_by?(latest_resolvable_version) }
+            .any? { |r| r.satisfied_by?(T.must(latest_resolvable_version)) }
         end
 
+        sig { params(requirement_strings: T::Array[String]).returns(String) }
         def find_and_update_equality_match(requirement_strings)
           if requirement_strings.any? { |r| requirement_class.new(r).exact? }
             # True equality match
-            requirement_strings.find { |r| requirement_class.new(r).exact? }
-                               .sub(
-                                 RequirementParser::VERSION,
-                                 latest_resolvable_version.to_s
-                               )
+            T.must(requirement_strings.find { |r| requirement_class.new(r).exact? })
+             .sub(
+               RequirementParser::VERSION,
+               T.must(latest_resolvable_version).to_s
+             )
           else
             # Prefix match
-            requirement_strings.find { |r| r.match?(/^(=+|\d)/) }
-                               .sub(RequirementParser::VERSION) do |v|
-              at_same_precision(latest_resolvable_version.to_s, v)
+            T.must(requirement_strings.find { |r| r.match?(/^(=+|\d)/) })
+             .sub(RequirementParser::VERSION) do |v|
+              at_same_precision(T.must(latest_resolvable_version).to_s, v)
             end
           end
         end
 
+        sig { params(new_version: String, old_version: String).returns(String) }
         def at_same_precision(new_version, old_version)
           # return new_version unless old_version.include?("*")
 
@@ -273,16 +309,17 @@ module Dependabot
             .join(".")
         end
 
+        sig { params(requirement_strings: T::Array[String]).returns(String) }
         def update_requirements_range(requirement_strings)
           ruby_requirements =
             requirement_strings.map { |r| requirement_class.new(r) }
 
           updated_requirement_strings = ruby_requirements.flat_map do |r|
-            next r.to_s if r.satisfied_by?(latest_resolvable_version)
+            next r.to_s if r.satisfied_by?(T.must(latest_resolvable_version))
 
             case op = r.requirements.first.first
             when "<"
-              "<" + update_greatest_version(r.requirements.first.last, latest_resolvable_version)
+              "<" + update_greatest_version(r.requirements.first.last, T.must(latest_resolvable_version))
             when "<="
               "<=" + latest_resolvable_version.to_s
             when "!=", ">", ">="
@@ -298,10 +335,11 @@ module Dependabot
         end
 
         # Updates the version in a constraint to be the given version
+        sig { params(req_string: String, version_to_be_permitted: String).returns(String) }
         def bump_version(req_string, version_to_be_permitted)
-          old_version = req_string
-                        .match(/(#{RequirementParser::VERSION})/o)
-                        .captures.first
+          old_version = T.must(T.must(req_string
+                        .match(/(#{RequirementParser::VERSION})/o))
+                        .captures.first)
 
           req_string.sub(
             old_version,
@@ -309,14 +347,15 @@ module Dependabot
           )
         end
 
+        sig { params(req_string: String, version_to_be_permitted: Dependabot::Uv::Version).returns(String) }
         def convert_to_range(req_string, version_to_be_permitted)
           # Construct an upper bound at the same precision that the original
           # requirement was at (taking into account ~ dynamics)
           index_to_update = index_to_update_for(req_string)
-          ub_segments = version_to_be_permitted.segments
-          ub_segments << 0 while ub_segments.count <= index_to_update
-          ub_segments = ub_segments[0..index_to_update]
-          ub_segments[index_to_update] += 1
+          ub_segments = T.let(version_to_be_permitted.segments, T::Array[T.any(String, Integer)])
+          ub_segments << "0" while ub_segments.count <= index_to_update
+          ub_segments = T.must(ub_segments[0..index_to_update])
+          ub_segments[index_to_update] = T.must(ub_segments[index_to_update]).to_i + 1
 
           lb_segments = lower_bound_segments_for_req(req_string)
 
@@ -328,6 +367,7 @@ module Dependabot
           ">=#{lb_segments.join('.')},<#{ub_segments.join('.')}"
         end
 
+        sig { params(req_string: String).returns(T::Array[Integer]) }
         def lower_bound_segments_for_req(req_string)
           requirement = requirement_class.new(req_string)
           version = requirement.requirements.first.last
@@ -339,6 +379,7 @@ module Dependabot
           lb_segments
         end
 
+        sig { params(req_string: String).returns(Integer) }
         def index_to_update_for(req_string)
           req = requirement_class.new(req_string.split(/[.\-]\*/).first)
           version = req.requirements.first.last.release
@@ -350,13 +391,19 @@ module Dependabot
           elsif req_string.strip.start_with?("~=", "==")
             version.segments.count - 2
           elsif req_string.strip.start_with?("~")
-            req_string.split(".").count == 1 ? 0 : 1
+            req_string.split(".").one? ? 0 : 1
           else
             raise "Don't know how to convert #{req_string} to range"
           end
         end
 
         # Updates the version in a "<" constraint to allow the given version
+        sig do
+          params(
+            version: Gem::Version,
+            version_to_be_permitted: T.any(String, Dependabot::Uv::Version)
+          ).returns(String)
+        end
         def update_greatest_version(version, version_to_be_permitted)
           if version_to_be_permitted.is_a?(String)
             version_to_be_permitted =
@@ -365,7 +412,7 @@ module Dependabot
           version = version.release if version.prerelease?
 
           index_to_update = [
-            version.segments.map.with_index { |n, i| n.zero? ? 0 : i }.max,
+            version.segments.map.with_index { |n, i| n.to_i.zero? ? 0 : i }.max,
             version_to_be_permitted.segments.count - 1
           ].min
 
@@ -373,7 +420,7 @@ module Dependabot
             if index < index_to_update
               version_to_be_permitted.segments[index]
             elsif index == index_to_update
-              version_to_be_permitted.segments[index] + 1
+              version_to_be_permitted.segments[index].to_i + 1
             else
               0
             end
@@ -382,6 +429,7 @@ module Dependabot
           new_segments.join(".")
         end
 
+        sig { returns(T.class_of(Dependabot::Uv::Requirement)) }
         def requirement_class
           Uv::Requirement
         end